Skip to content

Commit 3c05aeb

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-38mq-gg8g-j53r GHSA-5vmx-5g6g-mcfc GHSA-r58r-mmgc-mr7f GHSA-r99f-gh52-rv7j GHSA-rw74-955x-jxvv GHSA-w2x9-wvhh-7qg3
1 parent 65532a5 commit 3c05aeb

6 files changed

Lines changed: 320 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/01/GHSA-38mq-gg8g-j53r/GHSA-38mq-gg8g-j53r.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-38mq-gg8g-j53r",
4+
"modified": "2026-01-26T03:30:34Z",
5+
"published": "2026-01-26T03:30:34Z",
6+
"aliases": [
7+
"CVE-2026-1413"
8+
],
9+
"details": "A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function portValidate of the file /fort/ip_and_port/port_validate of the component HTTP POST Request Handler. Performing a manipulation of the argument port results in command injection. The attack can be initiated remotely. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1413"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-LX88/cve/issues/23"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.342802"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.342802"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.736522"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-26T02:15:48Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-5vmx-5g6g-mcfc/GHSA-5vmx-5g6g-mcfc.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5vmx-5g6g-mcfc",
4+
"modified": "2026-01-26T03:30:33Z",
5+
"published": "2026-01-26T03:30:33Z",
6+
"aliases": [
7+
"CVE-2026-1411"
8+
],
9+
"details": "A flaw has been found in Beetel 777VR1 up to 01.00.09/01.00.09_55. The affected element is an unknown function of the component UART Interface. This manipulation causes improper access controls. It is feasible to perform the attack on the physical device. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:P/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1411"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gist.github.com/raghav20232023/ea6adcd6d1eca35683570a1094164bd3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.342800"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.342800"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.740674"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-266"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-26T01:15:49Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-r58r-mmgc-mr7f/GHSA-r58r-mmgc-mr7f.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r58r-mmgc-mr7f",
4+
"modified": "2026-01-26T03:30:34Z",
5+
"published": "2026-01-26T03:30:34Z",
6+
"aliases": [
7+
"CVE-2026-1415"
8+
],
9+
"details": "A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gf_media_export_webvtt_metadata of the file src/media_tools/media_export.c. The manipulation of the argument Name leads to null pointer dereference. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is af951b892dfbaaa38336ba2eba6d6a42c25810fd. To fix this issue, it is recommended to deploy a patch.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1415"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/gpac/gpac/issues/3428"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/gpac/gpac/issues/3428#issue-3802223345"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/enocknt/gpac/commit/af951b892dfbaaa38336ba2eba6d6a42c25810fd"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.342804"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.342804"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.736541"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-404"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-01-26T03:15:49Z"
59+
}
60+
}

‎advisories/unreviewed/2026/01/GHSA-r99f-gh52-rv7j/GHSA-r99f-gh52-rv7j.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r99f-gh52-rv7j",
4+
"modified": "2026-01-26T03:30:34Z",
5+
"published": "2026-01-26T03:30:34Z",
6+
"aliases": [
7+
"CVE-2026-1412"
8+
],
9+
"details": "A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The impacted element is an unknown function of the file /fort/audit/get_clip_img of the component HTTP POST Request Handler. Such manipulation of the argument frame/dirno leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1412"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-LX88/cve/issues/22"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.342801"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.342801"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.736513"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-26T01:15:49Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-rw74-955x-jxvv/GHSA-rw74-955x-jxvv.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rw74-955x-jxvv",
4+
"modified": "2026-01-26T03:30:33Z",
5+
"published": "2026-01-26T03:30:33Z",
6+
"aliases": [
7+
"CVE-2026-1410"
8+
],
9+
"details": "A vulnerability was detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. Impacted is an unknown function of the component UART Interface. The manipulation results in missing authentication. An attack on the physical device is feasible. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1410"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gist.github.com/raghav20232023/96a6b13ab00c493d21362e744627ea9f"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.342799"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.342799"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.739433"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-287"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-26T01:15:48Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-w2x9-wvhh-7qg3/GHSA-w2x9-wvhh-7qg3.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w2x9-wvhh-7qg3",
4+
"modified": "2026-01-26T03:30:34Z",
5+
"published": "2026-01-26T03:30:34Z",
6+
"aliases": [
7+
"CVE-2026-1414"
8+
],
9+
"details": "A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Executing a manipulation of the argument fortEquipmentIp can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1414"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-LX88/cve/issues/24"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.342803"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.342803"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.736524"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-26T03:15:49Z"
51+
}
52+
}

0 commit comments

Comments
 (0)