Skip to content

Commit 98d1a4a

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent e3d5a46 commit 98d1a4a

39 files changed

Lines changed: 1022 additions & 57 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-7648-c8fp-vqw5/GHSA-7648-c8fp-vqw5.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7648-c8fp-vqw5",
4-
"modified": "2026-03-25T18:31:49Z",
4+
"modified": "2026-04-06T21:31:33Z",
55
"published": "2026-03-25T18:31:49Z",
66
"aliases": [
77
"CVE-2026-23971"
88
],
99
"details": "Deserialization of Untrusted Data vulnerability in xtemos WoodMart woodmart allows Object Injection.This issue affects WoodMart: from n/a through <= 8.3.8.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-502"
2530
],
26-
"severity": null,
31+
"severity": "HIGH",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-03-25T17:16:36Z"

‎advisories/unreviewed/2026/03/GHSA-w9px-jjvp-q592/GHSA-w9px-jjvp-q592.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-w9px-jjvp-q592",
4-
"modified": "2026-03-25T18:31:51Z",
4+
"modified": "2026-04-06T21:31:33Z",
55
"published": "2026-03-25T18:31:51Z",
66
"aliases": [
77
"CVE-2026-25371"
88
],
99
"details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in King-Theme Lumise Product Designer lumise allows Blind SQL Injection.This issue affects Lumise Product Designer: from n/a through < 2.0.9.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-89"
2530
],
26-
"severity": null,
31+
"severity": "CRITICAL",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-03-25T17:16:47Z"

‎advisories/unreviewed/2026/04/GHSA-25v3-gpg9-m4p7/GHSA-25v3-gpg9-m4p7.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-25v3-gpg9-m4p7",
4-
"modified": "2026-04-02T18:31:38Z",
4+
"modified": "2026-04-06T21:31:33Z",
55
"published": "2026-04-02T18:31:38Z",
66
"aliases": [
77
"CVE-2026-34119"
88
],
99
"details": "A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing\nloop\nwhen appending segmented request bodies without\ncontinuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input.  An attacker\non the same network segment could trigger heap memory corruption conditions by\nsending crafted payloads that cause write operations beyond allocated buffer\nboundaries.  Successful exploitation\ncauses a Denial-of-Service (DoS) condition, causing the device’s process to\ncrash or become unresponsive.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/04/GHSA-2j2r-9pgw-95hp/GHSA-2j2r-9pgw-95hp.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2j2r-9pgw-95hp",
4+
"modified": "2026-04-06T21:31:35Z",
5+
"published": "2026-04-06T21:31:35Z",
6+
"aliases": [
7+
"CVE-2026-5682"
8+
],
9+
"details": "A vulnerability has been found in Meesho Online Shopping App up to 27.3 on Android. Affected is an unknown function of the file /api/endpoint of the component com.meesho.supply. Such manipulation leads to risky cryptographic algorithm. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5682"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/honestcorrupt/MEESHO-CVE"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/792717"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/355509"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/355509/cti"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "MODERATE",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2026-04-06T20:16:29Z"
49+
}
50+
}

‎advisories/unreviewed/2026/04/GHSA-2pm6-rcw9-992f/GHSA-2pm6-rcw9-992f.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2pm6-rcw9-992f",
4-
"modified": "2026-04-06T15:31:28Z",
4+
"modified": "2026-04-06T21:31:34Z",
55
"published": "2026-04-06T15:31:28Z",
66
"aliases": [
77
"CVE-2026-31066"
88
],
99
"details": "UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the selDateType parameter of the formTaskEdit function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-120"
30+
],
31+
"severity": "MODERATE",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2026-04-06T15:17:09Z"

‎advisories/unreviewed/2026/04/GHSA-3p7h-7569-cp4p/GHSA-3p7h-7569-cp4p.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3p7h-7569-cp4p",
4+
"modified": "2026-04-06T21:31:34Z",
5+
"published": "2026-04-06T21:31:34Z",
6+
"aliases": [
7+
"CVE-2025-54328"
8+
],
9+
"details": "An issue was discovered in SMS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. A Stack-based Buffer Overflow occurs while parsing SMS RP-DATA messages.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54328"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54328"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-121"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-06T20:16:20Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-479q-mw77-pmr5/GHSA-479q-mw77-pmr5.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-479q-mw77-pmr5",
4+
"modified": "2026-04-06T21:31:34Z",
5+
"published": "2026-04-06T21:31:34Z",
6+
"aliases": [
7+
"CVE-2026-35022"
8+
],
9+
"details": "Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in authentication helper execution where helper configuration values are executed using shell=true without input validation. Attackers who can influence authentication settings can inject shell metacharacters through parameters like apiKeyHelper, awsAuthRefresh, awsCredentialExport, and gcpAuthRefresh to execute arbitrary commands with the privileges of the user or automation environment, enabling credential theft and environment variable exfiltration.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35022"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://phoenix.security/critical-ci-cd-nightmare-3-command-injection-flaws-in-claude-code-cli-allow-credential-exfiltration"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/anthropic-claude-code-agent-sdk-os-command-injection-via-authentication-helper"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-78"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-06T20:16:25Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-495h-3r6f-j5gc/GHSA-495h-3r6f-j5gc.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-495h-3r6f-j5gc",
4-
"modified": "2026-04-06T15:31:28Z",
4+
"modified": "2026-04-06T21:31:34Z",
55
"published": "2026-04-06T15:31:28Z",
66
"aliases": [
77
"CVE-2026-31060"
88
],
99
"details": "UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the notes parameter of the formGroupConfig function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-120"
30+
],
31+
"severity": "MODERATE",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2026-04-06T15:17:08Z"

‎advisories/unreviewed/2026/04/GHSA-4c3f-9h8p-j5x9/GHSA-4c3f-9h8p-j5x9.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4c3f-9h8p-j5x9",
4-
"modified": "2026-04-06T15:31:28Z",
4+
"modified": "2026-04-06T21:31:34Z",
55
"published": "2026-04-06T15:31:28Z",
66
"aliases": [
77
"CVE-2026-31067"
88
],
99
"details": "A remote command execution (RCE) vulnerability in the /goform/formReleaseConnect component of UTT Aggressive 520W v3v1.7.7-180627 allows attackers to execute arbitrary commands via a crafted string.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-78"
30+
],
31+
"severity": "MODERATE",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2026-04-06T15:17:09Z"

‎advisories/unreviewed/2026/04/GHSA-6jwv-w5xf-7j27/GHSA-6jwv-w5xf-7j27.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6jwv-w5xf-7j27",
4+
"modified": "2026-04-06T21:31:34Z",
5+
"published": "2026-04-06T21:31:34Z",
6+
"aliases": [
7+
"CVE-2026-33817"
8+
],
9+
"details": "Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33817"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/golang/vulndb/issues/4923"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/etcd-io/bbolt/pull/1171/changes/386d5b69785937d1aa20cb25c8439404cf398143"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://pkg.go.dev/vuln/GO-2026-4923"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-125"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-06T19:16:27Z"
43+
}
44+
}

0 commit comments

Comments
 (0)