Skip to content

Commit c8cb570

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-98vg-cqgx-463p GHSA-cm69-52gj-g4j6 GHSA-p2h8-5v2r-2vg8 GHSA-p6f4-6qxg-8xqv GHSA-pcxg-4cp2-qqj4
1 parent c56a50c commit c8cb570

5 files changed

Lines changed: 243 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-98vg-cqgx-463p/GHSA-98vg-cqgx-463p.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-98vg-cqgx-463p",
4+
"modified": "2026-03-29T03:30:17Z",
5+
"published": "2026-03-29T03:30:17Z",
6+
"aliases": [
7+
"CVE-2026-5020"
8+
],
9+
"details": "A vulnerability was detected in Totolink A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function setNoticeCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument NoticeUrl results in command injection. The attack may be launched remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5020"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://lavender-bicycle-a5a.notion.site/TOTOLINK_A3600R_setNoticeCfg-32253a41781f80c197eaf8e7558c5ed1?source=copy_link"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/779536"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/353905"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/353905/cti"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.totolink.net"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-29T01:15:57Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-cm69-52gj-g4j6/GHSA-cm69-52gj-g4j6.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cm69-52gj-g4j6",
4+
"modified": "2026-03-29T03:30:18Z",
5+
"published": "2026-03-29T03:30:18Z",
6+
"aliases": [
7+
"CVE-2026-5023"
8+
],
9+
"details": "A vulnerability has been found in DeDeveloper23 codebase-mcp up to 3ec749d237dd8eabbeef48657cf917275792fde6. This vulnerability affects the function getCodebase/getRemoteCodebase/saveCodebase of the file src/tools/codebase.ts of the component RepoMix Command Handler. Such manipulation leads to os command injection. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5023"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/DeDeveloper23/codebase-mcp/issues/7"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/DeDeveloper23/codebase-mcp"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/778348"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/353907"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/353907/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-77"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-29T02:16:17Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-p2h8-5v2r-2vg8/GHSA-p2h8-5v2r-2vg8.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p2h8-5v2r-2vg8",
4+
"modified": "2026-03-29T03:30:17Z",
5+
"published": "2026-03-29T03:30:17Z",
6+
"aliases": [
7+
"CVE-2026-2602"
8+
],
9+
"details": "The Twentig plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'featuredImageSizeWidth' parameter in versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2602"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3486634/twentig"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f07881db-7494-4e6d-82ea-16018fa81806?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-29T02:16:16Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-p6f4-6qxg-8xqv/GHSA-p6f4-6qxg-8xqv.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p6f4-6qxg-8xqv",
4+
"modified": "2026-03-29T03:30:17Z",
5+
"published": "2026-03-29T03:30:17Z",
6+
"aliases": [
7+
"CVE-2026-4851"
8+
],
9+
"details": "GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization.\n\nGRID::Machine provides Remote Procedure Calls (RPC) over SSH for Perl. The client connects to remote hosts to execute code on them. A compromised or malicious remote host can execute arbitrary code back on the client through unsafe deserialization in the RPC protocol.\n\nread_operation() in lib/GRID/Machine/Message.pm deserialises values from the remote side using eval()\n\n $arg .= '$VAR1';\n my $val = eval \"no strict; $arg\"; # line 40-41\n\n$arg is raw bytes from the protocol pipe. A compromised remote host can embed arbitrary perl in the Dumper-formatted response:\n\n $VAR1 = do { system(\"...\"); };\n\nThis executes on the client silently on every RPC call, as the return values remain correct.\n\nThis functionality is by design but the trust requirement for the remote host is not documented in the distribution.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4851"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://www.openwall.com/lists/oss-security/2026/03/26/6"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://www.openwall.com/lists/oss-security/2026/03/26/6"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-95"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-03-29T01:15:56Z"
34+
}
35+
}

‎advisories/unreviewed/2026/03/GHSA-pcxg-4cp2-qqj4/GHSA-pcxg-4cp2-qqj4.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pcxg-4cp2-qqj4",
4+
"modified": "2026-03-29T03:30:18Z",
5+
"published": "2026-03-29T03:30:18Z",
6+
"aliases": [
7+
"CVE-2026-5021"
8+
],
9+
"details": "A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. This manipulation of the argument delno causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5021"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Litengzheng/vul_db/blob/main/F453/vul_92/README.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/778415"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/353906"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/353906/cti"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-29T02:16:17Z"
55+
}
56+
}

0 commit comments

Comments
 (0)