Auto-Update: 2025-12-03T09:00:11.183018+00:00

2026-10-24 16:44:29 +00:00 · 2025-12-03 09:04:01 +00:00
1 parent c0e8c78f6d
commit ccc2862eee
@@ -2,7 +2,7 @@
  "id": "CVE-2022-40023",
  "sourceIdentifier": "[email protected]",
  "published": "2022-09-07T13:15:09.953",
-  "lastModified": "2024-11-21T07:20:44.470",
+  "lastModified": "2025-12-03T07:16:01.227",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
@@ -162,6 +162,10 @@
        "Third Party Advisory"
      ]
    },
+    {
+      "url": "https://lists.debian.org/debian-lts-announce/2025/12/msg00004.html",
+      "source": "af854a3a-2127-422b-91ae-364da2661108"
+    },
    {
      "url": "https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
@@ -2,13 +2,13 @@
  "id": "CVE-2024-7096",
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
  "published": "2025-05-30T15:15:40.063",
-  "lastModified": "2025-10-06T13:58:40.593",
-  "vulnStatus": "Analyzed",
+  "lastModified": "2025-12-03T08:15:47.267",
+  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
-      "value": "A privilege escalation vulnerability exists in multiple [Vendor Name] products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met:\n  *  SOAP admin services are accessible to the attacker.\n  *  The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.\n  *  At least one custom role exists with non-default permissions.\n  *  The attacker has knowledge of the custom role and the internal attribute used in the deployment.\n\n\nExploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms."
+      "value": "A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met:\n  *  SOAP admin services are accessible to the attacker.\n  *  The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.\n  *  At least one custom role exists with non-default permissions.\n  *  The attacker has knowledge of the custom role and the internal attribute used in the deployment.\n\n\nExploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms."
    },
    {
      "lang": "es",
@@ -0,0 +1,60 @@
+{
+  "id": "CVE-2025-13486",
+  "sourceIdentifier": "[email protected]",
+  "published": "2025-12-03T07:16:02.840",
+  "lastModified": "2025-12-03T07:16:02.840",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "[email protected]",
+        "type": "Primary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+          "baseScore": 9.8,
+          "baseSeverity": "CRITICAL",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "NONE",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "HIGH",
+          "integrityImpact": "HIGH",
+          "availabilityImpact": "HIGH"
+        },
+        "exploitabilityScore": 3.9,
+        "impactScore": 5.9
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "[email protected]",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-94"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://plugins.trac.wordpress.org/changeset/3400134/acf-extended",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c508cb73-53e6-4ebe-b3d0-285908b722c9?source=cve",
+      "source": "[email protected]"
+    }
+  ]
+}
@@ -0,0 +1,60 @@
+{
+  "id": "CVE-2025-13945",
+  "sourceIdentifier": "[email protected]",
+  "published": "2025-12-03T08:15:47.940",
+  "lastModified": "2025-12-03T08:15:47.940",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service"
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "[email protected]",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
+          "baseScore": 5.5,
+          "baseSeverity": "MEDIUM",
+          "attackVector": "LOCAL",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "REQUIRED",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "NONE",
+          "integrityImpact": "NONE",
+          "availabilityImpact": "HIGH"
+        },
+        "exploitabilityScore": 1.8,
+        "impactScore": 3.6
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "[email protected]",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-1325"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://gitlab.com/wireshark/wireshark/-/issues/20860",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://www.wireshark.org/security/wnpa-sec-2025-07.html",
+      "source": "[email protected]"
+    }
+  ]
+}
@@ -0,0 +1,60 @@
+{
+  "id": "CVE-2025-13946",
+  "sourceIdentifier": "[email protected]",
+  "published": "2025-12-03T08:15:48.180",
+  "lastModified": "2025-12-03T08:15:48.180",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service"
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "[email protected]",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
+          "baseScore": 5.5,
+          "baseSeverity": "MEDIUM",
+          "attackVector": "LOCAL",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "REQUIRED",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "NONE",
+          "integrityImpact": "NONE",
+          "availabilityImpact": "HIGH"
+        },
+        "exploitabilityScore": 1.8,
+        "impactScore": 3.6
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "[email protected]",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-835"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://gitlab.com/wireshark/wireshark/-/issues/20884",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://www.wireshark.org/security/wnpa-sec-2025-08.html",
+      "source": "[email protected]"
+    }
+  ]
+}
@@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
 ### Last Repository Update

 ```plain
-2025-12-03T07:00:11.027347+00:00
+2025-12-03T09:00:11.183018+00:00
 ```

 ### Most recent CVE Modification Timestamp synchronized with NVD

 ```plain
-2025-12-03T06:15:47.260000+00:00
+2025-12-03T08:15:48.180000+00:00
 ```

