[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-12382":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":468,"aliases":469,"duplicate_of":9,"upstream":470,"downstream":471,"duplicates":476,"related":477,"reserved_at":9,"published_at":478,"modified_at":479,"state":480,"summary":481,"references_raw":490,"kevs":520,"epss":521,"epss_history":524,"metrics":723,"affected":731},"CVE-2026-12382","A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-290","Authentication Bypass by Spoofing","This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.","weakness","Incomplete","Base",[19,194,198,202,206,282,286,290,429,433],{"id":20,"name":21,"techniques":22},"CAPEC-21","Exploitation of Trusted Identifiers",[23,140,170],{"id":24,"name":25,"tactics":26,"countermeasures":36},"T1134","Access Token Manipulation",[27,30,33],{"id":28,"name":29},"TA0030","Defense Evasion",{"id":31,"name":32},"TA0005","Stealth",{"id":34,"name":35},"TA0111","Privilege Escalation",[37,42,47,51,55,60,65,69,73,78,82,87,91,95,99,103,107,112,116,120,124,128,132,136],{"id":38,"name":39,"tactic":40},"D3-CTS","Credential Transmission Scoping",{"name":41},"Isolate",{"id":43,"name":44,"tactic":45},"D3-CCSA","Credential Compromise Scope Analysis",{"name":46},"Detect",{"id":48,"name":49,"tactic":50},"D3-OPM","Operational Process Monitoring",{"name":46},{"id":52,"name":53,"tactic":54},"D3-PSA","Process Spawn Analysis",{"name":46},{"id":56,"name":57,"tactic":58},"D3-ST","Session Termination",{"name":59},"Evict",{"id":61,"name":62,"tactic":63},"D3-NTPM","Network Traffic Policy Mapping",{"name":64},"Model",{"id":66,"name":67,"tactic":68},"D3-CR","Credential Revocation",{"name":59},{"id":70,"name":71,"tactic":72},"D3-ANCI","Authentication Cache Invalidation",{"name":59},{"id":74,"name":75,"tactic":76},"D3-DUC","Decoy User Credential",{"name":77},"Deceive",{"id":79,"name":80,"tactic":81},"D3-AM","Access Modeling",{"name":64},{"id":83,"name":84,"tactic":85},"D3-CH","Credential Hardening",{"name":86},"Harden",{"id":88,"name":89,"tactic":90},"D3-MFA","Multi-factor Authentication",{"name":86},{"id":92,"name":93,"tactic":94},"D3-CRO","Credential Rotation",{"name":86},{"id":96,"name":97,"tactic":98},"D3-HBPI","Hardware-based Process Isolation",{"name":41},{"id":100,"name":101,"tactic":102},"D3-TB","Token Binding",{"name":86},{"id":104,"name":105,"tactic":106},"D3-TBA","Token-based Authentication",{"name":86},{"id":108,"name":109,"tactic":110},"D3-RC","Restore Configuration",{"name":111},"Restore",{"id":113,"name":114,"tactic":115},"D3-AEM","Application Exception Monitoring",{"name":46},{"id":117,"name":118,"tactic":119},"D3-RIC","Reissue Credential",{"name":111},{"id":121,"name":122,"tactic":123},"D3-CI","Configuration Inventory",{"name":64},{"id":125,"name":126,"tactic":127},"D3-SCA","System Call Analysis",{"name":46},{"id":129,"name":130,"tactic":131},"D3-SCF","System Call Filtering",{"name":41},{"id":133,"name":134,"tactic":135},"D3-EAL","Executable Allowlisting",{"name":41},{"id":137,"name":138,"tactic":139},"D3-EDL","Executable Denylisting",{"name":41},{"id":141,"name":142,"tactics":143,"countermeasures":147},"T1528","Steal Application Access Token",[144],{"id":145,"name":146},"TA0031","Credential