VULN/vuln-nvd
1
0
Fork 0
Code Pull Requests Actions Activity

NVD update 2026-11-12T08:47:52Z

Browse Source
This commit is contained in:
Vulnerability Bot
2026-11-12 09:47:58 +01:00
parent faed7c977d
commit c92a952376
18 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/2025/CVE-2025-2399.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/2025/CVE-2025-47541.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mail-mint","product":"Mail Mint","vendor":"WPFunnels","versions":[{"changes":[{"at":"1.17.8","status":"unaffected"}],"lessThanOrEqual":"1.17.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through <= 1.17.7."},{"lang":"es","value":"La vulnerabilidad de inserción de información confidencial en los datos enviados en WPFunnels Mail Mint permite recuperar datos confidenciales incrustados. Este problema afecta a Mail Mint desde la versión n/d hasta la 1.17.7."}],"id":"CVE-2025-47541","lastModified":"2026-06-17T09:28:16.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-47541","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-23T15:20:02.972380Z","version":"2.0.3"}}]},"published":"2025-05-23T13:15:39.680","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/Wordpress/Plugin/mail-mint/vulnerability/wordpress-mail-mint-1-17-7-sensitive-data-exposure-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"}],"source":"audit@patchstack.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mail-mint","product":"Mail Mint","vendor":"WPFunnels Team","versions":[{"changes":[{"at":"1.17.8","status":"unaffected"}],"lessThanOrEqual":"1.17.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Team Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through 1.17.7."},{"lang":"es","value":"La vulnerabilidad de inserción de información confidencial en los datos enviados en WPFunnels Mail Mint permite recuperar datos confidenciales incrustados. Este problema afecta a Mail Mint desde la versión n/d hasta la 1.17.7."}],"id":"CVE-2025-47541","lastModified":"2026-11-12T07:16:44.903","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-47541","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-23T15:20:02.972380Z","version":"2.0.3"}}]},"published":"2025-05-23T13:15:39.680","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mail-mint/vulnerability/wordpress-mail-mint-1-17-7-sensitive-data-exposure-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"}],"source":"audit@patchstack.com","type":"Secondary"}]}
data/2026/CVE-2026-113408.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"Git","repo":"https://gitlab.com/git-scm/git","vendor":"Git","versions":[{"status":"affected","version":"2.50.1"},{"status":"affected","version":"2.51.2"},{"status":"affected","version":"2.52.0"},{"status":"affected","version":"2.53.0"},{"status":"affected","version":"2.54.0"},{"status":"affected","version":"2.55.0"},{"status":"affected","version":"2.56.0"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}],"id":"CVE-2026-113408","lastModified":"2026-11-12T07:16:45.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-12T07:16:45.597","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/git/-/work_items/809"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cve@gitlab.com","type":"Primary"}]}
data/2026/CVE-2026-118855.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","repo":"https://github.com/akaunting/akaunting","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0","versionType":"semver"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin."}],"id":"CVE-2026-118855","lastModified":"2026-11-12T08:16:39.930","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-12T08:16:39.930","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/advisories/sabbath"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Http/Requests/Document/Document.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/input/hidden.blade.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Primary"}]}
data/2026/CVE-2026-123133.json
+1
View File
@@ -0,0 +1 @@
{"cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID is a duplicate of CVE-2026-116518 and was never published. Both IDs were assigned to the same vulnerability in the ElasticPress WordPress plugin. All CVE users should reference CVE-2026-116518 instead of this ID."}],"id":"CVE-2026-123133","lastModified":"2026-11-12T08:16:41.187","metrics":{},"published":"2026-11-12T08:16:41.187","references":[],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Rejected"}
data/2026/CVE-2026-12507.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AssetExplorer","vendor":"Zohocorp","versions":[{"lessThan":"7860","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ServiceDesk Plus","vendor":"Zohocorp","versions":[{"lessThan":"15290","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ServiceDesk Plus MSP","vendor":"Zohocorp","versions":[{"lessThan":"15150","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"SupportCenter Plus","vendor":"Zohocorp","versions":[{"lessThan":"15150","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server."}],"id":"CVE-2026-12507","lastModified":"2026-11-12T07:16:46.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T07:16:46.750","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/products/service-desk/cve-2026-12507.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]}
