{"id":"CVE-2026-111495","aliases":[],"cve":{"records":[{"id":"CVE-2026-111495","source":"INCIBE","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-16T09:54:35.040Z","published":"2026-11-05T21:59:47.856Z","modified":"2026-11-10T14:07:54.073Z"}],"publishers":[{"name":"INCIBE","role":"CNA","organizationId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","modified":"2026-11-05T21:59:47.856Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T14:07:54.073Z"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint","tags":[],"source":"INCIBE"}],"weaknesses":[{"id":"CWE-312","description":"CWE-312 Cleartext Storage of Sensitive Information","source":"CISA-ADP"}],"applicability":[{"source":"INCIBE","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T14:07:33.112204Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"API keys, credentials, and configuration parameters embedded in the MatchPoint APK","titleSource":"INCIBE","descriptionSource":"INCIBE","description":"API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.","score":5.1,"severity":"medium","published":"2026-11-05T21:59:47.856Z","modified":"2026-11-10T14:07:54.073Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"TPC Software","name":"Matchpoint","platforms":[],"versions":[{"version":"Versions prior to latest one","status":"affected"}],"defaultStatus":"unaffected","cpes":[],"source":"INCIBE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111495"}],"remediation":[{"text":"The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.","source":"INCIBE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111495"}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"],"sources":[{"name":"CVE","id":"CVE-2026-111495","modified":"2026-11-10T14:07:54.073Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111495"}],"assessments":[{"source":"INCIBE","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":5.1}],"sourceAffected":[],"observedAt":"2026-11-10T14:22:23.497Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:45:32.518Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-06T04:00:59.760Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-06T04:00:34.409Z","attemptedAt":"2026-11-06T04:00:34.409Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T04:00:34.923Z","attemptedAt":"2026-11-06T04:00:34.923Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-06T04:00:33.722Z","attemptedAt":"2026-11-06T04:00:33.722Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-965g-9cqv-fwmx","url":"https://github.com/advisories/GHSA-965g-9cqv-fwmx","modified":"2026-11-06T00:32:46Z","checkedAt":"2026-11-06T04:00:34.409Z"},{"source":"ENISA EUVD","id":"EUVD-2026-117822","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117822","modified":"Nov 5, 2026, 9:59:47 PM","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-06T04:00:34.923Z"}],"aiSummary":{"text":"MatchPoint APK versions prior to the latest one store sensitive information in cleartext, which can be extracted through reverse engineering. The impact depends on the capabilities of each exposed element. Local access is required to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T14:26:18.153Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111495"}]}}