diff --git a/data/2026/106xxx/CVE-2026-106027.json b/data/2026/106xxx/CVE-2026-106027.json new file mode 100644 index 0000000000..4abab37466 --- /dev/null +++ b/data/2026/106xxx/CVE-2026-106027.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-106027", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-10-06T13:14:08.045Z", + "datePublished": "2026-11-12T06:00:06.145Z", + "dateUpdated": "2026-11-12T06:00:06.145Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:06.145Z" + }, + "title": "Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-862 Missing Authorization", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Oxygen MyData for WooCommerce", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "3.0.0", + "lessThan": "3.0.9" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/6f364114-e016-4c60-9ced-5b726d84bc19/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Naoki Kawahigashi", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/107xxx/CVE-2026-107935.json b/data/2026/107xxx/CVE-2026-107935.json index 9a7b97896b..9272eb544c 100644 --- a/data/2026/107xxx/CVE-2026-107935.json +++ b/data/2026/107xxx/CVE-2026-107935.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-09T08:27:11.041Z", "datePublished": "2026-10-09T09:05:43.726Z", - "dateUpdated": "2026-11-04T21:42:04.826Z" + "dateUpdated": "2026-11-12T05:58:41.476Z" }, "containers": { "cna": { @@ -236,7 +236,7 @@ "product": "Red Hat OpenShift Dev Spaces", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "devspaces/udi-base-rhel10", - "defaultStatus": "affected", + "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:openshift_devspaces:3" ] @@ -310,7 +310,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-04T21:42:04.826Z" + "dateUpdated": "2026-11-12T05:58:41.476Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/108xxx/CVE-2026-108094.json b/data/2026/108xxx/CVE-2026-108094.json index fc26aa1019..6ff41de04e 100644 --- a/data/2026/108xxx/CVE-2026-108094.json +++ b/data/2026/108xxx/CVE-2026-108094.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-09T13:14:56.844Z", "datePublished": "2026-10-12T14:43:09.674Z", - "dateUpdated": "2026-11-11T22:35:16.667Z" + "dateUpdated": "2026-11-12T05:28:41.514Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.3" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10.2 Extended Update Support", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "mutter", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:49.4-5.el10_2.5", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux_eus:10.2" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", @@ -106,6 +124,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99141", + "name": "RHSA-2026:99141", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-108094", "tags": [ @@ -163,7 +189,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T22:35:16.667Z" + "dateUpdated": "2026-11-12T05:28:41.514Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/110xxx/CVE-2026-110041.json b/data/2026/110xxx/CVE-2026-110041.json new file mode 100644 index 0000000000..ade4f46af6 --- /dev/null +++ b/data/2026/110xxx/CVE-2026-110041.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-110041", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-10-13T15:40:27.661Z", + "datePublished": "2026-11-12T06:00:06.327Z", + "dateUpdated": "2026-11-12T06:00:06.327Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:06.327Z" + }, + "title": "Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-639 Authorization Bypass Through User-Controlled Key", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Crop Thumbnails", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "1.10.0" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/f79fa2e0-ebba-4075-84d9-b5fadfbd6ca4/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Pedro Pinho", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/110xxx/CVE-2026-110072.json b/data/2026/110xxx/CVE-2026-110072.json new file mode 100644 index 0000000000..0710644c25 --- /dev/null +++ b/data/2026/110xxx/CVE-2026-110072.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-110072", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-10-13T15:54:22.141Z", + "datePublished": "2026-11-12T06:00:06.497Z", + "dateUpdated": "2026-11-12T06:00:06.497Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:06.497Z" + }, + "title": "Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attribute", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-79 Cross-Site Scripting (XSS)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Photo Gallery by 10Web", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "1.8.49" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/6bf17a5c-21c4-4e0e-b0a4-aee18c9820f1/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Karthik Ramakrishnan", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/110xxx/CVE-2026-110959.json b/data/2026/110xxx/CVE-2026-110959.json new file mode 100644 index 0000000000..6480e2c040 --- /dev/null +++ b/data/2026/110xxx/CVE-2026-110959.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-110959", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-10-15T09:31:25.187Z", + "datePublished": "2026-11-12T06:00:06.674Z", + "dateUpdated": "2026-11-12T06:00:06.674Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:06.674Z" + }, + "title": "Descope < 1.2.0 - Unauthenticated Account Takeover", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-287 Improper Authentication", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Descope", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "1.2.0" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/8b97f139-cbc3-4913-b69a-a3179f4cc264/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Muni Nitish Kumar Yaddala", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/115xxx/CVE-2026-115207.json b/data/2026/115xxx/CVE-2026-115207.json index 4a44423219..818cda381a 100644 --- a/data/2026/115xxx/CVE-2026-115207.json +++ b/data/2026/115xxx/CVE-2026-115207.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-22T07:11:53.976Z", "datePublished": "2026-10-22T10:16:12.930Z", - "dateUpdated": "2026-11-09T16:42:00.353Z" + "dateUpdated": "2026-11-12T05:52:52.873Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:8::baseos" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 9.8 Extended Update Support", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "patch", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.7.6-16.el9_8.