Advisory Database Sync

Author: advisory-database[bot]

advisories/unreviewed/2026/01/GHSA-6v4g-392h-r9mh/GHSA-6v4g-392h-r9mh.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6v4g-392h-r9mh",
-  "modified": "2026-03-12T15:30:22Z",
+  "modified": "2026-03-12T21:34:39Z",
   "published": "2026-01-14T18:31:36Z",
   "aliases": [
     "CVE-2025-14242"
@@ -31,10 +31,26 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:0608"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:4470"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:4477"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:4513"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:4522"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:4525"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/security/cve/CVE-2025-14242"

advisories/unreviewed/2026/01/GHSA-9688-9jmc-xf77/GHSA-9688-9jmc-xf77.json

@@ -1,13 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9688-9jmc-xf77",
-  "modified": "2026-01-07T12:31:22Z",
+  "modified": "2026-03-12T21:34:39Z",
   "published": "2026-01-07T12:31:22Z",
   "aliases": [
     "CVE-2025-14631"
   ],
   "details": "A NULL Pointer Dereference vulnerability in TP-Link Archer BE400 V1(802.11 modules) allows \n\nan adjacent attacker to cause a denial-of-service (DoS) by triggering a device reboot.\n\nThis issue affects Archer BE400: xi 1.1.0 Build 20250710 rel.14914.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

advisories/unreviewed/2026/01/GHSA-q363-5cqv-4f8m/GHSA-q363-5cqv-4f8m.json

@@ -26,7 +26,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-269"
+      "CWE-269",
+      "CWE-863"
     ],
     "severity": "MODERATE",
     "github_reviewed": false,

advisories/unreviewed/2026/03/GHSA-258q-v95r-6j9p/GHSA-258q-v95r-6j9p.json

@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-258q-v95r-6j9p",
+  "modified": "2026-03-12T21:34:50Z",
+  "published": "2026-03-12T21:34:50Z",
+  "aliases": [
+    "CVE-2025-70245"
+  ],
+  "details": "Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizardSelectMode.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70245"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70245"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.dlink.com/en/security-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-03-12T19:16:15Z"
+  }
+}

advisories/unreviewed/2026/03/GHSA-35vp-x4m3-rrq9/GHSA-35vp-x4m3-rrq9.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-35vp-x4m3-rrq9",
-  "modified": "2026-03-10T21:32:17Z",
+  "modified": "2026-03-12T21:34:40Z",
   "published": "2026-03-10T21:32:17Z",
   "aliases": [
     "CVE-2025-70128"
   ],
   "details": "A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier. The application fails to properly sanitize or validate user-supplied input in the \"link\" field of a comment. An attacker can inject arbitrary JavaScript code using a <script> element. The injected payload is stored in the database and subsequently rendered in the Administration panel's \"Comments\" section when administrators review submitted comments. Importantly, the malicious script is not reflected in the public-facing comments interface, but only within the backend administration view. Alternatively, users of Administrator, Moderator, Manager roles can also directly input crafted payloads into existing comments. This makes the vulnerability a persistent XSS issue targeting administrative users. This affects /core/admin/comments.php, while CVE-2022-24585 affects /core/admin/comment.php, a uniquely distinct vulnerability.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -24,8 +29,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2026-03-10T20:16:20Z"

advisories/unreviewed/2026/03/GHSA-37rg-q294-rgvc/GHSA-37rg-q294-rgvc.json

@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-37rg-q294-rgvc",
+  "modified": "2026-03-12T21:34:50Z",
+  "published": "2026-03-12T21:34:50Z",
+  "aliases": [
+    "CVE-2025-61154"
+  ],
+  "details": "Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a crafted DWG file to cause a Denial of Service (DoS) via the function decompress_R2004_section at decode.c.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61154"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/LibreDWG/libredwg/issues/1180"
+    },
+    {
+      "type": "WEB",
+      "url": "https://davizin.com/cves/CVE-2025-61154.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-03-12T19:16:14Z"
+  }
+}

advisories/unreviewed/2026/03/GHSA-39xw-9qh5-7xj4/GHSA-39xw-9qh5-7xj4.json

@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-39xw-9qh5-7xj4",
+  "modified": "2026-03-12T21:34:50Z",
+  "published": "2026-03-12T21:34:50Z",
+  "aliases": [
+    "CVE-2025-66955"
+  ],
+  "details": "Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via \"path\" parameter in the downloadAttachment and downloadAttachmentFromPath API calls.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66955"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/TheWoodenBench/CVE-2025-66955"
+    },
+    {
+      "type": "WEB",
+      "url": "http://asseco.com"
+    },
+    {
+      "type": "WEB",
+      "url": "http://live.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-03-12T19:16:15Z"
+  }
+}

advisories/unreviewed/2026/03/GHSA-3p4g-vg78-jqrv/GHSA-3p4g-vg78-jqrv.json

@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3p4g-vg78-jqrv",
+  "modified": "2026-03-12T21:34:51Z",
+  "published": "2026-03-12T21:34:51Z",
+  "aliases": [
+    "CVE-2026-3611"
+  ],
+  "details": "The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3611"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-03.json"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-03"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.honeywell.com/us/en/contact"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-306"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-03-12T21:16:27Z"
+  }
+}

advisories/unreviewed/2026/03/GHSA-439v-7mv7-5p44/GHSA-439v-7mv7-5p44.json

@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-439v-7mv7-5p44",
+  "modified": "2026-03-12T21:34:49Z",
+  "published": "2026-03-12T21:34:49Z",
+  "aliases": [
+    "CVE-2025-13913"
+  ],
+  "details": "Inductive Automation Ignition Software is vulnerable to an unauthenticated API endpoint exposure that may allow an attacker to remotely change the \"forgot password\" recovery email address.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13913"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-071-06.json"
+    },
+    {
+      "type": "WEB",
+      "url": "https://inductiveautomation.com/resources/article/ignition-security-hardening-guide"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-06"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-03-12T19:16:14Z"
+  }
+}

advisories/unreviewed/2026/03/GHSA-5j2j-j2vj-6m3j/GHSA-5j2j-j2vj-6m3j.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-5j2j-j2vj-6m3j",
-  "modified": "2026-03-12T00:31:16Z",
+  "modified": "2026-03-12T21:34:45Z",
   "published": "2026-03-12T00:31:16Z",
   "aliases": [
     "CVE-2026-3915"
   ],
   "details": "Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -27,7 +32,7 @@
     "cwe_ids": [
       "CWE-122"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2026-03-11T22:16:33Z"