{"items":[{"id":"CVE-2026-111495","published":"2026-11-05T21:59:47.856Z","updated":"2026-11-05T21:59:47.856Z","title":"API keys, credentials, and configuration parameters embedded in the MatchPoint APK","severity":"MEDIUM","score":5.1,"vendor":"TPC Software","product":"Matchpoint","kev":false,"epss":0.00149,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111494","published":"2026-11-05T21:58:02.432Z","updated":"2026-11-05T21:58:02.432Z","title":"Incorrect validation of TLS certificates in the MatchPoint Android app","severity":"CRITICAL","score":9.1,"vendor":"TPC Software","product":"Matchpoint","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111493","published":"2026-11-05T21:56:17.098Z","updated":"2026-11-05T21:56:17.098Z","title":"Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint","severity":"HIGH","score":8.7,"vendor":"TPC Software","product":"Matchpoint","kev":false,"epss":0.00484,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111492","published":"2026-11-05T21:53:32.301Z","updated":"2026-11-05T21:53:32.301Z","title":"SQL injection in the push notification handler of the MatchPoint Android app","severity":"HIGH","score":8.6,"vendor":"TPC Software","product":"Matchpoint","kev":false,"epss":0.00152,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111491","published":"2026-11-05T21:51:47.817Z","updated":"2026-11-05T21:51:47.817Z","title":"Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences","severity":"MEDIUM","score":6.9,"vendor":"TPC Software","product":"Matchpoint","kev":false,"epss":0.00119,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111490","published":"2026-11-05T21:49:40.608Z","updated":"2026-11-05T21:49:40.608Z","title":"Insecure direct object reference (IDOR) vulnerability in the MatchPoint API","severity":"CRITICAL","score":9.9,"vendor":"TPC Software","product":"Matchpoint","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-111489","published":"2026-11-05T21:47:37.430Z","updated":"2026-11-05T21:47:37.430Z","title":"A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform","severity":"CRITICAL","score":9.9,"vendor":"TPC Software","product":"Matchpoint","kev":false,"epss":0.00312,"kevAdded":null,"exploit":false}]}