{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-13507",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-13507",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-06-28T21:30:09.767Z",
    "updatedAt": "2026-06-29T11:13:20.274Z",
    "importedAt": "2026-10-24T01:57:55.771Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "volcengine OpenViking Local VectorDB Primary-key Label str_to_uint64.py str_to_uint64 data authenticity",
      "summary": "A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function str_to_uint64 of the file openviking/storage/vectordb/utils/str_to_uint64.py of the component Local VectorDB Primary-key Label Handler. The manipulation of the argument ID results in insufficient verification of data authenticity. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The pull request to fix this issue awaits acceptance.",
      "affected": [
        {
          "vendor": "volcengine",
          "product": "OpenViking",
          "versions": [
            {
              "version": "0.3.0",
              "status": "affected"
            },
            {
              "version": "0.3.1",
              "status": "affected"
            },
            {
              "version": "0.3.2",
              "status": "affected"
            },
            {
              "version": "0.3.3",
              "status": "affected"
            },
            {
              "version": "0.3.4",
              "status": "affected"
            },
            {
              "version": "0.3.5",
              "status": "affected"
            },
            {
              "version": "0.3.6",
              "status": "affected"
            },
            {
              "version": "0.3.7",
              "status": "affected"
            },
            {
              "version": "0.3.8",
              "status": "affected"
            },
            {
              "version": "0.3.9",
              "status": "affected"
            },
            {
              "version": "0.3.10",
              "status": "affected"
            },
            {
              "version": "0.3.11",
              "status": "affected"
            },
            {
              "version": "0.3.12",
              "status": "affected"
            },
            {
              "version": "0.3.13",
              "status": "affected"
            },
            {
              "version": "0.3.14",
              "status": "affected"
            },
            {
              "version": "0.3.15",
              "status": "affected"
            },
            {
              "version": "0.3.16",
              "status": "affected"
            },
            {
              "version": "0.3.17",
              "status": "affected"
            },
            {
              "version": "0.3.18",
              "status": "affected"
            },
            {
              "version": "0.3.19",
              "status": "affected"
            },
            {
              "version": "0.3.20",
              "status": "affected"
            },
            {
              "version": "0.3.21",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}