[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-52902":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":40,"aliases":41,"duplicate_of":9,"upstream":44,"downstream":45,"duplicates":52,"related":53,"reserved_at":9,"published_at":54,"modified_at":55,"state":56,"summary":57,"references_raw":66,"kevs":112,"epss":113,"epss_history":116,"metrics":354,"affected":364},"CVE-2026-52902","A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using \"awx --conf.format yaml import\". This is a client-side vulnerability requiring user interaction.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-22","Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","weakness","Stable","Base","High",[20,24,28,32,36],{"id":21,"name":22,"techniques":23},"CAPEC-126","Path Traversal",[],{"id":25,"name":26,"techniques":27},"CAPEC-64","Using Slashes and URL Encoding Combined to Bypass Validation Logic",[],{"id":29,"name":30,"techniques":31},"CAPEC-76","Manipulating Web Input to File System Calls",[],{"id":33,"name":34,"techniques":35},"CAPEC-78","Using Escaped Slashes in Alternate Encoding",[],{"id":37,"name":38,"techniques":39},"CAPEC-79","Using Slashes in Alternate Encoding",[],[],[42,43],"GHSA-g29c-rgq6-gxgj","PYSEC-2026-3550",[],[46,48,50],{"_key":47},"RHSA-2026:59137",{"_key":49},"RHSA-2026:59135",{"_key":51},"RHSA-2026:59136",[],[],"2026-06-09T09:33:40.154Z","2026-08-24T20:25:03.281Z","Awaiting Analysis",{"cisa_kev":58,"cisa_ransomware":58,"cisa_vendor":9,"epss_severity":59,"epss_score":60,"severity":61,"severity_score":62,"severity_version":63,"severity_source":64,"severity_vector":65,"severity_status":56},false,"low",0.00128,"medium",4.7,"v3.1","cve.org","CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",[67,76,81,86,91,95,99,104,108],{"url":68,"sources":69,"tags":72},"https://access.redhat.com/security/cve/CVE-2026-52902",[64,70,71],"nvd","osv_pypi",[73,74,75],"VDB Entry","X Refsource REDHAT","WEB",{"url":77,"sources":78,"tags":79},"https://bugzilla.redhat.com/show_bug.cgi?id=2486729",[64,70,71],[80,74,75],"Issue Tracking",{"url":82,"sources":83,"tags":84},"https://nvd.nist.gov/vuln/detail/CVE-2026-52902",[71],[85],"Advisory",{"url":87,"sources":88,"tags":89},"https://github.com/ansible/awx",[71],[90],"PACKAGE",{"url":92,"sources":93,"tags":94},"https://pypi.org/project/awxkit",[71],[90],{"url":96,"sources":97,"tags":98},"https://github.com/advisories/GHSA-g29c-rgq6-gxgj",[71],[85],{"url":100,"sources":101,"tags":102},"https://access.redhat.com/errata/RHSA-2026:59137",[64,70],[103,74],"Vendor Advisory",{"url":105,"sources":106,"tags":107},"https://access.redhat.com/errata/RHSA-2026:59135",[64,70],[103,74],{"url":109,"sources":110,"tags":111},"https://access.redhat.com/errata/RHSA-2026:59136",[64,70],[103,74],[],{"date":114,"score":60,"percentile":115},"2026-09-19",0.02849,[117,121,124,127,130,133,136,140,143,146,148,151,154,157,160,163,166,168,171,174,177,180,182,184,187,189,191,193,196,199,202,205,208,210,212,215,218,221,224,226,228,230,232,234,237,240,242,244,246,248,250,253,255,257,259,262,265,267,270,273,275,277,280,282,285,287,290,292,294,297,299,302,305,308,310,313,316,319,322,324,327,330,333,336,339,342,345,347,349,351],{"date":118,"score":119,"percentile":120},"2026-06-09",0.00012,0.01642,{"date":122,"score":119,"percentile":123},"2026-06-10",0.01639,{"date":125,"score":119,"percentile":126},"2026-06-11",0.01645,{"date":128,"score":119,"percentile":129},"2026-06-12",0.01649,{"date":131,"score":119,"percentile":132},"2026-06-13",0.01652,{"date":134,"score":119,"percentile":135},"2026-06-14",0.0166,{"date":137,"score":138,"percentile":139},"2026-06-15",0.00121,0.02221,{"date":141,"score":138,"percentile":142},"2026-06-16",0.02223,{"date":144,"score":138,"percentile":145},"2026-06-17",0.02225,{"date":147,"score":138,"percentile":142},"2026-06-18",{"date":149,"score":138,"percentile":150},"2026-06-19",0.02222,{"date":152,"score":138,"percentile":153},"2026-06-20",0.02219,{"date":155,"score":138,"percentile":156},"2026-06-21",0.02215,{"date":158,"score":138,"percentile":159},"2026-06-22",0.02212,{"date":161,"score":138,"percentile":162},"2026-06-23",0.02214,{"date":164,"score":138,"percentile":165},"2026-06-24",0.02217,{"date":167,"score":138,"percentile":142},"2026-06-25",{"date":169,"score":138,"percentile":170},"2026-06-26",0.0223,{"date":172,"score":138,"percentile":173},"2026-06-27",0.02236,{"date":175,"score":138,"percentile":176},"2026-06-28",0.02239,{"date":178,"score":138,"percentile":179},"2026-06-29",0.02235,{"date":181,"score":138,"percentile":173},"2026-06-30",{"date":183,"score":138,"percentile":173},"2026-07-01",{"date":185,"score":138,"percentile":186},"2026-07-02",0.02234,{"date":188,"score":138,"percentile":186},"2026-07-03",{"date":190,"score":138,"percentile":179},"2026-07-04",{"date":192,"score":138,"percentile":179},"2026-07-05",{"date":194,"score":138,"percentile":195},"2026-07-06",0.02238,{"date":197,"score":138,"percentile":198},"2026-07-07",0.02246,{"date":200,"score":138,"percentile":201},"2026-07-08",0.02254,{"date":203,"score":138,"percentile":204},"2026-07-09",0.02263,{"date":206,"score":138,"percentile":207},"2026-07-10",0.02264,{"date":209,"score":138,"percentile":207},"2026-07-11",{"date":211,"score":138,"percentile":207},"2026-07-12",{"date":213,"score":138,"percentile":214},"2026-07-13",0.02258,{"date":216,"score":138,"percentile":217},"2026-07-14",0.02257,{"date":219,"score":138,"percentile":220},"2026-07-15",0.02248,{"date":222,"score":138,"percentile":223},"2026-07-16",0.02256,{"date":225,"score":138,"percentile":214},"2026-07-17",{"date":227,"score":138,"percentile":214},"2026-07-18",{"date":229,"score":138,"percentile":217},"2026-07-19",{"date":231,"score":138,"percentile":201},"2026-07-20",{"date":233,"score":138,"percentile":207},"2026-07-21",{"date":235,"score":138,"percentile":236},"2026-07-22",0.02273,{"date":238,"score":138,"percentile":239},"2026-07-23",0.02272,{"date":241,"score":138,"percentile":223},"2026-07-24",{"date":243,"score":138,"percentile":217},"2026-07-25",{"date":245,"score":138,"percentile":217},"2026-07-26",{"date":247,"score":138,"percentile":214},"2026-07-27",{"date":249,"score":138,"percentile":201},"2026-07-28",{"date":251,"score":138,"percentile":252},"2026-07-29",0.02253,{"date":254,"score":138,"percentile":220},"2026-07-30",{"date":256,"score":138,"percentile":220},"2026-07-31",{"date":258,"score":138,"percentile":198},"2026-08-01",{"date":260,"score":138,"percentile":261},"2026-08-02",0.02244,{"date":263,"score":138,"percentile":264},"2026-08-03",0.02241,{"date":266,"score":138,"percentile":264},"2026-08-04",{"date":268,"score":138,"percentile":269},"2026-08-05",0.0224,{"date":271,"score":138,"percentile":272},"2026-08-06",0.02229,{"date":274,"score":138,"percentile":272},"2026-08-07",{"date":276,"score":138,"percentile":145},"2026-08-08",{"date":278,"score":138,"percentile":279},"2026-08-09",0.02227,{"date":281,"score":138,"percentile":170},"2026-08-10",{"date":283,"score":138,"percentile":284},"2026-08-11",0.02228,{"date":286,"score":138,"percentile":176},"2026-08-12",{"date":288,"score":138,"percentile":289},"2026-08-13",0.02247,{"date":291,"score":138,"percentile":214},"2026-08-14",{"date":293,"score":138,"percentile":201},"2026-08-15",{"date":295,"score":138,"percentile":296},"2026-08-16",0.02251,{"date":298,"score":138,"percentile":214},"2026-08-17",{"date":300,"score":138,"percentile":301},"2026-08-18",0.0226,{"date":303,"score":138,"percentile":304},"2026-08-19",0.02267,{"date":306,"score":138,"percentile":307},"2026-08-20",0.02275,{"date":309,"score":138,"percentile":307},"2026-08-21",{"date":311,"score":138,"percentile":312},"2026-08-22",0.02276,{"date":314,"score":138,"percentile":315},"2026-08-23",0.02265,{"date":317,"score":138,"percentile":318},"2026-08-24",0.02107,{"date":320,"score":60,"percentile":321},"2026-08-25",0.02717,{"date":323,"score":60,"percentile":321},"2026-08-26",{"date":325,"score":60,"percentile":326},"2026-08-27",0.02768,{"date":328,"score":60,"percentile":329},"2026-08-28",0.02763,{"date":331,"score":60,"percentile":332},"2026-08-29",0.02769,{"date":334,"score":60,"percentile":335},"2026-08-30",0.02774,{"date":337,"score":60,"percentile":338},"2026-08-31",0.02775,{"date":340,"score":60,"percentile":341},"2026-09-01",0.0277,{"date":343,"score":60,"percentile":344},"2026-09-02",0.02767,{"date":346,"score":60,"percentile":344},"2026-09-03",{"date":348,"score":60,"percentile":338},"2026-09-04",{"date":350,"score":60,"percentile":338},"2026-09-05",{"date":352,"score":60,"percentile":353},"2026-09-06",0.02781,[355,360,362],{"source":64,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":356,"cvss_v4_0":9},{"baseScore":62,"baseSeverity":357,"vectorString":65,"impactScore":358,"exploitabilityScore":359},"MEDIUM",6,2.6,{"source":70,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":361,"cvss_v4_0":9},{"baseScore":62,"baseSeverity":357,"vectorString":65,"impactScore":358,"exploitabilityScore":359},{"source":71,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":363,"cvss_v4_0":9},{"baseScore":62,"baseSeverity":9,"vectorString":65,"impactScore":358,"exploitabilityScore":359},[365],{"ecosystem":366,"name":367,"vendor":366,"product":367,"cpe_part":9,"purl_type":368,"purl_namespace":9,"purl_name":367,"source":9,"versions":369},"PyPI","awxkit","pypi",[370],{"version":371,"is_range":372,"range_type":373,"version_start":9,"version_start_type":9,"version_end":374,"version_end_type":375,"fixed_in":9},"lte24_6_1",true,"ecosystem","24.6.1","including"]