diff --git a/data/2025/59xxx/CVE-2025-59847.json b/data/2025/59xxx/CVE-2025-59847.json new file mode 100644 index 0000000000..1b4ba75b75 --- /dev/null +++ b/data/2025/59xxx/CVE-2025-59847.json @@ -0,0 +1,98 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2025-59847", + "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", + "state": "PUBLISHED", + "assignerShortName": "HCL", + "dateReserved": "2025-09-22T14:59:58.051Z", + "datePublished": "2026-11-11T07:48:51.436Z", + "dateUpdated": "2026-11-11T07:48:51.436Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", + "shortName": "HCL", + "dateUpdated": "2026-11-11T07:48:51.436Z" + }, + "title": "HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session", + "datePublic": "2026-11-11T07:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-79", + "description": "CWE-79 Improper Neutralization of Input During Web Page Generation", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "HCL Software", + "product": "HCL Domino Leap", + "versions": [ + { + "status": "affected", + "version": "1.1.66 - 1.1.9" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session" + } + ] + } + ], + "references": [ + { + "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134535" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "HIGH", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseSeverity": "MEDIUM", + "baseScore": 6.8, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.0" + } + } + } +} \ No newline at end of file diff --git a/data/2025/59xxx/CVE-2025-59848.json b/data/2025/59xxx/CVE-2025-59848.json new file mode 100644 index 0000000000..4f69de4a8e --- /dev/null +++ b/data/2025/59xxx/CVE-2025-59848.json @@ -0,0 +1,97 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2025-59848", + "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", + "state": "PUBLISHED", + "assignerShortName": "HCL", + "dateReserved": "2025-09-22T14:59:58.051Z", + "datePublished": "2026-11-11T07:41:08.937Z", + "dateUpdated": "2026-11-11T07:41:08.937Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", + "shortName": "HCL", + "dateUpdated": "2026-11-11T07:41:08.937Z" + }, + "title": "HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-79", + "description": "CWE-79 Improper Neutralization of Input During Web Page Generation", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "HCL Software", + "product": "HCL Leap", + "versions": [ + { + "status": "affected", + "version": "9.3.88 - 9.2.10" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session" + } + ] + } + ], + "references": [ + { + "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134534" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "HIGH", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseSeverity": "MEDIUM", + "baseScore": 6.8, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.0" + } + } + } +} \ No newline at end of file diff --git a/data/2026/105xxx/CVE-2026-105948.json b/data/2026/105xxx/CVE-2026-105948.json new file mode 100644 index 0000000000..7999cf06d5 --- /dev/null +++ b/data/2026/105xxx/CVE-2026-105948.json @@ -0,0 +1,125 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-105948", + "assignerOrgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272", + "state": "PUBLISHED", + "assignerShortName": "Octopus", + "dateReserved": "2026-10-06T07:44:16.638Z", + "datePublished": "2026-11-11T07:27:40.806Z", + "dateUpdated": "2026-11-11T07:27:40.806Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272", + "shortName": "Octopus", + "dateUpdated": "2026-11-11T07:27:40.806Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-863", + "description": "CWE-863: Incorrect Authorization", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Octopus Deploy", + "product": "Octopus Server", + "platforms": [ + "Windows", + "Linux" + ], + "versions": [ + { + "status": "affected", + "version": "2024.2.5035", + "lessThan": "2026.2.13487", + "versionType": "custom" + }, + { + "status": "affected", + "version": "2026.3.0", + "lessThan": "2026.3.15909", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled." + } + ] + } + ], + "references": [ + { + "url": "https://advisories.octopus.com/post/2026/sa2026-21" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "PRESENT", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "HIGH", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 7.7, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "This vulnerability was found by Nathan Willoughby", + "type": "finder" + } + ], + "source": { + "discovery": "INTERNAL" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/111xxx/CVE-2026-111190.json b/data/2026/111xxx/CVE-2026-111190.json new file mode 100644 index 0000000000..25106cde74 --- /dev/null +++ b/data/2026/111xxx/CVE-2026-111190.json @@ -0,0 +1,88 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-111190", + "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", + "state": "PUBLISHED", + "assignerShortName": "Wordfence", + "dateReserved": "2026-10-15T17:47:44.757Z", + "datePublished": "2026-11-11T07:26:41.208Z", + "dateUpdated": "2026-11-11T07:26:41.208Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", + "shortName": "Wordfence", + "dateUpdated": "2026-11-11T07:26:41.208Z" + }, + "affected": [ + { + "vendor": "n/a", + "product": "ARforms", + "versions": [ + { + "version": "0", + "status": "affected", + "lessThanOrEqual": "7.2.4", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin's file-type and content-safety checks can be evaded, allowing files that contain executable PHP code to be written to a publicly accessible directory. This makes it possible for unauthenticated attackers to upload malicious files to the affected site's server, which may make