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:rhel_eus:9.8::appstream" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", @@ -126,6 +144,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99161", + "name": "RHSA-2026:99161", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-115207", "tags": [ @@ -183,7 +209,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T16:42:00.353Z" + "dateUpdated": "2026-11-12T05:52:52.873Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/117xxx/CVE-2026-117477.json b/data/2026/117xxx/CVE-2026-117477.json index eab4090e4d..c56733ff82 100644 --- a/data/2026/117xxx/CVE-2026-117477.json +++ b/data/2026/117xxx/CVE-2026-117477.json @@ -8,60 +8,21 @@ "assignerShortName": "jpcert", "dateReserved": "2026-10-27T06:16:54.712Z", "datePublished": "2026-11-09T23:22:12.476Z", - "dateUpdated": "2026-11-09T23:22:12.476Z" + "dateUpdated": "2026-11-12T05:44:32.062Z" }, "containers": { "cna": { "affected": [ { "vendor": "GMO Prime Strategy Co., Ltd.", - "product": "KUSANAGI 7 Security Edition", + "product": "KUSANAGI 7", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", - "lessThanOrEqual": "10.7.2-1" - } - ] - }, - { - "vendor": "GMO Prime Strategy Co., Ltd.", - "product": "KUSANAGI 7 Enterprise Edition", - "defaultStatus": "unaffected", - "versions": [ - { - "version": "0", - "status": "affected", - "versionType": "semver", - "lessThanOrEqual": "10.7.2-1" - } - ] - }, - { - "vendor": "GMO Prime Strategy Co., Ltd.", - "product": "KUSANAGI 8 Security Edition", - "defaultStatus": "unaffected", - "versions": [ - { - "version": "0", - "status": "affected", - "versionType": "semver", - "lessThanOrEqual": "10.7.2-1" - } - ] - }, - { - "vendor": "GMO Prime Strategy Co., Ltd.", - "product": "KUSANAGI 8 Enterprise Edition", - "defaultStatus": "unaffected", - "versions": [ - { - "version": "0", - "status": "affected", - "versionType": "semver", - "lessThanOrEqual": "10.7.2-1" + "lessThanOrEqual": "*" } ] }, @@ -91,45 +52,6 @@ } ] }, - { - "vendor": "GMO Prime Strategy Co., Ltd.", - "product": "KUSANAGI 7 Free Edition", - "defaultStatus": "unaffected", - "versions": [ - { - "version": "0", - "status": "affected", - "versionType": "semver", - "lessThanOrEqual": "9.12.2-1" - } - ] - }, - { - "vendor": "GMO Prime Strategy Co., Ltd.", - "product": "KUSANAGI 7 Business Edition", - "defaultStatus": "unaffected", - "versions": [ - { - "version": "0", - "status": "affected", - "versionType": "semver", - "lessThanOrEqual": "9.12.2-1" - } - ] - }, - { - "vendor": "GMO Prime Strategy Co., Ltd.", - "product": "KUSANAGI 7 Premium Edition", - "defaultStatus": "unaffected", - "versions": [ - { - "version": "0", - "status": "affected", - "versionType": "semver", - "lessThanOrEqual": "9.12.2-1" - } - ] - }, { "vendor": "GMO Prime Strategy Co., Ltd.", "product": "KUSANAGI 8 Free Edition", @@ -139,7 +61,7 @@ "version": "0", "status": "affected", "versionType": "semver", - "lessThanOrEqual": "9.12.2-1" + "lessThanOrEqual": "*" } ] }, @@ -152,7 +74,7 @@ "version": "0", "status": "affected", "versionType": "semver", - "lessThanOrEqual": "9.12.2-1" + "lessThanOrEqual": "*" } ] }, @@ -165,7 +87,7 @@ "version": "0", "status": "affected", "versionType": "semver", - "lessThanOrEqual": "9.12.2-1" + "lessThanOrEqual": "*" } ] }, @@ -270,7 +192,7 @@ "providerMetadata": { "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", - "dateUpdated": "2026-11-09T23:22:12.476Z" + "dateUpdated": "2026-11-12T05:44:32.062Z" } } } diff --git a/data/2026/118xxx/CVE-2026-118421.json b/data/2026/118xxx/CVE-2026-118421.json new file mode 100644 index 0000000000..36c3a59dd1 --- /dev/null +++ b/data/2026/118xxx/CVE-2026-118421.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-118421", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-10-28T04:42:38.158Z", + "datePublished": "2026-11-12T06:00:06.857Z", + "dateUpdated": "2026-11-12T06:00:06.857Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:06.857Z" + }, + "title": "WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-89 SQL Injection", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "WP Directory Kit", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "1.6.3" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on one of its admin screens before using it in a SQL statement, relying on a keyword deny-list whose replacement order can be bypassed, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/cb2c14ff-96bd-4731-bce2-346a904fc72b/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "anhdung1329", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/118xxx/CVE-2026-118531.json b/data/2026/118xxx/CVE-2026-118531.json new file mode 100644 index 0000000000..fcff06ac46 --- /dev/null +++ b/data/2026/118xxx/CVE-2026-118531.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-118531", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-10-28T15:32:14.950Z", + "datePublished": "2026-11-12T06:00:07.049Z", + "dateUpdated": "2026-11-12T06:00:07.049Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:07.049Z" + }, + "title": "Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-863 Incorrect Authorization", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Directorist: AI-Powered Business Directory, Listings & Classified Ads", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "8.11.1" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing moderation and publish their own pending listings." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/04ba942d-59f2-4e35-9d09-877f9bdd3606/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "vuxvinh", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/118xxx/CVE-2026-118597.json b/data/2026/118xxx/CVE-2026-118597.json new file mode 100644 index 0000000000..9bef41e187 --- /dev/null +++ b/data/2026/118xxx/CVE-2026-118597.json @@ -0,0 +1,232 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-118597", + "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", + "state": "PUBLISHED", + "assignerShortName": "Fluid Attacks", + "dateReserved": "2026-10-28T16:41:38.774Z", + "datePublished": "2026-11-12T06:09:34.999Z", + "dateUpdated": "2026-11-12T06:09:34.999Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", + "shortName": "Fluid Attacks", + "dateUpdated": "2026-11-12T06:09:34.999Z" + }, + "title": "Akaunting 3.3.0 - Stored XSS in custom invoice payment terms", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-79", + "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-592", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-592 Stored XSS" + } + ] + } + ], + "affected": [ + { + "vendor": "Akaunting", + "product": "Akaunting", + "platforms": [ + "Windows", + "MacOS", + "Linux" + ], + "repo": "https://github.com/akaunting/akaunting", + "versions": [ + { + "status": "affected", + "version": "3.3.0", + "versionType": "semver" + } + ], + "defaultStatus": "affected" + } + ], + "cpeApplicability": [ + { + "operator": "OR", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:akaunting:akaunting:3.3.0:*:windows:*:*:*:*:*" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:akaunting:akaunting:3.3.0:*:macos:*:*:*:*:*" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:akaunting:akaunting:3.3.0:*:linux:*:*:*:*:*" + } + ] + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin." + } + ] + } + ], + "references": [ + { + "url": "https://fluidattacks.com/advisories/rhiannon", + "tags": [ + "third-party-advisory" + ] + }, + { + "url": "https://github.com/akaunting/akaunting", + "tags": [ + "product" + ] + }, + { + "url": "https://github.com/akaunting/akaunting/blob/3.3.0/app/View/Components/Form/Group/PaymentTerm.php", + "tags": [ + "technical-description" + ] + }, + { + "url": "https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/group/payment_term.blade.php", + "tags": [ + "technical-description" + ] + }, + { + "url": "https://github.com/akaunting/akaunting/blob/3.3.0/app/Abstracts/Http/SettingController.php", + "tags": [ + "technical-description" + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "PRESENT", + "privilegesRequired": "HIGH", + "userInteraction": "PASSIVE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "HIGH", + "subIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 7.2, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N" + } + } + ], + "workarounds": [ + { + "lang": "en", + "value": "Use only predefined payment-term options, replace existing custom values, and restrict invoice-settings update access to trusted users until a vendor fix is available. Treat this as temporary mitigation rather than a fix.