Skip to content

Commit 14964a3

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-24g2-fgx6-x4g7 GHSA-8rxc-fxqr-8jx3 GHSA-f28j-gx5r-p78j GHSA-g37f-4r6m-qg8m GHSA-mwg5-3pp3-6h5w GHSA-pqvv-q69f-46xj GHSA-q5mc-rx2x-2mqv GHSA-qvmh-94p6-pp46 GHSA-5pgv-4jf4-9r43 GHSA-7m2j-268v-rc6r GHSA-c9qp-qc83-7rwj GHSA-cwq2-35x4-44pq GHSA-g88c-8gfj-6c98 GHSA-vf7g-wm62-vfxh
1 parent baaacf3 commit 14964a3

File tree

14 files changed

+363
-15
lines changed

14 files changed

+363
-15
lines changed

‎advisories/unreviewed/2026/03/GHSA-24g2-fgx6-x4g7/GHSA-24g2-fgx6-x4g7.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-24g2-fgx6-x4g7",
4-
"modified": "2026-03-23T12:30:29Z",
4+
"modified": "2026-04-18T06:30:14Z",
55
"published": "2026-03-23T12:30:29Z",
66
"aliases": [
77
"CVE-2026-4581"
@@ -42,6 +42,18 @@
4242
{
4343
"type": "WEB",
4444
"url": "https://vuldb.com/?submit.775211"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/submit/775211"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/352418"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/vuln/352418/cti"
4557
}
4658
],
4759
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-8rxc-fxqr-8jx3/GHSA-8rxc-fxqr-8jx3.json‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8rxc-fxqr-8jx3",
4-
"modified": "2026-03-23T21:30:52Z",
4+
"modified": "2026-04-18T06:30:14Z",
55
"published": "2026-03-23T21:30:52Z",
66
"aliases": [
77
"CVE-2026-4597"
@@ -38,6 +38,22 @@
3838
{
3939
"type": "WEB",
4040
"url": "https://vuldb.com/?submit.775635"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/submit/775635"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/submit/780377"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/352435"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/vuln/352435/cti"
4157
}
4258
],
4359
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-f28j-gx5r-p78j/GHSA-f28j-gx5r-p78j.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f28j-gx5r-p78j",
4-
"modified": "2026-03-23T15:30:45Z",
4+
"modified": "2026-04-18T06:30:14Z",
55
"published": "2026-03-23T15:30:45Z",
66
"aliases": [
77
"CVE-2026-4589"
@@ -35,6 +35,18 @@
3535
"type": "WEB",
3636
"url": "https://vuldb.com/?submit.775467"
3737
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/submit/775467"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/352425"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/352425/cti"
49+
},
3850
{
3951
"type": "WEB",
4052
"url": "https://vulnplus-note.wetolink.com/share/UTZQq38f9VyI"

‎advisories/unreviewed/2026/03/GHSA-g37f-4r6m-qg8m/GHSA-g37f-4r6m-qg8m.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-g37f-4r6m-qg8m",
4-
"modified": "2026-03-22T09:30:27Z",
4+
"modified": "2026-04-18T06:30:13Z",
55
"published": "2026-03-22T09:30:27Z",
66
"aliases": [
77
"CVE-2026-4541"
@@ -58,6 +58,18 @@
5858
{
5959
"type": "WEB",
6060
"url": "https://vuldb.com/?submit.774687"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://vuldb.com/submit/774687"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://vuldb.com/vuln/352358"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://vuldb.com/vuln/352358/cti"
6173
}
6274
],
6375
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-mwg5-3pp3-6h5w/GHSA-mwg5-3pp3-6h5w.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mwg5-3pp3-6h5w",
4-
"modified": "2026-03-22T09:30:27Z",
4+
"modified": "2026-04-18T06:30:13Z",
55
"published": "2026-03-22T09:30:27Z",
66
"aliases": [
77
"CVE-2026-4542"
@@ -35,6 +35,18 @@
3535
"type": "WEB",
3636
"url": "https://vuldb.com/?submit.774689"
3737
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/submit/774689"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/352359"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/352359/cti"
49+
},
3850
{
3951
"type": "WEB",
4052
"url": "https://www.yuque.com/la12138/pa2fpb/vlyutc51eb7vhwaz?singleDoc"

