[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-15554":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":27,"aliases":28,"duplicate_of":9,"upstream":31,"downstream":32,"duplicates":39,"related":40,"reserved_at":9,"published_at":41,"modified_at":42,"state":43,"summary":44,"references_raw":53,"kevs":99,"epss":100,"epss_history":103,"metrics":223,"affected":235},"CVE-2026-15554","the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-295","Improper Certificate Validation","The product does not validate, or incorrectly validates, a certificate.","weakness","Draft","Base",[19,23],{"id":20,"name":21,"techniques":22},"CAPEC-459","Creating a Rogue Certification Authority Certificate",[],{"id":24,"name":25,"techniques":26},"CAPEC-475","Signature Spoofing by Improper Validation",[],[],[29,30],"DEBIAN-CVE-2026-15554","UBUNTU-CVE-2026-15554",[],[33,35,37],{"_key":34},"RHSA-2026:53644",{"_key":36},"RHSA-2026:53645",{"_key":38},"RHSA-2026:53646",[],[],"2026-08-11T08:49:40.484Z","2026-09-17T23:27:08.566Z","Awaiting Analysis",{"cisa_kev":45,"cisa_ransomware":45,"cisa_vendor":9,"epss_severity":46,"epss_score":47,"severity":48,"severity_score":49,"severity_version":50,"severity_source":51,"severity_vector":52,"severity_status":43},false,"low",0.00235,"high",7.4,"v3.1","cve.org","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",[54,63,67,72,77,83,87,91,95],{"url":55,"sources":56,"tags":59},"https://access.redhat.com/errata/RHSA-2026:53644",[51,57,58],"nvd","osv_ubuntu",[60,61,62],"Vendor Advisory","X Refsource REDHAT","REPORT",{"url":64,"sources":65,"tags":66},"https://access.redhat.com/errata/RHSA-2026:53806",[51,57,58],[60,61,62],{"url":68,"sources":69,"tags":70},"https://access.redhat.com/security/cve/CVE-2026-15554",[51,57,58],[71,61,62],"VDB Entry",{"url":73,"sources":74,"tags":75},"https://bugzilla.redhat.com/show_bug.cgi?id=2480601",[51,57,58],[76,61,62],"Issue Tracking",{"url":78,"sources":79,"tags":81},"https://security-tracker.debian.org/tracker/CVE-2026-15554",[80],"osv_debian",[82],"Advisory",{"url":84,"sources":85,"tags":86},"https://ubuntu.com/security/CVE-2026-15554",[58],[62],{"url":88,"sources":89,"tags":90},"https://www.cve.org/CVERecord?id=CVE-2026-15554",[58],[62],{"url":92,"sources":93,"tags":94},"https://access.redhat.com/errata/RHSA-2026:53645",[51,57],[60,61],{"url":96,"sources":97,"tags":98},"https://access.redhat.com/errata/RHSA-2026:53646",[51,57],[60,61],[],{"date":101,"score":47,"percentile":102},"2026-09-19",0.14791,[104,108,112,116,119,122,125,128,131,134,137,140,143,146,149,152,155,158,161,164,167,170,173,176,178,181,184,187,190,192,195,198,201,204,207,210,213,216,219,222],{"date":105,"score":106,"percentile":107},"2026-08-11",0.00187,0.08515,{"date":109,"score":110,"percentile":111},"2026-08-12",0.00217,0.1231,{"date":113,"score":114,"percentile":115},"2026-08-13",0.00222,0.12929,{"date":117,"score":114,"percentile":118},"2026-08-14",0.12933,{"date":120,"score":114,"percentile":121},"2026-08-15",0.13088,{"date":123,"score":114,"percentile":124},"2026-08-16",0.13117,{"date":126,"score":114,"percentile":127},"2026-08-17",0.13042,{"date":129,"score":114,"percentile":130},"2026-08-18",0.13041,{"date":132,"score":114,"percentile":133},"2026-08-19",0.13083,{"date":135,"score":114,"percentile":136},"2026-08-20",0.13091,{"date":138,"score":114,"percentile":139},"2026-08-21",0.13092,{"date":141,"score":114,"percentile":142},"2026-08-22",0.13087,{"date":144,"score":114,"percentile":145},"2026-08-23",0.13085,{"date":147,"score":114,"percentile":148},"2026-08-24",0.12582,{"date":150,"score":114,"percentile":151},"2026-08-25",0.1258,{"date":153,"score":114,"percentile":154},"2026-08-26",0.12618,{"date":156,"score":114,"percentile":157},"2026-08-27",0.12603,{"date":159,"score":114,"percentile":160},"2026-08-28",0.12625,{"date":162,"score":114,"percentile":163},"2026-08-29",0.12629,{"date":165,"score":114,"percentile":166},"2026-08-30",0.12643,{"date":168,"score":114,"percentile":169},"2026-08-31",0.12641,{"date":171,"score":114,"percentile":172},"2026-09-01",0.12653,{"date":174,"score":114,"percentile":175},"2026-09-02",0.12657,{"date":177,"score":114,"percentile":172},"2026-09-03",{"date":179,"score":114,"percentile":180},"2026-09-04",0.12671,{"date":182,"score":114,"percentile":183},"2026-09-05",0.12701,{"date":185,"score":114,"percentile":186},"2026-09-06",0.12716,{"date":188,"score":114,"percentile":189},"2026-09-07",0.12712,{"date":191,"score":114,"percentile":183},"2026-09-08",{"date":193,"score":114,"percentile":194},"2026-09-09",0.12757,{"date":196,"score":114,"percentile":197},"2026-09-10",0.12751,{"date":199,"score":114,"percentile":200},"2026-09-11",0.12754,{"date":202,"score":114,"percentile":203},"2026-09-12",0.12868,{"date":205,"score":114,"percentile":206},"2026-09-13",0.12822,{"date":208,"score":114,"percentile":209},"2026-09-14",0.12838,{"date":211,"score":114,"percentile":212},"2026-09-15",0.12893,{"date":214,"score":114,"percentile":215},"2026-09-16",0.12935,{"date":217,"score":114,"percentile":218},"2026-09-17",0.12975,{"date":220,"score":47,"percentile":221},"2026-09-18",0.14824,{"date":101,"score":47,"percentile":102},[224,229,231,233],{"source":51,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":225,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":226,"vectorString":52,"impactScore":227,"exploitabilityScore":228},"HIGH",8.7,5.6,{"source":57,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":230,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":226,"vectorString":52,"impactScore":227,"exploitabilityScore":228},{"source":80,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":232,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":9,"vectorString":52,"impactScore":227,"exploitabilityScore":228},{"source":58,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":234,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":9,"vectorString":52,"impactScore":227,"exploitabilityScore":228},[236,246],{"ecosystem":237,"name":238,"vendor":239,"product":238,"cpe_part":9,"purl_type":240,"purl_namespace":239,"purl_name":238,"source":9,"versions":241},"Debian","undertow","debian","deb",[242],{"version":243,"is_range":244,"range_type":245,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"ecosystem":247,"name":238,"vendor":248,"product":238,"cpe_part":9,"purl_type":240,"purl_namespace":248,"purl_name":238,"source":9,"versions":249},"Ubuntu","ubuntu",[250,251],{"version":243,"is_range":244,"range_type":245,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":243,"is_range":244,"range_type":245,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9}]