Skip to content

Commit ac8c6a8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2wx5-jfx2-287m GHSA-4p55-phcx-2vg2 GHSA-8g9w-79w6-cw84 GHSA-9rxj-wrx5-6463 GHSA-h376-wgw6-6272 GHSA-mqp2-8ch3-3446 GHSA-pm3x-gpqq-3g4r GHSA-wv3p-w5rj-f5p6
1 parent f37c424 commit ac8c6a8

File tree

8 files changed

+322
-8
lines changed

8 files changed

+322
-8
lines changed

‎advisories/unreviewed/2026/01/GHSA-2wx5-jfx2-287m/GHSA-2wx5-jfx2-287m.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2wx5-jfx2-287m",
4+
"modified": "2026-01-30T00:31:23Z",
5+
"published": "2026-01-30T00:31:23Z",
6+
"aliases": [
7+
"CVE-2026-1638"
8+
],
9+
"details": "A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZSetCfg of the file /goform/mDMZSetCfg. The manipulation of the argument dmzIp results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1638"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-LX88/cve/issues/26"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.343417"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.343417"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.740871"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-01-30T00:15:57Z"
55+
}
56+
}

‎advisories/unreviewed/2026/01/GHSA-4p55-phcx-2vg2/GHSA-4p55-phcx-2vg2.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4p55-phcx-2vg2",
4+
"modified": "2026-01-30T00:31:23Z",
5+
"published": "2026-01-30T00:31:23Z",
6+
"aliases": [
7+
"CVE-2026-1624"
8+
],
9+
"details": "A security vulnerability has been detected in D-Link DWR-M961 1.1.47. The affected element is an unknown function of the file /boafrm/formLtefotaUpgradeFibocom. Such manipulation of the argument fota_url leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1624"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/QIU-DIE/CVE/issues/50"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.343383"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.343383"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.740770"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.dlink.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-01-29T22:15:53Z"
55+
}
56+
}

‎advisories/unreviewed/2026/01/GHSA-8g9w-79w6-cw84/GHSA-8g9w-79w6-cw84.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8g9w-79w6-cw84",
4-
"modified": "2026-01-29T21:30:31Z",
4+
"modified": "2026-01-30T00:31:22Z",
55
"published": "2026-01-29T21:30:31Z",
66
"aliases": [
77
"CVE-2025-69516"
88
],
99
"details": "A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-1336"
38+
],
39+
"severity": "HIGH",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2026-01-29T20:16:09Z"

‎advisories/unreviewed/2026/01/GHSA-9rxj-wrx5-6463/GHSA-9rxj-wrx5-6463.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9rxj-wrx5-6463",
4-
"modified": "2026-01-28T21:31:24Z",
4+
"modified": "2026-01-30T00:31:22Z",
55
"published": "2026-01-28T21:31:24Z",
66
"aliases": [
77
"CVE-2025-71006"
88
],
99
"details": "A floating point exception (FPE) in the oneflow.reshape component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-369"
34+
],
35+
"severity": "MODERATE",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2026-01-28T21:16:09Z"

‎advisories/unreviewed/2026/01/GHSA-h376-wgw6-6272/GHSA-h376-wgw6-6272.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h376-wgw6-6272",
4+
"modified": "2026-01-30T00:31:23Z",
5+
"published": "2026-01-30T00:31:23Z",
6+
"aliases": [
7+
"CVE-2026-1637"
8+
],
9+
"details": "A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function fromAdvSetMacMtuWan of the file /goform/AdvSetMacMtuWan. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1637"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-LX88/cve/issues/25"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.343416"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.343416"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.740865"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-01-29T23:16:11Z"
55+
}
56+
}

‎advisories/unreviewed/2026/01/GHSA-mqp2-8ch3-3446/GHSA-mqp2-8ch3-3446.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mqp2-8ch3-3446",
4+
"modified": "2026-01-30T00:31:23Z",
5+
"published": "2026-01-30T00:31:22Z",
6+
"aliases": [
7+
"CVE-2026-1281"
8+
],
9+
"details": "A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1281"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1281"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-94"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-29T22:15:53Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-pm3x-gpqq-3g4r/GHSA-pm3x-gpqq-3g4r.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pm3x-gpqq-3g4r",
4+
"modified": "2026-01-30T00:31:23Z",
5+
"published": "2026-01-30T00:31:23Z",
6+
"aliases": [
7+
"CVE-2026-1625"
8+
],
9+
"details": "A vulnerability was detected in D-Link DWR-M961 1.1.47. The impacted element is the function sub_4250E0 of the file /boafrm/formSmsManage of the component SMS Message. Performing a manipulation of the argument action_value results in command injection. The attack may be initiated remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1625"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/QIU-DIE/CVE/issues/51"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.343384"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.343384"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.740792"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.dlink.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-01-29T22:15:54Z"
55+
}
56+
}

‎advisories/unreviewed/2026/01/GHSA-wv3p-w5rj-f5p6/GHSA-wv3p-w5rj-f5p6.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wv3p-w5rj-f5p6",
4+
"modified": "2026-01-30T00:31:22Z",
5+
"published": "2026-01-30T00:31:22Z",
6+
"aliases": [
7+
"CVE-2026-1340"
8+
],
9+
"details": "A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1340"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-94"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-29T22:15:53Z"
35+
}
36+
}

0 commit comments

Comments
 (0)