Access",[148,150,152,154,156,158,160,162,164,166,168],{"id":83,"name":84,"tactic":149},{"name":86},{"id":117,"name":118,"tactic":151},{"name":111},{"id":70,"name":71,"tactic":153},{"name":59},{"id":100,"name":101,"tactic":155},{"name":86},{"id":38,"name":39,"tactic":157},{"name":41},{"id":88,"name":89,"tactic":159},{"name":86},{"id":66,"name":67,"tactic":161},{"name":59},{"id":104,"name":105,"tactic":163},{"name":86},{"id":43,"name":44,"tactic":165},{"name":46},{"id":92,"name":93,"tactic":167},{"name":86},{"id":74,"name":75,"tactic":169},{"name":77},{"id":171,"name":172,"tactics":173,"countermeasures":175},"T1539","Steal Web Session Cookie",[174],{"id":145,"name":146},[176,178,180,182,184,186,188,190,192],{"id":38,"name":39,"tactic":177},{"name":41},{"id":74,"name":75,"tactic":179},{"name":77},{"id":83,"name":84,"tactic":181},{"name":86},{"id":88,"name":89,"tactic":183},{"name":86},{"id":70,"name":71,"tactic":185},{"name":59},{"id":43,"name":44,"tactic":187},{"name":46},{"id":92,"name":93,"tactic":189},{"name":86},{"id":66,"name":67,"tactic":191},{"name":59},{"id":117,"name":118,"tactic":193},{"name":111},{"id":195,"name":196,"techniques":197},"CAPEC-22","Exploiting Trust in Client",[],{"id":199,"name":200,"techniques":201},"CAPEC-459","Creating a Rogue Certification Authority Certificate",[],{"id":203,"name":204,"techniques":205},"CAPEC-461","Web Services API Signature Forgery Leveraging Hash Function Extension Weakness",[],{"id":207,"name":208,"techniques":209},"CAPEC-473","Signature Spoof",[210,273],{"id":211,"name":212,"tactics":213,"countermeasures":216},"T1036.001","Invalid Code Signature",[214,215],{"id":28,"name":29},{"id":31,"name":32},[217,221,225,229,233,237,241,245,249,253,257,261,265,269,271],{"id":218,"name":219,"tactic":220},"D3-FA","File Analysis",{"name":46},{"id":222,"name":223,"tactic":224},"D3-FE","File Encryption",{"name":86},{"id":226,"name":227,"tactic":228},"D3-FIM","File Integrity Monitoring",{"name":46},{"id":230,"name":231,"tactic":232},"D3-DA","Dynamic Analysis",{"name":46},{"id":234,"name":235,"tactic":236},"D3-EFA","Emulated File Analysis",{"name":46},{"id":238,"name":239,"tactic":240},"D3-DF","Decoy File",{"name":77},{"id":242,"name":243,"tactic":244},"D3-FEV","File Eviction",{"name":59},{"id":246,"name":247,"tactic":248},"D3-RF","Restore File",{"name":111},{"id":250,"name":251,"tactic":252},"D3-CF","Content Filtering",{"name":41},{"id":254,"name":255,"tactic":256},"D3-LFP","Local File Permissions",{"name":41},{"id":258,"name":259,"tactic":260},"D3-RFAM","Remote File Access Mediation",{"name":41},{"id":262,"name":263,"tactic":264},"D3-CQ","Content Quarantine",{"name":41},{"id":266,"name":267,"tactic":268},"D3-CM","Content Modification",{"name":41},{"id":133,"name":134,"tactic":270},{"name":41},{"id":137,"name":138,"tactic":272},{"name":41},{"id":274,"name":275,"tactics":276,"countermeasures":281},"T1553.002","Code Signing",[277,278],{"id":28,"name":29},{"id":279,"name":280},"TA0112","Defense Impairment",[],{"id":283,"name":284,"techniques":285},"CAPEC-476","Signature Spoofing by Misrepresentation",[],{"id":287,"name":288,"techniques":289},"CAPEC-59","Session Credential Falsification through Prediction",[],{"id":291,"name":292,"techniques":293},"CAPEC-60","Reusing Session IDs (aka Session Replay)",[294,324],{"id":295,"name":296,"tactics":297,"countermeasures":301},"T1134.001","Token