 ### Last Data Feed Release
@@ -33,20 +33,24 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
 ### Total Number of included CVEs

 ```plain
-319965
+319968
 ```

 ### CVEs added in the last Commit

-Recently added CVEs: `1`
+Recently added CVEs: `3`

- [CVE-2025-12954](CVE-2025/CVE-2025-129xx/CVE-2025-12954.json) (`2025-12-03T06:15:47.260`)
+- [CVE-2025-13486](CVE-2025/CVE-2025-134xx/CVE-2025-13486.json) (`2025-12-03T07:16:02.840`)
+- [CVE-2025-13945](CVE-2025/CVE-2025-139xx/CVE-2025-13945.json) (`2025-12-03T08:15:47.940`)
+- [CVE-2025-13946](CVE-2025/CVE-2025-139xx/CVE-2025-13946.json) (`2025-12-03T08:15:48.180`)


 ### CVEs modified in the last Commit

-Recently modified CVEs: `0`
+Recently modified CVEs: `2`

+- [CVE-2022-40023](CVE-2022/CVE-2022-400xx/CVE-2022-40023.json) (`2025-12-03T07:16:01.227`)
+- [CVE-2024-7096](CVE-2024/CVE-2024-70xx/CVE-2024-7096.json) (`2025-12-03T08:15:47.267`)


