Skip to content

Commit 293d774

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent a33df0b commit 293d774

File tree

140 files changed

+2059
-376
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

140 files changed

+2059
-376
lines changed

‎advisories/unreviewed/2023/03/GHSA-vxpc-466w-pjjv/GHSA-vxpc-466w-pjjv.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vxpc-466w-pjjv",
4-
"modified": "2023-03-10T03:30:16Z",
4+
"modified": "2026-04-13T21:30:30Z",
55
"published": "2023-03-01T09:30:29Z",
66
"aliases": [
77
"CVE-2022-27672"
@@ -26,6 +26,10 @@
2626
{
2727
"type": "WEB",
2828
"url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1045"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "http://xenbits.xen.org/xsa/advisory-426.html"
2933
}
3034
],
3135
"database_specific": {

‎advisories/unreviewed/2026/04/GHSA-24v7-w2x9-2cxh/GHSA-24v7-w2x9-2cxh.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-24v7-w2x9-2cxh",
4-
"modified": "2026-04-09T00:32:00Z",
4+
"modified": "2026-04-13T21:30:37Z",
55
"published": "2026-04-09T00:32:00Z",
66
"aliases": [
77
"CVE-2026-5887"
88
],
99
"details": "Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypass download restrictions via a crafted HTML page. (Chromium security severity: Medium)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-20"
2934
],
30-
"severity": null,
35+
"severity": "MODERATE",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2026-04-08T22:16:28Z"

‎advisories/unreviewed/2026/04/GHSA-295f-cjg2-fv68/GHSA-295f-cjg2-fv68.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-295f-cjg2-fv68",
4-
"modified": "2026-04-08T09:31:36Z",
4+
"modified": "2026-04-13T21:30:36Z",
55
"published": "2026-04-08T09:31:36Z",
66
"aliases": [
77
"CVE-2026-39713"
88
],
99
"details": "Missing Authorization vulnerability in mailercloud Mailercloud &#8211; Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize-contacts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mailercloud &#8211; Integrate webforms and synchronize website contacts: from n/a through <= 1.0.7.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-862"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-04-08T09:16:44Z"

‎advisories/unreviewed/2026/04/GHSA-2chh-fcwm-p667/GHSA-2chh-fcwm-p667.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2chh-fcwm-p667",
4-
"modified": "2026-04-08T09:31:35Z",
4+
"modified": "2026-04-13T21:30:36Z",
55
"published": "2026-04-08T09:31:35Z",
66
"aliases": [
77
"CVE-2026-39691"
88
],
99
"details": "Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations cryptocurrency-donation-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Donation Box – Bitcoin & Crypto Donations: from n/a through <= 2.2.13.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-862"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-04-08T09:16:41Z"

‎advisories/unreviewed/2026/04/GHSA-2h64-4pg7-rq8p/GHSA-2h64-4pg7-rq8p.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2h64-4pg7-rq8p",
4-
"modified": "2026-04-09T00:32:00Z",
4+
"modified": "2026-04-13T21:30:39Z",
55
"published": "2026-04-09T00:32:00Z",
66
"aliases": [
77
"CVE-2026-5904"
88
],
99
"details": "Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-416"
2934
],
30-
"severity": null,
35+
"severity": "HIGH",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2026-04-08T22:16:30Z"

‎advisories/unreviewed/2026/04/GHSA-2m2q-qgx4-j4mp/GHSA-2m2q-qgx4-j4mp.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2m2q-qgx4-j4mp",
4+
"modified": "2026-04-13T21:30:43Z",
5+
"published": "2026-04-13T21:30:43Z",
6+
"aliases": [
7+
"CVE-2026-29955"
8+
],
9+
"details": "The `/registercrd` endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable to command injection. The component uses `subprocess.Popen()` with `shell=True` parameter to execute shell commands, and the user-supplied `chartName` parameter is directly concatenated into the command string without any sanitization or validation. An attacker can inject arbitrary shell commands by crafting a malicious `chartName` parameter value.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29955"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://gist.github.com/b0b0haha/f011fdd69adc3ae272a4e3b99af90163"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/b0b0haha/CVE-2026-29955/blob/main/README.md"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-04-13T19:16:39Z"
32+
}
33+
}

‎advisories/unreviewed/2026/04/GHSA-2mpg-m27w-5p6f/GHSA-2mpg-m27w-5p6f.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2mpg-m27w-5p6f",
4-
"modified": "2026-04-08T09:31:32Z",
4+
"modified": "2026-04-13T21:30:35Z",
55
"published": "2026-04-08T09:31:32Z",
66
"aliases": [
77
"CVE-2026-39504"
88
],
99
"details": "Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.2.5.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-862"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-04-08T09:16:24Z"

‎advisories/unreviewed/2026/04/GHSA-2pmg-wxw5-4334/GHSA-2pmg-wxw5-4334.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2pmg-wxw5-4334",
4-
"modified": "2026-04-13T15:31:43Z",
4+
"modified": "2026-04-13T21:30:43Z",
55
"published": "2026-04-13T15:31:43Z",
66
"aliases": [
77
"CVE-2026-36944"
88
],
99
"details": "Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to SQL injection in the file/rsms/admin/repairs/view_details.php.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "LOW",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2026-04-13T15:17:34Z"

‎advisories/unreviewed/2026/04/GHSA-2qmh-3x75-j23v/GHSA-2qmh-3x75-j23v.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2qmh-3x75-j23v",
4-
"modified": "2026-04-08T09:31:35Z",
4+
"modified": "2026-04-13T21:30:36Z",
55
"published": "2026-04-08T09:31:35Z",
66
"aliases": [
77
"CVE-2026-39679"
88
],
99
"details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Freeio freeio allows PHP Local File Inclusion.This issue affects Freeio: from n/a through <= 1.3.21.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-98"
2530
],
26-
"severity": null,
31+
"severity": "HIGH",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-04-08T09:16:39Z"

‎advisories/unreviewed/2026/04/GHSA-2x9w-3q66-8rrm/GHSA-2x9w-3q66-8rrm.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2x9w-3q66-8rrm",
4-
"modified": "2026-04-09T00:32:00Z",
4+
"modified": "2026-04-13T21:30:38Z",
55
"published": "2026-04-09T00:32:00Z",
66
"aliases": [
77
"CVE-2026-5897"
88
],
99
"details": "Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-451"
34+
],
35+
"severity": "MODERATE",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2026-04-08T22:16:29Z"

0 commit comments

Comments
 (0)