{"affected":[{"defaultStatus":"unaffected","product":"Płatnik","source":"CNA: CERT-PL","vendor":"Zakład Ubezpieczeń Społecznych","versions":[{"changes":[{"at":"metric 242","status":"unaffected"}],"lessThanOrEqual":"10.02.002","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-110970","cwes":["CWE-1428"],"description":"Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own.\n\n\n\n\nThis issue was fixed in metric 242 in version 10.02.002.","epss":{"date":"2026-11-01","percentile":0.26882,"score":0.00335},"exploits":[],"kev":null,"metrics":[{"score":2.3,"severity":"low","source":"CNA: CERT-PL","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793626274203,"publishedAt":1793361399165,"references":[{"source":"CNA: CERT-PL","tags":["third-party-advisory"],"url":"https://cert.pl/posts/2026/10/CVE-2026-110970"},{"source":"CNA: CERT-PL","tags":["product"],"url":"https://www.zus.pl/firmy/program-platnik/o-programie-platnik"}],"remediation":[],"revision":"6cf172818a66f36067c1ae6ff0ec58f7d8d8fce046b4b4afc3d57f748cd07618","sources":[{"modifiedAt":1793626274203,"name":"CNA: CERT-PL","retrievedAt":1793628522314,"url":"https://www.cve.org/CVERecord?id=CVE-2026-110970"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793628544585,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110970"}],"ssvc":{"assessedAt":1793374189098,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Lack of traffic encryption in Płatnik","updatedAt":1793628544585}