{"id":"CVE-2023-49088","aliases":["ALPINE-CVE-2023-49088","DEBIAN-CVE-2023-49088","DLA-3765-1","DSA-5646-1","EUVD-2023-53102","UBUNTU-CVE-2023-49088","openSUSE-SU-2024:0031-1","openSUSE-SU-2024:13533-1"],"status":"published","title":"Cacti has incomplete fix for CVE-2023-39515","description":"Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration\u003eSites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://\u003cHOST\u003e/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01268,"percentile":0.7001,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-12-22T16:16:53Z","modified":"2026-11-03T06:32:43Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cacti","fixed_in":["1.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cacti","fixed_in":["1.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cacti","fixed_in":["1.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cacti","fixed_in":["1.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cacti","fixed_in":["1.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cacti","fixed_in":["1.2.25-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cacti","fixed_in":["1.2.24+ds1-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cacti","fixed_in":["1.2.26+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cacti","fixed_in":["1.2.26+ds1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24+ds1-1+deb12u2"}]}],"versions":["1.2.24+ds1-1","1.2.24+ds1-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2+ds1-2+deb10u6"}]}],"versions":["1.2.2+ds1-2","1.2.2+ds1-2+deb10u1","1.2.2+ds1-2+deb10u2","1.2.2+ds1-2+deb10u3","1.2.2+ds1-2+deb10u4","1.2.2+ds1-2+deb10u5"],"bundled":13},{"source":"osv","ecosystem":"Debian:11","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.16+ds1-2+deb11u3"}]}],"versions":["1.2.16+ds1-2","1.2.16+ds1-2+deb11u1","1.2.16+ds1-2+deb11u2"],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24+ds1-1+deb12u2"}]}],"versions":["1.2.24+ds1-1","1.2.24+ds1-1+deb12u1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.8b+dfsg-3","0.8.8b+dfsg-5","0.8.8b+dfsg-5ubuntu0.1","0.8.8b+dfsg-5ubuntu0.2","0.8.8b+dfsg-5ubuntu0.2+esm1","0.8.8b+dfsg-5ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.8f+ds1-2","0.8.8f+ds1-3","0.8.8f+ds1-4","0.8.8f+ds1-4ubuntu1","0.8.8f+ds1-4ubuntu2","0.8.8f+ds1-4ubuntu3","0.8.8f+ds1-4ubuntu4","0.8.8f+ds1-4ubuntu4.16.04","0.8.8f+ds1-4ubuntu4.16.04.1","0.8.8f+ds1-4ubuntu4.16.04.2","0.8.8f+ds1-4ubuntu4.16.04.2+esm1","0.8.8f+ds1-4ubuntu4.16.04.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.18+ds1-1","1.1.27+ds1-2","1.1.27+ds1-3","1.1.28+ds1-2","1.1.35+ds1-1","1.1.36+ds1-1","1.1.38+ds1-1","1.1.38+ds1-1ubuntu0.1~esm1","1.1.38+ds1-1ubuntu0.1~esm3","1.1.38+ds1-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.4+ds1-2ubuntu3","1.2.9+ds1-1ubuntu1","1.2.9+ds1-1ubuntu2","1.2.10+ds1-1ubuntu1","1.2.10+ds1-1ubuntu1+esm1","1.2.10+ds1-1ubuntu1.1","1.2.10+ds1-1ubuntu1.1+esm1","1.2.10+ds1-1ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.16+ds1-2ubuntu1","1.2.19+ds1-2ubuntu1","1.2.19+ds1-2ubuntu1+esm1","1.2.19+ds1-2ubuntu1.1","1.2.19+ds1-2ubuntu1.1+esm1","1.2.19+ds1-2ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-1.1"}]}],"bundled":6}],"products":[{"vendor":"cacti","product":"cacti"}],"references":[{"url":"https://github.com/Cacti/cacti/security/advisories/GHSA-q7g7-gcf6-wh4x","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","report"]},{"url":"https://github.com/Cacti/cacti/security/advisories/GHSA-hrg9-qqqx-wc4h","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/data_debug.php","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/","tags":["x_transferred","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-49088","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49088.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49088","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-49088","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-49088","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49088","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IZJKJNYP7JFJ3XMRIGZT22J5DIAVPSY7/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218360","tags":["report"]},{"url":"https://bugzilla.suse.com/1218366","tags":["report"]},{"url":"https://bugzilla.suse.com/1218378","tags":["report"]},{"url":"https://bugzilla.suse.com/1218379","tags":["report"]},{"url":"https://bugzilla.suse.com/1218380","tags":["report"]},{"url":"https://bugzilla.suse.com/1218381","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51448","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-49088","title":"Cacti has incomplete fix for CVE-2023-39515","description":"Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration\u003eSites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://\u003cHOST\u003e/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.","status":"published","published":"2023-12-22T16:16:53.348Z","modified":"2026-02-25T16:34:32.172Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2023-53102","description":"Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration\u003eSites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://\u003cHOST\u003e/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.","status":"published","published":"2023-12-22T16:16:53Z","modified":"2026-02-25T16:34:32Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:29.128374Z"}],"nvd":[{"id":"CVE-2023-49088","description":"Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration\u003eSites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://\u003cHOST\u003e/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.","status":"published","published":"2023-12-22T17:15:08.247Z","modified":"2026-06-17T06:35:20.447Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:57.117371Z"}],"osv":[{"id":"ALPINE-CVE-2023-49088","description":"Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration\u003eSites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://\u003cHOST\u003e/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.","status":"published","published":"2023-12-22T17:15:08.247Z","modified":"2026-11-03T06:32:43.766604498Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2023-49088","title":"Cacti