From 6f794ca4bbedd23f006511567c4dbb5fd914885e Mon Sep 17 00:00:00 2001 From: Vulnerability Bot Date: Sat, 14 Nov 2026 10:31:24 +0100 Subject: [PATCH] CVE sync 2026-11-14T09:31:19Z --- data/2026/18xxx/CVE-2026-18742.json | 88 +++++++++++ data/delta.json | 14 +- data/deltaLog.json | 230 ++-------------------------- state/sync.json | 6 +- 4 files changed, 112 insertions(+), 226 deletions(-) create mode 100644 data/2026/18xxx/CVE-2026-18742.json diff --git a/data/2026/18xxx/CVE-2026-18742.json b/data/2026/18xxx/CVE-2026-18742.json new file mode 100644 index 0000000000..55caa80ff6 --- /dev/null +++ b/data/2026/18xxx/CVE-2026-18742.json @@ -0,0 +1,88 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-18742", + "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", + "state": "PUBLISHED", + "assignerShortName": "Wordfence", + "dateReserved": "2026-08-03T21:12:09.895Z", + "datePublished": "2026-11-14T08:31:34.753Z", + "dateUpdated": "2026-11-14T08:31:34.753Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", + "shortName": "Wordfence", + "dateUpdated": "2026-11-14T08:31:34.753Z" + }, + "affected": [ + { + "vendor": "UX-themes", + "product": "Flatsome", + "versions": [ + { + "version": "0", + "status": "affected", + "lessThanOrEqual": "3.20.12", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' Attributes via Custom HTML Block in all versions up to, and including, 3.20.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives server-side sanitization because wp_kses_post permits data-* attributes globally via _wp_add_global_attributes, allowing attacker-controlled values in data-text-sec, data-title, and title attributes to persist in saved post content and be later interpreted as HTML by the ux-countdown, scroll-to, and lightbox-gallery JavaScript behaviors." + } + ], + "title": "Flatsome <= 3.20.12 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' Attributes via Custom HTML Block", + "references": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6567c87-9e69-4e18-bea3-08d8aae23ef6?source=cve" + }, + { + "url": "https://themeforest.net/item/flatsome-multipurpose-responsive-woocommerce-theme/5484319#item-description__change-log" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-79 Improper Neutralization of Input During Web Page Generation", + "cweId": "CWE-79", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", + "baseScore": 6.4, + "baseSeverity": "MEDIUM" + } + } + ], + "credits": [ + { + "lang": "en", + "type": "finder", + "value": "Webbernaut" + } + ], + "timeline": [ + { + "time": "2026-11-13T19:42:31.000Z", + "lang": "en", + "value": "Disclosed" + } + ] + } + } +} \ No newline at end of file diff --git a/data/delta.json b/data/delta.json index e1edbe4b6b..c50c83b025 100644 --- a/data/delta.json +++ b/data/delta.json @@ -1,14 +1,14 @@ { - "fetchTime": "2026-11-14T07:43:11.684Z", + "fetchTime": "2026-11-14T08:34:34.622Z", "numberOfChanges": 1, - "new": [], - "updated": [ + "new": [ { - "cveId": "CVE-2026-84761", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84761", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84761.json", - "dateUpdated": "2026-11-14T07:41:35.639Z" + "cveId": "CVE-2026-18742", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18742", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18742.json", + "dateUpdated": "2026-11-14T08:31:34.753Z" } ], + "updated": [], "error": [] } \ No newline at end of file diff --git a/data/deltaLog.json b/data/deltaLog.json index 11847a0343..2bcac67b21 100644 --- a/data/deltaLog.json +++ b/data/deltaLog.json @@ -1,4 +1,18 @@ [ + { + "fetchTime": "2026-11-14T08:34:34.622Z", + "numberOfChanges": 1, + "new": [ + { + "cveId": "CVE-2026-18742", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18742", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18742.json", + "dateUpdated": "2026-11-14T08:31:34.753Z" + } + ], + "updated": [], + "error": [] + }, { "fetchTime": "2026-11-14T07:43:11.684Z", "numberOfChanges": 1, @@ -761312,221 +761326,5 @@ } ], "error": [] - }, - { - "fetchTime": "2026-10-15T08:29:07.370Z", - "numberOfChanges": 16, - "new": [ - { - "cveId": "CVE-2023-32198", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2023-32198", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32198.json", - "dateUpdated": "2026-10-15T08:22:47.085Z" - }, - { - "cveId": "CVE-2024-22031", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-22031", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/22xxx/CVE-2024-22031.json", - "dateUpdated": "2026-10-15T08:21:02.222Z" - }, - { - "cveId": "CVE-2025-23390", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-23390", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/23xxx/CVE-2025-23390.json", - "dateUpdated": "2026-10-15T08:16:46.096Z" - }, - { - "cveId": "CVE-2026-102461", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102461", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102461.json", - "dateUpdated": "2026-10-15T08:23:54.256Z" - }, - { - "cveId": "CVE-2026-102462", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102462", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102462.json", - "dateUpdated": "2026-10-15T08:09:36.396Z" - }, - { - "cveId": "CVE-2026-102463", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102463", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102463.json", - "dateUpdated": "2026-10-15T08:13:41.485Z" - }, - { - "cveId": "CVE-2026-102464", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102464", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102464.json", - "dateUpdated": "2026-10-15T08:26:02.688Z" - }, - { - "cveId": "CVE-2026-102466", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102466", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102466.json", - "dateUpdated": "2026-10-15T08:15:32.883Z" - }