Skip to content

Commit 7f255e0

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5c5p-g26h-xx2f GHSA-6phw-p8vc-q8gp GHSA-8643-3fq3-vwcr GHSA-8mfp-xmv3-hv35 GHSA-mjjp-xjfg-97wg GHSA-p54q-9gfq-fvp4 GHSA-q82x-ch97-83xv
1 parent 1f017a7 commit 7f255e0

7 files changed

Lines changed: 326 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/01/GHSA-5c5p-g26h-xx2f/GHSA-5c5p-g26h-xx2f.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5c5p-g26h-xx2f",
4+
"modified": "2026-01-10T12:30:15Z",
5+
"published": "2026-01-10T12:30:15Z",
6+
"aliases": [
7+
"CVE-2025-52435"
8+
],
9+
"details": "J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE.\n\nImproper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange.\nThis issue affects Apache NimBLE: through <= 1.8.0.\n\nUsers are recommended to upgrade to version 1.9.0, which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52435"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/apache/mynewt-nimble/commit/164f1c23c18a290908df76ed83fe848bfe4a4903"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/apache/mynewt-nimble/commit/ec3d75e909fa6dcadf1836fefc4432794a673d18"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://lists.apache.org/thread/ow8dzpsqfh9llfclh5fzh6z237brzc0s"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "http://www.openwall.com/lists/oss-security/2026/01/08/1"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2026-01-10T10:15:50Z"
40+
}
41+
}

‎advisories/unreviewed/2026/01/GHSA-6phw-p8vc-q8gp/GHSA-6phw-p8vc-q8gp.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6phw-p8vc-q8gp",
4+
"modified": "2026-01-10T12:30:16Z",
5+
"published": "2026-01-10T12:30:16Z",
6+
"aliases": [
7+
"CVE-2025-53477"
8+
],
9+
"details": "NULL Pointer Dereference vulnerability in Apache Nimble.\n\nMissing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference.\nThis issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low.\n\nThis issue affects Apache NimBLE: through 1.8.0.\n\nUsers are recommended to upgrade to version 1.9.0, which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53477"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/apache/mynewt-nimble/commit/0caf9baeb271ede85fcc5237ab87ddbf938600da"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/apache/mynewt-nimble/commit/3160b8c4c7ff8db4e0f9badcdf7df684b151e077"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://lists.apache.org/thread/1dxthc132hwm2tzvjblrtnschcsbw2vo"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "http://www.openwall.com/lists/oss-security/2026/01/08/3"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [
36+
"CWE-476"
37+
],
38+
"severity": null,
39+
"github_reviewed": false,
40+
"github_reviewed_at": null,
41+
"nvd_published_at": "2026-01-10T10:15:50Z"
42+
}
43+
}

‎advisories/unreviewed/2026/01/GHSA-8643-3fq3-vwcr/GHSA-8643-3fq3-vwcr.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8643-3fq3-vwcr",
4+
"modified": "2026-01-10T12:30:16Z",
5+
"published": "2026-01-10T12:30:16Z",
6+
"aliases": [
7+
"CVE-2026-0831"
8+
],
9+
"details": "The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. This is due to inadequate input validation in the `save_template_to_file()` function where user-controlled parameters like `session_id`, `content_id`, and `ai_page_ids` are used to construct file paths without proper sanitization. This makes it possible for unauthenticated attackers to write arbitrary `.ai.json` files to locations within the uploads directory.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0831"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/templately/tags/3.4.5/includes/API/AIContent.php#L38"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/templately/tags/3.4.5/includes/Core/Importer/Utils/AIUtils.php#L414"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/changeset/3426051"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/778242f4-5dfa-4d72-a032-8b5521c5b8ce?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-863"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-01-10T10:15:50Z"
47+
}
48+
}