has incomplete fix for CVE-2023-39515","description":"Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration\u003eSites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://\u003cHOST\u003e/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.","status":"published","published":"2023-12-22T16:16:53.348Z","modified":"2026-10-28T02:30:42.267304421Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"DEBIAN-CVE-2023-49088","description":"Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration\u003eSites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://\u003cHOST\u003e/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.","status":"published","published":"2023-12-22T17:15:08.247Z","modified":"2026-10-26T18:03:07.119182204Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-49088","description":"Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration\u003eSites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://\u003cHOST\u003e/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.","status":"published","published":"2023-12-22T17:15:00Z","modified":"2025-10-24T05:02:21Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"DLA-3765-1","title":"cacti - security update","status":"published","published":"2024-03-18T00:00:00Z","modified":"2026-03-09T01:19:04.16814Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5646-1","title":"cacti - security update","status":"published","published":"2024-03-24T00:00:00Z","modified":"2026-03-09T02:10:33.052825Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:0031-1","title":"Security update for cacti, cacti-spine","description":"This update for cacti, cacti-spine fixes the following issues:\n\ncacti-spine 1.2.26:\n\n* Fix: Errors when uptime OID is not present\n* Fix: MySQL reconnect option is depreciated\n* Fix: Spine does not check a host with no poller items\n* Fix: Poller may report the wrong number of devices polled\n* Feature: Allow users to override the threads setting at the command line\n* Feature: Allow spine to run in ping-only mode\n\ncacti 1.2.26:\n\n* CVE-2023-50250: XSS vulnerability when importing a template file (boo#1218380)\n* CVE-2023-49084: RCE vulnerability when managing links (boo#1218360)\n* CVE-2023-49085: SQL Injection vulnerability when managing poller devices (boo#1218378)\n* CVE-2023-49086: XSS vulnerability when adding new devices (boo#1218366)\n* CVE-2023-49088: XSS vulnerability when viewing data sources in debug mode (boo#1218379)\n* CVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivers (boo#1218381)\n* When viewing data sources, an undefined variable error may be seen\n* Improvements for Poller Last Run Date\n* Attempting to edit a Data Query that does not exist throws warnings and not an GUI error\n* Improve PHP 8.1 support when adding devices\n* Viewing Data Query Cache can cause errors to be logged\n* Preserve option is not properly honoured when removing devices at command line\n* Infinite recursion is possible during a database failure\n* Monitoring Host CPU's does not always work on Windows endpoints\n* Multi select drop down list box not rendered correctly in Chrome and Edge\n* Selective Plugin Debugging may not always work as intended\n* During upgrades, Plugins may be falsely reported as incompatible\n* Plugin management at command line does not work with multiple plugins\n* Improve PHP 8.1 support for incrementing only numbers\n* Allow the renaming of guest and template accounts\n* DS Stats issues warnings when the RRDfile has not been initialized\n* When upgrading, missing data source profile can cause errors to be logged\n* When deleting a single Data Source, purge historical debug data\n* Improvements to form element warnings\n* Some interface aliases do not appear correctly\n* Aggregate graph does not show other percentiles\n* Settings table updates for large values reverted by database repair\n* When obtaining graph records, error messages may be recorded\n* Unable to change a device's community at command line\n* Increase timeout for RRDChecker\n* When viewing a graph, option to edit template may lead to incorrect URL\n* When upgrading, failures may occur due to missing color table keys\n* On installation, allow a more appropriate template to be used as the default\n* When data input parameters are allowed to be null, allow null\n* CSV Exports may not always output data correctly\n* When debugging a graph, long CDEF's can cause undesirable scrolling\n* Secondary LDAP server not evaluated when the first one has failed\n* When adding a device, using the bulk walk option can make version information appear\n* When parsing a Data Query resource, an error can be reported if no direction is specified\n* Database reconnection can cause errors to be reported incorrectly\n* fix returned value if $sau is empty\n* Add Aruba switch, Aruba controller and HPE iLO templates\n* Add OSCX 6x00 templates\n","status":"published","published":"2024-01-24T12:47:05Z","modified":"2026-02-04T02:28:19.679293Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:13533-1","title":"cacti-1.2.26-1.1 on GA media","description":"These are all security issues fixed in the cacti-1.2.26-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:35:52.465734Z","updated_at":"2026-11-02T16:58:36.327643Z"}]}}