Skip to content

Commit 2f09d5e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent a998b93 commit 2f09d5e

File tree

26 files changed

+879
-11
lines changed

26 files changed

+879
-11
lines changed

‎advisories/unreviewed/2026/03/GHSA-64fw-jx9p-5j24/GHSA-64fw-jx9p-5j24.json‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-64fw-jx9p-5j24",
4-
"modified": "2026-03-12T21:34:40Z",
4+
"modified": "2026-04-17T18:31:41Z",
55
"published": "2026-03-10T18:31:23Z",
66
"aliases": [
77
"CVE-2026-3854"
@@ -27,25 +27,49 @@
2727
"type": "WEB",
2828
"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.25"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.19"
3337
},
38+
{
39+
"type": "WEB",
40+
"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.20"
41+
},
3442
{
3543
"type": "WEB",
3644
"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15"
3745
},
46+
{
47+
"type": "WEB",
48+
"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.16"
49+
},
3850
{
3951
"type": "WEB",
4052
"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12"
4153
},
54+
{
55+
"type": "WEB",
56+
"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.13"
57+
},
4258
{
4359
"type": "WEB",
4460
"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6"
4561
},
62+
{
63+
"type": "WEB",
64+
"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.7"
65+
},
4666
{
4767
"type": "WEB",
4868
"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.4"
4973
}
5074
],
5175
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-c76v-r5mr-9fpq/GHSA-c76v-r5mr-9fpq.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,9 @@
2929
}
3030
],
3131
"database_specific": {
32-
"cwe_ids": [],
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
3335
"severity": "CRITICAL",
3436
"github_reviewed": false,
3537
"github_reviewed_at": null,

‎advisories/unreviewed/2026/03/GHSA-cm99-m826-vgg7/GHSA-cm99-m826-vgg7.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cm99-m826-vgg7",
4-
"modified": "2026-03-24T15:30:29Z",
4+
"modified": "2026-04-17T18:31:42Z",
55
"published": "2026-03-24T15:30:29Z",
66
"aliases": [
77
"CVE-2026-4775"
@@ -26,6 +26,10 @@
2626
{
2727
"type": "WEB",
2828
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450768"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html"
2933
}
3034
],
3135
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-h68h-qcxp-qv6v/GHSA-h68h-qcxp-qv6v.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,9 @@
2929
}
3030
],
3131
"database_specific": {
32-
"cwe_ids": [],
32+
"cwe_ids": [
33+
"CWE-538"
34+
],
3335
"severity": "HIGH",
3436
"github_reviewed": false,
3537
"github_reviewed_at": null,

‎advisories/unreviewed/2026/04/GHSA-28p4-5j5m-924h/GHSA-28p4-5j5m-924h.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-28p4-5j5m-924h",
4+
"modified": "2026-04-17T18:31:50Z",
5+
"published": "2026-04-17T18:31:50Z",
6+
"aliases": [
7+
"CVE-2025-40899"
8+
],
9+
"details": "A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authenticated user with custom fields privileges can define a malicious custom field containing a JavaScript payload. When the victim views the Assets or Nodes pages, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40899"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://security.nozominetworks.com/NN-2026:2-01"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-15T09:16:30Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-4h67-fm2h-4qrp/GHSA-4h67-fm2h-4qrp.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4h67-fm2h-4qrp",
4+
"modified": "2026-04-17T18:31:52Z",
5+
"published": "2026-04-17T18:31:52Z",
6+
"aliases": [
7+
"CVE-2026-21733"
8+
],
9+
"details": "Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and files.\n\nThis is caused by improper handling of GPU memory reservation protections.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21733"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-280"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-17T17:16:35Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-54pv-34f9-m4mq/GHSA-54pv-34f9-m4mq.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-54pv-34f9-m4mq",
4+
"modified": "2026-04-17T18:31:53Z",
5+
"published": "2026-04-17T18:31:53Z",
6+
"aliases": [
7+
"CVE-2026-40518"
8+
],
9+
"details": "ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary file write vulnerability in bootstrap-mode custom-agent creation where the agent name validation is bypassed. Attackers can supply traversal-style values or absolute paths as the agent name to influence directory creation and write files outside the intended custom-agent directory, potentially achieving arbitrary file write on the system subject to filesystem permissions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40518"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bytedance/deer-flow/pull/2274"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/bytedance/deer-flow/commit/2176b2bbfccfce25ceee08318813f96d843a13fd"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/bytedance-deerflow-path-traversal-and-arbitrary-file-write-via-bootstrap-mode"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-22"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-04-17T17:17:09Z"
47+
}
48+
}

‎advisories/unreviewed/2026/04/GHSA-574f-3g2m-x479/GHSA-574f-3g2m-x479.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-574f-3g2m-x479",
4+
"modified": "2026-04-17T18:31:50Z",
5+
"published": "2026-04-17T18:31:50Z",
6+
"aliases": [
7+
"CVE-2025-14813"
8+
],
9+
"details": "Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher.\n\nGOSTCTR implementation unable to process more than 255 blocks correctly.\n\n\nThis issue affects BC-JAVA: from 1.59 before 1.84.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Red"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-327"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-15T10:16:38Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-57pr-fgr5-wqvx/GHSA-57pr-fgr5-wqvx.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-57pr-fgr5-wqvx",
4+
"modified": "2026-04-17T18:31:50Z",
5+
"published": "2026-04-17T18:31:50Z",
6+
"aliases": [
7+
"CVE-2025-40897"
8+
],
9+
"details": "An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. An authenticated user with view-only privileges for the Threat Intelligence functionality can perform administrative actions on it, altering the rules configuration, and/or affecting their availability.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40897"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://security.nozominetworks.com/NN-2026:1-01"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-863"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-15T09:16:29Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-785m-9q28-jp3m/GHSA-785m-9q28-jp3m.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-785m-9q28-jp3m",
4+
"modified": "2026-04-17T18:31:53Z",
5+
"published": "2026-04-17T18:31:53Z",
6+
"aliases": [
7+
"CVE-2026-40516"
8+
],
9+
"details": "OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. Attackers can influence an agent session to invoke these tools against loopback, RFC1918, link-local, or other non-public addresses to read response bodies from local development services, cloud metadata endpoints, admin panels, or other private HTTP services reachable from the victim host.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40516"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/HKUDS/OpenHarness/pull/92"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/HKUDS/OpenHarness/commit/bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/openharness-ssrf-via-web-fetch-and-web-search"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-918"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-04-17T17:17:09Z"
47+
}
48+
}

0 commit comments

Comments
 (0)