Skip to content

Commit 2cff387

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-g7mr-vm94-3rv7 GHSA-25w3-8f4h-3qh6 GHSA-72r6-p2x3-g9gj GHSA-7w3v-mfh5-q7x3 GHSA-c3cr-f45p-2vfp GHSA-fj7g-gh2h-jx3m GHSA-h46w-ffvp-4pw5 GHSA-m3x9-92c9-624c GHSA-rjxq-j5v8-3c89
1 parent 37cd7ec commit 2cff387

File tree

9 files changed

+343
-2
lines changed

9 files changed

+343
-2
lines changed

‎advisories/unreviewed/2025/11/GHSA-g7mr-vm94-3rv7/GHSA-g7mr-vm94-3rv7.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-g7mr-vm94-3rv7",
4-
"modified": "2026-03-16T21:34:29Z",
4+
"modified": "2026-03-17T00:31:34Z",
55
"published": "2025-11-18T21:32:31Z",
66
"aliases": [
77
"CVE-2025-61662"
@@ -19,6 +19,10 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61662"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/errata/RHSA-2026:4648"
25+
},
2226
{
2327
"type": "WEB",
2428
"url": "https://access.redhat.com/errata/RHSA-2026:4649"
@@ -27,6 +31,10 @@
2731
"type": "WEB",
2832
"url": "https://access.redhat.com/errata/RHSA-2026:4652"
2933
},
34+
{
35+
"type": "WEB",
36+
"url": "https://access.redhat.com/errata/RHSA-2026:4653"
37+
},
3038
{
3139
"type": "WEB",
3240
"url": "https://access.redhat.com/errata/RHSA-2026:4654"

‎advisories/unreviewed/2026/03/GHSA-25w3-8f4h-3qh6/GHSA-25w3-8f4h-3qh6.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-25w3-8f4h-3qh6",
4+
"modified": "2026-03-17T00:31:34Z",
5+
"published": "2026-03-17T00:31:34Z",
6+
"aliases": [
7+
"CVE-2026-4284"
8+
],
9+
"details": "A vulnerability was determined in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. This issue affects the function downloadFile of the file - yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/module/digitalcourse/util/PPTUtil.java of the component PPT File Handler. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4284"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://fx4tqqfvdw4.feishu.cn/docx/XF5WdvWAEoU9jyx2C2mcImSMnBg?from=from_copylink"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.351290"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.351290"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.771949"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-918"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-16T23:16:21Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-72r6-p2x3-g9gj/GHSA-72r6-p2x3-g9gj.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-72r6-p2x3-g9gj",
4+
"modified": "2026-03-17T00:31:34Z",
5+
"published": "2026-03-17T00:31:34Z",
6+
"aliases": [
7+
"CVE-2026-4177"
8+
],
9+
"details": "YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.\n\nThe heap overflow occurs when class names exceed the initial 512-byte allocation.\n\nThe base64 decoder could read past the buffer end on trailing newlines.\n\nstrtok mutated n->type_id in place, corrupting shared node data.\n\nA memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4177"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/cpan-authors/YAML-Syck/commit/e8844a31c8cf0052914b198fc784ed4e6b8ae69e.patch"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://metacpan.org/release/TODDR/YAML-Syck-1.37_01/changes#L21"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-122"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-03-16T23:16:21Z"
34+
}
35+
}

‎advisories/unreviewed/2026/03/GHSA-7w3v-mfh5-q7x3/GHSA-7w3v-mfh5-q7x3.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7w3v-mfh5-q7x3",
4+
"modified": "2026-03-17T00:31:34Z",
5+
"published": "2026-03-17T00:31:34Z",
6+
"aliases": [
7+
"CVE-2026-4289"
8+
],
9+
"details": "A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This affects an unknown function of the file /rest/preSetTemplate/getRecByTemplateId. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4289"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://my.feishu.cn/docx/UmmudBVvYoMwpIxUtTicjsS8nDe?from=from_copylink"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.351294"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.351294"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.771997"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-17T00:16:19Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-c3cr-f45p-2vfp/GHSA-c3cr-f45p-2vfp.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c3cr-f45p-2vfp",
4+
"modified": "2026-03-17T00:31:34Z",
5+
"published": "2026-03-17T00:31:34Z",
6+
"aliases": [
7+
"CVE-2026-4285"
8+
],
9+
"details": "A vulnerability was identified in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. Impacted is the function recognizeMarkdown of the file yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/module/digitalcourse/util/Pdf2MdUtil.java. Such manipulation of the argument fileUrl leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4285"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://fx4tqqfvdw4.feishu.cn/docx/KezQdqzVGoTVj9x8SH1c9dNvnOg?from=from_copylink"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.351291"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.351291"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.771950"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-22"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-17T00:16:19Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-fj7g-gh2h-jx3m/GHSA-fj7g-gh2h-jx3m.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fj7g-gh2h-jx3m",
4+
"modified": "2026-03-17T00:31:34Z",
5+
"published": "2026-03-17T00:31:34Z",
6+
"aliases": [
7+
"CVE-2026-4288"
8+
],
9+
"details": "A weakness has been identified in Tiandy Easy7 Integrated Management Platform 7.17.0. The impacted element is an unknown function of the file /rest/devStatus/getDevDetailedInfo of the component Endpoint. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4288"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://my.feishu.cn/docx/LgjudozCFo9rVTx57hJcDyk0nXd?from=from_copylink"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.351293"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.351293"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.771963"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-17T00:16:19Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-h46w-ffvp-4pw5/GHSA-h46w-ffvp-4pw5.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h46w-ffvp-4pw5",
4-
"modified": "2026-03-16T18:32:04Z",
4+
"modified": "2026-03-17T00:31:34Z",
55
"published": "2026-03-16T18:32:04Z",
66
"aliases": [
77
"CVE-2026-4224"
@@ -42,6 +42,10 @@
4242
{
4343
"type": "WEB",
4444
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "http://www.openwall.com/lists/oss-security/2026/03/16/4"
4549
}
4650
],
4751
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-m3x9-92c9-624c/GHSA-m3x9-92c9-624c.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m3x9-92c9-624c",
4+
"modified": "2026-03-17T00:31:34Z",
5+
"published": "2026-03-17T00:31:34Z",
6+
"aliases": [
7+
"CVE-2026-21991"
8+
],
9+
"details": "A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21991"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://linux.oracle.com/cve/CVE-2026-21991.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "MODERATE",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-16T22:16:18Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-rjxq-j5v8-3c89/GHSA-rjxq-j5v8-3c89.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rjxq-j5v8-3c89",
4+
"modified": "2026-03-17T00:31:34Z",
5+
"published": "2026-03-17T00:31:34Z",
6+
"aliases": [
7+
"CVE-2026-4287"
8+
],
9+
"details": "A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0. The affected element is an unknown function of the file /rest/devStatus/queryResources of the component Endpoint. Performing a manipulation of the argument areaId results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4287"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://my.feishu.cn/docx/F68OduQq8oI2MdxmjHlch8u5n8f?from=from_copylink"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.351292"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.351292"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.771956"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-17T00:16:19Z"
51+
}
52+
}

0 commit comments

Comments
 (0)