{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T19:17:13.302Z", "lastRun": "2026-10-23T19:01:02.861Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "mljar" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-111057", "url": "https://cveboard.org/i/cve-2026-111057", "urlPt": "https://cveboard.org/pt/i/cve-2026-111057", "json": "https://cveboard.org/i/cve-2026-111057.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass", "summary": "A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury.", "titlePt": "Mercury: execução remota de código não autenticada em /api/terminals - contorno de controle de acesso", "summaryPt": "Uma vírgula faltante na lista BLOCKED_PATTERNS do arquivo mercury_app/block_handler.py faz com que a lista de bloqueios falhe ao cobrir o endpoint /api/terminals. Como resultado, qualquer atacante não autenticado pode iniciar um shell interativo completo no nível do sistema operacional no host que executa o Mercury.", "affected": [ { "vendor": "mljar", "product": "mercury", "defaultStatus": "unknown", "versions": [ { "version": ">= 3.0.0, < 3.2.4", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-185", "name": "Incorrect Regular Expression" }, { "id": "CWE-284", "name": "Improper Access Control" } ], "ssvc": null, "fix": "listed", "tags": [ "mljar", "pip" ], "cves": [ "CVE-2026-111057" ], "ghsa": "GHSA-f8c7-rwf9-fmgm", "cvss": { "score": 10, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00443, "percentile": 0.37507, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "mercury", "vulnerable": ">= 3.0.0, <= 3.2.3", "fixed": "3.2.4", "advisory": "GHSA-f8c7-rwf9-fmgm" } ], "vendor": "mljar", "product": "mercury", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-f8c7-rwf9-fmgm" } ], "publishedAt": "2026-10-19T17:00:54.000Z", "updatedAt": "2026-10-19T17:00:54.000Z" }, { "id": "cve-2026-111058", "url": "https://cveboard.org/i/cve-2026-111058", "urlPt": "https://cveboard.org/pt/i/cve-2026-111058", "json": "https://cveboard.org/i/cve-2026-111058.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Mercury: Unauthenticated Remote Code Execution via /api/kernels", "summary": "Mercury runs a JupyterLab server with anonymous access by default (mercury_app/main.py sets --IdentityProvider.token='' when no --token/MERCURY_TOKEN is given; when tokenless it also sets --ServerApp.disable_check_xsrf=True). It relies on a blocklist (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) to keep anonymous users off dangerous Jupyter endpoints.", "titlePt": "Mercury: execução remota de código não autenticada via /api/kernels", "summaryPt": "Mercury executa um servidor JupyterLab com acesso anônimo por padrão (mercury_app/main.py define --IdentityProvider.token='' quando nenhum --token/MERCURY_TOKEN é fornecido; quando sem token, também define --ServerApp.disable_check_xsrf=True). Ele depende de uma lista de bloqueio (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) para manter usuários anônimos fora de endpoints perigosos do Jupyter.", "affected": [ { "vendor": "mljar", "product": "mercury", "defaultStatus": "unknown", "versions": [ { "version": "< 3.2.6", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-862", "name": "Missing Authorization" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-19T17:05:16.440Z" }, "fix": "listed", "tags": [ "mljar", "pip" ], "cves": [ "CVE-2026-111058" ], "ghsa": "GHSA-rv4m-xm3f-3ccq", "cvss": { "score": 9.8, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00437, "percentile": 0.37005, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "mercury", "vulnerable": "<= 3.2.5", "fixed": "3.2.6", "advisory": "GHSA-rv4m-xm3f-3ccq" } ], "vendor": "mljar", "product": "mercury", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-rv4m-xm3f-3ccq" } ], "publishedAt": "2026-10-19T16:49:08.000Z", "updatedAt": "2026-10-19T16:49:08.000Z" } ], "tag": { "tag": "mljar", "name": "mljar", "kev": null } }