remote code execution possible. Exploitation requires a published form containing a File field to be publicly accessible on the site." + } + ], + "title": "ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header", + "references": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/58e67f1f-1139-406a-80fb-95aeccac9436?source=cve" + }, + { + "url": "https://www.arformsplugin.com/documentation/changelog/" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", + "cweId": "CWE-434", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", + "baseScore": 8.1, + "baseSeverity": "HIGH" + } + } + ], + "credits": [ + { + "lang": "en", + "type": "finder", + "value": "LionTree" + } + ], + "timeline": [ + { + "time": "2026-11-10T19:06:38.000Z", + "lang": "en", + "value": "Disclosed" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/116xxx/CVE-2026-116468.json b/data/2026/116xxx/CVE-2026-116468.json new file mode 100644 index 0000000000..1afe445701 --- /dev/null +++ b/data/2026/116xxx/CVE-2026-116468.json @@ -0,0 +1,147 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-116468", + "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", + "state": "PUBLISHED", + "assignerShortName": "redhat", + "dateReserved": "2026-10-26T10:31:08.562Z", + "datePublished": "2026-11-11T07:57:21.958Z", + "dateUpdated": "2026-11-11T07:57:21.958Z" + }, + "containers": { + "cna": { + "title": "Keycloak-services: keycloak-services: delegated admin escalates to realm-admin via group move", + "metrics": [ + { + "other": { + "content": { + "value": "Important", + "namespace": "https://access.redhat.com/security/updates/classification/" + }, + "type": "Red Hat severity rating" + } + }, + { + "cvssV3_1": { + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 6.6, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", + "version": "3.1" + }, + "format": "CVSS" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm." + } + ], + "affected": [ + { + "vendor": "Red Hat", + "product": "Red Hat Build of Keycloak", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "keycloak-services", + "defaultStatus": "affected", + "cpes": [ + "cpe:/a:redhat:build_keycloak:" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Build of Keycloak", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "rhbk/keycloak-rhel9", + "defaultStatus": "affected", + "cpes": [ + "cpe:/a:redhat:build_keycloak:" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Single Sign-On 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "keycloak-services", + "defaultStatus": "unaffected", + "cpes": [ + "cpe:/a:redhat:red_hat_single_sign_on:7" + ] + } + ], + "references": [ + { + "url": "https://access.redhat.com/security/cve/CVE-2026-116468", + "tags": [ + "vdb-entry", + "x_refsource_REDHAT" + ] + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560575", + "name": "RHBZ#2560575", + "tags": [ + "issue-tracking", + "x_refsource_REDHAT" + ] + } + ], + "datePublic": "2026-11-11T00:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-862", + "description": "Missing Authorization", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "x_redhatCweChain": "CWE-862: Missing Authorization", + "workarounds": [ + { + "lang": "en", + "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." + } + ], + "timeline": [ + { + "lang": "en", + "time": "2026-10-23T19:41:35.000Z", + "value": "Reported to Red Hat." + }, + { + "lang": "en", + "time": "2026-11-11T00:00:00.000Z", + "value": "Made public." + } + ], + "credits": [ + { + "lang": "en", + "value": "Red Hat would like to thank Abhijeet Ingle for reporting this issue." + } + ], + "providerMetadata": { + "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", + "shortName": "redhat", + "dateUpdated": "2026-11-11T07:57:21.958Z" + }, + "x_generator": { + "engine": "cvelib 1.8.0" + } + } + } +} \ No newline at end of file diff --git a/data/2026/119xxx/CVE-2026-119171.json b/data/2026/119xxx/CVE-2026-119171.json new file mode 100644 index 0000000000..8cc47cb66d --- /dev/null +++ b/data/2026/119xxx/CVE-2026-119171.json @@ -0,0 +1,94 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-119171", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-10-29T15:12:57.413Z", + "datePublished": "2026-11-11T07:33:06.987Z", + "dateUpdated": "2026-11-11T07:33:06.987Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-11T07:33:06.987Z" + }, + "title": "Advanced Product Fields (Product Addons) for WooCommerce 1.6.22 - 1.7.3 - Unauthenticated Paid Option Surcharge Bypass via Add-to-Cart Choice Field", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-20 Improper Input Validation", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Advanced Product Fields (Product Addons) for WooCommerce", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "1.6.22", + "lessThan": "1.7.4" + } + ], + "defaultStatus": "unaffected", + "collectionURL": "https://wordpress.org/plugins" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/e02cc0f2-9f10-4114-b9b5-1e1a2ae18355/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "Karthik Ramakrishnan", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/119xxx/CVE-2026-119302.json b/data/2026/119xxx/CVE-2026-119302.json new file mode 100644 index 0000000000..f334f58d24 --- /dev/null +++ b/data/2026/119xxx/CVE-2026-119302.json @@ -0,0 +1,94 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-119302", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-10-29T19:01:18.410Z", + "datePublished": "2026-11-11T07:33:08.165Z", + "dateUpdated": "2026-11-11T07:33:08.165Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-11T07:33:08.165Z" + }, + "title": "NotificationX < 3.3.7 - Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution via Notification Preview", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-862 Missing Authorization", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "NotificationX", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "3.3.7" + } + ], + "defaultStatus": "unaffected", + "collectionURL": "https://wordpress.org/plugins" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/e0264d07-668c-46f7-acab-0a7b59edb45f/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", + "baseScore": 6.5, + "baseSeverity": "MEDIUM" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "vuxvinh", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/121xxx/CVE-2026-121885.json b/data/2026/121xxx/CVE-2026-121885.json index 62ebc1c641..ce8b665f73 100644 --- a/data/2026/121xxx/CVE-2026-121885.json +++ b/data/2026/121xxx/CVE-2026-121885.