CVE-2026-122154

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122154", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-04T18:35:15.823Z", "datePublished": "2026-11-05T01:30:31.582Z", "dateUpdated": "2026-11-05T20:35:18.777Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T01:30:31.582Z"}, "title": "purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "Information Disclosure"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "purocean", "product": "Yank Note", "versions": [{"version": "3.93.0", "status": "affected"}, {"version": "3.93.1", "status": "unaffected"}], "cpes": ["cpe:2.3:a:purocean:yank_note:*:*:*:*:*:*:*:*"], "modules": ["Settings Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-11-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-04T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-04T19:40:22.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "CopperKoi (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/431155", "name": "VDB-431155 | purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431155/cti", "name": "VDB-431155 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122154", "name": "CVE-2026-122154 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1028031", "name": "Submit #1028031 | Purocean Yank Note 3.93.0 Information Disclosure", "tags": ["third-party-advisory"]}, {"url": "https://github.com/purocean/yn/issues/532", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/purocean/yn/pull/535", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df", "tags": ["patch"]}, {"url": "https://github.com/purocean/yn/releases/tag/v3.93.1", "tags": ["patch"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T20:34:46.502761Z", "id": "CVE-2026-122154", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:35:18.777Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122154", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T20:34:46.502761Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:35:15.582Z"}}], "cna": {"tags": ["x_open-source"], "title": "purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure", "credits": [{"lang": "en", "type": "reporter", "value": "CopperKoi (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:purocean:yank_note:*:*:*:*:*:*:*:*"], "vendor": "purocean", "modules": ["Settings Endpoint"], "product": "Yank Note", "versions": [{"status": "affected", "version": "3.93.0"}, {"status": "unaffected", "version": "3.93.1"}]}], "timeline": [{"lang": "en", "time": "2026-11-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-11-04T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-11-04T19:40:22.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/431155", "name": "VDB-431155 | purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431155/cti", "name": "VDB-431155 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122154", "name": "CVE-2026-122154 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1028031", "name": "Submit #1028031 | Purocean Yank Note 3.93.0 Information Disclosure", "tags": ["third-party-advisory"]}, {"url": "https://github.com/purocean/yn/issues/532", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/purocean/yn/pull/535", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df", "tags": ["patch"]}, {"url": "https://github.com/purocean/yn/releases/tag/v3.93.1", "tags": ["patch"]}], "x_generator": ["VulDB PVTS v202611"], "descriptions": [{"lang": "en", "value": "A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Information Disclosure"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T01:30:31.582Z"}}}, "cveMetadata": {"cveId": "CVE-2026-122154", "state": "PUBLISHED", "dateUpdated": "2026-11-05T20:35:18.777Z", "dateReserved": "2026-11-04T18:35:15.823Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-11-05T01:30:31.582Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:purocean:yank_note:*:*:*:*:*:*:*:*"], "modules": ["Settings Endpoint"], "product": "Yank Note", "vendor": "purocean", "versions": [{"status": "affected", "version": "3.93.0"}, {"status": "unaffected", "version": "3.93.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response."}], "id": "CVE-2026-122154", "lastModified": "2026-11-05T21:18:43.240", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122154", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T20:34:46.502761Z", "version": "2.0.3"}}]}, "published": "2026-11-05T02:16:57.990", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df"}, {"source": "cna@vuldb.com", "url": "https://github.com/purocean/yn/issues/532"}, {"source": "cna@vuldb.com", "url": "https://github.com/purocean/yn/pull/535"}, {"source": "cna@vuldb.com", "url": "https://github.com/purocean/yn/releases/tag/v3.93.1"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-122154"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1028031"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431155"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431155/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "yank-note: yank-note: Information disclosure via settings endpoint", "id": "2567515", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567515"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response.", "A flaw was found in Yank Note. The application's settings endpoint improperly includes sensitive keys in server configuration responses. A remote attacker can exploit this vulnerability by querying the configuration endpoint to obtain sensitive configuration data, leading to information disclosure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122154", "public_date": "2026-11-05T01:30:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122154\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122154\nhttps://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df\nhttps://github.com/purocean/yn/issues/532\nhttps://github.com/purocean/yn/pull/535\nhttps://github.com/purocean/yn/releases/tag/v3.93.1\nhttps://vuldb.com/cve/CVE-2026-122154\nhttps://vuldb.com/submit/1028031\nhttps://vuldb.com/vuln/431155\nhttps://vuldb.com/vuln/431155/cti"], "statement": "This vulnerability is evaluated with a Moderate impact because an unauthenticated network actor can retrieve sensitive server configuration parameters, but the flaw does not facilitate system compromise or integrity tampering. Additionally, Yank Note is not distributed or supported within Red Hat Enterprise Linux or related enterprise offerings, resulting in no direct exposure for standard Red Hat environments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.93.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.93.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Yank Note", "source": "cna", "vendor": "purocean"}, "product": "yank_note", "vendor": "purocean"}], "created": "2026-11-05T03:45:18.528633+00:00", "updated": "2026-11-06T21:27:11.317134+00:00", "vendors": ["purocean", "purocean$PRODUCT$yank_note"]}