 ## Download and Usage
@@ -207023,7 +207023,7 @@ CVE-2022-40016,0,0,100b5b79a376baf443c3be9376df72f4d615eff2e19857689b9ef583275af
 CVE-2022-4002,0,0,03ff78a7f3bf72b254b65f244d7ab9ecbd438043995767e6c6c4a3facc300bed,2024-08-13T15:23:51.097000
 CVE-2022-40021,0,0,7c39516cdd288184e582fc0863677682d76c7162f5872be1d2184272623c3009,2025-03-18T17:15:39.603000
 CVE-2022-40022,0,0,be198aa5f14916eccdc04ae62059d6423a199546a0038d12aa6ff3aa2030363d,2025-03-21T19:15:39.777000
-CVE-2022-40023,0,0,1969d9a6fdd882f53e50f36591b8d0a8013170838af37568bd463fa48a30fb96,2024-11-21T07:20:44.470000
+CVE-2022-40023,0,1,0a77468c1de11f28f117dff0b20b1ecaf19b1ce677d17ee9c1ecb71ac82cc8ce,2025-12-03T07:16:01.227000
 CVE-2022-40026,0,0,634d13f40ce7850be0b1d27888d3d2840baffbe57665923c60cc4baa34f4b20a,2025-05-28T14:15:29.773000
 CVE-2022-40027,0,0,42de45d500526324ef0c4554ceae78087fc007b3496a3087fe19273f38ada173,2025-05-28T14:15:29.980000
 CVE-2022-40028,0,0,7af30c31783fd5ca82dc208897538f7a375e70a7d1b32c50df3bad1170651fec,2025-05-28T14:15:30.190000
@@ -282009,7 +282009,7 @@ CVE-2024-7092,0,0,422abf4bd36177ce9961c0f919edf6c6f74cba62c54abe4f5e6a3dbdcfa520
 CVE-2024-7093,0,0,67601957fefc739748f2bd0d3e707115807c6ad7cc988ec66a095365c56eeca2,2024-08-02T12:59:43.990000
 CVE-2024-7094,0,0,b22ce77ffacf979339f568296208b1cc49b896d3f1ddb1fcde0ad4f63f12731e,2024-08-13T12:58:25.437000
 CVE-2024-7095,0,0,8022420a39cbfcd3372a34a53680c91a4d262f7eb4cb2666208fca7996ad0343,2025-01-14T15:15:27.263000
-CVE-2024-7096,0,0,74b17cfdaeaa7bc95cd5dfa7dce407f51d1b248dad11b86dddb7ca463350e247,2025-10-06T13:58:40.593000
+CVE-2024-7096,0,1,644d4769845ad7d4386abd13d6933e219e7249898168ee7c7bd1aaa1a90d0066,2025-12-03T08:15:47.267000
 CVE-2024-7097,0,0,9a850b99162ebf7599a50f1ced88bd98327d761aad25986392ed97e915ce60db,2025-10-06T13:51:05.690000
 CVE-2024-7098,0,0,36ff175214260eaceb7976e1ef6f36e1f1b66a19a8e7f05f9c65473710d19b24,2024-09-20T17:14:53.063000
 CVE-2024-7099,0,0,f0db6fa14083f4f3d5afac5cbd8a89a7d98f96c83edd5a721c0a0a3d51f8e487,2025-07-30T19:44:27.253000
@@ -288171,7 +288171,7 @@ CVE-2025-12943,0,0,e8d4d8694e8fd5add70efc108bf0ec895f3f6e84c74ec0ee5e1051202c6e3
 CVE-2025-12944,0,0,ecea00f57e86fdc3c1d7a2827a6a5f1bb0029b0815ab2cd7d9cbd2b9513c6d57,2025-11-12T16:19:34.210000
 CVE-2025-1295,0,0,2a4bc8a9e306b7d7cae49d0fff6161acb070f2799f35d70bd6c6546c6dbde442,2025-02-27T06:15:21.990000
 CVE-2025-12953,0,0,bb7b596cf660f4e753932ced3ec80b71edfe5802d780e4d0104589ac7bb81f13,2025-11-12T16:19:34.210000
-CVE-2025-12954,1,1,a6eb1ac4c5874a1448f3abd2533b9949299c4929a68f083708145acf3feebdaa,2025-12-03T06:15:47.260000
+CVE-2025-12954,0,0,a6eb1ac4c5874a1448f3abd2533b9949299c4929a68f083708145acf3feebdaa,2025-12-03T06:15:47.260000
 CVE-2025-12955,0,0,99979c2e3b082395a0c7e6550b8851b79c1c4704016a89ed894c4027f91620e3,2025-11-18T14:06:29.817000
 CVE-2025-1296,0,0,d95bfd9a7f0753e22aec4081e35e5f3d5b17ed2789c524a1845821d0907a79ad,2025-03-10T18:15:30.237000
 CVE-2025-12961,0,0,9a96ae17b762b1a71d961fbc7583d204f9ba709b9b013257faeb9b275943c3fa,2025-11-18T14:06:29.817000
@@ -288504,6 +288504,7 @@ CVE-2025-1348,0,0,ad5b07dca40b6e849a1c97372fa9df66d93e7131088daf1d9df44209e6a8bb
 CVE-2025-13483,0,0,055ab09c6c4fdee1e56eeadf822959daf8ce401badc8ffea8795065191f686cb,2025-11-25T22:16:16.690000
 CVE-2025-13484,0,0,5d1d24b7fdeff47a075d0a5a0372fcb3e3171f9faea76bc6080b539c9dca6458,2025-11-24T19:15:47.877000
 CVE-2025-13485,0,0,52d4a486e871d930cb950f4ef4d9b0dcb95b214b682f7238feb33cc6f9ca4b69,2025-11-24T16:01:47.413000
+CVE-2025-13486,1,1,a4b9abf728b198bf4091986239a6afcf7d82cefe79298c09dde0ffcda3d9173c,2025-12-03T07:16:02.840000
 CVE-2025-1349,0,0,e7daf32839b3f238c77f10cfc713f5e67c2ab59db0fe96ec93216ff70824f1f2,2025-07-25T17:58:03.213000
 CVE-2025-13495,0,0,85cf1aba188fa92fa73cbea540e22ae001faf92ecb9d3d0fd64cdb8daad10e51,2025-12-03T04:15:59.830000
 CVE-2025-13499,0,0,e0e9fbd2aef81532330dd54c6f6204b3d10397481939a9dd57c895c3ee355257,2025-11-21T15:13:13.800000
@@ -288707,6 +288708,8 @@ CVE-2025-1391,0,0,92923563d5f6ebe7489c1cf297a79c50e1a9d080a96d841d79358c408c639e
 CVE-2025-1392,0,0,0edccaa049f5e6881402c6772eeeb1c415751b419e55975e8780c9e97d8f3003,2025-07-16T14:26:19.947000
 CVE-2025-1393,0,0,1a18b9780d45efd3906fabb9eb91bce6e4d37c3f3f1f9128e55d743057ba1663,2025-03-05T08:15:35.107000
 CVE-2025-1394,0,0,6fd0ce05c39cbf7c4a662482beea049126087e918dbcbf1d6510ba64a624e414,2025-07-31T18:42:37.870000
+CVE-2025-13945,1,1,3b734edb7caf8a033670060aa7fd2cc496f32f6dda85c079841b59b226a7bc77,2025-12-03T08:15:47.940000
+CVE-2025-13946,1,1,638d9bc347ab95f653fc1ee368a577e372d855fb8135e23f09138d10c6780a6b,2025-12-03T08:15:48.180000
 CVE-2025-1396,0,0,4fd588fd19c632185590c40438bc6a2ef10b260201a71ffb590ae0c685d4bd2c,2025-10-06T13:44:11.523000
 CVE-2025-1398,0,0,d83bac3550fc7635b21484a96b732decccb9a75524309113ddbb6574c33b0582,2025-09-25T19:14:25.120000
 CVE-2025-1399,0,0,e8485dd7af68ba8f2d01d51196b9d6a2f2dcf208ff563be9860baa305f6daa36,2025-05-07T14:13:20.483000