Skip to content

Commit dea68e1

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2v7h-6c67-v7p4 GHSA-6q56-mrmc-cph4 GHSA-f2p8-hh36-r2r8 GHSA-h7v7-pr65-4w53 GHSA-hvj6-2w8w-j3wj GHSA-m592-cr2f-4qg5 GHSA-mwg5-cwh8-88m5 GHSA-pq2w-3m7x-qx76 GHSA-rfq2-gv2r-vgjg GHSA-whj7-f2cg-8pv5 GHSA-x7h6-xxfr-j6pv GHSA-xjvw-vc5c-qgj5
1 parent a4b8ad7 commit dea68e1

File tree

12 files changed

+453
-4
lines changed

12 files changed

+453
-4
lines changed

‎advisories/unreviewed/2025/11/GHSA-2v7h-6c67-v7p4/GHSA-2v7h-6c67-v7p4.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
],
2727
"database_specific": {
2828
"cwe_ids": [
29+
"CWE-362",
2930
"CWE-367"
3031
],
3132
"severity": "MODERATE",

‎advisories/unreviewed/2026/01/GHSA-6q56-mrmc-cph4/GHSA-6q56-mrmc-cph4.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6q56-mrmc-cph4",
4+
"modified": "2026-01-13T00:30:46Z",
5+
"published": "2026-01-13T00:30:46Z",
6+
"aliases": [
7+
"CVE-2025-15514"
8+
],
9+
"details": "Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid media before passing it to the mtmd_helper_bitmap_init_from_buf function. This function can return NULL for malformed input, but the code does not check this return value before dereferencing the pointer in subsequent operations. A remote attacker can exploit this by sending specially crafted base64 image data that decodes to invalid media, causing a segmentation fault and crashing the runner process. This results in a denial of service condition where the model becomes unavailable to all users until the service is restarted.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15514"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://https://github.com/ollama/ollama"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://huntr.com/bounties/172df98b-07cd-41ea-a628-366f8cd525c0"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://ollama.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/ollama-multi-modal-image-processing-null-pointer-dereference"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-395"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-01-12T23:15:51Z"
47+
}
48+
}

‎advisories/unreviewed/2026/01/GHSA-f2p8-hh36-r2r8/GHSA-f2p8-hh36-r2r8.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f2p8-hh36-r2r8",
4-
"modified": "2026-01-12T21:30:34Z",
4+
"modified": "2026-01-13T00:30:46Z",
55
"published": "2026-01-12T21:30:34Z",
66
"aliases": [
77
"CVE-2025-67147"
88
],
99
"details": "Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_contact.php, the 'username' and 'pass_key' parameters in (2) secure_login.php, and the 'login_id', 'pwfield', and 'login_key' parameters in (3) change_s_pwd.php. An unauthenticated or authenticated attacker can exploit these issues to bypass authentication, execute arbitrary SQL commands, modify database records, delete data, or escalate privileges to administrator level.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2026-01-12T21:15:59Z"

‎advisories/unreviewed/2026/01/GHSA-h7v7-pr65-4w53/GHSA-h7v7-pr65-4w53.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h7v7-pr65-4w53",
4+
"modified": "2026-01-13T00:30:47Z",
5+
"published": "2026-01-13T00:30:46Z",
6+
"aliases": [
7+
"CVE-2024-58339"
8+
],
9+
"details": "LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() logic generates SQL statements from a user-supplied prompt and executes them via vn.run_sql() without enforcing query execution limits In downstream deployments where untrusted users can supply prompts, an attacker can trigger expensive or unbounded SQL operations that exhaust CPU or memory resources, resulting in a denial-of-service condition. The vulnerable execution path occurs in llama_index/packs/vanna/base.py within custom_query().",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58339"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/run-llama/llama_index"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://huntr.com/bounties/a1d6c30d-fce0-412a-bd22-14e0d4c1fa1f"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.llamaindex.ai"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/llamaindex-vannaqueryengine-sql-execution-allows-resource-exhaustion"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-770"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-01-12T23:15:51Z"
47+
}
48+
}