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-11-04T11:15:46.453Z", "datePublished": "2026-11-10T14:34:31.734Z", - "dateUpdated": "2026-11-10T15:18:45.306Z" + "dateUpdated": "2026-11-11T08:05:52.838Z" }, "containers": { "cna": { @@ -48,6 +48,25 @@ } ], "affected": [ + { + "versions": [ + { + "status": "affected", + "version": "1.8.2", + "lessThan": "5.8.10", + "versionType": "semver" + }, + { + "status": "affected", + "version": "6.0.0", + "lessThan": "6.2.0", + "versionType": "semver" + } + ], + "packageName": "podman", + "collectionURL": "https://github.com/podman-container-tools/podman", + "defaultStatus": "unaffected" + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", @@ -114,6 +133,9 @@ "issue-tracking", "x_refsource_REDHAT" ] + }, + { + "url": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-55rm-rwr7-q2wr" } ], "datePublic": "2026-11-10T14:00:00.000Z", @@ -157,7 +179,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-10T14:34:31.734Z" + "dateUpdated": "2026-11-11T08:05:52.838Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/123xxx/CVE-2026-123659.json b/data/2026/123xxx/CVE-2026-123659.json new file mode 100644 index 0000000000..1dab165ed1 --- /dev/null +++ b/data/2026/123xxx/CVE-2026-123659.json @@ -0,0 +1,94 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-123659", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-06T08:56:42.658Z", + "datePublished": "2026-11-11T07:33:08.816Z", + "dateUpdated": "2026-11-11T07:33:08.816Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-11T07:33:08.816Z" + }, + "title": "ProfilePress < 4.17.6 - Unauthenticated Member Directory Role Restriction Bypass and User Meta Disclosure", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-863 Incorrect Authorization", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "ProfilePress", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "4.17.6" + } + ], + "defaultStatus": "unaffected", + "collectionURL": "https://wordpress.org/plugins" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover user meta values of listed users." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/01d27477-0971-4ca7-a285-39e81c3df648/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "vuxvinh", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123668.json b/data/2026/123xxx/CVE-2026-123668.json new file mode 100644 index 0000000000..dba568ebb8 --- /dev/null +++ b/data/2026/123xxx/CVE-2026-123668.json @@ -0,0 +1,94 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-123668", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-06T09:27:52.392Z", + "datePublished": "2026-11-11T07:33:09.445Z", + "dateUpdated": "2026-11-11T07:33:09.445Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-11T07:33:09.445Z" + }, + "title": "GetPaid 2.8.63 - 2.8.64 - Unauthenticated Payment Bypass via Fractional Item Quantity", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-1284 Improper Validation of Specified Quantity in Input", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "GetPaid", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "2.8.63", + "lessThan": "2.8.65" + } + ], + "defaultStatus": "unaffected", + "collectionURL": "https://wordpress.org/plugins" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/62c1a6ac-0f9f-4402-b72b-8b10ffe6989c/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "Aabideen Bangash", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/12xxx/CVE-2026-12062.json b/data/2026/12xxx/CVE-2026-12062.json new file mode 100644 index 0000000000..c19866ddb9 --- /dev/null +++ b/data/2026/12xxx/CVE-2026-12062.json @@ -0,0 +1,129 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-12062", + "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "state": "PUBLISHED", + "assignerShortName": "Zohocorp", + "dateReserved": "2026-06-12T06:37:10.058Z", + "datePublished": "2026-11-11T07:38:57.448Z", + "dateUpdated": "2026-11-11T07:38:57.448Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "shortName": "Zohocorp", + "dateUpdated": "2026-11-11T07:38:57.448Z" + }, + "title": "Authenticated SQL Injection", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-89", + "description": "CWE-89 – Improper Neutralization of Special Elements Used in an SQL Command", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-66", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-66 – SQL Injection" + } + ] + } + ], + "affected": [ + { + "vendor": "Zohocorp", + "product": "ADAudit Plus", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "8703", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "cpeApplicability": [ + { + "operator": "OR", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:zohocorp:adaudit_plus:*:*:*:*:*:*:*:*", + "versionStartIncluding": "0", + "versionEndExcluding": "8703" + } + ] + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "

Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API.