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Use only predefined payment-term options, replace existing custom values, and restrict invoice-settings update access to trusted users until a vendor fix is available. Treat this as temporary mitigation rather than a fix." + } + ] + } + ], + "solutions": [ + { + "lang": "en", + "value": "Use a JavaScript-safe serializer such as Laravel Js::from() or a framework data binding for the custom payment-term value; validate it as a bounded integer when it represents a number of days; apply the vendor-fixed release once one is published.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Use a JavaScript-safe serializer such as Laravel Js::from() or a framework data binding for the custom payment-term value; validate it as a bounded integer when it represents a number of days; apply the vendor-fixed release once one is published." + } + ] + } + ], + "timeline": [ + { + "time": "2026-10-27T14:00:00.000Z", + "lang": "en", + "value": "Vulnerability discovered" + }, + { + "time": "2026-10-28T21:51:00.000Z", + "lang": "en", + "value": "Vendor contacted" + }, + { + "time": "2026-11-12T06:08:00.000Z", + "lang": "en", + "value": "Public disclosure" + } + ], + "credits": [ + { + "lang": "en", + "value": "Fluid Attacks' AI SAST Scanner", + "type": "finder" + }, + { + "lang": "en", + "value": "Miguel Gómez", + "type": "finder" + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/119xxx/CVE-2026-119039.json b/data/2026/119xxx/CVE-2026-119039.json new file mode 100644 index 0000000000..9fae90ccb3 --- /dev/null +++ b/data/2026/119xxx/CVE-2026-119039.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-119039", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-10-29T11:41:45.920Z", + "datePublished": "2026-11-12T06:00:07.223Z", + "dateUpdated": "2026-11-12T06:00:07.223Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:07.223Z" + }, + "title": "Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-290 Authentication Bypass by Spoofing", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Defender Security", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "4.9.0", + "lessThan": "6.4.1" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/58a8fb54-7dc6-4749-9467-6ce19a13f0ed/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Karthik Ramakrishnan", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/119xxx/CVE-2026-119040.json b/data/2026/119xxx/CVE-2026-119040.json new file mode 100644 index 0000000000..c60b7bac01 --- /dev/null +++ b/data/2026/119xxx/CVE-2026-119040.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-119040", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-10-29T11:41:49.003Z", + "datePublished": "2026-11-12T06:00:07.503Z", + "dateUpdated": "2026-11-12T06:00:07.503Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:07.503Z" + }, + "title": "Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-287 Improper Authentication", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Defender Security", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "6.4.1" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/325f30c7-7ea9-48c8-a7fc-2644779e6ca6/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Karthik Ramakrishnan", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/119xxx/CVE-2026-119528.json b/data/2026/119xxx/CVE-2026-119528.json index 7af6766cda..d497c72fa1 100644 --- a/data/2026/119xxx/CVE-2026-119528.json +++ b/data/2026/119xxx/CVE-2026-119528.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-30T09:41:38.593Z", "datePublished": "2026-10-30T13:52:12.118Z", - "dateUpdated": "2026-11-11T12:35:24.492Z" + "dateUpdated": "2026-11-12T05:27:46.669Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/a:redhat:enterprise_linux:9::appstream" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 9.8 Extended Update Support", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gimp", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:3.0.4-4.el9_8.16", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:rhel_eus:9.8::appstream" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", @@ -116,6 +134,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99154", + "name": "RHSA-2026:99154", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-119528", "tags": [ @@ -176,7 +202,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:35:24.492Z" + "dateUpdated": "2026-11-12T05:27:46.669Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/121xxx/CVE-2026-121498.json b/data/2026/121xxx/CVE-2026-121498.json new file mode 100644 index 0000000000..dc55d284db --- /dev/null +++ b/data/2026/121xxx/CVE-2026-121498.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-121498", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-03T14:12:58.909Z", + "datePublished": "2026-11-12T06:00:07.678Z", + "dateUpdated": "2026-11-12T06:00:07.678Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:07.678Z" + }, + "title": "Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-639 Authorization Bypass Through User-Controlled Key", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "AskAny", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "2.2.1" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or changing it, allowing unauthenticated users who obtain or guess another visitor's session identifier to read that visitor's chat transcript, name, email address and IP address, and to add messages to their conversation or overwrite their details." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/0347e870-93ff-48d3-b100-6cd9ec0535bb/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Ryan Fabella", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/121xxx/CVE-2026-121629.json b/data/2026/121xxx/CVE-2026-121629.json index e1a27b536b..da6bc21489 100644 --- a/data/2026/121xxx/CVE-2026-121629.json +++ b/data/2026/121xxx/CVE-2026-121629.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-11-03T16:58:46.246Z", "datePublished": "2026-11-09T11:35:18.991Z", - "dateUpdated": "2026-11-11T13:58:59.979Z" + "dateUpdated": "2026-11-12T05:29:17.336Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.3" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10.2 Extended Update Support", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gstreamer1-plugins-good", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.26.7-2.el10_2.9", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux_eus:10.2" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", @@ -126,6 +144,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99140", + "name": "RHSA-2026:99140", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-121629", "tags": [ @@ -183,7 +209,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T13:58:59.979Z" + "dateUpdated": "2026-11-12T05:29:17.336Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/122xxx/CVE-2026-122003.json b/data/2026/122xxx/CVE-2026-122003.json new file mode 100644 index 0000000000..b8e0bd36ab --- /dev/null +++ b/data/2026/122xxx/CVE-2026-122003.json @@ -0,0 +1,93 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-122003", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-04T13:51:35.405Z", + "datePublished": "2026-11-12T06:00:08.273Z", + "dateUpdated": "2026-11-12T06:00:08.273Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:08.273Z" + }, + "title": "Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-352 Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Abilities Bridge", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "1.4.2" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and taking over the site, by tricking them into opening a crafted page (CSRF)." