‹ Volver al listado

CVE-2026-122154

Media (5.5)—
Seguimiento normalGravedad Media 5.5. Sin exploit público ni explotación activa conocidos.
Parche· github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec2…
Gravedad5.5Media · CVSS 4.0
Probabilidad de explotación0.32 %mayor que el 25 % de las CVE · dato del 8 nov 2026
Explotación activaNono figura en el catálogo de CISA · comprobado 8 nov, 14:00
Exploit públicoNo conocidosin código público localizado

Se ha detectado una vulnerabilidad en purocean Yank Note 3.93.0. Afecta a la función config.getAll del archivo src/main/server/index.ts del componente Settings Endpoint. La manipulación da lugar a una revelación de información. El ataque puede lanzarse de forma remota. El exploit se ha hecho público y podría utilizarse. La actualización a la versión 3.93.1 corregirá este problema. El parche se identifica como 59f85d48f17a70a402ad59dcecacdbec20f954df. Debe actualizarse el componente afectado. El commit elimina la clave de la respuesta.

Traducción automática del texto original de NVD (en inglés).

Cronología

Elaborada con nuestros propios datos: NVD, CISA KEV, FIRST EPSS, exploits públicos, prensa especializada y la cobertura de Orbitaley.

  1. Registro CVE publicado en NVD

Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

El vector AV:N/PR:N/UI:N permite explotación remota sin autenticación; config.getAll del endpoint Settings provoca divulgación de información de configuración, por lo que el impacto es lectura de datos locales.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network TrafficApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Yank-note — Yank NoteAI

Registro NVD

Estado en NVD
Aplazada
Publicada
5 nov 2026
Última modificación
5 nov 2026
Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Debilidad (CWE)
CWE-200, CWE-284

Referencias

Mostrar 2 referencias másMostrar menos

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-122154",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-122154",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-11-05T20:34:46.502761Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.5,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:purocean:yank_note:*:*:*:*:*:*:*:*"
          ],
          "vendor": "purocean",
          "modules": [
            "Settings Endpoint"
          ],
          "product": "Yank Note",
          "versions": [
            {
              "status": "affected",
              "version": "3.93.0"
            },
            {
              "status": "unaffected",
              "version": "3.93.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-11-05T02:16:57.990",
  "references": [
    {
      "url": "https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/purocean/yn/issues/532",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/purocean/yn/pull/535",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/purocean/yn/releases/tag/v3.93.1",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-122154",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/submit/1028031",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/431155",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/431155/cti",
      "source": "cna@vuldb.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response."
    }
  ],
  "lastModified": "2026-11-05T21:18:43.240",
  "sourceIdentifier": "cna@vuldb.com"
}