# SQL Injection or OS Command Injection Since September 2026 CVEs published since 1 September 2026 that map to CWE-89 or CWE-78. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/sqli-or-command-injection-recent/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs published since 1 September 2026 that map to CWE-89 or CWE-78. Example 5 of 6 in **Combinations** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `published` · `field` `enrichment.cwe.id` · `operator` `gte` · `operator` `eq` · `logic` `must` · `logic` `should` Two `should` filters: at least one of them has to match. The `must` filter applies to every result. In the response, look at `results[].enrichment.cwe[].id` and `results[].published`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `published` | | `filters.must[0].type` | body | `gte` | | `filters.must[0].value` | body | `2026-09-01T00:00:00Z` | | `filters.should[0].name` | body | `enrichment.cwe.id` | | `filters.should[0].type` | body | `eq` | | `filters.should[0].value` | body | `89` | | `filters.should[1].name` | body | `enrichment.cwe.id` | | `filters.should[1].type` | body | `eq` | | `filters.should[1].value` | body | `78` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "published", "type": "gte", "value": "2026-09-01T00:00:00Z" } ], "should": [ { "name": "enrichment.cwe.id", "type": "eq", "value": 89 }, { "name": "enrichment.cwe.id", "type": "eq", "value": 78 } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 649, "results": [ { "id": "CVE-2026-86152", "source_identifier": "user@vuldb.com", "published": "2026-09-06T02:17:19Z", "last_modified": "2026-09-10T19:17:36Z", "status": "Deferred", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely." } ], "references": [ { "url": "https://vuldb.com/cve/CVE-2026-86152", "source": "user@vuldb.com", "tags": null }, { "url": "https://vuldb.com/submit/895353", "source": "user@vuldb.com", "tags": null }, { "url": "https://vuldb.com/vuln/399275", "source": "user@vuldb.com", "tags": null }, { "url": "https://vuldb.com/vuln/399275/cti", "source": "user@vuldb.com", "tags": null }, { "url": "https://www.tenda.com.cn/", "source": "user@vuldb.com", "tags": null } ], "metrics": { "cvss_metric_v40": [ { "source": "user@vuldb.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": [ { "source": "user@vuldb.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@vuldb.com", "type": "Secondary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "COMPLETE", "integrity_impact": "COMPLETE", "availability_impact": "COMPLETE", "base_score": 10.0, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 10.0, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@vuldb.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-77" }, { "lang": "en", "value": "CWE-78" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 77, "owasptop10_2021": "A03 Injection", "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')", "description": "The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.", "capec_id": [ 15, 40, 43, 75, 76, 136, 183, 248 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "Execute Unauthorized Code or Commands" ], "detection_method": [ "Automated Static Analysis" ] }, { "id": 78, "owasptop10_2021": "A03 Injection", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "description": "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.", "capec_id": [ 6, 15, 43, 88, 108 ], "scope": [ "Availability", "Confidentiality", "Integrity", "Non-Repudiation" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Hide Activities", "Modify Application Data", "Modify Files or Directories", "Read Application Data", "Read Files or Directories" ], "detection_method": [ "Architecture or Design Review", "Automated Dynamic Analysis", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Static Analysis", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.01859, "percentile": 0.77971, "date": "2026-09-21" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0", "3.1", "2.0" ], "source": "user@vuldb.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-82004", "source_identifier": "user@adobe.com", "published": "2026-09-08T19:19:59Z", "last_modified": "2026-09-11T21:17:23Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed." } ], "references": [ { "url": "https://helpx.adobe.com/security/products/campaign/apsb26-142.html", "source": "user@adobe.com", "tags": [ "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@adobe.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@adobe.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-78" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*", "match_criteria_id": "C9E59FAC-3BEF-4286-A299-6AB05272ED74", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "7.4.4" }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9400:*:*:classic:*:*:*", "match_criteria_id": "560799AF-A848-47B5-B37C-7B35C8D1B48B", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9401:*:*:classic:*:*:*", "match_criteria_id": "FA9301A1-69C2-470A-9520-E865A32B38BF", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*", "vendor": "adobe", "product": "campaign", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "7.4.4", "affected_versions_first": "7.2.1", "affected_versions_last": "7.4.3" }, { "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9400:*:*:classic:*:*:*", "vendor": "adobe", "product": "campaign", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.4.4", "affected_versions_last": "7.4.4" }, { "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9401:*:*:classic:*:*:*", "vendor": "adobe", "product": "campaign", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.4.4", "affected_versions_last": "7.4.4" } ], "cwe": [ { "id": 78, "owasptop10_2021": "A03 Injection", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "description": "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.", "capec_id": [ 6, 15, 43, 88, 108 ], "scope": [ "Availability", "Confidentiality", "Integrity", "Non-Repudiation" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Hide Activities", "Modify Application Data", "Modify Files or Directories", "Read Application Data", "Read Files or Directories" ], "detection_method": [ "Architecture or Design Review", "Automated Dynamic Analysis", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Static Analysis", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.01437, "percentile": 0.71983, "date": "2026-09-22" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@adobe.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-77521", "source_identifier": "user@github.com", "published": "2026-09-21T21:17:10Z", "last_modified": "2026-09-22T14:17:15Z", "status": "Deferred", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts." } ], "references": [ { "url": "https://github.com/1Panel-dev/MaxKB/commit/594f50f2ea80a502d1c955371ba0438b277c30ea", "source": "user@github.com", "tags": null }, { "url": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.10.5-lts", "source": "user@github.com", "tags": null }, { "url": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f36j-f34j-h3rx", "source": "user@github.com", "tags": null }, { "url": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f36j-f34j-h3rx", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": null } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@github.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@github.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-78" }, { "lang": "en", "value": "CWE-250" }, { "lang": "en", "value": "CWE-749" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 250, "owasptop10_2021": null, "name": "Execution with Unnecessary Privileges", "description": "The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.", "capec_id": [ 69, 104, 470 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Gain Privileges or Assume Identity", "Read Application Data" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Black Box", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] }, { "id": 749, "owasptop10_2021": null, "name": "Exposed Dangerous Method or Function", "description": "The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.", "capec_id": [ 500 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Other" ], "impact": [ "Execute Unauthorized Code or Commands", "Gain Privileges or Assume Identity", "Modify Application Data", "Other", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] }, { "id": 78, "owasptop10_2021": "A03 Injection", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "description": "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.", "capec_id": [ 6, 15, 43, 88, 108 ], "scope": [ "Availability", "Confidentiality", "Integrity", "Non-Repudiation" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Hide Activities", "Modify Application Data", "Modify Files or Directories", "Read Application Data", "Read Files or Directories" ], "detection_method": [ "Architecture or Design Review", "Automated Dynamic Analysis", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Static Analysis", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.01049, "percentile": 0.62809, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@github.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [Sort by Vendor](/reference/vulnerability/search/examples/sort-enrichment-cpe-vendor/) - [Microsoft CVEs of 2024 With a High EPSS](/reference/vulnerability/search/examples/microsoft-2024-high-epss/) - [Sort by EPSS: Most Likely to Be Exploited First](/reference/vulnerability/search/examples/sort-epss/) - [Last Reachable Page (10,000 Results)](/reference/vulnerability/search/examples/page-400/) - [CVEs Published in December 2021](/reference/vulnerability/search/examples/published/) - [MOVEit Transfer CVEs Other Than the 2023 Mass Exploitation](/reference/vulnerability/search/examples/moveit-except-cve-2023-34362/)