‎advisories/unreviewed/2026/01/GHSA-8mfp-xmv3-hv35/GHSA-8mfp-xmv3-hv35.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8mfp-xmv3-hv35",
4+
"modified": "2026-01-10T12:30:16Z",
5+
"published": "2026-01-10T12:30:15Z",
6+
"aliases": [
7+
"CVE-2025-62235"
8+
],
9+
"details": "Authentication Bypass by Spoofing vulnerability in Apache NimBLE.\n\nReceiving specially crafted Security Request could lead to removal of original bond and re-bond with impostor.\nThis issue affects Apache NimBLE: through 1.8.0.\n\nUsers are recommended to upgrade to version 1.9.0, which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62235"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/apache/mynewt-nimble/commit/41f67e391e788c5feef9030026cc5cbc5431838a"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://lists.apache.org/thread/rw2mrpfwb9d9wmq4h4b6ctcd6gpkk2ho"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "http://www.openwall.com/lists/oss-security/2026/01/08/4"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [
32+
"CWE-290"
33+
],
34+
"severity": null,
35+
"github_reviewed": false,
36+
"github_reviewed_at": null,
37+
"nvd_published_at": "2026-01-10T10:15:50Z"
38+
}
39+
}

‎advisories/unreviewed/2026/01/GHSA-mjjp-xjfg-97wg/GHSA-mjjp-xjfg-97wg.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mjjp-xjfg-97wg",
4+
"modified": "2026-01-10T12:30:16Z",
5+
"published": "2026-01-10T12:30:16Z",
6+
"aliases": [
7+
"CVE-2025-15504"
8+
],
9+
"details": "A security flaw has been discovered in lief-project LIEF up to 0.17.1. Affected by this issue is the function Parser::parse_binary of the file src/ELF/Parser.tcc of the component ELF Binary Parser. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.17.2 can resolve this issue. The patch is identified as 81bd5d7ea0c390563f1c4c017c9019d154802978. It is recommended to upgrade the affected component.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15504"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/lief-project/LIEF/issues/1277"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/lief-project/LIEF/issues/1277#issuecomment-3693859001"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/lief-project/LIEF/commit/81bd5d7ea0c390563f1c4c017c9019d154802978"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/lief-project/LIEF/releases/tag/0.17.2"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/oneafter/1210/blob/main/segv1"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?ctiid.340375"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?id.340375"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/?submit.733329"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-404"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": false,
65+
"github_reviewed_at": null,
66+
"nvd_published_at": "2026-01-10T12:15:49Z"
67+
}
68+
}

‎advisories/unreviewed/2026/01/GHSA-p54q-9gfq-fvp4/GHSA-p54q-9gfq-fvp4.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p54q-9gfq-fvp4",
4+
"modified": "2026-01-10T12:30:16Z",
5+
"published": "2026-01-10T12:30:15Z",
6+
"aliases": [
7+
"CVE-2025-53470"
8+
],
9+
"details": "Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver.\n\nThis issue affects Apache NimBLE: through 1.8. \n\nThis issue requires a broken or bogus Bluetooth controller and thus severity is considered low.\n\nUsers are recommended to upgrade to version 1.9, which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53470"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/apache/mynewt-nimble/commit/b973df0c6cf7b30efbf8eb2cafdc1ee843464b76"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://lists.apache.org/thread/32sm0944dyod4sdql77stgyw9xb2msc0"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "http://www.openwall.com/lists/oss-security/2026/01/08/2"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [
32+
"CWE-125"
33+
],
34+
"severity": null,
35+
"github_reviewed": false,
36+
"github_reviewed_at": null,
37+
"nvd_published_at": "2026-01-10T10:15:50Z"
38+
}
39+
}

‎advisories/unreviewed/2026/01/GHSA-q82x-ch97-83xv/GHSA-q82x-ch97-83xv.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q82x-ch97-83xv",
4+
"modified": "2026-01-10T12:30:16Z",
5+
"published": "2026-01-10T12:30:16Z",
6+
"aliases": [
7+
"CVE-2025-14506"
8+
],
9+
"details": "The ConvertForce Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gutenberg block's `entrance_animation` attribute in all versions up to, and including, 0.0.7. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14506"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/convertforce-popup-builder/trunk/inc/Blocks/Conversion.php#L47"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/convertforce-popup-builder/trunk/inc/Blocks/Conversion.php#L66"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/changeset/3419678"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c57b9a78-53f4-40bb-ae6a-c5242b41329f?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-79"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-01-10T12:15:48Z"
47+
}
48+
}

0 commit comments

Comments
 (0)