Skip to content

Commit 84185f0

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5jcv-37h5-w6rh GHSA-7f48-jjj6-53wv GHSA-857q-6v86-xp84 GHSA-86f8-8qwm-r888 GHSA-8phm-9c2m-9hpq GHSA-h2j5-qh4r-f6cm GHSA-m23h-283x-x3r6 GHSA-xmfj-7pp5-fxr6
1 parent 4fc3c98 commit 84185f0

8 files changed

Lines changed: 300 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/01/GHSA-5jcv-37h5-w6rh/GHSA-5jcv-37h5-w6rh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5jcv-37h5-w6rh",
4+
"modified": "2026-01-30T09:30:55Z",
5+
"published": "2026-01-30T09:30:55Z",
6+
"aliases": [
7+
"CVE-2026-22277"
8+
],
9+
"details": "Dell UnityVSA, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22277"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.dell.com/support/kbdoc/en-us/000421197/dsa-2026-054-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-78"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-30T09:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-7f48-jjj6-53wv/GHSA-7f48-jjj6-53wv.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7f48-jjj6-53wv",
4+
"modified": "2026-01-30T09:30:54Z",
5+
"published": "2026-01-30T09:30:54Z",
6+
"aliases": [
7+
"CVE-2026-1680"
8+
],
9+
"details": "Improper access control in the WCF endpoint in Edgemo (now owned by Danoffice IT) Local Admin Service 1.2.7.23180 on Windows allows a local user to escalate their privileges to local administrator via direct communication with the LocalAdminService.exe named pipe, bypassing client-side group membership restrictions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1680"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://retest.dk/local-privilege-escalation-vulnerability-found-in-local-admin-service"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.danofficeit.com/howwedoit/workplace/management"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-250"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-30T07:16:15Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-857q-6v86-xp84/GHSA-857q-6v86-xp84.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-857q-6v86-xp84",
4+
"modified": "2026-01-30T09:30:55Z",
5+
"published": "2026-01-30T09:30:55Z",
6+
"aliases": [
7+
"CVE-2026-25210"
8+
],
9+
"details": "In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25210"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/libexpat/libexpat/pull/1075"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-190"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-30T07:16:15Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-86f8-8qwm-r888/GHSA-86f8-8qwm-r888.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-86f8-8qwm-r888",
4+
"modified": "2026-01-30T09:30:55Z",
5+
"published": "2026-01-30T09:30:55Z",
6+
"aliases": [
7+
"CVE-2026-21418"
8+
],
9+
"details": "Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21418"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.dell.com/support/kbdoc/en-us/000421197/dsa-2026-054-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-78"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-30T09:15:50Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-8phm-9c2m-9hpq/GHSA-8phm-9c2m-9hpq.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8phm-9c2m-9hpq",
4+
"modified": "2026-01-30T09:30:54Z",
5+
"published": "2026-01-30T09:30:54Z",
6+
"aliases": [
7+
"CVE-2026-0963"
8+
],
9+
"details": "An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0963"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gitlab.com/crafty-controller/crafty-4/-/issues/660"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-22"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-30T07:16:15Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-h2j5-qh4r-f6cm/GHSA-h2j5-qh4r-f6cm.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h2j5-qh4r-f6cm",
4+
"modified": "2026-01-30T09:30:55Z",
5+
"published": "2026-01-30T09:30:55Z",
6+
"aliases": [
7+
"CVE-2025-1395"
8+
],
9+
"details": "Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson allows Fuzzing for application mapping.This issue affects HeyGarson: through 30012026.\n\nNOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1395"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.usom.gov.tr/bildirim/tr-26-0009"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-209"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-30T09:15:49Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-m23h-283x-x3r6/GHSA-m23h-283x-x3r6.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m23h-283x-x3r6",
4+
"modified": "2026-01-30T09:30:53Z",
5+
"published": "2026-01-30T09:30:53Z",
6+
"aliases": [
7+
"CVE-2026-0805"
8+
],
9+
"details": "An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0805"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gitlab.com/crafty-controller/crafty-4/-/issues/650"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-22"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-30T07:16:14Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-xmfj-7pp5-fxr6/GHSA-xmfj-7pp5-fxr6.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xmfj-7pp5-fxr6",
4+
"modified": "2026-01-30T09:30:55Z",
5+
"published": "2026-01-30T09:30:55Z",
6+
"aliases": [
7+
"CVE-2026-25211"
8+
],
9+
"details": "Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25211"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/llamastack/llama-stack/pull/4439"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/llamastack/llama-stack/compare/v0.4.0rc2...v0.4.0rc3"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-532"
34+
],
35+
"severity": "LOW",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-30T08:16:02Z"
39+
}
40+
}

0 commit comments

Comments
 (0)