Impersonation/Theft",[298,299,300],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},[302,304,306,308,310,312,314,316,318,320,322],{"id":66,"name":67,"tactic":303},{"name":59},{"id":43,"name":44,"tactic":305},{"name":46},{"id":38,"name":39,"tactic":307},{"name":41},{"id":70,"name":71,"tactic":309},{"name":59},{"id":100,"name":101,"tactic":311},{"name":86},{"id":104,"name":105,"tactic":313},{"name":86},{"id":74,"name":75,"tactic":315},{"name":77},{"id":83,"name":84,"tactic":317},{"name":86},{"id":92,"name":93,"tactic":319},{"name":86},{"id":88,"name":89,"tactic":321},{"name":86},{"id":117,"name":118,"tactic":323},{"name":111},{"id":325,"name":326,"tactics":327,"countermeasures":332},"T1550.004","Web Session Cookie",[328,329],{"id":28,"name":29},{"id":330,"name":331},"TA0109","Lateral Movement",[333,335,337,339,341,345,349,353,357,359,361,365,369,373,377,379,383,385,389,391,395,399,401,403,407,411,415,417,421,425],{"id":92,"name":93,"tactic":334},{"name":86},{"id":129,"name":130,"tactic":336},{"name":41},{"id":117,"name":118,"tactic":338},{"name":111},{"id":38,"name":39,"tactic":340},{"name":41},{"id":342,"name":343,"tactic":344},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":46},{"id":346,"name":347,"tactic":348},"D3-APCA","Application Protocol Command Analysis",{"name":46},{"id":350,"name":351,"tactic":352},"D3-PSMD","Process Self-Modification Detection",{"name":46},{"id":354,"name":355,"tactic":356},"D3-RTSD","Remote Terminal Session Detection",{"name":46},{"id":52,"name":53,"tactic":358},{"name":46},{"id":96,"name":97,"tactic":360},{"name":41},{"id":362,"name":363,"tactic":364},"D3-KBPI","Kernel-based Process Isolation",{"name":41},{"id":366,"name":367,"tactic":368},"D3-ABPI","Application-based Process Isolation",{"name":41},{"id":370,"name":371,"tactic":372},"D3-HS","Host Shutdown",{"name":59},{"id":374,"name":375,"tactic":376},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":46},{"id":66,"name":67,"tactic":378},{"name":59},{"id":380,"name":381,"tactic":382},"D3-HR","Host Reboot",{"name":59},{"id":43,"name":44,"tactic":384},{"name":46},{"id":386,"name":387,"tactic":388},"D3-NTF","Network Traffic Filtering",{"name":41},{"id":74,"name":75,"tactic":390},{"name":77},{"id":392,"name":393,"tactic":394},"D3-CSPP","Client-server Payload Profiling",{"name":46},{"id":396,"name":397,"tactic":398},"D3-PT","Process Termination",{"name":59},{"id":83,"name":84,"tactic":400},{"name":86},{"id":88,"name":89,"tactic":402},{"name":86},{"id":404,"name":405,"tactic":406},"D3-PLA","Process Lineage Analysis",{"name":46},{"id":408,"name":409,"tactic":410},"D3-NTCD","Network Traffic Community Deviation",{"name":46},{"id":412,"name":413,"tactic":414},"D3-PS","Process Suspension",{"name":59},{"id":70,"name":71,"tactic":416},{"name":59},{"id":418,"name":419,"tactic":420},"D3-NTSA","Network Traffic Signature Analysis",{"name":46},{"id":422,"name":423,"tactic":424},"D3-WSAM","Web Session Access Mediation",{"name":41},{"id":426,"name":427,"tactic":428},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":46},{"id":430,"name":431,"techniques":432},"CAPEC-667","Bluetooth Impersonation AttackS (BIAS)",[],{"id":434,"name":435,"techniques":436},"CAPEC-94","Adversary in the Middle (AiTM)",[437],{"id":438,"name":439,"tactics":440,"countermeasures":445},"T1557","Adversary-in-the-Middle",[441,442],{"id":145,"name":146},{"id":443,"name":444},"TA0100","Collection",[446,448,450,452,454,456,458,462,464,466],{"id":346,"name":347,"tactic":447},{"name":46},{"id":392,"name":393,"tactic":449},{"name":46},{"id":342,"name":343,"tactic":451},{"name":46},{"id":418,"name":419,"tactic":453},{"name":46},{"id":408,"name":409,"tactic":455},{"name":46},{"id":354,"name":355,"tactic":457},{"name":46},{"id":459,"name":460,"tactic":461},"D3-CAA","Connection Attempt Analysis",{"name":46},{"id":426,"name":427,"tactic":463},{"name":46},{"id":374,"name":375,"tactic":465},{"name":46},{"id":386,"name":387,"tactic":467},{"name":41},[],[],[],[472,474],{"_key":473},"RHSA-2026:13508",{"_key":475},"RHSA-2026:42078",[],[],"2026-07-15T17:21:28.516Z","2026-08-12T17:34:15.091Z","Awaiting Analysis",{"cisa_kev":482,"cisa_ransomware":482,"cisa_vendor":9,"epss_severity":483,"epss_score":484,"severity":485,"severity_score":486,"severity_version":487,"severity_source":488,"severity_vector":489,"severity_status":480},false,"low",0.00464,"high",8.2,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",[491,498,502,507,512,516],{"url":492,"sources":493,"tags":495},"https://access.redhat.com/errata/RHSA-2026:13508",[488,494],"nvd",[496,497],"Vendor Advisory","X Refsource REDHAT",{"url":499,"sources":500,"tags":501},"https://access.redhat.com/errata/RHSA-2026:13545",[488,494],[496,497],{"url":503,"sources":504,"tags":505},"https://access.redhat.com/security/cve/CVE-2026-12382",[488,494],[506,497],"VDB Entry",{"url":508,"sources":509,"tags":510},"https://bugzilla.redhat.com/show_bug.cgi?id=2489126",[488,494],[511,497],"Issue Tracking",{"url":513,"sources":514,"tags":515},"https://access.redhat.com/errata/RHSA-2026:42078",[488,494],[496,497],{"url":517,"sources":518,"tags":519},"https://access.redhat.com/errata/RHSA-2026:42142",[488,494],[496,497],[],{"date":522,"score":484,"percentile":523},"2026-09-19",0.39411,[525,529,532,535,538,541,545,548,551,554,557,560,563,566,569,572,575,578,581,584,587,590,593,596,599,602,605,608,611,614,617,620,623,626,629,632,635,638,641,644,647,650,653,656,659,662,665,668,671,674,677,680,683,686,689,692,695,698,701,704,707,710,713,716,719,722],{"date":526,"score":527,"percentile":528},"2026-07-16",0.00338,0.2592,{"date":530,"score":527,"percentile":531},"2026-07-17",0.25943,{"date":533,"score":527,"percentile":534},"2026-07-18",0.25951,{"date":536,"score":527,"percentile":537},"2026-07-19",0.25949,{"date":539,"score":527,"percentile":540},"2026-07-20",0.26034,{"date":542,"score":543,"percentile":544},"2026-07-21",0.00366,0.28956,{"date":546,"score":543,"percentile":547},"2026-07-22",0.29118,{"date":549,"score":543,"percentile":550},"2026-07-23",0.29113,{"date":552,"score":543,"percentile":553},"2026-07-24",0.29135,{"date":555,"score":543,"percentile":556},"2026-07-25",0.29213,{"date":558,"score":543,"percentile":559},"2026-07-26",0.29205,{"date":561,"score":543,"percentile":562},"2026-07-27",0.29178,{"date":564,"score":543,"percentile":565},"2026-07-28",0.29234,{"date":567,"score":543,"percentile":568},"2026-07-29",0.29249,{"date":570,"score":543,"percentile":571},"2026-07-30",0.29296,{"date":573,"score":543,"percentile":574},"2026-07-31",0.2931,{"date":576,"score":543,"percentile":577},"2026-08-01",0.29315,{"date":579,"score":543,"percentile":580},"2026-08-02",0.2932,{"date":582,"score":543,"percentile":583},"2026-08-03",0.29335,{"date