add: AVE-1999-0214

Author: adysec

vulns/1999/AVE-1999-0214.toml

@@ -4,21 +4,21 @@ published = ""
 remediation = "Refer to vendor advisory and upgrade to fixed version."
 score = 0.0
 severity = "UNKNOWN"
-sources = ["redhat"]
-title = "CVE-1999-0804 漏洞"
+sources = ["exploitdb"]
+title = "CVE-1999-0027 漏洞"
 updated = ""
 
 [exploit]
 exp_urls = []
 poc_urls = []
 
 [id]
-aliases = ["CVE-1999-0804"]
+aliases = ["CVE-1999-0027"]
 ave_id = "AVE-1999-0214"
-cve_id = "CVE-1999-0804"
+cve_id = "CVE-1999-0027"
 
 [meta]
-collected_at = "2026-07-11T00:12:04.667954695+00:00"
+collected_at = "2026-07-11T00:07:56.584880467+00:00"
 status = "completed"
 
 [references]

vulns/2026/AVE-2026-0053.toml

@@ -0,0 +1,32 @@
+[id]
+ave_id = "AVE-2026-0053"
+cve_id = "CVE-2026-49471"
+aliases = ["CVE-2026-49471", "GHSA-37h2-6p4f-mp3q"]
+
+[basic]
+title = "Serena AI 编程助手 Web 面板未授权访问致远程代码执行漏洞"
+description = "Serena 是一款 AI 编程助手，其内置 Web 管理面板默认在固定端口（TCP 24282）启动 Flask API 服务，未实施任何身份认证、CSRF 防护或 Host 头验证。攻击者可通过 DNS 重绑定攻击绕过浏览器同源策略，向本地 API 发送恶意请求写入持久化记忆存储。结合默认启用的 execute_shell_command 函数（shell=True），可触发完整的远程代码执行链，完全控制受害者主机。"
+severity = "HIGH"
+score = 7.5
+remediation = "升级至 Serena 官方已修复版本；或在配置中设置 web_dashboard: false 禁用 Web 面板；或通过防火墙限制 127.0.0.1 仅有本地访问 24282 端口。"
+published = "2026-07-10"
+updated = "2026-07-10"
+sources = ["ghsa"]
+
+[affected]
+vendor = "Serena"
+product = "Serena AI Coding Agent"
+
+[exploit]
+poc_urls = ["https://github.com/user-attachments/files/27755382/verify_vuln.py"]
+exp_urls = []
+
+[references]
+urls = [
+    "https://nvd.nist.gov/vuln/detail/CVE-2026-49471",
+    "https://github.com/advisories/GHSA-37h2-6p4f-mp3q"
+]
+
+[meta]
+status = "completed"
+collected_at = "2026-07-10T12:52:47Z"