" + } + ] + } + ], + "references": [ + { + "url": "https://www.manageengine.com/products/active-directory-audit/cve-2026-12062.html" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseSeverity": "HIGH", + "baseScore": 8.8, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/12xxx/CVE-2026-12424.json b/data/2026/12xxx/CVE-2026-12424.json new file mode 100644 index 0000000000..216e8261e0 --- /dev/null +++ b/data/2026/12xxx/CVE-2026-12424.json @@ -0,0 +1,88 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-12424", + "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", + "state": "PUBLISHED", + "assignerShortName": "Wordfence", + "dateReserved": "2026-06-16T16:57:45.442Z", + "datePublished": "2026-11-11T07:26:40.463Z", + "dateUpdated": "2026-11-11T07:26:40.463Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", + "shortName": "Wordfence", + "dateUpdated": "2026-11-11T07:26:40.463Z" + }, + "affected": [ + { + "vendor": "n/a", + "product": "ARforms", + "versions": [ + { + "version": "0", + "status": "affected", + "lessThanOrEqual": "7.2.4", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The arf_save_incomplete_form_data() AJAX handler is registered with wp_ajax_nopriv_, meaning unauthenticated attackers can store a malicious payload by submitting a partial form entry with a forged Referer header, with no authentication required at any step." + } + ], + "title": "ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer Header", + "references": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/23a50221-af0c-46e6-94d5-1d07f6b6fb01?source=cve" + }, + { + "url": "https://www.arformsplugin.com/documentation/changelog/" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-79 Improper Neutralization of Input During Web Page Generation", + "cweId": "CWE-79", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", + "baseScore": 7.2, + "baseSeverity": "HIGH" + } + } + ], + "credits": [ + { + "lang": "en", + "type": "finder", + "value": "Huynh Pham Thanh Luc" + } + ], + "timeline": [ + { + "time": "2026-11-10T19:05:30.000Z", + "lang": "en", + "value": "Disclosed" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/12xxx/CVE-2026-12427.json b/data/2026/12xxx/CVE-2026-12427.json new file mode 100644 index 0000000000..7e31293f47 --- /dev/null +++ b/data/2026/12xxx/CVE-2026-12427.json @@ -0,0 +1,88 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-12427", + "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", + "state": "PUBLISHED", + "assignerShortName": "Wordfence", + "dateReserved": "2026-06-16T17:06:18.591Z", + "datePublished": "2026-11-11T07:26:40.857Z", + "dateUpdated": "2026-11-11T07:26:40.857Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", + "shortName": "Wordfence", + "dateUpdated": "2026-11-11T07:26:40.857Z" + }, + "affected": [ + { + "vendor": "n/a", + "product": "ARforms", + "versions": [ + { + "version": "0", + "status": "affected", + "lessThanOrEqual": "7.2.4", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is deserialized via maybe_unserialize() when an administrator views the affected entry; if the attacker's array contains a 'referrer' key, the attacker-controlled page_url and http_referrer values are used as-is and rendered unescaped into the admin entry detail view." + } + ], + "title": "ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter", + "references": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/50ad2e66-7708-44cd-945e-9833138520ac?source=cve" + }, + { + "url": "https://www.arformsplugin.com/documentation/changelog/" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-79 Improper Neutralization of Input During Web Page Generation", + "cweId": "CWE-79", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", + "baseScore": 7.2, + "baseSeverity": "HIGH" + } + } + ], + "credits": [ + { + "lang": "en", + "type": "finder", + "value": "Huynh Pham Thanh Luc" + } + ], + "timeline": [ + { + "time": "2026-11-10T19:03:56.000Z", + "lang": "en", + "value": "Disclosed" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/15xxx/CVE-2026-15785.json b/data/2026/15xxx/CVE-2026-15785.json new file mode 100644 index 0000000000..537608ce49 --- /dev/null +++ b/data/2026/15xxx/CVE-2026-15785.json @@ -0,0 +1,112 