data/2026/CVE-2026-125836.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"simple-jwt-login","product":"Simple JWT Login","vendor":"Nicu Micle","versions":[{"lessThanOrEqual":"3.6.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8."}],"id":"CVE-2026-125836","lastModified":"2026-11-12T08:16:41.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-12T08:16:41.267","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/simple-jwt-login/vulnerability/wordpress-simple-jwt-login-plugin-3-6-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"audit@patchstack.com","type":"Primary"}]}
data/2026/CVE-2026-12591.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"M365 Manager Plus","vendor":"Zohocorp","versions":[{"lessThan":"4818","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing."}],"id":"CVE-2026-12591","lastModified":"2026-11-12T07:16:47.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T07:16:47.260","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-12591.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]}
data/2026/CVE-2026-126991.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*"],"modules":["misp_modules/modules/expansion/wiki.py"],"product":"misp-modules","programFiles":["misp_modules/modules/expansion/wiki.py"],"repo":"https://github.com/MISP/misp-modules","vendor":"misp","versions":[{"lessThanOrEqual":"3.1.4","status":"affected","version":"unspecified","versionType":"semver"}]}],"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler function constructed a SPARQL query by directly concatenating the user-supplied text value into the query string without any escaping or parameterization: 'SELECT ?item WHERE { ?item rdfs:label\"' + request.get(\"text\") + '\" @en }'. An authenticated MISP user with access to the module could supply a crafted text attribute value containing SPARQL syntax (quotes, closing braces, UNION, SERVICE, LIMIT, etc.) to alter the structure of the query sent to the Wikidata SPARQL endpoint. This could allow an attacker to modify the query logic, extract unintended data, or cause the query to fail in ways that expose internal error details. Additionally, the old error handling path formatted raw exception objects into the response string ('wikidata API not accessible {}'.format(e)), potentially leaking internal information such as proxy credentials, query contents, or response bodies. The module also used a spoofed browser user-agent string and the deprecated Wikidata endpoint. The vulnerability required authenticated access to the MISP instance and the ability to invoke the wiki expansion module with a text attribute. The impact is limited to manipulation of the enrichment query and potential disclosure of internal error details; it does not directly compromise the MISP server or its stored data."}],"id":"CVE-2026-126991","lastModified":"2026-11-12T08:16:41.630","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary"}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"Supplier","timestamp":"2026-11-12T05:54:11Z","version":"2.0.3"}}]},"published":"2026-11-12T08:16:41.480","references":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","url":"https://github.com/MISP/misp-modules"},{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","url":"https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9"},{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","url":"https://github.com/MISP/misp-modules/pull/869"},{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","url":"https://misp.github.io/misp-modules/expansion/#wikidata-lookup"}],"sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-209"}],"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary"}]}
data/2026/CVE-2026-40820.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"status":"affected","version":"2.20.0"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"status":"affected","version":"2.20.0"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"status":"affected","version":"2.20.0"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"status":"affected","version":"2.20.0"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getVpnData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."}],"id":"CVE-2026-40820","lastModified":"2026-11-12T08:16:41.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-12T08:16:41.760","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-044/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-058/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"info@cert.vde.com","type":"Primary"}]}
data/2026/CVE-2026-47832.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"bosh-openstack-cpi-release","vendor":"CloudFoundry Foundation","versions":[{"lessThanOrEqual":"v55.0.4","status":"affected","version":"v55","versionType":"custom"}]}],"source":"security@vmware.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The vulnerability lies in the way application credentials are handled within the BOSH deployment.\nbosh-openstack-cpi-release: all versions from v55 to v55.0.4 (inclusive)"}],"id":"CVE-2026-47832","lastModified":"2026-11-12T08:16:41.947","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@vmware.com","type":"Secondary"}]},"published":"2026-11-12T08:16:41.947","references":[{"source":"security@vmware.com","url":"https://www.cloudfoundry.org/blog/cve-2026-47832-openstack-application-credentials-logged-in-cleartext-to-bosh-debug-logs/"}],"sourceIdentifier":"security@vmware.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security@vmware.com","type":"Secondary"}]}
