Skip to content

Commit 86c172d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2m8h-x5w5-777h GHSA-2w8x-224x-785m GHSA-8g9j-3hrr-2hvm GHSA-fcq3-632g-qpmv GHSA-gxf2-jfmj-j5cj
1 parent 79c97ff commit 86c172d

File tree

5 files changed

+244
-0
lines changed

5 files changed

+244
-0
lines changed

‎advisories/unreviewed/2026/03/GHSA-2m8h-x5w5-777h/GHSA-2m8h-x5w5-777h.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2m8h-x5w5-777h",
4+
"modified": "2026-03-17T06:31:32Z",
5+
"published": "2026-03-17T06:31:32Z",
6+
"aliases": [
7+
"CVE-2026-2373"
8+
],
9+
"details": "The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the get_main_query_args() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract contents of non-public custom post types, such as Contact Form 7 submissions or WooCommerce coupons.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2373"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3475656"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c4192a7f-b962-46f9-a524-7271ed6f4917?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-862"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-17T04:16:14Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-2w8x-224x-785m/GHSA-2w8x-224x-785m.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2w8x-224x-785m",
4+
"modified": "2026-03-17T06:31:32Z",
5+
"published": "2026-03-17T06:31:32Z",
6+
"aliases": [
7+
"CVE-2026-4258"
8+
],
9+
"details": "All versions of the package sjcl are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH outputs. The dhJavaEc() function directly returns the raw x-coordinate of the scalar multiplication result (no hashing), providing a plaintext oracle without requiring any decryption feedback.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4258"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bitwiseshiftleft/sjcl/commit/ee307459972442a17beebc29dc331fffd8aff796"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gist.github.com/Kr0emer/2560f98edb10b0b34f2438cd63913c47"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/bitwiseshiftleft/sjcl/blob/master/core/ecc.js%23L454-L461"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://security.snyk.io/vuln/SNYK-JS-SJCL-15369617"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-347"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-17T06:16:18Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-8g9j-3hrr-2hvm/GHSA-8g9j-3hrr-2hvm.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8g9j-3hrr-2hvm",
4+
"modified": "2026-03-17T06:31:32Z",
5+
"published": "2026-03-17T06:31:32Z",
6+
"aliases": [
7+
"CVE-2026-4308"
8+
],
9+
"details": "A weakness has been identified in frdel/agent0ai agent-zero 0.9.7. This affects the function handle_pdf_document of the file python/helpers/document_query.py. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4308"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.351338"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.351338"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.773950"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-918"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-17T04:16:24Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-fcq3-632g-qpmv/GHSA-fcq3-632g-qpmv.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fcq3-632g-qpmv",
4+
"modified": "2026-03-17T06:31:32Z",
5+
"published": "2026-03-17T06:31:32Z",
6+
"aliases": [
7+
"CVE-2026-4307"
8+
],
9+
"details": "A security flaw has been discovered in frdel/agent0ai agent-zero 0.9.7-10. The impacted element is the function get_abs_path of the file python/helpers/files.py. The manipulation results in path traversal. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4307"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gist.github.com/YLChen-007/1819c843ad26aaaaecdc768a789df022"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.351337"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.351337"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.771967"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-22"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-17T04:16:22Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-gxf2-jfmj-j5cj/GHSA-gxf2-jfmj-j5cj.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gxf2-jfmj-j5cj",
4+
"modified": "2026-03-17T06:31:32Z",
5+
"published": "2026-03-17T06:31:32Z",
6+
"aliases": [
7+
"CVE-2026-0708"
8+
],
9+
"details": "A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) input that contains a key with an embedded null byte. This can cause a segmentation fault (SEGV fault) in the `ucl_object_emit` function when parsing and emitting the object, leading to a Denial of Service (DoS) for the affected system.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0708"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/vstakhov/libucl/issues/323"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://access.redhat.com/security/cve/CVE-2026-0708"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427770"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-125"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-17T04:16:07Z"
43+
}
44+
}

0 commit comments

Comments
 (0)