Skip to content

Commit 54604af

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent d543e01 commit 54604af

43 files changed

Lines changed: 1036 additions & 44 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/03/GHSA-ff9c-4g39-vvcf/GHSA-ff9c-4g39-vvcf.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@
2626
],
2727
"database_specific": {
2828
"cwe_ids": [
29-
"CWE-290"
29+
"CWE-290",
30+
"CWE-451"
3031
],
3132
"severity": "MODERATE",
3233
"github_reviewed": false,

‎advisories/unreviewed/2026/04/GHSA-2h6j-mhcp-9j9h/GHSA-2h6j-mhcp-9j9h.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2h6j-mhcp-9j9h",
4+
"modified": "2026-04-07T21:32:39Z",
5+
"published": "2026-04-07T21:32:39Z",
6+
"aliases": [
7+
"CVE-2025-56015"
8+
],
9+
"details": "In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-56015"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/e1st/CVE-2025-56015"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/genieacs/genieacs"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-04-07T20:16:22Z"
32+
}
33+
}

‎advisories/unreviewed/2026/04/GHSA-2hvj-57fv-jjcc/GHSA-2hvj-57fv-jjcc.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2hvj-57fv-jjcc",
4+
"modified": "2026-04-07T21:32:39Z",
5+
"published": "2026-04-07T21:32:39Z",
6+
"aliases": [
7+
"CVE-2026-32862"
8+
],
9+
"details": "There is a memory corruption vulnerability due to an out-of-bounds write in ResFileFactory::InitResourceMgr() in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32862"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/memory-corruption-vulnerabilities-in-ni-labview.html"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-787"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-07T20:16:24Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-2mg7-w9r8-29mw/GHSA-2mg7-w9r8-29mw.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2mg7-w9r8-29mw",
4+
"modified": "2026-04-07T21:32:40Z",
5+
"published": "2026-04-07T21:32:40Z",
6+
"aliases": [
7+
"CVE-2026-39841"
8+
],
9+
"details": "Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39841"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237973"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://phabricator.wikimedia.org/T416389"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-80"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-07T20:16:34Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-2r8h-6hvp-jqwg/GHSA-2r8h-6hvp-jqwg.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2r8h-6hvp-jqwg",
4+
"modified": "2026-04-07T21:32:39Z",
5+
"published": "2026-04-07T21:32:39Z",
6+
"aliases": [
7+
"CVE-2026-32863"
8+
],
9+
"details": "There is a memory corruption vulnerability due to an out-of-bounds read in sentry_transaction_context_set_operation() in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32863"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/memory-corruption-vulnerabilities-in-ni-labview.html"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-125"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-07T20:16:26Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-4fp2-3xgg-jg4w/GHSA-4fp2-3xgg-jg4w.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4fp2-3xgg-jg4w",
4+
"modified": "2026-04-07T21:32:39Z",
5+
"published": "2026-04-07T21:32:39Z",
6+
"aliases": [
7+
"CVE-2026-5736"
8+
],
9+
"details": "A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the component detailPlus Endpoint. The manipulation of the argument customQuery leads to sql injection. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5736"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/PowerJob/PowerJob/issues/1167"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/PowerJob/PowerJob/pull/1166"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/PowerJob/PowerJob"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/submit/786727"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/355746"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/355746/cti"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-74"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-04-07T19:16:48Z"
59+
}
60+
}

‎advisories/unreviewed/2026/04/GHSA-4fwv-vp29-wx8m/GHSA-4fwv-vp29-wx8m.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4fwv-vp29-wx8m",
4-
"modified": "2026-04-01T12:31:28Z",
4+
"modified": "2026-04-07T21:32:35Z",
55
"published": "2026-04-01T12:31:28Z",
66
"aliases": [
77
"CVE-2026-24096"
88
],
99
"details": "Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 allows low-privileged users to perform unauthorized actions or obtain sensitive information",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/04/GHSA-664p-j3q6-p843/GHSA-664p-j3q6-p843.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-664p-j3q6-p843",
4-
"modified": "2026-04-06T18:33:07Z",
4+
"modified": "2026-04-07T21:32:37Z",
55
"published": "2026-04-06T18:33:07Z",
66
"aliases": [
77
"CVE-2026-31353"
88
],
99
"details": "An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2026-04-06T16:16:33Z"

‎advisories/unreviewed/2026/04/GHSA-6c2r-c48j-rxph/GHSA-6c2r-c48j-rxph.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6c2r-c48j-rxph",
4+
"modified": "2026-04-07T21:32:39Z",
5+
"published": "2026-04-07T21:32:39Z",
6+
"aliases": [
7+
"CVE-2025-69515"
8+
],
9+
"details": "An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting falsified GPS signals as legitimate, resulting in the device reporting an incorrect or static location.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69515"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/thorat-shubham/JXL_Infotainment_CVE-2025-69515/blob/main/README.md"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://jxl.com"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-04-07T20:16:22Z"
32+
}
33+
}

‎advisories/unreviewed/2026/04/GHSA-6m53-gpj2-w66j/GHSA-6m53-gpj2-w66j.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6m53-gpj2-w66j",
4+
"modified": "2026-04-07T21:32:40Z",
5+
"published": "2026-04-07T21:32:40Z",
6+
"aliases": [
7+
"CVE-2026-39837"
8+
],
9+
"details": "Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39837"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237979"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://phabricator.wikimedia.org/T416402"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-80"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-07T20:16:33Z"
39+
}
40+
}

0 commit comments

Comments
 (0)