Approved changes feed: RSS · Atom
cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Cervantessec (10df812c-08d3-512c-a5d4-42336f53fdc9) |
|---|---|
| Product | Cervantes (68d674a0-98d4-5c1f-8885-968fe1f45f31) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/cervantessec/cervantes |
purl2cpe | 2026-06-01 10:14:49.302058 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-115993 |
vulnerable | 2026-11-03 10:15:37.633928 |
Stored XSS in the “Notes” field of project checklists
MEDIUM (6.8)
Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges
Published: 2026-10-24T08:32:46.940Z
Updated: 2026-11-02T14:02:56.947Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115998 |
vulnerable | 2026-11-03 10:15:37.330381 |
IDOR: User reads and modifies findings from other people's projects
MEDIUM (4.3)
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
Published: 2026-10-24T09:28:05.849Z
Updated: 2026-11-02T14:05:02.842Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115975 |
vulnerable | 2026-11-03 10:15:37.318158 |
Broken access control in JiraController
HIGH (7.1)
Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects
Published: 2026-10-24T07:39:34.357Z
Updated: 2026-11-02T14:00:09.921Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115994 |
vulnerable | 2026-11-03 10:15:37.237622 |
BOLA Allows Cross-Project Target Tampering
MEDIUM (5.4)
BOLA Allows Cross-Project Target Tampering
in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
Published: 2026-10-24T09:04:02.750Z
Updated: 2026-11-02T14:03:51.629Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.