‎advisories/unreviewed/2026/03/GHSA-pqvv-q69f-46xj/GHSA-pqvv-q69f-46xj.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pqvv-q69f-46xj",
4-
"modified": "2026-03-23T03:31:40Z",
4+
"modified": "2026-04-18T06:30:13Z",
55
"published": "2026-03-23T03:31:40Z",
66
"aliases": [
77
"CVE-2026-4568"
@@ -39,6 +39,18 @@
3939
"type": "WEB",
4040
"url": "https://vuldb.com/?submit.775161"
4141
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/submit/775161"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/352405"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/352405/cti"
53+
},
4254
{
4355
"type": "WEB",
4456
"url": "https://www.sourcecodester.com"

‎advisories/unreviewed/2026/03/GHSA-q5mc-rx2x-2mqv/GHSA-q5mc-rx2x-2mqv.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-q5mc-rx2x-2mqv",
4-
"modified": "2026-03-23T12:30:29Z",
4+
"modified": "2026-04-18T06:30:14Z",
55
"published": "2026-03-23T12:30:29Z",
66
"aliases": [
77
"CVE-2026-4582"
@@ -38,6 +38,18 @@
3838
{
3939
"type": "WEB",
4040
"url": "https://vuldb.com/?submit.775433"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/submit/775433"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/352419"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/352419/cti"
4153
}
4254
],
4355
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-qvmh-94p6-pp46/GHSA-qvmh-94p6-pp46.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qvmh-94p6-pp46",
4-
"modified": "2026-03-23T21:30:51Z",
4+
"modified": "2026-04-18T06:30:14Z",
55
"published": "2026-03-23T21:30:51Z",
66
"aliases": [
77
"CVE-2026-4595"
@@ -42,6 +42,18 @@
4242
{
4343
"type": "WEB",
4444
"url": "https://vuldb.com/?submit.775623"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/submit/775623"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/352433"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/vuln/352433/cti"
4557
}
4658
],
4759
"database_specific": {

‎advisories/unreviewed/2026/04/GHSA-5pgv-4jf4-9r43/GHSA-5pgv-4jf4-9r43.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5pgv-4jf4-9r43",
4+
"modified": "2026-04-18T06:30:14Z",
5+
"published": "2026-04-18T06:30:14Z",
6+
"aliases": [
7+
"CVE-2026-41253"
8+
],
9+
"details": "In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka \"hypothetical in-band signaling abuse.\" This occurs because iTerm2 accepts the SSH conductor protocol from terminal output that does not originate from a legitimate conductor session.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41253"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30b884a16617cd5495899f86"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://blog.calif.io/p/mad-bugs-even-cat-readmetxt-is-not"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://iterm2.com/downloads.html"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://news.ycombinator.com/item?id=47809190"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-829"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-04-18T06:16:17Z"
47+
}
48+
}

‎advisories/unreviewed/2026/04/GHSA-7m2j-268v-rc6r/GHSA-7m2j-268v-rc6r.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7m2j-268v-rc6r",
4+
"modified": "2026-04-18T06:30:14Z",
5+
"published": "2026-04-18T06:30:14Z",
6+
"aliases": [
7+
"CVE-2026-4801"
8+
],
9+
"details": "The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via external iCal feed data in all versions up to, and including, 3.1.16 due to insufficient output escaping of event titles, descriptions, and locations fetched from external iCal feeds in the Events block rendering function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4801"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/coblocks/tags/3.1.16/src/blocks/events/index.php#L218"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/coblocks/tags/3.1.16/src/blocks/events/index.php#L245"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/coblocks/tags/3.1.16/src/blocks/events/index.php#L246"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/coblocks/tags/3.1.16/src/blocks/events/index.php#L255"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/browser/coblocks/tags/3.1.16/src/blocks/events/index.php#L91"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/browser/coblocks/trunk/src/blocks/events/index.php#L218"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://plugins.trac.wordpress.org/browser/coblocks/trunk/src/blocks/events/index.php#L245"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://plugins.trac.wordpress.org/browser/coblocks/trunk/src/blocks/events/index.php#L246"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://plugins.trac.wordpress.org/browser/coblocks/trunk/src/blocks/events/index.php#L255"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://plugins.trac.wordpress.org/browser/coblocks/trunk/src/blocks/events/index.php#L91"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://plugins.trac.wordpress.org/changeset/3475789/coblocks/trunk/src/blocks/events/index.php"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fcoblocks/tags/3.1.16&new_path=%2Fcoblocks/tags/3.1.17"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bde0aef3-aa61-4ee7-9cbf-9f51cb5ac700?source=cve"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-79"
78+
],
79+
"severity": "MODERATE",
80+
"github_reviewed": false,
81+
"github_reviewed_at": null,
82+
"nvd_published_at": "2026-04-18T05:16:23Z"
83+
}
84+
}

0 commit comments

Comments
 (0)