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/e421e862-8d7a-4df6-9c5e-dc06a466a0fc/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Enrico Marcolini", + "type": "finder" + }, + { + "lang": "en", + "value": "Claudio Marchesini", + "type": "finder" + }, + { + "lang": "en", + "value": "Dottor Marc", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123044.json b/data/2026/123xxx/CVE-2026-123044.json new file mode 100644 index 0000000000..45db085c77 --- /dev/null +++ b/data/2026/123xxx/CVE-2026-123044.json @@ -0,0 +1,93 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-123044", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-05T08:34:47.607Z", + "datePublished": "2026-11-12T06:00:08.453Z", + "dateUpdated": "2026-11-12T06:00:08.453Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:08.453Z" + }, + "title": "ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-79 Cross-Site Scripting (XSS)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "ContentPen", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "1.1.1" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/646b9448-ee17-4852-8f42-c086625e5983/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Enrico Marcolini", + "type": "finder" + }, + { + "lang": "en", + "value": "Claudio Marchesini", + "type": "finder" + }, + { + "lang": "en", + "value": "Dottor Marc", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123092.json b/data/2026/123xxx/CVE-2026-123092.json new file mode 100644 index 0000000000..bd11e20c1a --- /dev/null +++ b/data/2026/123xxx/CVE-2026-123092.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-123092", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-05T12:04:41.951Z", + "datePublished": "2026-11-12T06:00:08.632Z", + "dateUpdated": "2026-11-12T06:00:08.632Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:08.632Z" + }, + "title": "WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-269 Improper Privilege Management", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "WP Remote Users Sync", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "2.3.0" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/31ed11db-eb07-4628-8ad8-5b545c6f8fe0/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Turan Dadashzada", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124647.json b/data/2026/124xxx/CVE-2026-124647.json new file mode 100644 index 0000000000..be1e700b0a --- /dev/null +++ b/data/2026/124xxx/CVE-2026-124647.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-124647", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-09T08:28:10.809Z", + "datePublished": "2026-11-12T06:00:08.827Z", + "dateUpdated": "2026-11-12T06:00:08.827Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:08.827Z" + }, + "title": "TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-89 SQL Injection", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "TI WooCommerce Wishlist", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "2.0.7" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using it in a SQL statement in a front-end endpoint, allowing unauthenticated users to perform SQL injection attacks." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/d0119edb-2845-4106-a2bf-0ef28949ae32/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Seid Yassin Ali", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124648.json b/data/2026/124xxx/CVE-2026-124648.json new file mode 100644 index 0000000000..2a75fe396e --- /dev/null +++ b/data/2026/124xxx/CVE-2026-124648.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-124648", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-09T08:28:12.360Z", + "datePublished": "2026-11-12T06:00:08.998Z", + "dateUpdated": "2026-11-12T06:00:08.998Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:08.998Z" + }, + "title": "TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-863 Incorrect Authorization", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "TI WooCommerce Wishlist", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "2.13.0" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/528218ee-f437-4028-aae0-022435cbb66e/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Ángel Santana", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124652.json b/data/2026/124xxx/CVE-2026-124652.json new file mode 100644 index 0000000000..3eab543460 --- /dev/null +++ b/data/2026/124xxx/CVE-2026-124652.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-124652", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-09T08:41:42.253Z", + "datePublished": "2026-11-12T06:00:09.181Z", + "dateUpdated": "2026-11-12T06:00:09.181Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:09.181Z" + }, + "title": "Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-639 Authorization Bypass Through User-Controlled Key", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Mine CloudVod", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "2.6.6" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning its payment status, allowing any authenticated user, such as subscriber, to read other customers' order status, the purchased item and, while an Alipay payment is in progress, the buyer's Alipay account identifier." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/ed4ce4b8-a30b-443c-9b5a-b7415e30eb62/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Ryan Fabella", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124653.json b/data/2026/124xxx/CVE-2026-124653.json new file mode 100644 index 0000000000..23a2e3a663 --- /dev/null +++ b/data/2026/124xxx/CVE-2026-124653.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-124653", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-09T08:42:32.870Z", + "datePublished": "2026-11-12T06:00:09.357Z", + "dateUpdated": "2026-11-12T06:00:09.357Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:09.357Z" + }, + "title": "Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-200 Information Exposure", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Mine CloudVod", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "2.6.6" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencent Cloud COS and Dogecloud accounts and use them to upload or overwrite files in the site's storage." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/c476458c-215d-4056-bd82-06e59f0f84d4/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Hariom Singh", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124665.json b/data/2026/124xxx/CVE-2026-124665.json new file mode 100644 index 0000000000..092271b6ab --- /dev/null +++ b/data/2026/124xxx/CVE-2026-124665.