Skip to content

Commit 99d0760

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 47c0e3a commit 99d0760

File tree

30 files changed

+1096
-2
lines changed

30 files changed

+1096
-2
lines changed

‎advisories/unreviewed/2024/06/GHSA-qqfg-j9g4-4mfh/GHSA-qqfg-j9g4-4mfh.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
],
2727
"database_specific": {
2828
"cwe_ids": [
29+
"CWE-122",
2930
"CWE-787"
3031
],
3132
"severity": "CRITICAL",

‎advisories/unreviewed/2026/01/GHSA-2vgv-hgv4-22mh/GHSA-2vgv-hgv4-22mh.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2vgv-hgv4-22mh",
4+
"modified": "2026-01-23T00:31:16Z",
5+
"published": "2026-01-23T00:31:16Z",
6+
"aliases": [
7+
"CVE-2026-20800"
8+
],
9+
"details": "Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "WEB",
15+
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-g54m-9f6g-wj7q"
16+
},
17+
{
18+
"type": "ADVISORY",
19+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20800"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/go-gitea/gitea/pull/36339"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://blog.gitea.com/release-of-1.25.4"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [
36+
"CWE-200"
37+
],
38+
"severity": null,
39+
"github_reviewed": false,
40+
"github_reviewed_at": null,
41+
"nvd_published_at": "2026-01-22T22:16:17Z"
42+
}
43+
}

‎advisories/unreviewed/2026/01/GHSA-393c-qgvj-3xph/GHSA-393c-qgvj-3xph.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-393c-qgvj-3xph",
4+
"modified": "2026-01-23T00:31:17Z",
5+
"published": "2026-01-23T00:31:16Z",
6+
"aliases": [
7+
"CVE-2026-20897"
8+
],
9+
"details": "Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "WEB",
15+
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rrq5-r9h5-pc7c"
16+
},
17+
{
18+
"type": "ADVISORY",
19+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20897"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/go-gitea/gitea/pull/36344"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://github.com/go-gitea/gitea/pull/36349"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://blog.gitea.com/release-of-1.25.4"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
36+
}
37+
],
38+
"database_specific": {
39+
"cwe_ids": [
40+
"CWE-284"
41+
],
42+
"severity": null,
43+
"github_reviewed": false,
44+
"github_reviewed_at": null,
45+
"nvd_published_at": "2026-01-22T22:16:18Z"
46+
}
47+
}

‎advisories/unreviewed/2026/01/GHSA-3h7x-hf52-fwj9/GHSA-3h7x-hf52-fwj9.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3h7x-hf52-fwj9",
4+
"modified": "2026-01-23T00:31:17Z",
5+
"published": "2026-01-23T00:31:17Z",
6+
"aliases": [
7+
"CVE-2026-21264"
8+
],
9+
"details": "Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing over a network.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21264"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21264"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-22T23:15:57Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-3xjj-vfrx-ch8r/GHSA-3xjj-vfrx-ch8r.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3xjj-vfrx-ch8r",
4+
"modified": "2026-01-23T00:31:17Z",
5+
"published": "2026-01-23T00:31:17Z",
6+
"aliases": [
7+
"CVE-2026-21227"
8+
],
9+
"details": "Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21227"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21227"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-22"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-22T23:15:57Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-4xvg-4w2r-qph8/GHSA-4xvg-4w2r-qph8.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4xvg-4w2r-qph8",
4+
"modified": "2026-01-23T00:31:17Z",
5+
"published": "2026-01-23T00:31:17Z",
6+
"aliases": [
7+
"CVE-2025-25051"
8+
],
9+
"details": "An attacker could decrypt sensitive data, impersonate legitimate users \nor devices, and potentially gain access to network resources for lateral\n attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25051"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-022-02.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-02"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-256"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-22T23:15:48Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-4xx9-vc8v-87hv/GHSA-4xx9-vc8v-87hv.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4xx9-vc8v-87hv",
4+
"modified": "2026-01-23T00:31:17Z",
5+
"published": "2026-01-23T00:31:17Z",
6+
"aliases": [
7+
"CVE-2026-20912"
8+
],
9+
"details": "Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "WEB",
15+
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw"
16+
},
17+
{
18+
"type": "ADVISORY",
19+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20912"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/go-gitea/gitea/pull/36320"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://github.com/go-gitea/gitea/pull/36355"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://blog.gitea.com/release-of-1.25.4"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
36+
}
37+
],
38+
"database_specific": {
39+
"cwe_ids": [
40+
"CWE-284"
41+
],
42+
"severity": null,
43+
"github_reviewed": false,
44+
"github_reviewed_at": null,
45+
"nvd_published_at": "2026-01-22T22:16:19Z"
46+
}
47+
}

‎advisories/unreviewed/2026/01/GHSA-5vx4-v4r5-wrxg/GHSA-5vx4-v4r5-wrxg.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5vx4-v4r5-wrxg",
4+
"modified": "2026-01-23T00:31:17Z",
5+
"published": "2026-01-23T00:31:17Z",
6+
"aliases": [
7+
"CVE-2026-21520"
8+
],
9+
"details": "Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21520"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21520"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-77"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-22T23:15:57Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-5wf5-mwm8-68x4/GHSA-5wf5-mwm8-68x4.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5wf5-mwm8-68x4",
4+
"modified": "2026-01-23T00:31:18Z",
5+
"published": "2026-01-23T00:31:18Z",
6+
"aliases": [
7+
"CVE-2026-24307"
8+
],
9+
"details": "Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24307"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24307"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-1287"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-22T23:15:59Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-857q-pww2-xgv7/GHSA-857q-pww2-xgv7.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-857q-pww2-xgv7",
4+
"modified": "2026-01-23T00:31:17Z",
5+
"published": "2026-01-23T00:31:17Z",
6+
"aliases": [
7+
"CVE-2025-55705"
8+
],
9+
"details": "This vulnerability occurs when the system permits multiple simultaneous \nconnections to the backend using the same charging station ID. This can \nresult in unauthorized access, data inconsistency, or potential \nmanipulation of charging sessions. The lack of proper session management\n and expiration control allows attackers to exploit this weakness by \nreusing valid charging station IDs to establish multiple sessions \nconcurrently.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55705"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-022-08.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-08"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-613"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-22T23:15:50Z"
39+
}
40+
}

0 commit comments

Comments
 (0)