Skip to content

Commit abb1169

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-23hh-2f47-3p4h GHSA-2g59-m95p-pgfq GHSA-354g-gr9q-32q8 GHSA-7f7m-83r3-p644 GHSA-89mp-j99f-xqxm GHSA-8f3h-gvwr-46vx GHSA-gm79-2pvc-wc75 GHSA-rqmc-4j3g-x93f GHSA-xc2j-7277-whgq
1 parent af614d0 commit abb1169

File tree

9 files changed

+432
-0
lines changed

9 files changed

+432
-0
lines changed

‎advisories/unreviewed/2026/01/GHSA-23hh-2f47-3p4h/GHSA-23hh-2f47-3p4h.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-23hh-2f47-3p4h",
4+
"modified": "2026-01-20T00:30:27Z",
5+
"published": "2026-01-20T00:30:27Z",
6+
"aliases": [
7+
"CVE-2026-1193"
8+
],
9+
"details": "A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cache/view of the component View Interface. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1193"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/SourByte05/MineAdmin-Vulnerability/issues/6"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341778"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341778"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.734270"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-266"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-19T23:16:03Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-2g59-m95p-pgfq/GHSA-2g59-m95p-pgfq.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2g59-m95p-pgfq",
4+
"modified": "2026-01-20T00:30:28Z",
5+
"published": "2026-01-20T00:30:28Z",
6+
"aliases": [
7+
"CVE-2026-22219"
8+
],
9+
"details": "Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22219"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/Chainlit/chainlit/releases/tag/2.9.4"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-918"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-20T00:15:49Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-354g-gr9q-32q8/GHSA-354g-gr9q-32q8.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-354g-gr9q-32q8",
4+
"modified": "2026-01-20T00:30:26Z",
5+
"published": "2026-01-20T00:30:26Z",
6+
"aliases": [
7+
"CVE-2026-1178"
8+
],
9+
"details": "A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1178"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-66-LX/cve/issues/18"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341772"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341772"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.734593"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-19T22:16:02Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-7f7m-83r3-p644/GHSA-7f7m-83r3-p644.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7f7m-83r3-p644",
4+
"modified": "2026-01-20T00:30:28Z",
5+
"published": "2026-01-20T00:30:27Z",
6+
"aliases": [
7+
"CVE-2026-1194"
8+
],
9+
"details": "A security flaw has been discovered in MineAdmin 1.x/2.x. This affects an unknown function of the component Swagger. The manipulation results in information disclosure. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1194"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/SourByte05/MineAdmin-Vulnerability/issues/5"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341779"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341779"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.734271"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-200"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-20T00:15:48Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-89mp-j99f-xqxm/GHSA-89mp-j99f-xqxm.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-89mp-j99f-xqxm",
4+
"modified": "2026-01-20T00:30:27Z",
5+
"published": "2026-01-20T00:30:27Z",
6+
"aliases": [
7+
"CVE-2026-1179"
8+
],
9+
"details": "A vulnerability was detected in Yonyou KSOA 9.0. This affects an unknown part of the file /kmf/user_popedom.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1179"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-66-LX/cve/issues/19"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341773"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341773"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.734594"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-19T23:16:02Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-8f3h-gvwr-46vx/GHSA-8f3h-gvwr-46vx.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8f3h-gvwr-46vx",
4+
"modified": "2026-01-20T00:30:27Z",
5+
"published": "2026-01-20T00:30:27Z",
6+
"aliases": [
7+
"CVE-2026-1192"
8+
],
9+
"details": "A vulnerability was determined in Tosei Online Store Management System ネット店舗管理システム 1.01. The affected element is an unknown function of the file /cgi-bin/imode_alldata.php. Executing a manipulation of the argument DevId can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1192"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.341777"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.341777"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.734205"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.yuque.com/yuqueyonghuexlgkz/zepczx/keenhf9u2bnw5o6g"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-19T23:16:03Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-gm79-2pvc-wc75/GHSA-gm79-2pvc-wc75.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gm79-2pvc-wc75",
4+
"modified": "2026-01-20T00:30:28Z",
5+
"published": "2026-01-20T00:30:28Z",
6+
"aliases": [
7+
"CVE-2026-22218"
8+
],
9+
"details": "Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents via /project/file/<chainlitKey>, allowing disclosure of any file readable by the Chainlit service.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22218"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/Chainlit/chainlit/releases/tag/2.9.4"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.vulncheck.com/advisories/chainlit-arbitrary-file-read-via-project-element"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-22"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-20T00:15:48Z"
39+
}
40+
}

0 commit comments

Comments
 (0)