Skip to content

Commit dd11d39

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-22rx-x655-8pgg GHSA-2f9j-ff2q-8qmx GHSA-46qm-5mvh-mmxr GHSA-7cgm-xpmc-6mg5 GHSA-87px-w7x5-8jjv GHSA-87wq-4q6j-76w5 GHSA-9539-rgx7-2v38 GHSA-98f5-7jq3-jhgq GHSA-c57j-h24c-r8gw GHSA-fwj3-7ppr-qcv6 GHSA-g6qw-3gmw-m78m GHSA-grpw-jgrw-ccqr GHSA-gvvx-mjmx-h5qh GHSA-h2mr-fr44-h45m GHSA-hfg3-mxf2-ggcg GHSA-jcvq-626f-f479 GHSA-mgcj-3w53-qpg2 GHSA-x57f-4q9r-qvpp
1 parent 715d94d commit dd11d39

18 files changed

Lines changed: 724 additions & 1 deletion

File tree

‎advisories/unreviewed/2026/03/GHSA-22rx-x655-8pgg/GHSA-22rx-x655-8pgg.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-22rx-x655-8pgg",
4+
"modified": "2026-03-18T00:30:54Z",
5+
"published": "2026-03-18T00:30:54Z",
6+
"aliases": [
7+
"CVE-2026-22727"
8+
],
9+
"details": "Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows any user who has bypassed the firewall to potentially replace droplets and therefore applications allowing them to access secure application information.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22727"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cloudfoundry.org/blog/cve-2026-22727-unprotected-internal-endpoints"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-306"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-17T23:16:17Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-2f9j-ff2q-8qmx/GHSA-2f9j-ff2q-8qmx.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2f9j-ff2q-8qmx",
4+
"modified": "2026-03-18T00:30:54Z",
5+
"published": "2026-03-18T00:30:54Z",
6+
"aliases": [
7+
"CVE-2026-32842"
8+
],
9+
"details": "Edimax GS-5008PL firmware version 1.00.54 and prior contain an insecure credential storage vulnerability that allows attackers to obtain administrator credentials by accessing configuration backup files. Attackers can download the config.bin file through fupload.cgi to extract plaintext username and password fields for unauthorized administrative access.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32842"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/us/smb_legacy_switches/gs-5008pl"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.edimax.com/edimax/merchandise/merchandise_list/data/edimax/us/smb_legacy_products"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/edimax-gs-5008pl-admin-credentials-stored-in-cleartext"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-312"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-17T22:16:15Z"
47+
}
48+
}

‎advisories/unreviewed/2026/03/GHSA-46qm-5mvh-mmxr/GHSA-46qm-5mvh-mmxr.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-46qm-5mvh-mmxr",
4+
"modified": "2026-03-18T00:30:54Z",
5+
"published": "2026-03-18T00:30:54Z",
6+
"aliases": [
7+
"CVE-2026-4349"
8+
],
9+
"details": "A vulnerability was determined in Duende IdentityServer 4. The affected element is an unknown function of the file /connect/authorize of the component Token Renewal Endpoint. This manipulation of the argument id_token_hint causes improper authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4349"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.351380"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.351380"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.772071"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-287"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-17T22:16:15Z"
47+
}
48+
}

‎advisories/unreviewed/2026/03/GHSA-7cgm-xpmc-6mg5/GHSA-7cgm-xpmc-6mg5.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7cgm-xpmc-6mg5",
4+
"modified": "2026-03-18T00:30:55Z",
5+
"published": "2026-03-18T00:30:55Z",
6+
"aliases": [
7+
"CVE-2026-4355"
8+
],
9+
"details": "A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4355"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/CVE-Hunters/CVE/blob/main/i-educar/XSS_educar_matricula_reclassificar_cad.php.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.351394"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.351394"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.772839"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-18T00:16:20Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-87px-w7x5-8jjv/GHSA-87px-w7x5-8jjv.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-87px-w7x5-8jjv",
4+
"modified": "2026-03-18T00:30:55Z",
5+
"published": "2026-03-18T00:30:55Z",
6+
"aliases": [
7+
"CVE-2026-4354"
8+
],
9+
"details": "A vulnerability was identified in TRENDnet TEW-824DRU 1.010B01/1.04B01. The impacted element is the function sub_420A78 of the file apply_sec.cgi of the component Web Interface. Such manipulation of the argument Language leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4354"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/i-Corner/cve/issues/41"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.351381"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.351381"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.772660"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-18T00:16:20Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-87wq-4q6j-76w5/GHSA-87wq-4q6j-76w5.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-87wq-4q6j-76w5",
4+
"modified": "2026-03-18T00:30:54Z",
5+
"published": "2026-03-18T00:30:54Z",
6+
"aliases": [
7+
"CVE-2026-32841"
8+
],
9+
"details": "Edimax GS-5008PL firmware version 1.00.54 and prior contain an authentication bypass vulnerability that allows unauthenticated attackers to access the management interface. Attackers can exploit the global authentication flag mechanism to gain administrative access without credentials after any user authenticates, enabling unauthorized password changes, firmware uploads, and configuration modifications.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32841"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/us/smb_legacy_switches/gs-5008pl"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.edimax.com/edimax/merchandise/merchandise_list/data/edimax/us/smb_legacy_products"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/edimax-gs-5008pl-global-authentication-state-across-all-clients"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-1108"
42+
],
43+
"severity": "CRITICAL",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-17T22:16:15Z"
47+
}
48+
}

‎advisories/unreviewed/2026/03/GHSA-9539-rgx7-2v38/GHSA-9539-rgx7-2v38.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9539-rgx7-2v38",
4+
"modified": "2026-03-18T00:30:54Z",
5+
"published": "2026-03-18T00:30:54Z",
6+
"aliases": [
7+
"CVE-2026-32838"
8+
],
9+
"details": "Edimax GS-5008PL firmware version 1.00.54 and prior use cleartext HTTP for the web management interface without implementing TLS or SSL encryption. Attackers on the same network can intercept management traffic to capture administrator credentials and sensitive configuration data.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32838"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/us/smb_legacy_switches/gs-5008pl"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.edimax.com/edimax/merchandise/merchandise_list/data/edimax/us/smb_legacy_products"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/edimax-gs-5008pl-transmits-credentials-over-cleartext-http"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-319"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-17T22:16:14Z"
47+
}
48+
}

‎advisories/unreviewed/2026/03/GHSA-98f5-7jq3-jhgq/GHSA-98f5-7jq3-jhgq.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-98f5-7jq3-jhgq",
4+
"modified": "2026-03-18T00:30:54Z",
5+
"published": "2026-03-18T00:30:54Z",
6+
"aliases": [
7+
"CVE-2025-14031"
8+
],
9+
"details": "IBM Sterling B2B Integrator and and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 could allow an unauthenticated attacker to send a specially crafted request that causes the application to crash.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14031"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.ibm.com/support/pages/node/7266520"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-77"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-17T23:16:15Z"
35+
}
36+
}

0 commit comments

Comments
 (0)