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-124665", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-09T09:26:56.575Z", + "datePublished": "2026-11-12T06:00:09.578Z", + "dateUpdated": "2026-11-12T06:00:09.578Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:09.578Z" + }, + "title": "Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-639 Authorization Bypass Through User-Controlled Key", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Order Tracking", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "3.6.2" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the order history of every customer and sales representative, including order contact email addresses in some versions." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/9165da1e-76b7-4364-9fd7-67ccb96afc48/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Vũ Quang Huy", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124814.json b/data/2026/124xxx/CVE-2026-124814.json new file mode 100644 index 0000000000..3dac201b03 --- /dev/null +++ b/data/2026/124xxx/CVE-2026-124814.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-124814", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-09T13:15:45.770Z", + "datePublished": "2026-11-12T06:00:09.772Z", + "dateUpdated": "2026-11-12T06:00:09.772Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:09.772Z" + }, + "title": "Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Ultimate Addons for Elementor Forms", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "1.0.8" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/85f2e67b-4c6d-4817-9e4d-ef62a7ddb081/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Mike Gozdiskowski", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124815.json b/data/2026/124xxx/CVE-2026-124815.json new file mode 100644 index 0000000000..47a3695f2b --- /dev/null +++ b/data/2026/124xxx/CVE-2026-124815.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-124815", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-09T13:16:57.046Z", + "datePublished": "2026-11-12T06:00:09.952Z", + "dateUpdated": "2026-11-12T06:00:09.952Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:09.952Z" + }, + "title": "Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-89 SQL Injection", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Clockinator Lite", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "1.1.0" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/a7fe2ca1-ddfe-45fa-93e2-e0959ae29256/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Muni Nitish Kumar Yaddala", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124817.json b/data/2026/124xxx/CVE-2026-124817.json new file mode 100644 index 0000000000..a47a321ee6 --- /dev/null +++ b/data/2026/124xxx/CVE-2026-124817.json @@ -0,0 +1,93 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-124817", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-11-09T13:17:43.589Z", + "datePublished": "2026-11-12T06:00:10.134Z", + "dateUpdated": "2026-11-12T06:00:10.134Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:10.134Z" + }, + "title": "Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-284 Improper Access Control", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "Clockinator Lite", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "0", + "lessThan": "1.1.0" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/31b79fe5-89ee-4ccf-b3c4-48ab46fa499c/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Enrico Marcolini", + "type": "finder" + }, + { + "lang": "en", + "value": "Claudio Marchesini", + "type": "finder" + }, + { + "lang": "en", + "value": "Dottor Marc", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125704.json b/data/2026/125xxx/CVE-2026-125704.json index 88d0a9b6a6..e201747447 100644 --- a/data/2026/125xxx/CVE-2026-125704.json +++ b/data/2026/125xxx/CVE-2026-125704.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-11-10T10:24:52.013Z", "datePublished": "2026-11-10T10:43:20.844Z", - "dateUpdated": "2026-11-12T03:10:26.660Z" + "dateUpdated": "2026-11-12T05:33:27.502Z" }, "containers": { "cna": { @@ -48,6 +48,24 @@ } ], "affected": [ + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gstreamer1", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.26.7-5.el10_3.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -84,16 +102,6 @@ "cpe:/a:redhat:enterprise_linux:9::appstream" ] }, - { - "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 10", - "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", - "packageName": "gstreamer1", - "defaultStatus": "affected", - "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" - ] - }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", @@ -114,6 +122,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99129", + "name": "RHSA-2026:99129", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/errata/RHSA-2026:99228", "name": "RHSA-2026:99228", @@ -179,7 +195,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-12T03:10:26.660Z" + "dateUpdated": "2026-11-12T05:33:27.502Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/125xxx/CVE-2026-125712.json b/data/2026/125xxx/CVE-2026-125712.json index 9b50db0418..e10795cbf4 100644 --- a/data/2026/125xxx/CVE-2026-125712.json +++ b/data/2026/125xxx/CVE-2026-125712.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-11-10T10:37:49.396Z", "datePublished": "2026-11-10T11:22:59.567Z", - "dateUpdated": "2026-11-11T22:34:35.277Z" + "dateUpdated": "2026-11-12T05:33:28.967Z" }, "containers": { "cna": { @@ -48,6 +48,24 @@ } ], "affected": [ + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gstreamer1-plugins-base", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.26.7-4.el10_3.2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -84,16 +102,6 @@ "cpe:/a:redhat:enterprise_linux:9::appstream" ] }, - { - "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 10", - "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", - "packageName": "gstreamer1-plugins-base", - "defaultStatus": "affected", - "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" - ] - }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", @@ -142,6 +150,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99128", + "name": "RHSA-2026:99128", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-125712", "tags": [ @@ -196,7 +212,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T22:34:35.277Z" + "dateUpdated": "2026-11-12T05:33:28.967Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/33xxx/CVE-2026-33818.json b/data/2026/33xxx/CVE-2026-33818.json index 9dd3b6d45a..d0c2fd4ec5 100644 --- a/data/2026/33xxx/CVE-2026-33818.json +++ b/data/2026/33xxx/CVE-2026-33818.json @@ -8,14 +8,14 @@ "assignerShortName": "Go", "dateReserved": "2026-03-23T20:35:32.815Z", "datePublished": "2026-08-13T21:58:52.821Z", - "dateUpdated": "2026-11-11T23:22:46.596Z" + "dateUpdated": "2026-11-12T05:21:59.095Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", - "dateUpdated": "2026-11-11T23:22:46.596Z" + "dateUpdated": "2026-11-12T05:21:59.095Z" }, "title": "Enforce maximum recursion depth in encoding/asn1", "descriptions": [ diff --git a/data/2026/42xxx/CVE-2026-42504.json b/data/2026/42xxx/CVE-2026-42504.json index 16a392a68e..f06f749647 100644 --- a/data/2026/42xxx/CVE-2026-42504.json +++ b/data/2026/42xxx/CVE-2026-42504.json @@ -8,14 +8,14 @@ "assignerShortName": "Go", "dateReserved": "2026-04-28T00:21:12.792Z", "datePublished": "2026-06-02T22:01:37.219Z", - "dateUpdated": "2026-11-11T23:22:44.538Z" + "dateUpdated": "2026-11-12T05:21:57.482Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", - "dateUpdated": "2026-11-11T23:22:44.538Z" + "dateUpdated": "2026-11-12T05:21:57.482Z" }, "title": "Quadratic complexity in WordDecoder.DecodeHeader in mime", "descriptions": [ diff --git a/data/2026/43xxx/CVE-2026-43961.json b/data/2026/43xxx/CVE-2026-43961.json index 0f007909f5..b0e4fcec25 100644 --- a/data/2026/43xxx/CVE-2026-43961.json +++ b/data/2026/43xxx/CVE-2026-43961.