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-15785", + "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", + "state": "PUBLISHED", + "assignerShortName": "Wordfence", + "dateReserved": "2026-07-14T19:10:47.225Z", + "datePublished": "2026-11-11T07:26:39.942Z", + "dateUpdated": "2026-11-11T07:26:39.942Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", + "shortName": "Wordfence", + "dateUpdated": "2026-11-11T07:26:39.942Z" + }, + "affected": [ + { + "vendor": "creapuntome", + "product": "Joinchat – Enhanced “click to chat”", + "versions": [ + { + "version": "0", + "status": "affected", + "lessThanOrEqual": "6.3.1", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Joinchat – Enhanced \"click to chat\" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable via Query Parameter Name in all versions up to, and including, 6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that an administrator has configured a telephone number and included the {HREF} dynamic variable in the Call-to-Action text." + } + ], + "title": "Joinchat <= 6.3.1 - Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable", + "references": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1dcf9af8-efdd-4f43-8d33-e62290c81ddd?source=cve" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/creame-whatsapp-me/tags/6.3.1/public/partials/html.php#L46" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/creame-whatsapp-me/tags/6.3.1/includes/class-joinchat-util.php#L344" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/creame-whatsapp-me/tags/6.3.1/includes/class-joinchat-util.php#L272" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/creame-whatsapp-me/tags/6.3.1/public/class-joinchat-public.php#L381" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/creame-whatsapp-me/tags/6.2.3/public/partials/html.php#L46" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/creame-whatsapp-me/tags/6.2.3/includes/class-joinchat-util.php#L344" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/creame-whatsapp-me/tags/6.2.3/includes/class-joinchat-util.php#L272" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/creame-whatsapp-me/tags/6.2.3/public/class-joinchat-public.php#L381" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3656273%40creame-whatsapp-me%2Ftags%2F6.3.2&old=3607156%40creame-whatsapp-me%2Ftags%2F6.3.1" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-79 Improper Neutralization of Input During Web Page Generation", + "cweId": "CWE-79", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "baseScore": 6.1, + "baseSeverity": "MEDIUM" + } + } + ], + "credits": [ + { + "lang": "en", + "type": "finder", + "value": "刀 妖" + } + ], + "timeline": [ + { + "time": "2026-11-10T19:25:00.000Z", + "lang": "en", + "value": "Disclosed" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/76xxx/CVE-2026-76981.json b/data/2026/76xxx/CVE-2026-76981.json new file mode 100644 index 0000000000..c0c903db6f --- /dev/null +++ b/data/2026/76xxx/CVE-2026-76981.json @@ -0,0 +1,129 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-76981", + "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "state": "PUBLISHED", + "assignerShortName": "Zohocorp", + "dateReserved": "2026-08-20T06:37:08.876Z", + "datePublished": "2026-11-11T07:29:50.300Z", + "dateUpdated": "2026-11-11T07:29:50.300Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "shortName": "Zohocorp", + "dateUpdated": "2026-11-11T07:29:50.300Z" + }, + "title": "Authenticated Second-Order SQL Injection", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-89", + "description": "CWE-89 – Improper Neutralization of Special Elements Used in an SQL Command", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-66", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-66 – SQL Injection" + } + ] + } + ], + "affected": [ + { + "vendor": "Zohocorp", + "product": "ADAudit Plus", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "8711", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "cpeApplicability": [ + { + "operator": "OR", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:zohocorp:adaudit_plus:*:*:*:*:*:*:*:*", + "versionStartIncluding": "0", + "versionEndExcluding": "8711" + } + ] + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "

Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module.