":585,"score":543,"percentile":586},"2026-08-04",0.29303,{"date":588,"score":543,"percentile":589},"2026-08-05",0.29265,{"date":591,"score":543,"percentile":592},"2026-08-06",0.29292,{"date":594,"score":543,"percentile":595},"2026-08-07",0.29324,{"date":597,"score":543,"percentile":598},"2026-08-08",0.29338,{"date":600,"score":543,"percentile":601},"2026-08-09",0.29326,{"date":603,"score":543,"percentile":604},"2026-08-10",0.2934,{"date":606,"score":543,"percentile":607},"2026-08-11",0.29424,{"date":609,"score":543,"percentile":610},"2026-08-12",0.29511,{"date":612,"score":543,"percentile":613},"2026-08-13",0.29548,{"date":615,"score":543,"percentile":616},"2026-08-14",0.29596,{"date":618,"score":543,"percentile":619},"2026-08-15",0.29735,{"date":621,"score":543,"percentile":622},"2026-08-16",0.29759,{"date":624,"score":543,"percentile":625},"2026-08-17",0.29671,{"date":627,"score":543,"percentile":628},"2026-08-18",0.29687,{"date":630,"score":543,"percentile":631},"2026-08-19",0.29838,{"date":633,"score":543,"percentile":634},"2026-08-20",0.299,{"date":636,"score":543,"percentile":637},"2026-08-21",0.29941,{"date":639,"score":543,"percentile":640},"2026-08-22",0.29949,{"date":642,"score":543,"percentile":643},"2026-08-23",0.29859,{"date":645,"score":484,"percentile":646},"2026-08-24",0.38138,{"date":648,"score":484,"percentile":649},"2026-08-25",0.38169,{"date":651,"score":484,"percentile":652},"2026-08-26",0.38267,{"date":654,"score":484,"percentile":655},"2026-08-27",0.38304,{"date":657,"score":484,"percentile":658},"2026-08-28",0.3825,{"date":660,"score":484,"percentile":661},"2026-08-29",0.38288,{"date":663,"score":484,"percentile":664},"2026-08-30",0.38396,{"date":666,"score":484,"percentile":667},"2026-08-31",0.38406,{"date":669,"score":484,"percentile":670},"2026-09-01",0.38435,{"date":672,"score":484,"percentile":673},"2026-09-02",0.38484,{"date":675,"score":484,"percentile":676},"2026-09-03",0.38515,{"date":678,"score":484,"percentile":679},"2026-09-04",0.38555,{"date":681,"score":484,"percentile":682},"2026-09-05",0.38509,{"date":684,"score":484,"percentile":685},"2026-09-06",0.3862,{"date":687,"score":484,"percentile":688},"2026-09-07",0.38625,{"date":690,"score":484,"percentile":691},"2026-09-08",0.38643,{"date":693,"score":484,"percentile":694},"2026-09-09",0.38795,{"date":696,"score":484,"percentile":697},"2026-09-10",0.38813,{"date":699,"score":484,"percentile":700},"2026-09-11",0.38841,{"date":702,"score":484,"percentile":703},"2026-09-12",0.38934,{"date":705,"score":484,"percentile":706},"2026-09-13",0.38891,{"date":708,"score":484,"percentile":709},"2026-09-14",0.38915,{"date":711,"score":484,"percentile":712},"2026-09-15",0.38989,{"date":714,"score":484,"percentile":715},"2026-09-16",0.3917,{"date":717,"score":484,"percentile":718},"2026-09-17",0.39244,{"date":720,"score":484,"percentile":721},"2026-09-18",0.39392,{"date":522,"score":484,"percentile":523},[724,729],{"source":488,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":725,"cvss_v4_0":9},{"baseScore":486,"baseSeverity":726,"vectorString":489,"impactScore":727,"exploitabilityScore":728},"HIGH",7,10,{"source":494,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":730,"cvss_v4_0":9},{"baseScore":486,"baseSeverity":726,"vectorString":489,"impactScore":727,"exploitabilityScore":728},[]]