{"schemaVersion":3,"id":"CVE-2023-26154","aliases":["GHSA-5844-q3fc-56rh","GO-2023-2385","PYSEC-2026-1807"],"status":"published","duplicateOf":null,"title":null,"description":"Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.\n\n**Note:**\n\nIn order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.","dates":{"published":"2023-12-06T05:00:02.795Z","modified":"2024-08-02T11:39:06.653Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.9,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Nuget","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Crates.io","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Rubygems","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00963,"percentile":0.61298,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0.008000000000000021,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00955},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00955,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00955,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00955,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00955,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00955,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00955,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00955,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00955,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00955,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00955,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00963,"percentile":0.61298}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00955,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00955,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00963,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00963,"percentile":0.61298}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_VARGAD_20237094FCE7A0A28F0723D7CE395BB0","name":"20237094Fce7A0A28F0723D7Ce395Bb0","source":"github","url":"https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-331","name":"Insufficient Entropy","description":"The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/331.html"}],"affected":[{"vendor":"Crates.Io","product":"pubnub","name":"pubnub","label":"pubnub","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/pubnub","purlType":"cargo","versions":[{"text":"< 0.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.0","eol":null,"hubHref":null},{"vendor":"pubnub","product":"pubnub","name":"pubnub/pubnub","label":"pubnub","ecosystem":"Packagist","cpePart":null,"purl":"pkg:composer/pubnub/pubnub","purlType":"composer","versions":[{"text":"< 6.1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.1.0","eol":null,"hubHref":null},{"vendor":"RubyGems","product":"pubnub","name":"pubnub","label":"pubnub","ecosystem":"RubyGems","cpePart":null,"purl":"pkg:gem/pubnub","purlType":"gem","versions":[{"text":"< 5.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.3.0","eol":null,"hubHref":null},{"vendor":"github.com/pubnub","product":"go","name":"github.com/pubnub/go","label":"go","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/pubnub/go","purlType":"golang","versions":[{"text":"< 0.0.0-20231016150651-428517fef5b9","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 0.0.0-20231016150651-428517fef5b9 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/pubnub/go","product":"v5","name":"github.com/pubnub/go/v5","label":"v5","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/pubnub/go/v5","purlType":"golang","versions":[{"text":"< 5.0.4-0.20231016150651-428517fef5b9","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 5.0.4-0.20231016150651-428517fef5b9 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/pubnub/go","product":"v6","name":"github.com/pubnub/go/v6","label":"v6","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/pubnub/go/v6","purlType":"golang","versions":[{"text":"< 6.1.1-0.20231016150651-428517fef5b9","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 6.1.1-0.20231016150651-428517fef5b9 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/pubnub/go","product":"v7","name":"github.com/pubnub/go/v7","label":"v7","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/pubnub/go/v7","purlType":"golang","versions":[{"text":"< 7.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.2.0","eol":null,"hubHref":null},{"vendor":"com.pubnub","product":"pubnub","name":"com.pubnub:pubnub","label":"pubnub","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/com.pubnub/pubnub","purlType":"maven","versions":[{"text":"≤ 4.6.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 4.6.5","eol":null,"hubHref":null},{"vendor":"com.pubnub","product":"pubnub-kotlin","name":"com.pubnub:pubnub-kotlin","label":"pubnub-kotlin","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/com.pubnub/pubnub-kotlin","purlType":"maven","versions":[{"text":"< 7.7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.7.0","eol":null,"hubHref":null},{"vendor":"Npm","product":"pubnub","name":"pubnub","label":"pubnub","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/pubnub","purlType":"npm","versions":[{"text":"< 7.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.4.0","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Pubnub","name":"Pubnub","label":"Pubnub","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Pubnub","purlType":"nuget","versions":[{"text":"< 6.19.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.19.0","eol":null,"hubHref":null},{"vendor":"Pub","product":"pubnub","name":"pubnub","label":"pubnub","ecosystem":"Pub","cpePart":null,"purl":"pkg:pub/pubnub","purlType":"pub","versions":[{"text":"< 4.