From 18193d111090974fa69aa2d94855e35fa62d1cdf Mon Sep 17 00:00:00 2001 From: Vulnerability Bot Date: Sun, 15 Nov 2026 11:47:49 +0100 Subject: [PATCH] NVD update 2026-11-15T10:47:43Z --- data/2026/CVE-2026-129349.json | 1 + data/2026/CVE-2026-129444.json | 1 + data/2026/CVE-2026-129445.json | 1 + data/2026/CVE-2026-82568.json | 1 + data/2026/CVE-2026-82663.json | 1 + state/sync.json | 2 +- 6 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 data/2026/CVE-2026-129349.json create mode 100644 data/2026/CVE-2026-129444.json create mode 100644 data/2026/CVE-2026-129445.json create mode 100644 data/2026/CVE-2026-82568.json create mode 100644 data/2026/CVE-2026-82663.json diff --git a/data/2026/CVE-2026-129349.json b/data/2026/CVE-2026-129349.json new file mode 100644 index 0000000000..3802092df2 --- /dev/null +++ b/data/2026/CVE-2026-129349.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.shiro:shiro-core","packageURL":"pkg:maven/org.apache.shiro/shiro-core","product":"Apache Shiro","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When authentication caching is enabled on DefaultLdapRealm, after a user logs in successfully once, subsequent logins for that user succeed with any password.\nA cached authentication skips the LDAP bind, and the AllowAllCredentialsMatcher installed by default in DefaultLdapRealm accepts any credentials, allowing an attacker who knows a valid username to authenticate as that user.\nThis issue affects all Apache Shiro versions through 3.0.0, only when using DefaultLdapRealm (or JndiLdapRealm) with authenticationCachingEnabled set to true, which is not the default.\n\nMitigation: Upgrade to version 3.0.1 or later, which fixes the issue by no longer installing AllowAllCredentialsMatcher by default.\nAlternatively, disable authentication caching on the LDAP realm (this is the default), or configure a credentials matcher, such as SimpleCredentialsMatcher, that verifies credentials against the cached authentication info."}],"id":"CVE-2026-129349","lastModified":"2026-11-15T10:16:53.020","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"RED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Red","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"LOW"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-15T10:16:53.020","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/1whn52ht402lhc782c3s843c9hho8b4y"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/14/8"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-129444.json b/data/2026/CVE-2026-129444.json new file mode 100644 index 0000000000..1f29d7542d --- /dev/null +++ b/data/2026/CVE-2026-129444.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:h:d-link:dsl-6740c:*:*:*:*:*:*:*:*"],"modules":["FTP Daemon"],"product":"DSL-6740C","vendor":"D-Link","versions":[{"status":"affected","version":"20131126"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in D-Link DSL-6740C 20131126. This affects an unknown function of the file /etc/templates/ftpd/ftpd_conf.php of the component FTP Daemon. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used."}],"id":"CVE-2026-129444","lastModified":"2026-11-15T09:16:44.743","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":10.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":10.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-15T09:16:44.570","references":[{"source":"cna@vuldb.com","url":"https://github.com/XueDugu/dlink-dsl6740c-ftp-default-evidence"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-129444"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1044943"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437457"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437457/cti"},{"source":"cna@vuldb.com","url":"https://www.dlink.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-259"},{"lang":"en","value":"CWE-798"}],"source":"cna@vuldb.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-129445.json b/data/2026/CVE-2026-129445.json new file mode 100644 index 0000000000..344c5c37fa --- /dev/null +++ b/data/2026/CVE-2026-129445.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:h:d-link:dir-850l:*:*:*:*:*:*:*:*"],"modules":["Console Login"],"product":"DIR-850L","vendor":"D-Link","versions":[{"status":"affected","version":"FW1.20WWb03"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in D-Link DIR-850L FW1.20WWb03. This impacts an unknown function of the file /usr/sbin/consolepwd of the component Console Login. Performing a manipulation results in hard-coded credentials. The attack requires a local approach. The exploit has been released to the public and may be used for attacks."}],"id":"CVE-2026-129445","lastModified":"2026-11-15T10:16:54.147","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"LOCAL","authentication":"MULTIPLE","availabilityImpact":"COMPLETE","baseScore":6.5,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:L/AC:L/Au:M/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":2.5,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.5,"impactScore":6.0,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-15T10:16:53.970","references":[{"source":"cna@vuldb.com","url":"https://github.com/XueDugu/dlink-dir850l-consolepwd-evidence"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-129445"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1044944"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437458"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437458/cti"},{"source":"cna@vuldb.com","url":"https://www.dlink.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-259"},{"lang":"en","value":"CWE-798"}],"source":"cna@vuldb.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-82568.json b/data/2026/CVE-2026-82568.json new file mode 100644 index 0000000000..3b14effbec --- /dev/null +++ b/data/2026/CVE-2026-82568.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Give - Peer-to-Peer","vendor":"GiveWP","versions":[{"lessThanOrEqual":"2.9.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Give - Peer-to-Peer plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort' parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Successful exploitation requires the existence of at least one Peer-to-Peer campaign. This vulnerability can be combined with CVE-2026-82663 to achieve unauthenticated remote code execution."}],"id":"CVE-2026-82568","lastModified":"2026-11-15T10:16:54.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-15T10:16:54.217","references":[{"source":"security@wordfence.com","url":"https://docs.nexcess.com/software/changelogs/give/give-peer-to-peer/"},{"source":"security@wordfence.com","url":"https://givewp.com/addons/peer-to-peer/"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b68d24c-a963-4316-a8f3-8dc6a494e016?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@wordfence.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-82663.json b/data/2026/CVE-2026-82663.json new file mode 100644 index 0000000000..707d507f83 --- /dev/null +++ b/data/2026/CVE-2026-82663.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Give - Peer-to-Peer","vendor":"GiveWP","versions":[{"lessThanOrEqual":"2.9.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers who know or discover an existing campaign and team ID to modify the team's name, story, goal, access and notification settings, set its profile image URL, and upload WordPress-allowed media files as parentless attachments. This vulnerability can be combined with CVE-2026-82568 to achieve unauthenticated remote code execution."}],"id":"CVE-2026-82663","lastModified":"2026-11-15T10:16:54.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-15T10:16:54.410","references":[{"source":"security@wordfence.com","url":"https://docs.nexcess.com/software/changelogs/give/give-peer-to-peer/"},{"source":"security@wordfence.com","url":"https://givewp.com/addons/peer-to-peer/"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f424258a-367d-43cb-b66b-1f898391a0ea?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@wordfence.com","type":"Primary"}]} diff --git a/state/sync.json b/state/sync.json index ffd705b4e4..3ab0df2dff 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1 +1 @@ -{"initial_complete":true,"last_run_counts":{"seen":1739,"skipped":2,"unchanged":1723,"written":14},"last_run_mode":"incremental","last_successful_end":"2026-11-15T08:42:21+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-15T08:47:34.571819+00:00"} +{"initial_complete":true,"last_run_counts":{"seen":1731,"skipped":2,"unchanged":1724,"written":5},"last_run_mode":"incremental","last_successful_end":"2026-11-15T10:42:21+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-15T10:47:32.803819+00:00"}