Skip to content

Commit 1cf9c2c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent b48dc4f commit 1cf9c2c

File tree

97 files changed

+3867
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

97 files changed

+3867
-0
lines changed

‎advisories/unreviewed/2026/04/GHSA-24h2-5vgh-pf37/GHSA-24h2-5vgh-pf37.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-24h2-5vgh-pf37",
4+
"modified": "2026-04-09T00:32:01Z",
5+
"published": "2026-04-09T00:32:01Z",
6+
"aliases": [
7+
"CVE-2026-5824"
8+
],
9+
"details": "A security vulnerability has been detected in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /userchecklogin.php. Such manipulation of the argument userid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5824"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/lonelyuan/vunls/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/788302"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/356271"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/356271/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-09T00:16:21Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-24v7-w2x9-2cxh/GHSA-24v7-w2x9-2cxh.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-24v7-w2x9-2cxh",
4+
"modified": "2026-04-09T00:32:00Z",
5+
"published": "2026-04-09T00:32:00Z",
6+
"aliases": [
7+
"CVE-2026-5887"
8+
],
9+
"details": "Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypass download restrictions via a crafted HTML page. (Chromium security severity: Medium)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5887"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/486079015"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-20"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-04-08T22:16:28Z"
34+
}
35+
}

‎advisories/unreviewed/2026/04/GHSA-26fq-x95v-v55j/GHSA-26fq-x95v-v55j.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-26fq-x95v-v55j",
4+
"modified": "2026-04-09T00:32:01Z",
5+
"published": "2026-04-09T00:32:00Z",
6+
"aliases": [
7+
"CVE-2026-5918"
8+
],
9+
"details": "Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5918"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/490139441"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-04-08T22:16:31Z"
32+
}
33+
}

‎advisories/unreviewed/2026/04/GHSA-26q6-hm4f-j23h/GHSA-26q6-hm4f-j23h.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-26q6-hm4f-j23h",
4+
"modified": "2026-04-09T00:32:01Z",
5+
"published": "2026-04-09T00:32:01Z",
6+
"aliases": [
7+
"CVE-2026-4332"
8+
],
9+
"details": "GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4332"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://hackerone.com/reports/3600345"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/593853"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-08T23:16:59Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-2fw9-cxch-qx5h/GHSA-2fw9-cxch-qx5h.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2fw9-cxch-qx5h",
4+
"modified": "2026-04-09T00:32:00Z",
5+
"published": "2026-04-09T00:32:00Z",
6+
"aliases": [
7+
"CVE-2026-5890"
8+
],
9+
"details": "Race in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5890"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/487259772"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-362"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-04-08T22:16:28Z"
34+
}
35+
}

‎advisories/unreviewed/2026/04/GHSA-2h64-4pg7-rq8p/GHSA-2h64-4pg7-rq8p.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2h64-4pg7-rq8p",
4+
"modified": "2026-04-09T00:32:00Z",
5+
"published": "2026-04-09T00:32:00Z",
6+
"aliases": [
7+
"CVE-2026-5904"
8+
],
9+
"details": "Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5904"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/483851888"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-416"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-04-08T22:16:30Z"
34+
}
35+
}

‎advisories/unreviewed/2026/04/GHSA-2m8h-6748-cf32/GHSA-2m8h-6748-cf32.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2m8h-6748-cf32",
4+
"modified": "2026-04-09T00:31:59Z",
5+
"published": "2026-04-09T00:31:59Z",
6+
"aliases": [
7+
"CVE-2026-40029"
8+
],
9+
"details": "parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename with embedded shell metacharacters that execute arbitrary commands on the forensic examiner's machine during USB artifact parsing.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40029"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/khyrenz/parseusbs/pull/10"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/khyrenz/parseusbs/commit/99f05996494e7e41ea0c7e13145ba20eb793e46b"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://mobasi.ai/sentinel"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.vulncheck.com/advisories/parseusbs-command-injection-via-crafted-lnk-filename"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-78"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-04-08T22:16:23Z"
51+
}
52+
}

‎advisories/unreviewed/2026/04/GHSA-2x9w-3q66-8rrm/GHSA-2x9w-3q66-8rrm.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2x9w-3q66-8rrm",
4+
"modified": "2026-04-09T00:32:00Z",
5+
"published": "2026-04-09T00:32:00Z",
6+
"aliases": [
7+
"CVE-2026-5897"
8+
],
9+
"details": "Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5897"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/419921726"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-04-08T22:16:29Z"
32+
}
33+
}

‎advisories/unreviewed/2026/04/GHSA-32x4-hg4x-w43c/GHSA-32x4-hg4x-w43c.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-32x4-hg4x-w43c",
4+
"modified": "2026-04-09T00:31:59Z",
5+
"published": "2026-04-09T00:31:59Z",
6+
"aliases": [
7+
"CVE-2026-5875"
8+
],
9+
"details": "Policy bypass in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5875"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/430198264"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-04-08T22:16:27Z"
32+
}
33+
}

0 commit comments

Comments
 (0)