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.0","eol":null,"hubHref":null},{"vendor":"pubnub","product":"c-core","name":"c-core","label":"c-core","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.5.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.5.0","eol":null,"hubHref":"/vendor/pubnub/c-core"},{"vendor":"pubnub","product":"kotlin","name":"kotlin","label":"kotlin","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.7.0","eol":{"isEol":null,"eolDate":null,"matchMethod":"name_exact","cycle":null,"product":{"name":"kotlin","label":"Kotlin","category":"lang"}},"hubHref":"/vendor/pubnub/kotlin"},{"vendor":"pubnub","product":"pubnub","name":"pubnub","label":"pubnub","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.4.0","noFixRecorded":false,"fixedIn":null},{"text":"< 7.2.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.6.4, < 4.3.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.3.1, < 5.2.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, < 6.1.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.0, < 6.19.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.3.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.3.1, < 7.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.0 | < 7.2.0 | ≥ 3.6.4, < 4.3.0 | ≥ 4.3.1, < 5.2.0 | ≥ 6.0.0, < 6.1.0 | ≥ 6.2.0, < 6.19.0 | ≥ 7.0.0, < 7.3.0 | ≥ 7.3.1, < 7.4.0","eol":null,"hubHref":"/vendor/pubnub/pubnub"},{"vendor":"pubnub","product":"swift","name":"swift","label":"swift","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 6.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.2.0","eol":null,"hubHref":"/vendor/pubnub/swift"},{"vendor":"PyPI","product":"pubnub","name":"pubnub","label":"pubnub","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/pubnub","purlType":"pypi","versions":[{"text":"< 7.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.3.0","eol":null,"hubHref":null},{"vendor":"github.com/pubnub","product":"swift","name":"github.com/pubnub/swift","label":"swift","ecosystem":"SwiftURL","cpePart":null,"purl":"pkg:swift/github.com/pubnub/swift","purlType":"swift","versions":[{"text":"< 6.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.2.0","eol":null,"hubHref":null}],"affectedCount":18,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690","label":"security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371","label":"security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372","label":"security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373","label":"security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374","label":"security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375","label":"security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376","label":"security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377","label":"security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378","label":"security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379","label":"security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380","label":"security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381","label":"security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384","label":"security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385","label":"security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385","hostname":"security.snyk.io","tags":["WEB","Third Party Advisory"]},{"url":"https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0","label":"gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0","hostname":"gist.github.com","tags":["WEB","Exploit","Issue Tracking"]},{"url":"https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70","label":"github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70","hostname":"github.com","tags":["Broken Link"]},{"url":"https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119","label":"github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119","hostname":"github.com","tags":["WEB","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26154","label":"nvd.nist.gov/vuln/detail/CVE-2023-26154","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/pubnub/go/commit/428517fef5b901db7275d9f5a75eda89a4c28e08","label":"github.com/pubnub/go/commit/428517fef5b901db7275d9f5a75eda89a4c28e08","hostname":"github.com","tags":["WEB","FIX"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pubnub/CVE-2023-26154.yml","label":"github.com/rubysec/ruby-advisory-db/blob/master/gems/pubnub/CVE-2023-26154.yml","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js#L70","label":"github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/pubnub/javascript","label":"github.com/pubnub/javascript","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/advisories/GHSA-5844-q3fc-56rh","label":"github.com/advisories/GHSA-5844-q3fc-56rh","hostname":"github.com","tags":["Advisory"]},{"url":"https://pypi.org/project/pubnub","label":"pypi.org/project/pubnub","hostname":"pypi.org","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2025:15469-1","OPENSUSE-SU-2026:21483-1"],"duplicates":[],"related":["OPENSUSE-SU-2025:15469-1","OPENSUSE-SU-2026:21483-1"]},"timeline":[{"kind":"published","date":"2023-12-06T05:00:02.795Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-02T11:39:06.653Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":34,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T14:55:20.923Z","stale":false,"partial":false}}