Skip to content

Commit d41fbe9

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-v6c5-9mp4-mwq4 GHSA-292q-v67v-f66g GHSA-382v-76mx-pqx3 GHSA-3gh2-3c3q-2933 GHSA-45hq-rq49-xwcf GHSA-4hm5-jmp9-7g72 GHSA-8283-g649-xjrh GHSA-8pm5-xr39-vfv3 GHSA-9x3w-xc3m-rx49 GHSA-cq4v-33m4-7gj5 GHSA-cr4v-m7hf-7hvj GHSA-f6mf-xjgg-34j8 GHSA-pqh8-v6gf-267q GHSA-rq8q-2gpw-5fr2 GHSA-rx39-3p86-f4v2 GHSA-w299-fq8v-qvg7 GHSA-xr9j-2jxx-p2h8
1 parent 8a14bbf commit d41fbe9

17 files changed

Lines changed: 605 additions & 1 deletion

File tree

‎advisories/unreviewed/2025/11/GHSA-v6c5-9mp4-mwq4/GHSA-v6c5-9mp4-mwq4.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-v6c5-9mp4-mwq4",
4-
"modified": "2026-01-27T09:30:29Z",
4+
"modified": "2026-01-27T12:31:18Z",
55
"published": "2025-11-26T15:34:12Z",
66
"aliases": [
77
"CVE-2025-13601"
@@ -35,6 +35,14 @@
3535
"type": "WEB",
3636
"url": "https://access.redhat.com/errata/RHSA-2026:1323"
3737
},
38+
{
39+
"type": "WEB",
40+
"url": "https://access.redhat.com/errata/RHSA-2026:1324"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://access.redhat.com/errata/RHSA-2026:1326"
45+
},
3846
{
3947
"type": "WEB",
4048
"url": "https://access.redhat.com/errata/RHSA-2026:1327"

‎advisories/unreviewed/2026/01/GHSA-292q-v67v-f66g/GHSA-292q-v67v-f66g.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-292q-v67v-f66g",
4+
"modified": "2026-01-27T12:31:18Z",
5+
"published": "2026-01-27T12:31:18Z",
6+
"aliases": [
7+
"CVE-2025-12387"
8+
],
9+
"details": "A vulnerability in the Pix-Link LV-WR21Q router's language module allows remote attackers to trigger a denial of service (DoS) by sending a specially crafted HTTP POST request containing non-existing language parameter. This renders the server unable to serve correct lang.js file, which causes administrator panel to not work, resulting in DoS until the language settings is reverted to a correct value. The Denial of Service affects only the administrator panel and does not affect other router functionalities.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12387"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cert.pl/en/posts/2026/01/CVE-2025-12386"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/wcyb/security_research"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.pix-link.com/lv-wr21q"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-754"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-01-27T12:15:57Z"
43+
}
44+
}

‎advisories/unreviewed/2026/01/GHSA-382v-76mx-pqx3/GHSA-382v-76mx-pqx3.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-382v-76mx-pqx3",
4+
"modified": "2026-01-27T12:31:18Z",
5+
"published": "2026-01-27T12:31:18Z",
6+
"aliases": [
7+
"CVE-2026-24829"
8+
],
9+
"details": "Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in Is-Daouda is-Engine.This issue affects is-Engine: before 3.3.4.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24829"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/Is-Daouda/is-Engine/pull/7"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-122"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-27T10:15:49Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-3gh2-3c3q-2933/GHSA-3gh2-3c3q-2933.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3gh2-3c3q-2933",
4+
"modified": "2026-01-27T12:31:18Z",
5+
"published": "2026-01-27T12:31:18Z",
6+
"aliases": [
7+
"CVE-2025-41728"
8+
],
9+
"details": "A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending specially crafted calls to the Device Manager web service that cause an out-of-bounds read operation under certain circumstances due to ASLR and thereby potentially copy confidential information into a response.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41728"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://certvde.com/de/advisories/VDE-2025-092"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-125"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-27T12:15:57Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-45hq-rq49-xwcf/GHSA-45hq-rq49-xwcf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-45hq-rq49-xwcf",
4+
"modified": "2026-01-27T12:31:18Z",
5+
"published": "2026-01-27T12:31:18Z",
6+
"aliases": [
7+
"CVE-2026-24347"
8+
],
9+
"details": "Improper input validation in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to manipulate files in the /tmp directory",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24347"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://hub.ntc.swiss/ntcf-2025-32806"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-20"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-27T10:15:49Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-4hm5-jmp9-7g72/GHSA-4hm5-jmp9-7g72.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4hm5-jmp9-7g72",
4+
"modified": "2026-01-27T12:31:18Z",
5+
"published": "2026-01-27T12:31:18Z",
6+
"aliases": [
7+
"CVE-2025-12386"
8+
],
9+
"details": "Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to the access point.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12386"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cert.pl/en/posts/2026/01/CVE-2025-12386"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/wcyb/security_research"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.pix-link.com/lv-wr21q"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-306"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-01-27T12:15:56Z"
43+
}
44+
}

‎advisories/unreviewed/2026/01/GHSA-8283-g649-xjrh/GHSA-8283-g649-xjrh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8283-g649-xjrh",
4+
"modified": "2026-01-27T12:31:18Z",
5+
"published": "2026-01-27T12:31:18Z",
6+
"aliases": [
7+
"CVE-2025-41726"
8+
],
9+
"details": "A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41726"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://certvde.com/de/advisories/VDE-2025-092"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-190"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-27T12:15:57Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-8pm5-xr39-vfv3/GHSA-8pm5-xr39-vfv3.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8pm5-xr39-vfv3",
4+
"modified": "2026-01-27T12:31:17Z",
5+
"published": "2026-01-27T12:31:17Z",
6+
"aliases": [
7+
"CVE-2026-1467"
8+
],
9+
"details": "A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them to inject additional HTTP headers or complete HTTP request bodies. This can lead to unintended or unauthorized HTTP requests being forwarded by the proxy, potentially impacting downstream services.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1467"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2026-1467"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433174"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-93"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-27T10:15:48Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-9x3w-xc3m-rx49/GHSA-9x3w-xc3m-rx49.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9x3w-xc3m-rx49",
4+
"modified": "2026-01-27T12:31:18Z",
5+
"published": "2026-01-27T12:31:18Z",
6+
"aliases": [
7+
"CVE-2026-24826"
8+
],
9+
"details": "Out-of-bounds Write, Divide By Zero, NULL Pointer Dereference, Use of Uninitialized Resource, Out-of-bounds Read, Reachable Assertion vulnerability in cadaver turso3d.This issue affects .",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24826"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cadaver/turso3d/pull/11"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-125"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-27T10:15:49Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-cq4v-33m4-7gj5/GHSA-cq4v-33m4-7gj5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cq4v-33m4-7gj5",
4+
"modified": "2026-01-27T12:31:18Z",
5+
"published": "2026-01-27T12:31:17Z",
6+
"aliases": [
7+
"CVE-2026-24346"
8+
],
9+
"details": "Use of well-known default credentials in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to access protected areas in the web application",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24346"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://hub.ntc.swiss/ntcf-2025-13993"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-798"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-27T10:15:49Z"
35+
}
36+
}

0 commit comments

Comments
 (0)