Skip to content

Commit 493883d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-r996-q9x2-5wwf GHSA-2cp9-2r3x-xx3f GHSA-34g8-8p3v-fxw2 GHSA-4g94-jfqp-p4f7 GHSA-5h3p-j6gw-765v GHSA-83p9-7gqh-59qj GHSA-cr46-frvv-mfcg GHSA-f3fr-gvgx-x9gh GHSA-hvx7-jqjg-r7r7 GHSA-m5f5-cq9j-vhwf GHSA-qc8x-v7mj-j62g GHSA-rg7c-g689-fr3x GHSA-w48x-mvpf-jfc3 GHSA-xq5v-qh4w-535c GHSA-xvjp-783h-vvhp
1 parent ac3c6a9 commit 493883d

15 files changed

Lines changed: 568 additions & 1 deletion

File tree

‎advisories/unreviewed/2026/02/GHSA-r996-q9x2-5wwf/GHSA-r996-q9x2-5wwf.json‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-r996-q9x2-5wwf",
4-
"modified": "2026-02-15T15:31:31Z",
4+
"modified": "2026-04-13T09:31:33Z",
55
"published": "2026-02-15T15:31:31Z",
66
"aliases": [
77
"CVE-2026-2516"
@@ -38,6 +38,22 @@
3838
{
3939
"type": "WEB",
4040
"url": "https://vuldb.com/?submit.736172"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/submit/736172"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/346107"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/346107/cti"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "http://www.unidocs.com/programs/ezPDF_DRM_Reader"
4157
}
4258
],
4359
"database_specific": {

‎advisories/unreviewed/2026/04/GHSA-2cp9-2r3x-xx3f/GHSA-2cp9-2r3x-xx3f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2cp9-2r3x-xx3f",
4+
"modified": "2026-04-13T09:31:33Z",
5+
"published": "2026-04-13T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-0233"
8+
],
9+
"details": "A certificate validation vulnerability in Palo Alto Networks Autonomous Digital Experience Manager on Windows allows an unauthenticated attacker with adjacent network access to execute arbitrary code with NT AUTHORITY\\SYSTEM privileges.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Green"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0233"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.paloaltonetworks.com/CVE-2026-0233"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-295"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-13T08:16:22Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-34g8-8p3v-fxw2/GHSA-34g8-8p3v-fxw2.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-34g8-8p3v-fxw2",
4+
"modified": "2026-04-13T09:31:33Z",
5+
"published": "2026-04-13T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-6166"
8+
],
9+
"details": "A security vulnerability has been detected in code-projects Vehicle Showroom Management System 1.0. This issue affects some unknown processing of the file /util/UpdateVehicleFunction.php. The manipulation of the argument VEHICLE_ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6166"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/wfcht-sy/src/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/797097"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/357054"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/357054/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-13T07:16:50Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-4g94-jfqp-p4f7/GHSA-4g94-jfqp-p4f7.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4g94-jfqp-p4f7",
4+
"modified": "2026-04-13T09:31:33Z",
5+
"published": "2026-04-13T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-5085"
8+
],
9+
"details": "Solstice::Session versions through 1440 for Perl generates session ids insecurely.\n\nThe _generateSessionID method returns an MD5 digest seeded by the epoch time, a random hash reference, a call to the built-in rand() function and the process id.\n\nThe same method is used in the _generateID method in Solstice::Subsession, which is part of the same distribution.\n\nThe epoch time may be guessed, if it is not leaked in the HTTP Date header. Stringified hash refences will contain predictable content. The built-in rand() function is seeded by 16-bits and is unsuitable for security purposes. The process id comes from a small set of numbers.\n\nPredictable session ids could allow an attacker to gain access to systems.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5085"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://metacpan.org/dist/Solstice/source/lib/Solstice/Session.pm#L481"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://metacpan.org/dist/Solstice/source/lib/Solstice/Subsession.pm#L105"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [
32+
"CWE-338"
33+
],
34+
"severity": null,
35+
"github_reviewed": false,
36+
"github_reviewed_at": null,
37+
"nvd_published_at": "2026-04-13T07:16:50Z"
38+
}
39+
}

‎advisories/unreviewed/2026/04/GHSA-5h3p-j6gw-765v/GHSA-5h3p-j6gw-765v.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5h3p-j6gw-765v",
4+
"modified": "2026-04-13T09:31:33Z",
5+
"published": "2026-04-13T09:31:33Z",
6+
"aliases": [
7+
"CVE-2025-15441"
8+
],
9+
"details": "The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the \"MySQL Mapping\" feature is in use, which could make SQL Injection attacks possible in certain contexts.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15441"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/41f69b0a-4d17-4a6b-b803-ea1c370e3cc0"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-04-13T07:16:07Z"
28+
}
29+
}

‎advisories/unreviewed/2026/04/GHSA-83p9-7gqh-59qj/GHSA-83p9-7gqh-59qj.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-83p9-7gqh-59qj",
4+
"modified": "2026-04-13T09:31:33Z",
5+
"published": "2026-04-13T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-6167"
8+
],
9+
"details": "A vulnerability was detected in code-projects Faculty Management System 1.0. Impacted is an unknown function of the file /subject-print.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6167"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/wfcht-sy/src/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/797098"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/357055"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/357055/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-13T07:16:51Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-cr46-frvv-mfcg/GHSA-cr46-frvv-mfcg.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cr46-frvv-mfcg",
4+
"modified": "2026-04-13T09:31:33Z",
5+
"published": "2026-04-13T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-3830"
8+
],
9+
"details": "The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3830"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/768014fd-0403-4182-b19e-3d46c92d8755"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-04-13T07:16:50Z"
28+
}
29+
}

‎advisories/unreviewed/2026/04/GHSA-f3fr-gvgx-x9gh/GHSA-f3fr-gvgx-x9gh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f3fr-gvgx-x9gh",
4+
"modified": "2026-04-13T09:31:33Z",
5+
"published": "2026-04-13T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-34865"
8+
],
9+
"details": "Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34865"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/4"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-122"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-13T07:16:49Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-hvx7-jqjg-r7r7/GHSA-hvx7-jqjg-r7r7.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hvx7-jqjg-r7r7",
4+
"modified": "2026-04-13T09:31:33Z",
5+
"published": "2026-04-13T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-0232"
8+
],
9+
"details": "A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Amber"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0232"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.paloaltonetworks.com/CVE-2026-0232"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-15"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-13T08:16:20Z"
35+
}
36+
}

0 commit comments

Comments
 (0)