" + } + ] + } + ], + "references": [ + { + "url": "https://www.manageengine.com/log-management/advisory/CVE-2026-92905.html" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseSeverity": "HIGH", + "baseScore": 8.8, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/92xxx/CVE-2026-92408.json b/data/2026/92xxx/CVE-2026-92408.json new file mode 100644 index 0000000000..7eee754ac8 --- /dev/null +++ b/data/2026/92xxx/CVE-2026-92408.json @@ -0,0 +1,94 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-92408", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-09-16T09:04:56.221Z", + "datePublished": "2026-11-11T07:33:10.080Z", + "dateUpdated": "2026-11-11T07:33:10.080Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-11T07:33:10.080Z" + }, + "title": "WPS Bookings for WooCommerce < 3.13.1 - Unauthenticated Price Manipulation via booking_price", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-472 External Control of Assumed-Immutable Web Parameter", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "WPS Bookings for WooCommerce", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "3.13.1" + } + ], + "defaultStatus": "unaffected", + "collectionURL": "https://wordpress.org/plugins" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/c40ea3c8-2062-4b4e-a3aa-65b47291725e/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "Profon3", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/92xxx/CVE-2026-92905.json b/data/2026/92xxx/CVE-2026-92905.json index 88abb3fd9b..39bc5d7139 100644 --- a/data/2026/92xxx/CVE-2026-92905.json +++ b/data/2026/92xxx/CVE-2026-92905.json @@ -8,23 +8,23 @@ "assignerShortName": "Zohocorp", "dateReserved": "2026-09-17T11:00:43.249Z", "datePublished": "2026-09-24T09:10:29.996Z", - "dateUpdated": "2026-09-24T12:42:23.459Z" + "dateUpdated": "2026-11-11T07:22:14.443Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "Zohocorp", - "dateUpdated": "2026-09-24T09:10:29.996Z" + "dateUpdated": "2026-11-11T07:22:14.443Z" }, - "title": "Denial of Service Vulnerability", + "title": "Denial of Service (DoS)", "problemTypes": [ { "descriptions": [ { "lang": "en", - "cweId": "CWE-248", - "description": "CWE-248 Uncaught exception", + "cweId": "CWE-122", + "description": "CWE-122 – Heap-based Buffer Overflow", "type": "CWE" } ] @@ -32,11 +32,11 @@ ], "impacts": [ { - "capecId": "CAPEC-125", + "capecId": "CAPEC-100", "descriptions": [ { "lang": "en", - "value": "CAPEC-125 Flooding" + "value": "CAPEC-100 – Overflow Buffers" } ] } @@ -44,7 +44,7 @@ "affected": [ { "vendor": "Zohocorp", - "product": "ManageEngine EventLog Analyzer", + "product": "Log360", "versions": [ { "status": "affected", @@ -57,7 +57,7 @@ }, { "vendor": "Zohocorp", - "product": "ManageEngine Log360", + "product": "EventLog Analyzer", "versions": [ { "status": "affected", @@ -79,7 +79,7 @@ "cpeMatch": [ { "vulnerable": true, - "criteria": "cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:*:*:*:*:*:*:*:*", + "criteria": "cpe:2.3:a:zohocorp:log360:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "13071" } @@ -91,7 +91,7 @@ "cpeMatch": [ { "vulnerable": true, - "criteria": "cpe:2.3:a:zohocorp:manageengine_log360:*:*:*:*:*:*:*:*", + "criteria": "cpe:2.3:a:zohocorp:eventlog_analyzer:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "13071" } @@ -103,12 +103,12 @@ "descriptions": [ { "lang": "en", - "value": "ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector using malformed syslog packets.", + "value": "Zoho Corporation ManageEngine EventLog Analyzer and Log360 versions below 13071 are vulnerable to a denial-of-service (DoS) vulnerability in the log collector component.", "supportingMedia": [ { "type": "text/html", "base64": false, - "value": "ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector using malformed syslog packets." + "value": "

Zoho Corporation ManageEngine EventLog Analyzer and Log360 versions below 13071 are vulnerable to a denial-of-service (DoS) vulnerability in the log collector component. 

