[{"data":1,"prerenderedAt":48},["ShallowReactive",2],{"sicherheitsluecke-cve-2026-128049":3},{"l":4,"details":25,"weitere":28,"indexierbar":46,"updated":47},{"cve":5,"status":6,"vendor":7,"product":8,"name":7,"added":9,"due":7,"ransomware":10,"published":9,"cwes":11,"cvss":13,"epss":18,"slug":21,"bereich":22,"schweregrad":23,"art":24,"produktLabel":8},"CVE-2026-128049","gemeldet","","OpenMage Magento LTS","2026-11-13",false,[12],"CWE-352",{"version":14,"score":15,"severity":16,"vector":17},"4.0",9.4,"CRITICAL","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:H\u002FSI:H\u002FSA:H\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",{"score":19,"percentile":20},0.00226,0.13419,"cve-2026-128049","web","kritisch","Untergeschobene Anfragen (Cross-Site Request Forgery)",{"description":26,"refs":27},"OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can lure a logged-in administrator or customer to a crafted confirm URL that authorizes the attacker's request token, then exchange it at \u002Foauth\u002Ftoken for a persistent REST API access token bound to the victim.",[],[29,35,41],{"cve":30,"status":6,"produktLabel":31,"vendor":7,"product":31,"art":32,"bereich":22,"schweregrad":23,"score":33,"epss":-1,"added":34,"ransomware":10},"CVE-2026-126173","AutomatorWP Pro (WordPress-Plugin)","Fehlende Berechtigungsprüfung",9.8,"2026-11-14",{"cve":36,"status":6,"produktLabel":37,"vendor":7,"product":37,"art":38,"bereich":22,"schweregrad":39,"score":40,"epss":-1,"added":34,"ransomware":10},"CVE-2026-124969","Optimole (WordPress-Plugin)","Unsicheres Einlesen von Daten (Deserialisierung)","hoch",7.1,{"cve":42,"status":6,"produktLabel":43,"vendor":7,"product":43,"art":44,"bereich":22,"schweregrad":23,"score":45,"epss":-1,"added":9,"ransomware":10},"CVE-2026-129171","NginxPulse","Einschleusen von Datenbankbefehlen (SQL-Injection)",9.3,true,"2026-11-14T11:41:59.691Z",1794656591294]