[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-12383":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":341,"aliases":342,"duplicate_of":9,"upstream":343,"downstream":344,"duplicates":349,"related":350,"reserved_at":9,"published_at":351,"modified_at":352,"state":353,"summary":354,"references_raw":363,"kevs":389,"epss":390,"epss_history":393,"metrics":550,"affected":558},"CVE-2026-12383","A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a trusted proxy. Additionally, the expected certificate Distinguished Name is leaked in the 403 error response body. An attacker who can reach the EDA API endpoint with a spoofed Subject header can inject arbitrary events into mTLS-protected event streams, triggering downstream automation actions.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-345","Insufficient Verification of Data Authenticity","The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.","weakness","Draft","Class",[19,23,76,88,109,113,117,121,125,129,133,337],{"id":20,"name":21,"techniques":22},"CAPEC-111","JSON Hijacking (aka JavaScript Hijacking)",[],{"id":24,"name":25,"techniques":26},"CAPEC-141","Cache Poisoning",[27],{"id":28,"name":29,"tactics":30,"countermeasures":37},"T1557.002","ARP Cache Poisoning",[31,34],{"id":32,"name":33},"TA0031","Credential Access",{"id":35,"name":36},"TA0100","Collection",[38,43,48,52,56,60,64,68,72],{"id":39,"name":40,"tactic":41},"D3-NTF","Network Traffic Filtering",{"name":42},"Isolate",{"id":44,"name":45,"tactic":46},"D3-NTCD","Network Traffic Community Deviation",{"name":47},"Detect",{"id":49,"name":50,"tactic":51},"D3-RTSD","Remote Terminal Session Detection",{"name":47},{"id":53,"name":54,"tactic":55},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":47},{"id":57,"name":58,"tactic":59},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":47},{"id":61,"name":62,"tactic":63},"D3-CSPP","Client-server Payload Profiling",{"name":47},{"id":65,"name":66,"tactic":67},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":47},{"id":69,"name":70,"tactic":71},"D3-NTSA","Network Traffic Signature Analysis",{"name":47},{"id":73,"name":74,"tactic":75},"D3-APCA","Application Protocol Command Analysis",{"name":47},{"id":77,"name":78,"techniques":79},"CAPEC-142","DNS Cache Poisoning",[80],{"id":81,"name":82,"tactics":83,"countermeasures":87},"T1584.002","DNS Server",[84],{"id":85,"name":86},"TA0042","Resource Development",[],{"id":89,"name":90,"techniques":91},"CAPEC-148","Content Spoofing",[92],{"id":93,"name":94,"tactics":95,"countermeasures":99},"T1491","Defacement",[96],{"id":97,"name":98},"TA0105","Impact",[100,105],{"id":101,"name":102,"tactic":103},"D3-DNR","Decoy Network Resource",{"name":104},"Deceive",{"id":106,"name":107,"tactic":108},"D3-NRAM","Network Resource Access Mediation",{"name":42},{"id":110,"name":111,"techniques":112},"CAPEC-218","Spoofing of UDDI/ebXML Messages",[],{"id":114,"name":115,"techniques":116},"CAPEC-384","Application API Message Manipulation via Man-in-the-Middle",[],{"id":118,"name":119,"techniques":120},"CAPEC-385","Transaction or Event Tampering via Application API Manipulation",[],{"id":122,"name":123,"techniques":124},"CAPEC-386","Application API Navigation Remapping",[],{"id":126,"name":127,"techniques":128},"CAPEC-387","Navigation Remapping To Propagate Malicious Content",[],{"id":130,"name":131,"techniques":132},"CAPEC-388","Application API Button Hijacking",[],{"id":134,"name":135,"techniques":136},"CAPEC-665","Exploitation of Thunderbolt Protection Flaws",[137,173,213],{"id":138,"name":139,"tactics":140,"countermeasures":147},"T1211","Exploitation for Stealth",[141,144],{"id":142,"name":143},"TA0030","Defense Evasion",{"id":145,"name":146},"TA0005","Stealth",[148,153,157,161,165,169],{"id":149,"name":150,"tactic":151},"D3-PSEP","Process Segment Execution Prevention",{"name":152},"Harden",{"id":154,"name":155,"tactic":156},"D3-MBT","Memory Boundary Tracking",{"name":47},{"id":158,"name":159,"tactic":160},"D3-PCSV","Process Code Segment Verification",{"name":47},{"id":162,"name":163,"tactic":164},"D3-SFCV","Stack Frame Canary Validation",{"name":152},{"id":166,"name":167,"tactic":168},"D3-SSC","Shadow Stack Comparisons",{"name":47},{"id":170,"name":171,"tactic":172},"D3-SAOR","Segment Address Offset