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-05-04T18:07:21.843Z", "datePublished": "2026-08-19T14:06:09.120Z", - "dateUpdated": "2026-11-11T22:35:02.468Z" + "dateUpdated": "2026-11-12T05:33:31.532Z" }, "containers": { "cna": { @@ -118,6 +118,25 @@ "cpe:/o:redhat:enterprise_linux:8::baseos" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 9.8 Extended Update Support", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "vim", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:8.2.2637-44.el9_8", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:rhel_eus:9.8::appstream", + "cpe:/o:redhat:rhel_eus:9.8::baseos" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Hardened Images", @@ -242,6 +261,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99166", + "name": "RHSA-2026:99166", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-43961", "tags": [ @@ -302,7 +329,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T22:35:02.468Z" + "dateUpdated": "2026-11-12T05:33:31.532Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/76xxx/CVE-2026-76792.json b/data/2026/76xxx/CVE-2026-76792.json new file mode 100644 index 0000000000..96377e9254 --- /dev/null +++ b/data/2026/76xxx/CVE-2026-76792.json @@ -0,0 +1,83 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-76792", + "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "state": "PUBLISHED", + "assignerShortName": "WPScan", + "dateReserved": "2026-08-19T17:55:44.197Z", + "datePublished": "2026-11-12T06:00:10.307Z", + "dateUpdated": "2026-11-12T06:00:10.307Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", + "shortName": "WPScan", + "dateUpdated": "2026-11-12T06:00:10.307Z" + }, + "title": "User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-287 Improper Authentication", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Unknown", + "product": "User Verification by PickPlugins", + "versions": [ + { + "status": "affected", + "versionType": "semver", + "version": "2.0.38", + "lessThan": "2.0.49" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only." + } + ], + "references": [ + { + "url": "https://wpscan.com/vulnerability/e77de84b-3567-4ec6-a2dc-dce93c1fdc6f/", + "tags": [ + "exploit", + "vdb-entry", + "technical-description" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Revanth Hari Narayana Matte", + "type": "finder" + }, + { + "lang": "en", + "value": "WPScan", + "type": "coordinator" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "WPScan CVE Generator" + } + } + } +} \ No newline at end of file diff --git a/data/2026/96xxx/CVE-2026-96442.json b/data/2026/96xxx/CVE-2026-96442.json index 5222e86a46..45cd01cf8b 100644 --- a/data/2026/96xxx/CVE-2026-96442.json +++ b/data/2026/96xxx/CVE-2026-96442.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-23T08:58:32.822Z", "datePublished": "2026-09-23T10:10:36.734Z", - "dateUpdated": "2026-11-11T12:53:55.209Z" + "dateUpdated": "2026-11-12T05:26:44.065Z" }, "containers": { "cna": { @@ -155,6 +155,24 @@ "cpe:/a:redhat:enterprise_linux:9::appstream" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "emacs", + "defaultStatus": "affected", + "versions": [ + { + "version": "1:27.2-18.el9_9.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:enterprise_linux:9::appstream" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", @@ -209,6 +227,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99160", + "name": "RHSA-2026:99160", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-96442", "tags": [ @@ -269,7 +295,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:53:55.209Z" + "dateUpdated": "2026-11-12T05:26:44.065Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/96xxx/CVE-2026-96541.json b/data/2026/96xxx/CVE-2026-96541.json index fb05261b40..ae50d78951 100644 --- a/data/2026/96xxx/CVE-2026-96541.json +++ b/data/2026/96xxx/CVE-2026-96541.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-23T12:16:46.357Z", "datePublished": "2026-09-23T18:08:23.661Z", - "dateUpdated": "2026-11-12T01:58:16.342Z" + "dateUpdated": "2026-11-12T05:55:30.207Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.3" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10.2 Extended Update Support", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gnome-remote-desktop", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:49.3-5.el10_2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux_eus:10.2" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.8 Extended Update Support", @@ -114,6 +132,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99125", + "name": "RHSA-2026:99125", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/errata/RHSA-2026:99136", "name": "RHSA-2026:99136", @@ -182,7 +208,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-12T01:58:16.342Z" + "dateUpdated": "2026-11-12T05:55:30.207Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/delta.json b/data/delta.json index 4e65c9a97a..607c4805fd 100644 --- a/data/delta.json +++ b/data/delta.json @@ -1,33 +1,140 @@ { - "fetchTime": "2026-11-12T05:15:30.900Z", - "numberOfChanges": 4, + "fetchTime": "2026-11-12T06:13:57.937Z", + "numberOfChanges": 22, "new": [ { - "cveId": "CVE-2026-101107", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-101107", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101107.json", - "dateUpdated": "2026-11-12T05:10:56.164Z" - } - ], - "updated": [ - { - "cveId": "CVE-2026-114605", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114605", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114605.json", - "dateUpdated": "2026-11-12T05:04:58.972Z" + "cveId": "CVE-2026-106027", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106027", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106027.json", + "dateUpdated": "2026-11-12T06:00:06.145Z" }, { - "cveId": "CVE-2026-126673", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126673", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126673.json", - "dateUpdated": "2026-11-12T05:05:03.042Z" + "cveId": "CVE-2026-110041", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110041", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110041.json", + "dateUpdated": "2026-11-12T06:00:06.327Z" }, { - "cveId": "CVE-2026-76878", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76878", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76878.json", - "dateUpdated": "2026-11-12T05:05:05.824Z" + "cveId": "CVE-2026-110072", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110072", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110072.json", + "dateUpdated": "2026-11-12T06:00:06.497Z" + }, + { + "cveId": "CVE-2026-110959", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110959", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110959.json", + "dateUpdated": "2026-11-12T06:00:06.674Z" + }, + { + "cveId": "CVE-2026-118421", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118421", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118421.json", + "dateUpdated": "2026-11-12T06:00:06.857Z" + }, + { + "cveId": "CVE-2026-118531", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118531", