Skip to content

Commit ff210b0

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 4594a94 commit ff210b0

File tree

38 files changed

+743
-33
lines changed

38 files changed

+743
-33
lines changed

‎advisories/unreviewed/2025/09/GHSA-4whh-r2w5-9vf6/GHSA-4whh-r2w5-9vf6.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4whh-r2w5-9vf6",
4-
"modified": "2025-11-03T21:34:34Z",
4+
"modified": "2026-03-31T15:31:52Z",
55
"published": "2025-09-23T12:31:11Z",
66
"aliases": [
77
"CVE-2025-9963"
@@ -23,6 +23,14 @@
2323
"type": "WEB",
2424
"url": "https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products"
33+
},
2634
{
2735
"type": "WEB",
2836
"url": "http://seclists.org/fulldisclosure/2025/Sep/70"

‎advisories/unreviewed/2025/09/GHSA-7f7w-xxrm-q8hm/GHSA-7f7w-xxrm-q8hm.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7f7w-xxrm-q8hm",
4-
"modified": "2025-11-03T21:34:34Z",
4+
"modified": "2026-03-31T15:31:52Z",
55
"published": "2025-09-23T12:31:11Z",
66
"aliases": [
77
"CVE-2025-9964"
@@ -23,6 +23,14 @@
2323
"type": "WEB",
2424
"url": "https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products"
33+
},
2634
{
2735
"type": "WEB",
2836
"url": "http://seclists.org/fulldisclosure/2025/Sep/70"

‎advisories/unreviewed/2025/09/GHSA-95hg-hgr3-hcj6/GHSA-95hg-hgr3-hcj6.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-95hg-hgr3-hcj6",
4-
"modified": "2025-11-03T21:34:35Z",
4+
"modified": "2026-03-31T15:31:53Z",
55
"published": "2025-09-23T12:31:11Z",
66
"aliases": [
77
"CVE-2025-9966"
@@ -23,6 +23,14 @@
2323
"type": "WEB",
2424
"url": "https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products"
33+
},
2634
{
2735
"type": "WEB",
2836
"url": "http://seclists.org/fulldisclosure/2025/Sep/70"

‎advisories/unreviewed/2025/09/GHSA-p9qm-qcvq-mrqj/GHSA-p9qm-qcvq-mrqj.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-p9qm-qcvq-mrqj",
4-
"modified": "2025-11-03T21:34:34Z",
4+
"modified": "2026-03-31T15:31:52Z",
55
"published": "2025-09-23T12:31:11Z",
66
"aliases": [
77
"CVE-2025-9962"
@@ -23,6 +23,14 @@
2323
"type": "WEB",
2424
"url": "https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products"
33+
},
2634
{
2735
"type": "WEB",
2836
"url": "http://seclists.org/fulldisclosure/2025/Sep/70"

‎advisories/unreviewed/2025/09/GHSA-v985-h9j9-wv32/GHSA-v985-h9j9-wv32.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-v985-h9j9-wv32",
4-
"modified": "2025-11-03T21:34:34Z",
4+
"modified": "2026-03-31T15:31:52Z",
55
"published": "2025-09-23T12:31:11Z",
66
"aliases": [
77
"CVE-2025-9965"
@@ -23,6 +23,14 @@
2323
"type": "WEB",
2424
"url": "https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products"
33+
},
2634
{
2735
"type": "WEB",
2836
"url": "http://seclists.org/fulldisclosure/2025/Sep/70"

‎advisories/unreviewed/2026/03/GHSA-22vj-v4r3-878v/GHSA-22vj-v4r3-878v.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-862"
30+
],
2931
"severity": "LOW",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2026/03/GHSA-27rm-rrv9-67mv/GHSA-27rm-rrv9-67mv.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-27rm-rrv9-67mv",
4+
"modified": "2026-03-31T15:31:56Z",
5+
"published": "2026-03-31T15:31:56Z",
6+
"aliases": [
7+
"CVE-2026-30311"
8+
],
9+
"details": "Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on fragile regular expressions to parse command structures; while it attempts to intercept dangerous operations, it fails to account for standard Shell command substitution Ridvay Code (specifically$(...)and backticks ...). An attacker can construct a command such as git log --grep=\"$(malicious_command)\", forcing Syntx to misidentify it as a safe git operation and automatically approve it. The underlying Shell prioritizes the execution of the malicious code injected within the arguments, resulting in Remote Code Execution without any user interaction.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30311"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/8"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://ridvay.com"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-03-31T15:16:12Z"
32+
}
33+
}

‎advisories/unreviewed/2026/03/GHSA-2vwv-vqpv-v8vc/GHSA-2vwv-vqpv-v8vc.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2vwv-vqpv-v8vc",
4-
"modified": "2026-03-30T09:31:29Z",
4+
"modified": "2026-03-31T15:31:55Z",
55
"published": "2026-03-30T09:31:29Z",
66
"aliases": [
77
"CVE-2026-5121"
88
],
99
"details": "A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-190"
34+
],
35+
"severity": "CRITICAL",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2026-03-30T08:16:18Z"

‎advisories/unreviewed/2026/03/GHSA-35cq-wv6v-88xf/GHSA-35cq-wv6v-88xf.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-35cq-wv6v-88xf",
4+
"modified": "2026-03-31T15:31:56Z",
5+
"published": "2026-03-31T15:31:56Z",
6+
"aliases": [
7+
"CVE-2026-34504"
8+
],
9+
"details": "OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal URLs. A malicious or compromised fal relay can exploit unguarded image download fetches to expose internal service metadata and responses through the image pipeline.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-qxgf-hmcj-3xw3"
25+
},
26+
{
27+
"type": "ADVISORY",
28+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34504"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/openclaw/openclaw/commit/80d1e8a11a2ac118c7f7a70bba9c862b6141d928"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unguarded-image-download-in-fal-provider"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-918"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-31T15:16:19Z"
47+
}
48+
}

‎advisories/unreviewed/2026/03/GHSA-3gr8-2752-h46q/GHSA-3gr8-2752-h46q.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3gr8-2752-h46q",
4+
"modified": "2026-03-31T15:31:56Z",
5+
"published": "2026-03-31T15:31:56Z",
6+
"aliases": [
7+
"CVE-2026-33581"
8+
],
9+
"details": "OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to access files outside the intended sandbox directory.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-v8wv-jg3q-qwpq"
25+
},
26+
{
27+
"type": "ADVISORY",
28+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33581"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/openclaw/openclaw/commit/1d7cb6fc03552bbba00e7cffb3aa9741f5556416"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/openclaw-arbitrary-file-read-via-mediaurl-and-fileurl-parameters"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-22"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-31T15:16:15Z"
47+
}
48+
}

0 commit comments

Comments
 (0)