Skip to content

Commit 971e17e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent ad4578f commit 971e17e

55 files changed

Lines changed: 1112 additions & 121 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/02/GHSA-h573-p6v2-3p2p/GHSA-h573-p6v2-3p2p.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h573-p6v2-3p2p",
4-
"modified": "2026-02-14T00:32:42Z",
4+
"modified": "2026-04-01T21:30:26Z",
55
"published": "2026-02-13T03:31:23Z",
66
"aliases": [
77
"CVE-2025-9293"
88
],
99
"details": "A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/02/GHSA-mgx6-7qx4-g5f3/GHSA-mgx6-7qx4-g5f3.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mgx6-7qx4-g5f3",
4-
"modified": "2026-02-14T00:32:41Z",
4+
"modified": "2026-04-01T21:30:26Z",
55
"published": "2026-02-13T03:31:23Z",
66
"aliases": [
77
"CVE-2025-9292"
88
],
99
"details": "A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/03/GHSA-27rm-rrv9-67mv/GHSA-27rm-rrv9-67mv.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-27rm-rrv9-67mv",
4-
"modified": "2026-03-31T15:31:56Z",
4+
"modified": "2026-04-01T21:30:27Z",
55
"published": "2026-03-31T15:31:56Z",
66
"aliases": [
77
"CVE-2026-30311"
88
],
99
"details": "Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on fragile regular expressions to parse command structures; while it attempts to intercept dangerous operations, it fails to account for standard Shell command substitution Ridvay Code (specifically$(...)and backticks ...). An attacker can construct a command such as git log --grep=\"$(malicious_command)\", forcing Syntx to misidentify it as a safe git operation and automatically approve it. The underlying Shell prioritizes the execution of the malicious code injected within the arguments, resulting in Remote Code Execution without any user interaction.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-78"
34+
],
35+
"severity": "CRITICAL",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2026-03-31T15:16:12Z"

‎advisories/unreviewed/2026/03/GHSA-53cw-7xjx-6838/GHSA-53cw-7xjx-6838.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-53cw-7xjx-6838",
4-
"modified": "2026-03-31T18:31:31Z",
4+
"modified": "2026-04-01T21:30:27Z",
55
"published": "2026-03-31T18:31:31Z",
66
"aliases": [
77
"CVE-2026-30281"
88
],
99
"details": "An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -32,8 +37,10 @@
3237
}
3338
],
3439
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
40+
"cwe_ids": [
41+
"CWE-73"
42+
],
43+
"severity": "CRITICAL",
3744
"github_reviewed": false,
3845
"github_reviewed_at": null,
3946
"nvd_published_at": "2026-03-31T16:16:29Z"

‎advisories/unreviewed/2026/03/GHSA-85jf-9mcx-32r5/GHSA-85jf-9mcx-32r5.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-85jf-9mcx-32r5",
4-
"modified": "2026-03-30T18:31:17Z",
4+
"modified": "2026-04-01T21:30:26Z",
55
"published": "2026-03-30T18:31:17Z",
66
"aliases": [
77
"CVE-2026-2285"
88
],
99
"details": "CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -21,7 +26,7 @@
2126
],
2227
"database_specific": {
2328
"cwe_ids": [],
24-
"severity": null,
29+
"severity": "HIGH",
2530
"github_reviewed": false,
2631
"github_reviewed_at": null,
2732
"nvd_published_at": "2026-03-30T16:16:04Z"

‎advisories/unreviewed/2026/03/GHSA-cj5g-jjhr-x8g6/GHSA-cj5g-jjhr-x8g6.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cj5g-jjhr-x8g6",
4-
"modified": "2026-03-31T15:31:56Z",
4+
"modified": "2026-04-01T21:30:27Z",
55
"published": "2026-03-31T15:31:56Z",
66
"aliases": [
77
"CVE-2026-30310"
88
],
99
"details": "In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-77"
34+
],
35+
"severity": "CRITICAL",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2026-03-31T14:16:11Z"

‎advisories/unreviewed/2026/03/GHSA-fgxv-26q5-6xq2/GHSA-fgxv-26q5-6xq2.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-fgxv-26q5-6xq2",
4-
"modified": "2026-03-31T18:31:31Z",
4+
"modified": "2026-04-01T21:30:27Z",
55
"published": "2026-03-31T18:31:31Z",
66
"aliases": [
77
"CVE-2026-30284"
88
],
99
"details": "An arbitrary file overwrite vulnerability in UXGROUP LLC Voice Recorder v10.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -32,8 +37,10 @@
3237
}
3338
],
3439
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
40+
"cwe_ids": [
41+
"CWE-73"
42+
],
43+
"severity": "HIGH",
3744
"github_reviewed": false,
3845
"github_reviewed_at": null,
3946
"nvd_published_at": "2026-03-31T16:16:29Z"

‎advisories/unreviewed/2026/03/GHSA-gr6f-xx69-hrgq/GHSA-gr6f-xx69-hrgq.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gr6f-xx69-hrgq",
4-
"modified": "2026-03-30T21:31:04Z",
4+
"modified": "2026-04-01T21:30:26Z",
55
"published": "2026-03-30T21:31:04Z",
66
"aliases": [
77
"CVE-2026-30308"
88
],
99
"details": "In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-94"
34+
],
35+
"severity": "CRITICAL",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2026-03-30T21:17:09Z"

‎advisories/unreviewed/2026/03/GHSA-mgj5-c563-6f76/GHSA-mgj5-c563-6f76.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mgj5-c563-6f76",
4-
"modified": "2026-03-30T18:31:17Z",
4+
"modified": "2026-04-01T21:30:26Z",
55
"published": "2026-03-30T18:31:17Z",
66
"aliases": [
77
"CVE-2026-2287"
88
],
99
"details": "CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE exploitation.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -21,7 +26,7 @@
2126
],
2227
"database_specific": {
2328
"cwe_ids": [],
24-
"severity": null,
29+
"severity": "CRITICAL",
2530
"github_reviewed": false,
2631
"github_reviewed_at": null,
2732
"nvd_published_at": "2026-03-30T16:16:04Z"

‎advisories/unreviewed/2026/03/GHSA-pgf5-gw7r-wxg7/GHSA-pgf5-gw7r-wxg7.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pgf5-gw7r-wxg7",
4-
"modified": "2026-03-30T18:31:17Z",
4+
"modified": "2026-04-01T21:30:26Z",
55
"published": "2026-03-30T18:31:17Z",
66
"aliases": [
77
"CVE-2026-2286"
88
],
99
"details": "CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search tools not properly validating URLs provided at runtime.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -21,7 +26,7 @@
2126
],
2227
"database_specific": {
2328
"cwe_ids": [],
24-
"severity": null,
29+
"severity": "CRITICAL",
2530
"github_reviewed": false,
2631
"github_reviewed_at": null,
2732
"nvd_published_at": "2026-03-30T16:16:04Z"

0 commit comments

Comments
 (0)