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118531.json", + "dateUpdated": "2026-11-12T06:00:07.049Z" + }, + { + "cveId": "CVE-2026-118597", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118597", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118597.json", + "dateUpdated": "2026-11-12T06:09:34.999Z" + }, + { + "cveId": "CVE-2026-119039", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119039", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119039.json", + "dateUpdated": "2026-11-12T06:00:07.223Z" + }, + { + "cveId": "CVE-2026-119040", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119040", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119040.json", + "dateUpdated": "2026-11-12T06:00:07.503Z" + }, + { + "cveId": "CVE-2026-121498", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121498", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121498.json", + "dateUpdated": "2026-11-12T06:00:07.678Z" + }, + { + "cveId": "CVE-2026-122003", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122003", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122003.json", + "dateUpdated": "2026-11-12T06:00:08.273Z" + }, + { + "cveId": "CVE-2026-123044", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123044", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123044.json", + "dateUpdated": "2026-11-12T06:00:08.453Z" + }, + { + "cveId": "CVE-2026-123092", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123092", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123092.json", + "dateUpdated": "2026-11-12T06:00:08.632Z" + }, + { + "cveId": "CVE-2026-124647", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124647", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124647.json", + "dateUpdated": "2026-11-12T06:00:08.827Z" + }, + { + "cveId": "CVE-2026-124648", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124648", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124648.json", + "dateUpdated": "2026-11-12T06:00:08.998Z" + }, + { + "cveId": "CVE-2026-124652", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124652", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124652.json", + "dateUpdated": "2026-11-12T06:00:09.181Z" + }, + { + "cveId": "CVE-2026-124653", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124653", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124653.json", + "dateUpdated": "2026-11-12T06:00:09.357Z" + }, + { + "cveId": "CVE-2026-124665", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124665", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124665.json", + "dateUpdated": "2026-11-12T06:00:09.578Z" + }, + { + "cveId": "CVE-2026-124814", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124814", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124814.json", + "dateUpdated": "2026-11-12T06:00:09.772Z" + }, + { + "cveId": "CVE-2026-124815", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124815", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124815.json", + "dateUpdated": "2026-11-12T06:00:09.952Z" + }, + { + "cveId": "CVE-2026-124817", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124817", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124817.json", + "dateUpdated": "2026-11-12T06:00:10.134Z" + }, + { + "cveId": "CVE-2026-76792", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76792", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76792.json", + "dateUpdated": "2026-11-12T06:00:10.307Z" } ], + "updated": [], "error": [] } \ No newline at end of file diff --git a/data/deltaLog.json b/data/deltaLog.json index dc35e56e8d..6ad85f61e0 100644 --- a/data/deltaLog.json +++ b/data/deltaLog.json @@ -1,4 +1,262 @@ [ + { + "fetchTime": "2026-11-12T06:13:57.937Z", + "numberOfChanges": 22, + "new": [ + { + "cveId": "CVE-2026-106027", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106027", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106027.json", + "dateUpdated": "2026-11-12T06:00:06.145Z" + }, + { + "cveId": "CVE-2026-110041", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110041", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110041.json", + "dateUpdated": "2026-11-12T06:00:06.327Z" + }, + { + "cveId": "CVE-2026-110072", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110072", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110072.json", + "dateUpdated": "2026-11-12T06:00:06.497Z" + }, + { + "cveId": "CVE-2026-110959", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110959", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110959.json", + "dateUpdated": "2026-11-12T06:00:06.674Z" + }, + { + "cveId": "CVE-2026-118421", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118421", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118421.json", + "dateUpdated": "2026-11-12T06:00:06.857Z" + }, + { + "cveId": "CVE-2026-118531", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118531", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118531.json", + "dateUpdated": "2026-11-12T06:00:07.049Z" + }, + { + "cveId": "CVE-2026-118597", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118597", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118597.json", + "dateUpdated": "2026-11-12T06:09:34.999Z" + }, + { + "cveId": "CVE-2026-119039", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119039", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119039.json", + "dateUpdated": "2026-11-12T06:00:07.223Z" + }, + { + "cveId": "CVE-2026-119040", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119040", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119040.json", + "dateUpdated": "2026-11-12T06:00:07.503Z" + }, + { + "cveId": "CVE-2026-121498", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121498", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121498.json", + "dateUpdated": "2026-11-12T06:00:07.678Z" + }, + { + "cveId": "CVE-2026-122003", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122003", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122003.json", + "dateUpdated": "2026-11-12T06:00:08.273Z" + }, + { + "cveId": "CVE-2026-123044", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123044", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123044.json", + "dateUpdated": "2026-11-12T06:00:08.453Z" + }, + { + "cveId": "CVE-2026-123092", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123092", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123092.json", + "dateUpdated": "2026-11-12T06:00:08.632Z" + }, + { + "cveId": "CVE-2026-124647", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124647", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124647.json", + "dateUpdated": "2026-11-12T06:00:08.827Z" + }, + { + "cveId": "CVE-2026-124648", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124648", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124648.json", + "dateUpdated": "2026-11-12T06:00:08.998Z" + }, + { + "cveId": "CVE-2026-124652", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124652", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124652.json", + "dateUpdated": "2026-11-12T06:00:09.181Z" + }, + { + "cveId": "CVE-2026-124653", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124653", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124653.json", + "dateUpdated": "2026-11-12T06:00:09.357Z" + }, + { + "cveId": "CVE-2026-124665", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124665", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124665.json", + "dateUpdated": "2026-11-12T06:00:09.578Z" + }, + { + "cveId": "CVE-2026-124814", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124814", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124814.json", + "dateUpdated": "2026-11-12T06:00:09.772Z" + }, + { + "cveId": "CVE-2026-124815", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124815", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124815.json", + "dateUpdated": "2026-11-12T06:00:09.952Z" + }, + { + "cveId": "CVE-2026-124817", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124817", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124817.json", + "dateUpdated": "2026-11-12T06:00:10.134Z" + }, + { + "cveId": "CVE-2026-76792", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76792", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76792.json", + "dateUpdated": "2026-11-12T06:00:10.307Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-12T05:58:49.024Z", + "numberOfChanges": 3, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-107935", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107935", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107935.json", + "dateUpdated": "2026-11-12T05:58:41.476Z" + }, + { + "cveId": "CVE-2026-115207", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115207", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115207.json", + "dateUpdated": "2026-11-12T05:52:52.873Z" + }, + { + "cveId": "CVE-2026-96541", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96541", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96541.json", + "dateUpdated": "2026-11-12T05:55:30.207Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-12T05:46:46.637Z", + "numberOfChanges": 1, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-117477", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-117477", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/117xxx/CVE-2026-117477.json", + "dateUpdated": "2026-11-12T05:44:32.062Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-12T05:35:20.632Z", + "numberOfChanges": 5, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-108094", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108094", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108094.json", + "dateUpdated": "2026-11-12T05:28:41.514Z" + }, + { + "cveId": "CVE-2026-121629", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121629", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121629.json", + "dateUpdated": "2026-11-12T05:29:17.336Z" + }, + { + "cveId": "CVE-2026-125704", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125704", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125704.json", + "dateUpdated": "2026-11-12T05:33:27.502Z" + }, + { + "cveId": "CVE-2026-125712", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125712", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125712.json", + "dateUpdated": "2026-11-12T05:33:28.967Z" + }, + { + "cveId": "CVE-2026-43961", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-43961", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/43xxx/CVE-2026-43961.json", + "dateUpdated": "2026-11-12T05:33:31.532Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-12T05:28:21.395Z", + "numberOfChanges": 2, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-119528", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119528", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119528.json", + "dateUpdated": "2026-11-12T05:27:46.669Z" + }, + { + "cveId": "CVE-2026-96442", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96442", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96442.json", + "dateUpdated": "2026-11-12T05:26:44.065Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-12T05:22:19.831Z", + "numberOfChanges": 2, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-33818", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-33818", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33818.json", + "dateUpdated": "2026-11-12T05:21:59.095Z" + }, + { + "cveId": "CVE-2026-42504", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-42504", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42504.json", + "dateUpdated": "2026-11-12T05:21:57.482Z" + } + ], + "error": [] + }, { "fetchTime": "2026-11-12T05:15:30.900Z", "numberOfChanges": 4, @@ -848319,89 +848577,5 @@ } ], "error": [] - }, - { - "fetchTime": "2026-10-13T06:01:26.998Z", - "numberOfChanges": 4, - "new": [ - { - "cveId": "CVE-2026-108972", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108972", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108972.json", - "dateUpdated": "2026-10-13T06:00:15.758Z" - }, - { - "cveId": "CVE-2026-54867", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-54867", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/54xxx/CVE-2026-54867.json", - "dateUpdated": "2026-10-13T05:51:19.258Z" - }, - { - "cveId": "CVE-2026-89269", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-89269", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89269.json", - "dateUpdated": "2026-10-13T06:00:09.204Z" - }, - { - "cveId": "CVE-2026-89271", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-89271", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89271.json", - "dateUpdated": "2026-10-13T06:00:09.384Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-13T05:50:45.673Z", - "numberOfChanges": 4, - "new": [ - { - "cveId": "CVE-2026-108971", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108971", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108971.json", - "dateUpdated": "2026-10-13T05:45:16.733Z" - }, - { - "cveId": "CVE-2026-54868", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-54868", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/54xxx/CVE-2026-54868.json", - "dateUpdated": "2026-10-13T05:50:34.522Z" - }, - { - "cveId": "CVE-2026-54869", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-54869", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/54xxx/CVE-2026-54869.json", - "dateUpdated": "2026-10-13T05:49:48.399Z" - }, - { - "cveId": "CVE-2026-54870", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-54870", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/54xxx/CVE-2026-54870.json", - "dateUpdated": "2026-10-13T05:48:07.924Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-13T05:31:58.744Z", - "numberOfChanges": 2, - "new": [ - { - "cveId": "CVE-2026-108969", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108969", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108969.json", - "dateUpdated": "2026-10-13T05:15:16.378Z" - }, - { - "cveId": "CVE-2026-108970", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108970", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108970.json", - "dateUpdated": "2026-10-13T05:30:14.172Z" - } - ], - "updated": [], - "error": [] } ] \ No newline at end of file diff --git a/state/sync.json b/state/sync.json index 46eded93b1..992eae3e89 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1,7 +1,7 @@ { "source": "https://github.com/CVEProject/cvelistV5.git", - "upstream_commit": "e9cc0b269eac09dfaf1a68a998aea58c8bdb28f2", + "upstream_commit": "48044dedaadad50d198ba53c697fe236bdc3aef9", "since_year": 2017, - "records": 331456, - "synced_at_utc": "2026-11-12T05:26:54.931489+00:00" + "records": 331478, + "synced_at_utc": "2026-11-12T06:26:35.032607+00:00" }