Skip to content

Commit 7ca20b2

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-8vgv-ffv5-269j GHSA-9pcj-m5rr-p28g GHSA-m387-6h4v-93hp GHSA-mvhf-547c-h55r GHSA-v8h4-7xcp-85r6 GHSA-vhm5-27gh-m6xq
1 parent 745efdf commit 7ca20b2

6 files changed

Lines changed: 95 additions & 20 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-8vgv-ffv5-269j/GHSA-8vgv-ffv5-269j.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8vgv-ffv5-269j",
4-
"modified": "2026-03-26T21:31:26Z",
4+
"modified": "2026-03-28T03:31:25Z",
55
"published": "2026-03-26T21:31:26Z",
66
"aliases": [
77
"CVE-2026-30458"
88
],
99
"details": "An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -32,8 +37,10 @@
3237
}
3338
],
3439
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
40+
"cwe_ids": [
41+
"CWE-620"
42+
],
43+
"severity": "CRITICAL",
3744
"github_reviewed": false,
3845
"github_reviewed_at": null,
3946
"nvd_published_at": "2026-03-26T19:17:00Z"

‎advisories/unreviewed/2026/03/GHSA-9pcj-m5rr-p28g/GHSA-9pcj-m5rr-p28g.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9pcj-m5rr-p28g",
4-
"modified": "2026-03-25T18:31:47Z",
4+
"modified": "2026-03-28T03:31:25Z",
55
"published": "2026-03-25T18:31:47Z",
66
"aliases": [
77
"CVE-2026-26831"
88
],
99
"details": "textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -40,8 +45,10 @@
4045
}
4146
],
4247
"database_specific": {
43-
"cwe_ids": [],
44-
"severity": null,
48+
"cwe_ids": [
49+
"CWE-94"
50+
],
51+
"severity": "CRITICAL",
4552
"github_reviewed": false,
4653
"github_reviewed_at": null,
4754
"nvd_published_at": "2026-03-25T16:16:21Z"

‎advisories/unreviewed/2026/03/GHSA-m387-6h4v-93hp/GHSA-m387-6h4v-93hp.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-m387-6h4v-93hp",
4-
"modified": "2026-03-25T21:30:35Z",
4+
"modified": "2026-03-28T03:31:25Z",
55
"published": "2026-03-25T21:30:35Z",
66
"aliases": [
77
"CVE-2025-70888"
88
],
99
"details": "An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-269"
38+
],
39+
"severity": "CRITICAL",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2026-03-25T20:16:22Z"

‎advisories/unreviewed/2026/03/GHSA-mvhf-547c-h55r/GHSA-mvhf-547c-h55r.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mvhf-547c-h55r",
4-
"modified": "2026-03-25T18:31:47Z",
4+
"modified": "2026-03-28T03:31:25Z",
55
"published": "2026-03-25T18:31:47Z",
66
"aliases": [
77
"CVE-2026-26833"
88
],
99
"details": "thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -32,8 +37,10 @@
3237
}
3338
],
3439
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
40+
"cwe_ids": [
41+
"CWE-94"
42+
],
43+
"severity": "CRITICAL",
3744
"github_reviewed": false,
3845
"github_reviewed_at": null,
3946
"nvd_published_at": "2026-03-25T16:16:21Z"

‎advisories/unreviewed/2026/03/GHSA-v8h4-7xcp-85r6/GHSA-v8h4-7xcp-85r6.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v8h4-7xcp-85r6",
4+
"modified": "2026-03-28T03:31:25Z",
5+
"published": "2026-03-28T03:31:25Z",
6+
"aliases": [
7+
"CVE-2026-4987"
8+
],
9+
"details": "The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a payment validation solely based on the value of a user-controlled parameter. This makes it possible for unauthenticated attackers to bypass configured form payment-amount validation and create underpriced payment/subscription intents by setting form_id to 0.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4987"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3488858/sureforms"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c4772b32-a730-44f2-b43c-f9bd5abb6541?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-20"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-28T02:16:14Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-vhm5-27gh-m6xq/GHSA-vhm5-27gh-m6xq.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vhm5-27gh-m6xq",
4-
"modified": "2026-03-26T21:31:26Z",
4+
"modified": "2026-03-28T03:31:25Z",
55
"published": "2026-03-26T21:31:26Z",
66
"aliases": [
77
"CVE-2026-30457"
88
],
99
"details": "An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -32,8 +37,10 @@
3237
}
3338
],
3439
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
40+
"cwe_ids": [
41+
"CWE-94"
42+
],
43+
"severity": "CRITICAL",
3744
"github_reviewed": false,
3845
"github_reviewed_at": null,
3946
"nvd_published_at": "2026-03-26T19:16:59Z"

0 commit comments

Comments
 (0)