Skip to content

Commit 08e2d0d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-q4hc-vp2m-fr47 GHSA-wc8x-254r-w3mh GHSA-29r8-gvx4-r9w3 GHSA-755r-r738-mjgp GHSA-92gg-mqgx-hqg4 GHSA-p5g2-8j3h-474p GHSA-q8w5-c2m8-wxrx
1 parent 86c172d commit 08e2d0d

File tree

7 files changed

+192
-2
lines changed

7 files changed

+192
-2
lines changed

‎advisories/unreviewed/2026/02/GHSA-q4hc-vp2m-fr47/GHSA-q4hc-vp2m-fr47.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-q4hc-vp2m-fr47",
4-
"modified": "2026-03-11T00:31:30Z",
4+
"modified": "2026-03-17T09:31:28Z",
55
"published": "2026-02-23T18:32:02Z",
66
"aliases": [
77
"CVE-2025-14905"
@@ -39,6 +39,10 @@
3939
"type": "WEB",
4040
"url": "https://access.redhat.com/errata/RHSA-2026:4207"
4141
},
42+
{
43+
"type": "WEB",
44+
"url": "https://access.redhat.com/errata/RHSA-2026:4661"
45+
},
4246
{
4347
"type": "WEB",
4448
"url": "https://access.redhat.com/security/cve/CVE-2025-14905"

‎advisories/unreviewed/2026/02/GHSA-wc8x-254r-w3mh/GHSA-wc8x-254r-w3mh.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wc8x-254r-w3mh",
4-
"modified": "2026-02-19T21:30:46Z",
4+
"modified": "2026-03-17T09:31:28Z",
55
"published": "2026-02-19T18:31:53Z",
66
"aliases": [
77
"CVE-2026-27052"

‎advisories/unreviewed/2026/03/GHSA-29r8-gvx4-r9w3/GHSA-29r8-gvx4-r9w3.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-29r8-gvx4-r9w3",
4+
"modified": "2026-03-17T09:31:28Z",
5+
"published": "2026-03-17T09:31:28Z",
6+
"aliases": [
7+
"CVE-2026-4208"
8+
],
9+
"details": "The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4208"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-007"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-639"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-17T09:16:14Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-755r-r738-mjgp/GHSA-755r-r738-mjgp.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-755r-r738-mjgp",
4+
"modified": "2026-03-17T09:31:28Z",
5+
"published": "2026-03-17T09:31:28Z",
6+
"aliases": [
7+
"CVE-2026-4202"
8+
],
9+
"details": "The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4202"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-006"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-200"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-17T09:16:14Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-92gg-mqgx-hqg4/GHSA-92gg-mqgx-hqg4.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-92gg-mqgx-hqg4",
4+
"modified": "2026-03-17T09:31:28Z",
5+
"published": "2026-03-17T09:31:28Z",
6+
"aliases": [
7+
"CVE-2026-4312"
8+
],
9+
"details": "GCB/FCB Audit Software developed by DrangSoft has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access certain APIs to create a new administrative account.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4312"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.twcert.org.tw/en/cp-139-10785-2cafe-2.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.twcert.org.tw/tw/cp-132-10784-4f67d-1.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-306"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-17T08:15:57Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-p5g2-8j3h-474p/GHSA-p5g2-8j3h-474p.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p5g2-8j3h-474p",
4+
"modified": "2026-03-17T09:31:28Z",
5+
"published": "2026-03-17T09:31:28Z",
6+
"aliases": [
7+
"CVE-2026-32586"
8+
],
9+
"details": "Missing Authorization vulnerability in Pluggabl Booster for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster for WooCommerce: from n/a before 7.11.3.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32586"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://patchstack.com/database/wordpress/plugin/woocommerce-jetpack/vulnerability/wordpress-booster-for-woocommerce-plugin-7-11-3-broken-access-control-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-862"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-17T09:16:14Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-q8w5-c2m8-wxrx/GHSA-q8w5-c2m8-wxrx.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q8w5-c2m8-wxrx",
4+
"modified": "2026-03-17T09:31:28Z",
5+
"published": "2026-03-17T09:31:28Z",
6+
"aliases": [
7+
"CVE-2026-3237"
8+
],
9+
"details": "In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3237"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://advisories.octopus.com/post/2026/sa2026-03"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "LOW",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-17T07:16:03Z"
33+
}
34+
}

0 commit comments

Comments
 (0)