Randomization",{"name":152},{"id":174,"name":175,"tactics":176,"countermeasures":182},"T1542.002","Component Firmware",[177,178,179],{"id":142,"name":143},{"id":145,"name":146},{"id":180,"name":181},"TA0110","Persistence",[183,187,191,195,199,204,209],{"id":184,"name":185,"tactic":186},"D3-FEMC","Firmware Embedded Monitoring Code",{"name":47},{"id":188,"name":189,"tactic":190},"D3-FV","Firmware Verification",{"name":47},{"id":192,"name":193,"tactic":194},"D3-FBA","Firmware Behavior Analysis",{"name":47},{"id":196,"name":197,"tactic":198},"D3-SU","Software Update",{"name":152},{"id":200,"name":201,"tactic":202},"D3-SWI","Software Inventory",{"name":203},"Model",{"id":205,"name":206,"tactic":207},"D3-RS","Restore Software",{"name":208},"Restore",{"id":210,"name":211,"tactic":212},"D3-AVE","Asset Vulnerability Enumeration",{"name":203},{"id":214,"name":215,"tactics":216,"countermeasures":223},"T1556","Modify Authentication Process",[217,218,221,222],{"id":142,"name":143},{"id":219,"name":220},"TA0112","Defense Impairment",{"id":180,"name":181},{"id":32,"name":33},[224,228,232,237,241,245,249,253,257,261,265,269,273,277,281,285,289,293,297,301,305,309,313,317,321,325,329,333],{"id":225,"name":226,"tactic":227},"D3-LFP","Local File Permissions",{"name":42},{"id":229,"name":230,"tactic":231},"D3-HBPI","Hardware-based Process Isolation",{"name":42},{"id":233,"name":234,"tactic":235},"D3-FEV","File Eviction",{"name":236},"Evict",{"id":238,"name":239,"tactic":240},"D3-HS","Host Shutdown",{"name":236},{"id":242,"name":243,"tactic":244},"D3-PSMD","Process Self-Modification Detection",{"name":47},{"id":246,"name":247,"tactic":248},"D3-CQ","Content Quarantine",{"name":42},{"id":250,"name":251,"tactic":252},"D3-ABPI","Application-based Process Isolation",{"name":42},{"id":254,"name":255,"tactic":256},"D3-SFA","System File Analysis",{"name":47},{"id":258,"name":259,"tactic":260},"D3-PT","Process Termination",{"name":236},{"id":262,"name":263,"tactic":264},"D3-SCF","System Call Filtering",{"name":42},{"id":266,"name":267,"tactic":268},"D3-AM","Access Modeling",{"name":203},{"id":270,"name":271,"tactic":272},"D3-RC","Restore Configuration",{"name":208},{"id":274,"name":275,"tactic":276},"D3-FE","File Encryption",{"name":152},{"id":278,"name":279,"tactic":280},"D3-DF","Decoy File",{"name":104},{"id":282,"name":283,"tactic":284},"D3-FIM","File Integrity Monitoring",{"name":47},{"id":286,"name":287,"tactic":288},"D3-CF","Content Filtering",{"name":42},{"id":290,"name":291,"tactic":292},"D3-FA","File Analysis",{"name":47},{"id":294,"name":295,"tactic":296},"D3-WSAM","Web Session Access Mediation",{"name":42},{"id":298,"name":299,"tactic":300},"D3-CI","Configuration Inventory",{"name":203},{"id":302,"name":303,"tactic":304},"D3-RF","Restore File",{"name":208},{"id":306,"name":307,"tactic":308},"D3-PSA","Process Spawn Analysis",{"name":47},{"id":310,"name":311,"tactic":312},"D3-PLA","Process Lineage Analysis",{"name":47},{"id":314,"name":315,"tactic":316},"D3-RFAM","Remote File Access Mediation",{"name":42},{"id":318,"name":319,"tactic":320},"D3-CM","Content Modification",{"name":42},{"id":322,"name":323,"tactic":324},"D3-NTPM","Network Traffic Policy Mapping",{"name":203},{"id":326,"name":327,"tactic":328},"D3-KBPI","Kernel-based Process Isolation",{"name":42},{"id":330,"name":331,"tactic":332},"D3-PS","Process Suspension",{"name":236},{"id":334,"name":335,"tactic":336},"D3-HR","Host Reboot",{"name":236},{"id":338,"name":339,"techniques":340},"CAPEC-701","Browser in the Middle (BiTM)",[],[],[],[],[345,347],{"_key":346},"RHSA-2026:50319",{"_key":348},"RHSA-2026:50336",[],[],"2026-07-27T19:12:29.271Z","2026-08-04T20:48:52.041Z","Awaiting Analysis",{"cisa_kev":355,"cisa_ransomware":355,"cisa_vendor":9,"epss_severity":356,"epss_score":357,"severity":358,"severity_score":359,"severity_version":360,"severity_source":361,"severity_vector":362,"severity_status":353},false,"low",0.00156,"high",7.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",[364,371,375,379,384],{"url":365,"sources":366,"tags":368},"https://access.redhat.com/errata/RHSA-2026:50319",[361,367],"nvd",[369,370],"Vendor Advisory","X Refsource REDHAT",{"url":372,"sources":373,"tags":374},"https://access.redhat.com/errata/RHSA-2026:50336",[361,367],[369,370],{"url":376,"sources":377,"tags":378},"https://access.redhat.com/errata/RHSA-2026:50340",[361,367],[369,370],{"url":380,"sources":381,"tags":382},"https://access.redhat.com/security/cve/CVE-2026-12383",[361,367],[383,370],"VDB Entry",{"url":385,"sources":386,"tags":387},"https://bugzilla.redhat.com/show_bug.cgi?id=2489127",[361,367],[388,370],"Issue Tracking",[],{"date":391,"score":357,"percentile":392},"2026-09-19",0.05171,[394,398,401,404,407,409,412,415,418,421,424,426,429,432,435,438,441,444,447,450,453,456,459,462,465,468,470,473,476,479,482,485,488,491,494,497,500,503,506,509,512,515,518,521,523,526,528,531,534,537,540,543,546,549],{"date":395,"score":396,"percentile":397},"2026-07-28",0.00128,0.02812,{"date":399,"score":396,"percentile":400},"2026-07-29",0.02822,{"date":402,"score":396,"percentile":403},"2026-07-30",0.02832,{"date":405,"score":396,"percentile":406},"2026-07-31",0.02836,{"date":408,"score":396,"percentile":403},"2026-08-01",{"date":410,"score":396,"percentile":411},"2026-08-02",0.02831,{"date":413,"score":396,"percentile":414},"2026-08-03",0.02826,{"date":416,"score":396,"percentile":417},"2026-08-04",0.02828,{"date":419,"score":357,"percentile":420},"2026-08-05",0.05233,{"date":422,"score":357,"percentile":423},"2026-08-06",0.05222,{"date":425,"score":357,"percentile":423},"2026-08-07",{"date":427,"score":357,"percentile":428},"2026-08-08",0.05213,{"date":430,"score":357,"percentile":431},"2026-08-09",0.05215,{"date":433,"score":357,"percentile":434},"2026-08-10",0.05219,{"date":436,"score":357,"percentile":437},"2026-08-11",0.05221,{"date":439,"score":357,"percentile":440},"2026-08-12",0.0523,{"date":442,"score":357,"percentile":443},"2026-08-13",0.05238,{"date":445,"score":357,"percentile":446},"2026-08-14",0.0526,{"date":448,"score":357,"percentile":449},"2026-08-15",0.05258,{"date":451,"score":357,"percentile":452},"2026-08-16",0.05235,{"date":454,"score":357,"percentile":455},"2026-08-17",0.0525,{"date":457,"score":357,"percentile":458},"2026-08-18",0.05261,{"date":460,"score":357,"percentile":461},"2026-08-19",0.05279,{"date":463,"score":357,"percentile":464},"2026-08-20",0.05284,{"date":466,"score":357,"percentile":467},"2026-08-21",0.05276,{"date":469,"score":357,"percentile":467},"2026-08-22",{"date":471,"score":357,"percentile":472},"2026-08-23",0.05254,{"date":474,"score":357,"percentile":475},"2026-08-24",0.04945,{"date":477,"score":357,"percentile":478},"2026-08-25",0.04967,{"date":480,"score":357,"percentile":481},"2026-08-26",0.04972,{"date":483,"score":357,"percentile":484},"2026-08-27",0.05058,{"date":486,"score":357,"percentile":487},"2026-08-28",0.05048,{"date":489,"score":357,"percentile":490},"2026-08-29",0.05057,{"date":492,"score":357,"percentile":493},"2026-08-30",0.05069,{"date":495,"score":357,"percentile":496},"2026-08-31",0.05071,{"date":498,"score":357,"percentile":499},"2026-09-01",0.05052,{"date":501,"score":357,"percentile":502},"2026-09-02",0.05056,{"date":504,"score":357,"percentile":505},"2026-09-03",0.05045,{"date":507,"score":357,"percentile":508},"2026-09-04",0.05051,{"date":510,"score":357,"percentile":511},"2026-09-05",0.05053,{"date":513,"score":357,"percentile":514},"2026-09-06",0.05066,{"date":516,"score":357,"percentile":517},"2026-09-07",0.05044,{"date":519,"score":357,"percentile":520},"2026-09-08",0.05046,{"date":522,"score":357,"percentile":496},"2026-09-09",{"date":524,"score":357,"percentile":525},"2026-09-10",0.05064,{"date":527,"score":357,"percentile":525},"2026-09-11",{"date":529,"score":357,"percentile":530},"2026-09-12",0.05072,{"date":532,"score":357,"percentile":533},"2026-09-13",0.05078,{"date":535,"score":357,"percentile":536},"2026-09-14",0.05088,{"date":538,"score":357,"percentile":539},"2026-09-15",0.05104,{"date":541,"score":357,"percentile":542},"2026-09-16",0.05138,{"date":544,"score":357,"percentile":545},"2026-09-17",0.0515,{"date":547,"score":357,"percentile":548},"2026-09-18",0.05168,{"date":391,"score":357,"percentile":392},[551,556],{"source":361,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":552,"cvss_v4_0":9},{"baseScore":359,"baseSeverity":553,"vectorString":362,"impactScore":554,"exploitabilityScore":555},"HIGH",6,10,{"source":367,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":557,"cvss_v4_0":9},{"baseScore":359,"baseSeverity":553,"vectorString":362,"impactScore":554,"exploitabilityScore":555},[]]