Skip to content

Commit 745da21

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-56ph-gvwc-wqxr GHSA-72rh-qqpc-g693 GHSA-7r2j-hgh9-jqqx GHSA-8h9m-gcc8-25c6 GHSA-h9hm-gx5c-xfc2 GHSA-j22f-5qx8-xp6w GHSA-mx9c-4xjq-mhj6 GHSA-vv3f-fcjm-crv5
1 parent f366702 commit 745da21

File tree

8 files changed

+430
-0
lines changed

8 files changed

+430
-0
lines changed

‎advisories/unreviewed/2026/03/GHSA-56ph-gvwc-wqxr/GHSA-56ph-gvwc-wqxr.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-56ph-gvwc-wqxr",
4+
"modified": "2026-03-28T21:33:11Z",
5+
"published": "2026-03-28T21:33:11Z",
6+
"aliases": [
7+
"CVE-2026-5007"
8+
],
9+
"details": "A vulnerability was identified in kazuph mcp-docs-rag up to 0.5.0. Affected is the function cloneRepository of the file src/index.ts of the component add_git_repository/add_text_file. The manipulation leads to os command injection. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5007"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/kazuph/mcp-docs-rag/issues/7"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/kazuph/mcp-docs-rag"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/user-attachments/files/25822451/mcp-docs-rag_bug.pdf"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/submit/779152"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/353892"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/353892/cti"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-77"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-03-28T19:16:56Z"
59+
}
60+
}

‎advisories/unreviewed/2026/03/GHSA-72rh-qqpc-g693/GHSA-72rh-qqpc-g693.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-72rh-qqpc-g693",
4+
"modified": "2026-03-28T21:33:12Z",
5+
"published": "2026-03-28T21:33:12Z",
6+
"aliases": [
7+
"CVE-2026-5014"
8+
],
9+
"details": "A vulnerability was found in elecV2 elecV2P up to 3.8.3. The affected element is the function path.join of the file /log/ of the component Wildcard Handler. The manipulation results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5014"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/elecV2/elecV2P/issues/200"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/elecV2/elecV2P"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/779178"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/353899"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/353899/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-22"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-28T21:17:00Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-7r2j-hgh9-jqqx/GHSA-7r2j-hgh9-jqqx.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7r2j-hgh9-jqqx",
4+
"modified": "2026-03-28T21:33:11Z",
5+
"published": "2026-03-28T21:33:11Z",
6+
"aliases": [
7+
"CVE-2025-15604"
8+
],
9+
"details": "Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions.\n\nIn versions 6.06 through 6.16, the random_string function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes by concatenating a SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nBefore version 6.06, there was no fallback when /dev/urandom was not available.\n\nBefore version 6.04, the random_string function used the built-in rand() function to generate a mixed-case alphanumeric string.\n\nThis function may be used for generating session ids, generating secrets for signing or encrypting cookie session data and generating tokens used for Cross Site Request Forgery (CSRF) protection.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15604"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/tokuhirom/Amon/pull/135"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://metacpan.org/release/TOKUHIROM/Amon2-6.17/changes"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://metacpan.org/release/TOKUHIROM/Amon2-6.17/diff/TOKUHIROM/Amon2-6.16#lib/Amon2/Util.pm"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "http://www.openwall.com/lists/oss-security/2026/03/28/4"
36+
}
37+
],
38+
"database_specific": {
39+
"cwe_ids": [
40+
"CWE-338"
41+
],
42+
"severity": null,
43+
"github_reviewed": false,
44+
"github_reviewed_at": null,
45+
"nvd_published_at": "2026-03-28T19:16:53Z"
46+
}
47+
}

‎advisories/unreviewed/2026/03/GHSA-8h9m-gcc8-25c6/GHSA-8h9m-gcc8-25c6.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8h9m-gcc8-25c6",
4+
"modified": "2026-03-28T21:33:12Z",
5+
"published": "2026-03-28T21:33:12Z",
6+
"aliases": [
7+
"CVE-2026-5015"
8+
],
9+
"details": "A vulnerability was determined in elecV2 elecV2P up to 3.8.3. The impacted element is an unknown function of the file /logs of the component Endpoint. This manipulation of the argument filename causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5015"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/elecV2/elecV2P/issues/201"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/elecV2/elecV2P"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/779180"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/353900"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/353900/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-28T21:17:00Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-h9hm-gx5c-xfc2/GHSA-h9hm-gx5c-xfc2.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h9hm-gx5c-xfc2",
4+
"modified": "2026-03-28T21:33:12Z",
5+
"published": "2026-03-28T21:33:12Z",
6+
"aliases": [
7+
"CVE-2026-5013"
8+
],
9+
"details": "A vulnerability has been found in elecV2 elecV2P up to 3.8.3. Impacted is the function path.join of the file /store/:key. The manipulation of the argument URL leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5013"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/elecV2/elecV2P/issues/199"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/elecV2/elecV2P"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/779177"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/353898"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/353898/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-22"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-28T20:16:16Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-j22f-5qx8-xp6w/GHSA-j22f-5qx8-xp6w.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j22f-5qx8-xp6w",
4+
"modified": "2026-03-28T21:33:11Z",
5+
"published": "2026-03-28T21:33:11Z",
6+
"aliases": [
7+
"CVE-2026-5012"
8+
],
9+
"details": "A flaw has been found in elecV2 elecV2P up to 3.8.3. This issue affects the function pm2run of the file /rpc. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5012"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/elecV2/elecV2P/issues/196"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/elecV2/elecV2P"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/779174"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/353897"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/353897/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-77"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-28T20:16:16Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-mx9c-4xjq-mhj6/GHSA-mx9c-4xjq-mhj6.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mx9c-4xjq-mhj6",
4+
"modified": "2026-03-28T21:33:11Z",
5+
"published": "2026-03-28T21:33:11Z",
6+
"aliases": [
7+
"CVE-2026-3256"
8+
],
9+
"details": "HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids.\n\nHTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nThe distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3256"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/MD5.pm"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/SHA1.pm"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "http://www.openwall.com/lists/oss-security/2026/03/28/5"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [
36+
"CWE-338"
37+
],
38+
"severity": null,
39+
"github_reviewed": false,
40+
"github_reviewed_at": null,
41+
"nvd_published_at": "2026-03-28T19:16:56Z"
42+
}
43+
}

0 commit comments

Comments
 (0)