" } ] } diff --git a/data/2026/93xxx/CVE-2026-93487.json b/data/2026/93xxx/CVE-2026-93487.json new file mode 100644 index 0000000000..79b9407305 --- /dev/null +++ b/data/2026/93xxx/CVE-2026-93487.json @@ -0,0 +1,125 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-93487", + "assignerOrgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272", + "state": "PUBLISHED", + "assignerShortName": "Octopus", + "dateReserved": "2026-09-18T06:18:08.082Z", + "datePublished": "2026-11-11T07:21:42.968Z", + "dateUpdated": "2026-11-11T07:21:42.968Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272", + "shortName": "Octopus", + "dateUpdated": "2026-11-11T07:21:42.968Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-863", + "description": "CWE-863: Incorrect Authorization", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Octopus Deploy", + "product": "Octopus Server", + "platforms": [ + "Windows", + "Linux" + ], + "versions": [ + { + "status": "affected", + "version": "2019.11.0", + "lessThan": "2026.2.13487", + "versionType": "custom" + }, + { + "status": "affected", + "version": "2026.3.0", + "lessThan": "2026.3.15863", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform." + } + ] + } + ], + "references": [ + { + "url": "https://advisories.octopus.com/post/2026/sa2026-20" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "HIGH", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "LOW", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 7.1, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "This vulnerability was found by Nathan Willoughby", + "type": "finder" + } + ], + "source": { + "discovery": "INTERNAL" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/delta.json b/data/delta.json index 6c8ad68bc0..1c24d6f493 100644 --- a/data/delta.json +++ b/data/delta.json @@ -1,19 +1,13 @@ { - "fetchTime": "2026-11-11T07:15:18.147Z", - "numberOfChanges": 2, + "fetchTime": "2026-11-11T08:11:04.661Z", + "numberOfChanges": 1, "new": [], "updated": [ { - "cveId": "CVE-2026-18912", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18912", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18912.json", - "dateUpdated": "2026-11-11T07:07:56.229Z" - }, - { - "cveId": "CVE-2026-96414", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96414", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96414.json", - "dateUpdated": "2026-11-11T07:03:53.880Z" + "cveId": "CVE-2026-121885", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121885", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121885.json", + "dateUpdated": "2026-11-11T08:05:52.838Z" } ], "error": [] diff --git a/data/deltaLog.json b/data/deltaLog.json index c6d6252385..0bf39e5aa1 100644 --- a/data/deltaLog.json +++ b/data/deltaLog.json @@ -1,4 +1,184 @@ [ + { + "fetchTime": "2026-11-11T08:11:04.661Z", + "numberOfChanges": 1, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-121885", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121885", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121885.json", + "dateUpdated": "2026-11-11T08:05:52.838Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T07:58:37.268Z", + "numberOfChanges": 1, + "new": [ + { + "cveId": "CVE-2026-116468", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-116468", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116468.json", + "dateUpdated": "2026-11-11T07:57:21.958Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T07:52:38.887Z", + "numberOfChanges": 1, + "new": [ + { + "cveId": "CVE-2025-59847", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-59847", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/59xxx/CVE-2025-59847.json", + "dateUpdated": "2026-11-11T07:48:51.436Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T07:47:01.998Z", + "numberOfChanges": 1, + "new": [ + { + "cveId": "CVE-2025-59848", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-59848", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/59xxx/CVE-2025-59848.json", + "dateUpdated": "2026-11-11T07:41:08.937Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T07:40:51.570Z", + "numberOfChanges": 1, + "new": [ + { + "cveId": "CVE-2026-12062", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-12062", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12062.json", + "dateUpdated": "2026-11-11T07:38:57.448Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T07:34:52.948Z", + "numberOfChanges": 7, + "new": [ + { + "cveId": "CVE-2026-119171", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119171", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119171.json", + "dateUpdated": "2026-11-11T07:33:06.987Z" + }, + { + "cveId": "CVE-2026-119302", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119302", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119302.json", + "dateUpdated": "2026-11-11T07:33:08.165Z" + }, + { + "cveId": "CVE-2026-123659", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123659", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123659.json", + "dateUpdated": "2026-11-11T07:33:08.816Z" + }, + { + "cveId": "CVE-2026-123668", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123668", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123668.json", + "dateUpdated": "2026-11-11T07:33:09.445Z" + }, + { + "cveId": "CVE-2026-76981", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76981", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76981.json", + "dateUpdated": "2026-11-11T07:29:50.300Z" + }, + { + "cveId": "CVE-2026-92408", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92408", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92408.json", + "dateUpdated": "2026-11-11T07:33:10.080Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-121885", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121885", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121885.json", + "dateUpdated": "2026-11-11T07:31:54.478Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T07:28:30.449Z", + "numberOfChanges": 5, + "new": [ + { + "cveId": "CVE-2026-105948", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105948", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105948.json", + "dateUpdated": "2026-11-11T07:27:40.806Z" + }, + { + "cveId": "CVE-2026-111190", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-111190", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111190.json", + "dateUpdated": "2026-11-11T07:26:41.208Z" + }, + { + "cveId": "CVE-2026-12424", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-12424", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12424.json", + "dateUpdated": "2026-11-11T07:26:40.463Z" + }, + { + "cveId": "CVE-2026-12427", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-12427", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12427.json", + "dateUpdated": "2026-11-11T07:26:40.857Z" + }, + { + "cveId": "CVE-2026-15785", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-15785", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15785.json", + "dateUpdated": "2026-11-11T07:26:39.942Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T07:22:35.941Z", + "numberOfChanges": 2, + "new": [ + { + "cveId": "CVE-2026-93487", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-93487", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93487.json", + "dateUpdated": "2026-11-11T07:21:42.968Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-92905", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92905", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92905.json", + "dateUpdated": "2026-11-11T07:22:14.443Z" + } + ], + "error": [] + }, { "fetchTime": "2026-11-11T07:15:18.147Z", "numberOfChanges": 2, @@ -832878,149 +833058,5 @@ } ], "error": [] - }, - { - "fetchTime": "2026-10-12T08:03:19.072Z", - "numberOfChanges": 17, - "new": [ - { - "cveId": "CVE-2026-103356", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103356", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103356.json", - "dateUpdated": "2026-10-12T07:46:53.010Z" - }, - { - "cveId": "CVE-2026-106605", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106605", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106605.json", - "dateUpdated": "2026-10-12T07:45:21.300Z" - }, - { - "cveId": "CVE-2026-107427", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107427", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107427.json", - "dateUpdated": "2026-10-12T07:45:35.583Z" - }, - { - "cveId": "CVE-2026-107429", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107429", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107429.json", - "dateUpdated": "2026-10-12T07:45:57.540Z" - }, - { - "cveId": "CVE-2026-107430", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107430", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107430.json", - "dateUpdated": "2026-10-12T07:45:32.370Z" - }, - { - "cveId": "CVE-2026-107432", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107432", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107432.json", - "dateUpdated": "2026-10-12T07:48:12.778Z" - }, - { - "cveId": "CVE-2026-108812", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108812", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108812.json", - "dateUpdated": "2026-10-12T07:30:16.731Z" - }, - { - "cveId": "CVE-2026-108813", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108813", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108813.json", - "dateUpdated": "2026-10-12T07:45:10.238Z" - }, - { - "cveId": "CVE-2026-108814", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108814", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108814.json", - "dateUpdated": "2026-10-12T08:00:15.600Z" - } - ], - "updated": [ - { - "cveId": "CVE-2026-11837", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-11837", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/11xxx/CVE-2026-11837.json", - "dateUpdated": "2026-10-12T07:54:32.139Z" - }, - { - "cveId": "CVE-2026-12894", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-12894", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12894.json", - "dateUpdated": "2026-10-12T07:51:37.912Z" - }, - { - "cveId": "CVE-2026-17615", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17615", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17615.json", - "dateUpdated": "2026-10-12T07:51:43.760Z" - }, - { - "cveId": "CVE-2026-55653", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-55653", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/55xxx/CVE-2026-55653.json", - "dateUpdated": "2026-10-12T07:58:08.718Z" - }, - { - "cveId": "CVE-2026-55655", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-55655", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/55xxx/CVE-2026-55655.json", - "dateUpdated": "2026-10-12T07:58:12.392Z" - }, - { - "cveId": "CVE-2026-79992", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-79992", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/79xxx/CVE-2026-79992.json", - "dateUpdated": "2026-10-12T07:54:44.479Z" - }, - { - "cveId": "CVE-2026-96275", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96275", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96275.json", - "dateUpdated": "2026-10-12T07:55:38.743Z" - }, - { - "cveId": "CVE-2026-96280", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96280", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96280.json", - "dateUpdated": "2026-10-12T07:59:21.438Z" - } - ], - "error": [] - }, - { - "fetchTime": "2026-10-12T07:26:01.896Z", - "numberOfChanges": 4, - "new": [ - { - "cveId": "CVE-2026-108810", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108810", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108810.json", - "dateUpdated": "2026-10-12T07:00:16.857Z" - }, - { - "cveId": "CVE-2026-108811", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108811", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108811.json", - "dateUpdated": "2026-10-12T07:15:18.816Z" - } - ], - "updated": [ - { - "cveId": "CVE-2026-109082", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109082", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109082.json", - "dateUpdated": "2026-10-12T07:12:27.872Z" - }, - { - "cveId": "CVE-2026-15581", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-15581", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15581.json", - "dateUpdated": "2026-10-12T07:11:35.619Z" - } - ], - "error": [] } ] \ No newline at end of file diff --git a/state/sync.json b/state/sync.json index 081d76bbe6..a36eb73b9a 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1,7 +1,7 @@ { "source": "https://github.com/CVEProject/cvelistV5.git", - "upstream_commit": "4fa4da5e15eb0364685f992f641114e22f10214a", + "upstream_commit": "2a64647fb47b795182264decd4abb7f7f43c4932", "since_year": 2017, - "records": 330841, - "synced_at_utc": "2026-11-11T07:35:58.504531+00:00" + "records": 330857, + "synced_at_utc": "2026-11-11T08:34:22.422799+00:00" }