Skip to content

Commit b9d9014

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2g4m-9v5x-mfwr GHSA-3385-wm72-hh52 GHSA-438q-mm87-r2p9 GHSA-593x-hf83-hmrv GHSA-65q8-p76v-6qj6 GHSA-8pjm-jgvr-53w9 GHSA-9pr2-m366-8728 GHSA-ccf6-mw22-wphc GHSA-f28w-75x8-62f8 GHSA-hvcr-3gq9-w43p GHSA-mxf6-4cfw-jjw8 GHSA-rc44-pmvh-crfp GHSA-v5c3-292h-hqp3 GHSA-wjmf-99rj-jgch GHSA-wv84-v8gw-jhh5
1 parent 89b61d7 commit b9d9014

File tree

15 files changed

+621
-0
lines changed

15 files changed

+621
-0
lines changed

‎advisories/unreviewed/2026/03/GHSA-2g4m-9v5x-mfwr/GHSA-2g4m-9v5x-mfwr.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2g4m-9v5x-mfwr",
4+
"modified": "2026-03-31T09:31:41Z",
5+
"published": "2026-03-31T09:31:41Z",
6+
"aliases": [
7+
"CVE-2025-10553"
8+
],
9+
"details": "A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10553"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10553"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-31T09:16:21Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-3385-wm72-hh52/GHSA-3385-wm72-hh52.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3385-wm72-hh52",
4+
"modified": "2026-03-31T09:31:41Z",
5+
"published": "2026-03-31T09:31:41Z",
6+
"aliases": [
7+
"CVE-2025-41357"
8+
],
9+
"details": "Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending him/her a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.\nIt affects 'host' parameter in '/diagdns.php' endpoint.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41357"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-anon-proxy-server"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-31T09:16:22Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-438q-mm87-r2p9/GHSA-438q-mm87-r2p9.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-438q-mm87-r2p9",
4+
"modified": "2026-03-31T09:31:41Z",
5+
"published": "2026-03-31T09:31:41Z",
6+
"aliases": [
7+
"CVE-2025-10551"
8+
],
9+
"details": "A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10551"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10551"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-31T09:16:21Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-593x-hf83-hmrv/GHSA-593x-hf83-hmrv.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-593x-hf83-hmrv",
4+
"modified": "2026-03-31T09:31:41Z",
5+
"published": "2026-03-31T09:31:41Z",
6+
"aliases": [
7+
"CVE-2026-5186"
8+
],
9+
"details": "A weakness has been identified in Nothings stb up to 2.30. This impacts the function stbi__load_gif_main of the file stb_image.h of the component Multi-frame GIF File Handler. This manipulation causes double free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5186"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/submit/780395"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/vuln/354254"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/354254/cti"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-119"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-31T08:15:54Z"
47+
}
48+
}

‎advisories/unreviewed/2026/03/GHSA-65q8-p76v-6qj6/GHSA-65q8-p76v-6qj6.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-65q8-p76v-6qj6",
4+
"modified": "2026-03-31T09:31:42Z",
5+
"published": "2026-03-31T09:31:42Z",
6+
"aliases": [
7+
"CVE-2026-3107"
8+
],
9+
"details": "Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redacted/index.php?page=items'. The application fails to properly sanitize and encode user-input data during the import process, allowing malicious JavaScript payloads to be persistently stored in the database. When other users view the imported passwords, the payload is automatically executed in their browsers, resulting in a stored XSS condition at the endpoint 'redacted/index.php?page=items'. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of multiple users and the administrator, which can lead to session hijacking, credential theft, privilege abuse, and compromise of application integrity.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3107"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-teampass"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-31T09:16:22Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-8pjm-jgvr-53w9/GHSA-8pjm-jgvr-53w9.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8pjm-jgvr-53w9",
4+
"modified": "2026-03-31T09:31:41Z",
5+
"published": "2026-03-31T09:31:41Z",
6+
"aliases": [
7+
"CVE-2025-10559"
8+
],
9+
"details": "A Path Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to read or write files in specific directories on the server.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10559"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10559"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-22"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-31T09:16:21Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-9pr2-m366-8728/GHSA-9pr2-m366-8728.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9pr2-m366-8728",
4+
"modified": "2026-03-31T09:31:42Z",
5+
"published": "2026-03-31T09:31:42Z",
6+
"aliases": [
7+
"CVE-2026-5201"
8+
],
9+
"details": "A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5201"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2026-5201"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453291"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/304"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-122"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-31T09:16:23Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-ccf6-mw22-wphc/GHSA-ccf6-mw22-wphc.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ccf6-mw22-wphc",
4+
"modified": "2026-03-31T09:31:41Z",
5+
"published": "2026-03-31T09:31:41Z",
6+
"aliases": [
7+
"CVE-2026-5185"
8+
],
9+
"details": "A security flaw has been discovered in Nothings stb_image up to 2.30. This affects the function stbi__gif_load_next of the file stb_image.h of the component Multi-frame GIF File Handler. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5185"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/submit/780390"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/vuln/354253"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/354253/cti"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-119"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-31T07:16:12Z"
47+
}
48+
}

‎advisories/unreviewed/2026/03/GHSA-f28w-75x8-62f8/GHSA-f28w-75x8-62f8.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f28w-75x8-62f8",
4+
"modified": "2026-03-31T09:31:41Z",
5+
"published": "2026-03-31T09:31:41Z",
6+
"aliases": [
7+
"CVE-2025-41356"
8+
],
9+
"details": "Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending him/her a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. It affects \n'host' parameter in '/diagconnect.php'\n\n endpoint.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41356"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-anon-proxy-server"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-31T09:16:22Z"
35+
}
36+
}

0 commit comments

Comments
 (0)