Skip to content

Commit 3402aa0

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 24e3c6c commit 3402aa0

66 files changed

Lines changed: 2341 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/01/GHSA-28qq-5f47-r5x2/GHSA-28qq-5f47-r5x2.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-28qq-5f47-r5x2",
4+
"modified": "2026-01-23T06:31:23Z",
5+
"published": "2026-01-23T06:31:23Z",
6+
"aliases": [
7+
"CVE-2026-0755"
8+
],
9+
"details": "gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27783.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0755"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-021"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-78"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-23T04:16:02Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-298v-qmqm-hfrx/GHSA-298v-qmqm-hfrx.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-298v-qmqm-hfrx",
4+
"modified": "2026-01-23T06:31:24Z",
5+
"published": "2026-01-23T06:31:23Z",
6+
"aliases": [
7+
"CVE-2026-0756"
8+
],
9+
"details": "github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of github-kanban-mcp-server. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the create_issue parameter. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27784.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0756"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-022"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-78"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-23T04:16:02Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-2phj-rv58-qq6m/GHSA-2phj-rv58-qq6m.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2phj-rv58-qq6m",
4+
"modified": "2026-01-23T06:31:24Z",
5+
"published": "2026-01-23T06:31:24Z",
6+
"aliases": [
7+
"CVE-2026-0776"
8+
],
9+
"details": "Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Discord Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the discord_rpc module. The product loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-27057.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0776"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-040"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-427"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-23T04:16:04Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-2r34-5w99-86fp/GHSA-2r34-5w99-86fp.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2r34-5w99-86fp",
4+
"modified": "2026-01-23T06:31:25Z",
5+
"published": "2026-01-23T06:31:25Z",
6+
"aliases": [
7+
"CVE-2025-14745"
8+
],
9+
"details": "The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-rss-aggregator' shortcode in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/core/src/Renderer.php#L209"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset/3439384/wp-rss-aggregator/trunk/core/src/Renderer.php"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd201949-d3a1-4fdb-bf98-252fbfd59380?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-01-23T06:15:50Z"
43+
}
44+
}

‎advisories/unreviewed/2026/01/GHSA-2rrm-c66p-mgc8/GHSA-2rrm-c66p-mgc8.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2rrm-c66p-mgc8",
4+
"modified": "2026-01-23T06:31:25Z",
5+
"published": "2026-01-23T06:31:25Z",
6+
"aliases": [
7+
"CVE-2026-0790"
8+
],
9+
"details": "ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the web-based user interface. By navigating directly to a URL, a user can gain unauthorized access to data. An attacker can leverage this vulnerability to disclose information in the context of the device. Was ZDI-CAN-28299.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0790"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-012"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-425"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-23T04:16:06Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-2x27-jmf7-8fj3/GHSA-2x27-jmf7-8fj3.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2x27-jmf7-8fj3",
4+
"modified": "2026-01-23T06:31:25Z",
5+
"published": "2026-01-23T06:31:25Z",
6+
"aliases": [
7+
"CVE-2026-24335"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24335"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-01-23T05:16:32Z"
24+
}
25+
}

‎advisories/unreviewed/2026/01/GHSA-3966-f6p6-2qr9/GHSA-3966-f6p6-2qr9.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3966-f6p6-2qr9",
4+
"modified": "2026-01-23T06:31:24Z",
5+
"published": "2026-01-23T06:31:24Z",
6+
"aliases": [
7+
"CVE-2026-0775"
8+
],
9+
"details": "npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0775"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-043"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-732"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-23T04:16:04Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-3xp7-v582-9h3c/GHSA-3xp7-v582-9h3c.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3xp7-v582-9h3c",
4+
"modified": "2026-01-23T06:31:24Z",
5+
"published": "2026-01-23T06:31:24Z",
6+
"aliases": [
7+
"CVE-2026-0760"
8+
],
9+
"details": "Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the deserialize_message function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28121.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0760"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-026"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-502"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-23T04:16:02Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-477q-f87r-gf6v/GHSA-477q-f87r-gf6v.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-477q-f87r-gf6v",
4+
"modified": "2026-01-23T06:31:24Z",
5+
"published": "2026-01-23T06:31:24Z",
6+
"aliases": [
7+
"CVE-2026-0780"
8+
],
9+
"details": "ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28289.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0780"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-002"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-78"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-23T04:16:05Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-4cjv-rrcw-xg72/GHSA-4cjv-rrcw-xg72.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4cjv-rrcw-xg72",
4+
"modified": "2026-01-23T06:31:25Z",
5+
"published": "2026-01-23T06:31:25Z",
6+
"aliases": [
7+
"CVE-2026-0793"
8+
],
9+
"details": "ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the InformaCast functionality. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28302.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0793"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-015"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-122"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-23T04:16:07Z"
35+
}
36+
}

0 commit comments

Comments
 (0)