‎advisories/unreviewed/2026/01/GHSA-hvj6-2w8w-j3wj/GHSA-hvj6-2w8w-j3wj.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hvj6-2w8w-j3wj",
4+
"modified": "2026-01-13T00:30:45Z",
5+
"published": "2026-01-13T00:30:45Z",
6+
"aliases": [
7+
"CVE-2025-67146"
8+
],
9+
"details": "Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search.php, and (3) gym_search.php, and via the 'id' parameter in (4) payment_search.php. An unauthenticated remote attacker can exploit these issues to inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or modification of database contents.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67146"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/AbhishekMali21/GYM-MANAGEMENT-SYSTEM/issues/4"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-12T22:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-m592-cr2f-4qg5/GHSA-m592-cr2f-4qg5.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m592-cr2f-4qg5",
4+
"modified": "2026-01-13T00:30:47Z",
5+
"published": "2026-01-13T00:30:46Z",
6+
"aliases": [
7+
"CVE-2024-14021"
8+
],
9+
"details": "LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-14021"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/run-llama/llama_index"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://huntr.com/bounties/ab4ceeb4-aa85-4d1c-aaca-4eda1b71fc12"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.llamaindex.ai"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/llamaindex-bgem3index-unsafe-deserialization"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-502"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-01-12T23:15:51Z"
47+
}
48+
}

‎advisories/unreviewed/2026/01/GHSA-mwg5-cwh8-88m5/GHSA-mwg5-cwh8-88m5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mwg5-cwh8-88m5",
4+
"modified": "2026-01-13T00:30:46Z",
5+
"published": "2026-01-13T00:30:45Z",
6+
"aliases": [
7+
"CVE-2025-12420"
8+
],
9+
"details": "A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.\n\nServiceNow has addressed this vulnerability by deploying a relevant security update to  hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerability is addressed in the listed Store App versions. We recommend that customers promptly apply an appropriate security update or upgrade if they have not already done so.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:H/U:Amber"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12420"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2587329"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-200"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-12T22:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-pq2w-3m7x-qx76/GHSA-pq2w-3m7x-qx76.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pq2w-3m7x-qx76",
4+
"modified": "2026-01-13T00:30:46Z",
5+
"published": "2026-01-13T00:30:46Z",
6+
"aliases": [
7+
"CVE-2024-58340"
8+
],
9+
"details": "LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_parser.py). The parser applies a backtracking-prone regular expression when extracting tool actions from model output. An attacker who can supply or influence the parsed text (for example via prompt injection in downstream applications that pass LLM output directly into MRKLOutputParser.parse()) can trigger excessive CPU consumption by providing a crafted payload, causing significant parsing delays and a denial-of-service condition.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58340"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/langchain-ai/langchain"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://huntr.com/bounties/e7ece02c-d4bb-4166-8e08-6baf4f8845bb"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.langchain.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/langchain-mrkloutputparser-redos"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-1333"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-01-12T23:15:51Z"
47+
}
48+
}

‎advisories/unreviewed/2026/01/GHSA-rfq2-gv2r-vgjg/GHSA-rfq2-gv2r-vgjg.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rfq2-gv2r-vgjg",
4+
"modified": "2026-01-13T00:30:47Z",
5+
"published": "2026-01-13T00:30:46Z",
6+
"aliases": [
7+
"CVE-2026-22214"
8+
],
9+
"details": "RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incoming serial frame data. The vulnerability occurs in the _handle_char() function, where incoming frame bytes are appended to a fixed-size stack buffer without verifying that the current write index remains within bounds. An attacker capable of sending crafted serial or TCP-framed input can cause the current write index to exceed the buffer size, resulting in a write past the end of the stack buffer. This condition leads to memory corruption and application crash.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22214"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/RIOT-OS/RIOT"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://seclists.org/fulldisclosure/2026/Jan/16"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.riot-os.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/riot-os-stack-based-buffer-overflow-in-ethos-serial-frame-parser"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-121"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-01-12T23:15:52Z"
47+
}
48+
}

0 commit comments

Comments
 (0)