Skip to content

Commit 0753bfe

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent ff95e5f commit 0753bfe

31 files changed

Lines changed: 436 additions & 65 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-xh35-43pp-33v2/GHSA-xh35-43pp-33v2.json‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xh35-43pp-33v2",
4-
"modified": "2026-02-03T00:30:19Z",
4+
"modified": "2026-03-17T15:36:17Z",
55
"published": "2026-02-03T00:30:19Z",
66
"aliases": [
77
"CVE-2025-61634"
88
],
99
"details": "Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php.\n\nThis issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Green"
@@ -25,7 +29,9 @@
2529
}
2630
],
2731
"database_specific": {
28-
"cwe_ids": [],
32+
"cwe_ids": [
33+
"CWE-22"
34+
],
2935
"severity": "LOW",
3036
"github_reviewed": false,
3137
"github_reviewed_at": null,

‎advisories/unreviewed/2026/03/GHSA-2w8x-224x-785m/GHSA-2w8x-224x-785m.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
],
4343
"database_specific": {
4444
"cwe_ids": [
45+
"CWE-325",
4546
"CWE-347"
4647
],
4748
"severity": "HIGH",

‎advisories/unreviewed/2026/03/GHSA-3wp7-xc34-h3f8/GHSA-3wp7-xc34-h3f8.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3wp7-xc34-h3f8",
4-
"modified": "2026-03-16T18:32:03Z",
4+
"modified": "2026-03-17T15:36:21Z",
55
"published": "2026-03-16T18:32:03Z",
66
"aliases": [
77
"CVE-2025-69783"
88
],
99
"details": "A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name (e.g., csrss.exe, edrsvc.exe, edrcon.exe). This allows unauthorized interaction with the OpenEDR kernel driver, granting access to privileged functionality such as configuration changes, process monitoring, and IOCTL communication that should be restricted to trusted components. While this issue alone does not directly grant SYSTEM privileges, it breaks OpenEDR's trust model and enables further exploitation leading to full local privilege escalation.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -32,8 +37,10 @@
3237
}
3338
],
3439
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
40+
"cwe_ids": [
41+
"CWE-250"
42+
],
43+
"severity": "HIGH",
3744
"github_reviewed": false,
3845
"github_reviewed_at": null,
3946
"nvd_published_at": "2026-03-16T16:16:13Z"

‎advisories/unreviewed/2026/03/GHSA-4fhm-p86v-hwpx/GHSA-4fhm-p86v-hwpx.json‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4fhm-p86v-hwpx",
4-
"modified": "2026-03-17T12:30:20Z",
4+
"modified": "2026-03-17T15:36:22Z",
55
"published": "2026-03-17T12:30:20Z",
66
"aliases": [
77
"CVE-2026-28779"
88
],
99
"details": "Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.\nThis allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.\n\nUsers are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -21,13 +26,17 @@
2126
{
2227
"type": "WEB",
2328
"url": "https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "http://www.openwall.com/lists/oss-security/2026/03/17/3"
2433
}
2534
],
2635
"database_specific": {
2736
"cwe_ids": [
2837
"CWE-668"
2938
],
30-
"severity": null,
39+
"severity": "HIGH",
3140
"github_reviewed": false,
3241
"github_reviewed_at": null,
3342
"nvd_published_at": "2026-03-17T11:16:11Z"

‎advisories/unreviewed/2026/03/GHSA-4hv2-747h-9q94/GHSA-4hv2-747h-9q94.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4hv2-747h-9q94",
4+
"modified": "2026-03-17T15:36:23Z",
5+
"published": "2026-03-17T15:36:23Z",
6+
"aliases": [
7+
"CVE-2026-4318"
8+
],
9+
"details": "A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Affected is the function strcpy of the file /goform/formApLbConfig. This manipulation of the argument loadBalanceNameOld causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4318"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/xiaoheshang404/cve/issues/1#issue-4026284809"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.351362"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.351362"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.772659"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-119"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-17T15:16:19Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-4m3h-wp5w-5hqh/GHSA-4m3h-wp5w-5hqh.json‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4m3h-wp5w-5hqh",
4-
"modified": "2026-03-17T12:30:19Z",
4+
"modified": "2026-03-17T15:36:22Z",
55
"published": "2026-03-17T12:30:19Z",
66
"aliases": [
77
"CVE-2026-26929"
88
],
99
"details": "Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to \"~\" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned.\n\n\nUsers are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -21,13 +26,17 @@
2126
{
2227
"type": "WEB",
2328
"url": "https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "http://www.openwall.com/lists/oss-security/2026/03/17/4"
2433
}
2534
],
2635
"database_specific": {
2736
"cwe_ids": [
2837
"CWE-732"
2938
],
30-
"severity": null,
39+
"severity": "HIGH",
3140
"github_reviewed": false,
3241
"github_reviewed_at": null,
3342
"nvd_published_at": "2026-03-17T11:16:11Z"

