Skip to content

Commit 5c61ee2

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent d20ef69 commit 5c61ee2

81 files changed

Lines changed: 1846 additions & 155 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/03/GHSA-272x-gpf6-6c9f/GHSA-272x-gpf6-6c9f.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-272x-gpf6-6c9f",
4+
"modified": "2026-03-24T21:31:24Z",
5+
"published": "2026-03-24T21:31:24Z",
6+
"aliases": [
7+
"CVE-2026-24158"
8+
],
9+
"details": "NVIDIA Triton Inference Server contains a vulnerability in the HTTP endpoint where an attacker may cause a denial of service by providing a large compressed payload. A successful exploit of this vulnerability may lead to denial of service.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24158"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5790"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24158"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-789"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-24T21:16:27Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-2h5x-h7x4-hm9h/GHSA-2h5x-h7x4-hm9h.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2h5x-h7x4-hm9h",
4+
"modified": "2026-03-24T21:31:23Z",
5+
"published": "2026-03-24T21:31:23Z",
6+
"aliases": [
7+
"CVE-2026-23920"
8+
],
9+
"details": "Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23920"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.zabbix.com/browse/ZBX-27639"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-78"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-24T19:16:49Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-2mf6-25gq-26v8/GHSA-2mf6-25gq-26v8.json‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2mf6-25gq-26v8",
4-
"modified": "2026-03-24T15:30:28Z",
4+
"modified": "2026-03-24T21:31:22Z",
55
"published": "2026-03-24T15:30:28Z",
66
"aliases": [
77
"CVE-2026-4704"
88
],
99
"details": "Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -25,11 +30,19 @@
2530
{
2631
"type": "WEB",
2732
"url": "https://www.mozilla.org/security/advisories/mfsa2026-22"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-23"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-24"
2841
}
2942
],
3043
"database_specific": {
3144
"cwe_ids": [],
32-
"severity": null,
45+
"severity": "HIGH",
3346
"github_reviewed": false,
3447
"github_reviewed_at": null,
3548
"nvd_published_at": "2026-03-24T13:16:06Z"

‎advisories/unreviewed/2026/03/GHSA-2qjw-h8g8-r86f/GHSA-2qjw-h8g8-r86f.json‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2qjw-h8g8-r86f",
4-
"modified": "2026-03-24T15:30:28Z",
4+
"modified": "2026-03-24T21:31:22Z",
55
"published": "2026-03-24T15:30:28Z",
66
"aliases": [
77
"CVE-2026-4699"
88
],
99
"details": "Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -29,11 +34,21 @@
2934
{
3035
"type": "WEB",
3136
"url": "https://www.mozilla.org/security/advisories/mfsa2026-22"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-23"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-24"
3245
}
3346
],
3447
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
48+
"cwe_ids": [
49+
"CWE-754"
50+
],
51+
"severity": "HIGH",
3752
"github_reviewed": false,
3853
"github_reviewed_at": null,
3954
"nvd_published_at": "2026-03-24T13:16:05Z"

‎advisories/unreviewed/2026/03/GHSA-2r77-x4qh-mhc3/GHSA-2r77-x4qh-mhc3.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2r77-x4qh-mhc3",
4-
"modified": "2026-03-24T15:30:29Z",
4+
"modified": "2026-03-24T21:31:23Z",
55
"published": "2026-03-24T15:30:29Z",
66
"aliases": [
77
"CVE-2026-4726"
@@ -21,6 +21,10 @@
2121
{
2222
"type": "WEB",
2323
"url": "https://www.mozilla.org/security/advisories/mfsa2026-20"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-23"
2428
}
2529
],
2630
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-382w-q5p9-3f2h/GHSA-382w-q5p9-3f2h.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-382w-q5p9-3f2h",
4-
"modified": "2026-03-24T15:30:29Z",
4+
"modified": "2026-03-24T21:31:23Z",
55
"published": "2026-03-24T15:30:29Z",
66
"aliases": [
77
"CVE-2026-33554"
88
],
99
"details": "ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were found to have exploitable buffer overflows on response messages. They are: \"ipmi-oem dell get-last-post-code - get the last POST code and string describing the error on some Dell servers,\" \"ipmi-oem supermicro extra-firmware-info - get extra firmware info on Supermicro servers,\" and \"ipmi-oem wistron read-proprietary-string - read a proprietary string on Wistron servers.\"",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -32,8 +37,10 @@
3237
}
3338
],
3439
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
40+
"cwe_ids": [
41+
"CWE-121"
42+
],
43+
"severity": "HIGH",
3744
"github_reviewed": false,
3845
"github_reviewed_at": null,
3946
"nvd_published_at": "2026-03-24T15:16:35Z"

‎advisories/unreviewed/2026/03/GHSA-3rrq-fwhx-9wq4/GHSA-3rrq-fwhx-9wq4.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3rrq-fwhx-9wq4",
4-
"modified": "2026-03-24T15:30:27Z",
4+
"modified": "2026-03-24T21:31:20Z",
55
"published": "2026-03-24T15:30:27Z",
66
"aliases": [
77
"CVE-2026-4684"
@@ -34,6 +34,14 @@
3434
{
3535
"type": "WEB",
3636
"url": "https://www.mozilla.org/security/advisories/mfsa2026-22"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-23"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-24"
3745
}
3846
],
3947
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-3w95-ccww-mwv8/GHSA-3w95-ccww-mwv8.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3w95-ccww-mwv8",
4+
"modified": "2026-03-24T21:31:24Z",
5+
"published": "2026-03-24T21:31:24Z",
6+
"aliases": [
7+
"CVE-2026-24151"
8+
],
9+
"details": "NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously crafted input. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24151"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5769"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24151"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-502"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-24T21:16:27Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-4mp5-p9jh-3rv5/GHSA-4mp5-p9jh-3rv5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4mp5-p9jh-3rv5",
4+
"modified": "2026-03-24T21:31:23Z",
5+
"published": "2026-03-24T21:31:23Z",
6+
"aliases": [
7+
"CVE-2026-23923"
8+
],
9+
"details": "An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23923"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.zabbix.com/browse/ZBX-27641"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-470"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-24T19:16:50Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-4p49-pghr-968w/GHSA-4p49-pghr-968w.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4p49-pghr-968w",
4+
"modified": "2026-03-24T21:31:24Z",
5+
"published": "2026-03-24T21:31:24Z",
6+
"aliases": [
7+
"CVE-2026-4371"
8+
],
9+
"details": "A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4371"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2023493"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-23"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-24"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [],
32+
"severity": null,
33+
"github_reviewed": false,
34+
"github_reviewed_at": null,
35+
"nvd_published_at": "2026-03-24T21:16:29Z"
36+
}
37+
}

0 commit comments

Comments
 (0)