data/2026/CVE-2026-82292.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["qtbase"],"product":"qt","vendor":"qt","versions":[{"lessThan":"6.8.9","status":"affected","version":"4.1.0","versionType":"python"},{"lessThan":"6.11.3","status":"affected","version":"6.9.0","versionType":"python"}]}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML module (qtbase)."}],"id":"CVE-2026-82292","lastModified":"2026-11-12T08:16:42.167","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":1.9,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"LOW"},"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]},"published":"2026-11-12T08:16:42.167","references":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtbase/+/757771"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-82292:"}],"sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]}
data/2026/CVE-2026-8331.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"collectionURL":"https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra","defaultStatus":"unaffected","product":"TimePictra","vendor":"Microchip","versions":[{"lessThan":"12.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution."}],"id":"CVE-2026-8331","lastModified":"2026-11-12T07:16:47.963","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","type":"Secondary"}]},"published":"2026-11-12T07:16:47.963","references":[{"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","url":"https://www.gruppotim.it/en/footer/TIM-red-team.html"},{"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload"}],"sourceIdentifier":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","type":"Secondary"}]}
data/2026/CVE-2026-8332.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"collectionURL":"https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra","defaultStatus":"unaffected","product":"TimePictra","vendor":"Microchip","versions":[{"lessThan":"12.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials"}],"id":"CVE-2026-8332","lastModified":"2026-11-12T07:16:48.747","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","type":"Secondary"}]},"published":"2026-11-12T07:16:48.747","references":[{"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","url":"https://www.gruppotim.it/en/footer/TIM-red-team.html"},{"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files"}],"sourceIdentifier":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","type":"Secondary"}]}
data/2026/CVE-2026-8333.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"collectionURL":"https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra","defaultStatus":"unaffected","product":"TimePictra","vendor":"Microchip","versions":[{"lessThan":"12.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page"}],"id":"CVE-2026-8333","lastModified":"2026-11-12T07:16:49.413","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","type":"Secondary"}]},"published":"2026-11-12T07:16:49.413","references":[{"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","url":"https://www.gruppotim.it/en/footer/TIM-red-team.html"},{"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-stored-cross-site-scripting-vulnerability"}],"sourceIdentifier":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","type":"Secondary"}]}
data/2026/CVE-2026-87772.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Pardus About","vendor":"TÜBİTAK BİLGEM Software Technologies Research Institute","versions":[{"lessThan":"1.2.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privilege Escalation.\n\nThis issue affects Pardus About: before 1.2.5."}],"id":"CVE-2026-87772","lastModified":"2026-11-12T07:16:47.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-12T07:16:47.580","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1521"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]}
data/2026/CVE-2026-96834.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"give","product":"GiveWP","vendor":"Nexcess","versions":[{"changes":[{"at":"4.17.0","status":"unaffected"}],"lessThanOrEqual":"4.16.9","status":"affected","version":"n/a","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions."}],"id":"CVE-2026-96834","lastModified":"2026-09-30T14:18:12.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-30T13:04:07.496300Z","version":"2.0.3"}}]},"published":"2026-09-30T13:17:33.280","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-9-sensitive-data-exposure-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"give","product":"GiveWP","vendor":"Liquid Web / StellarWP","versions":[{"changes":[{"at":"4.17.0","status":"unaffected"}],"lessThanOrEqual":"4.16.9","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Retrieve Embedded Sensitive Data.This issue affects GiveWP: from n/a through 4.16.9."}],"id":"CVE-2026-96834","lastModified":"2026-11-12T07:16:49.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-30T13:04:07.496300Z","version":"2.0.3"}}]},"published":"2026-09-30T13:17:33.280","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-9-sensitive-data-exposure-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
state/sync.json
+1 -1
View File
@@ -1 +1 @@
{"initial_complete":true,"last_run_counts":{"seen":7020,"skipped":39,"unchanged":6939,"written":42},"last_run_mode":"incremental","last_successful_end":"2026-11-12T06:42:28+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-12T06:47:45.194070+00:00"}
{"initial_complete":true,"last_run_counts":{"seen":6992,"skipped":39,"unchanged":6936,"written":17},"last_run_mode":"incremental","last_successful_end":"2026-11-12T08:42:30+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-12T08:47:41.247991+00:00"}