‎advisories/unreviewed/2026/03/GHSA-4w8j-4c9q-3cj8/GHSA-4w8j-4c9q-3cj8.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4w8j-4c9q-3cj8",
4-
"modified": "2026-03-16T18:32:03Z",
4+
"modified": "2026-03-17T15:36:22Z",
55
"published": "2026-03-16T18:32:03Z",
66
"aliases": [
77
"CVE-2025-66687"
88
],
99
"details": "Doom Launcher 3.8.1.0 is vulnerable to Directory Traversal due to missing file path validation during the extraction of game files",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-22"
34+
],
35+
"severity": "HIGH",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2026-03-16T18:16:04Z"

‎advisories/unreviewed/2026/03/GHSA-72r6-p2x3-g9gj/GHSA-72r6-p2x3-g9gj.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-72r6-p2x3-g9gj",
4-
"modified": "2026-03-17T03:30:21Z",
4+
"modified": "2026-03-17T15:36:22Z",
55
"published": "2026-03-17T00:31:34Z",
66
"aliases": [
77
"CVE-2026-4177"
88
],
99
"details": "YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.\n\nThe heap overflow occurs when class names exceed the initial 512-byte allocation.\n\nThe base64 decoder could read past the buffer end on trailing newlines.\n\nstrtok mutated n->type_id in place, corrupting shared node data.\n\nA memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -31,7 +36,7 @@
3136
"cwe_ids": [
3237
"CWE-122"
3338
],
34-
"severity": null,
39+
"severity": "CRITICAL",
3540
"github_reviewed": false,
3641
"github_reviewed_at": null,
3742
"nvd_published_at": "2026-03-16T23:16:21Z"

‎advisories/unreviewed/2026/03/GHSA-8x34-9q3v-h7g8/GHSA-8x34-9q3v-h7g8.json‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8x34-9q3v-h7g8",
4-
"modified": "2026-03-17T12:30:20Z",
4+
"modified": "2026-03-17T15:36:23Z",
55
"published": "2026-03-17T12:30:20Z",
66
"aliases": [
77
"CVE-2026-30911"
88
],
99
"details": "Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.\n\n\nUsers are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -21,13 +26,17 @@
2126
{
2227
"type": "WEB",
2328
"url": "https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "http://www.openwall.com/lists/oss-security/2026/03/17/2"
2433
}
2534
],
2635
"database_specific": {
2736
"cwe_ids": [
2837
"CWE-862"
2938
],
30-
"severity": null,
39+
"severity": "HIGH",
3140
"github_reviewed": false,
3241
"github_reviewed_at": null,
3342
"nvd_published_at": "2026-03-17T11:16:11Z"

‎advisories/unreviewed/2026/03/GHSA-94m9-vhc7-hv4q/GHSA-94m9-vhc7-hv4q.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-94m9-vhc7-hv4q",
4+
"modified": "2026-03-17T15:36:23Z",
5+
"published": "2026-03-17T15:36:23Z",
6+
"aliases": [
7+
"CVE-2025-13406"
8+
],
9+
"details": "NULL Pointer Dereference vulnerability in Softing Industrial Automation GmbH smartLink SW-HT (Webserver modules) allows HTTP DoS.This issue affects smartLink SW-HT: 1.43.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:L/U:Red"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13406"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-13406.html"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-13406.json"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-476"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-17T15:16:15Z"
39+
}
40+
}

0 commit comments

Comments
 (0)