, - { - "cveId": "CVE-2026-102469", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102469", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102469.json", - "dateUpdated": "2026-10-15T08:11:33.465Z" - }, - { - "cveId": "CVE-2026-102477", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102477", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102477.json", - "dateUpdated": "2026-10-15T08:28:25.876Z" - }, - { - "cveId": "CVE-2026-103223", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103223", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103223.json", - "dateUpdated": "2026-10-15T08:20:03.749Z" - }, - { - "cveId": "CVE-2026-103224", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103224", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103224.json", - "dateUpdated": "2026-10-15T08:22:18.498Z" - }, - { - "cveId": "CVE-2026-105271", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105271", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105271.json", - "dateUpdated": "2026-10-15T08:24:18.191Z" - }, - { - "cveId": "CVE-2026-109855", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109855", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109855.json", - "dateUpdated": "2026-10-15T08:12:51.245Z" - }, - { - "cveId": "CVE-2026-75559", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75559", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75559.json", - "dateUpdated": "2026-10-15T08:28:39.457Z" - }, - { - "cveId": "CVE-2026-96614", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96614", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96614.json", - "dateUpdated": "2026-10-15T08:25:39.167Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-15T08:00:56.051Z", - "numberOfChanges": 15, - "new": [], - "updated": [ - { - "cveId": "CVE-2025-29895", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-29895", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29895.json", - "dateUpdated": "2026-10-15T07:55:17.783Z" - }, - { - "cveId": "CVE-2025-29896", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-29896", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29896.json", - "dateUpdated": "2026-10-15T07:55:26.848Z" - }, - { - "cveId": "CVE-2025-29897", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-29897", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29897.json", - "dateUpdated": "2026-10-15T07:55:36.456Z" - }, - { - "cveId": "CVE-2025-62850", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-62850", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/62xxx/CVE-2025-62850.json", - "dateUpdated": "2026-10-15T07:55:45.679Z" - }, - { - "cveId": "CVE-2025-66272", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-66272", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66272.json", - "dateUpdated": "2026-10-15T07:55:56.157Z" - }, - { - "cveId": "CVE-2025-66275", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-66275", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66275.json", - "dateUpdated": "2026-10-15T07:56:07.507Z" - }, - { - "cveId": "CVE-2025-68403", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-68403", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68403.json", - "dateUpdated": "2026-10-15T07:56:18.547Z" - }, - { - "cveId": "CVE-2026-22896", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-22896", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22896.json", - "dateUpdated": "2026-10-15T07:56:30.453Z" - }, - { - "cveId": "CVE-2026-24715", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-24715", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24715.json", - "dateUpdated": "2026-10-15T07:56:40.898Z" - }, - { - "cveId": "CVE-2026-24718", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-24718", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24718.json", - "dateUpdated": "2026-10-15T07:56:58.919Z" - }, - { - "cveId": "CVE-2026-24721", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-24721", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24721.json", - "dateUpdated": "2026-10-15T07:57:09.186Z" - }, - { - "cveId": "CVE-2026-24722", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-24722", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24722.json", - "dateUpdated": "2026-10-15T07:57:19.414Z" - }, - { - "cveId": "CVE-2026-24723", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-24723", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24723.json", - "dateUpdated": "2026-10-15T07:57:29.173Z" - }, - { - "cveId": "CVE-2026-39993", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-39993", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39993.json", - "dateUpdated": "2026-10-15T07:57:39.832Z" - }, - { - "cveId": "CVE-2026-41544", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-41544", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41544.json", - "dateUpdated": "2026-10-15T07:57:51.093Z" - } - ], - "error": [] - }, - { - "fetchTime": "2026-10-15T07:46:40.787Z", - "numberOfChanges": 1, - "new": [ - { - "cveId": "CVE-2026-108092", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108092", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108092.json", - "dateUpdated": "2026-10-15T07:42:37.119Z" - } - ], - "updated": [], - "error": [] } ] \ No newline at end of file diff --git a/state/sync.json b/state/sync.json index 43fd2a1acd..6daef4934d 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1,7 +1,7 @@ { "source": "https://github.com/CVEProject/cvelistV5.git", - "upstream_commit": "d08feb04223b8e7005b4056a61aea76e581ef416", + "upstream_commit": "eb0c25067b3bc03b5800a5af8b0a5c90e4c48b17", "since_year": 2017, - "records": 332571, - "synced_at_utc": "2026-11-14T08:26:48.533141+00:00" + "records": 332572, + "synced_at_utc": "2026-11-14T09:25:55.095768+00:00" }