Skip to content

Commit def5a7c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5j8r-5f3r-4w9p GHSA-9438-qf7w-49rg GHSA-98q6-pq9m-chf7 GHSA-f48h-x82c-69jw GHSA-f8m2-v594-mjj5 GHSA-q4m9-3fr6-f83p
1 parent 3c05aeb commit def5a7c

6 files changed

Lines changed: 352 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/01/GHSA-5j8r-5f3r-4w9p/GHSA-5j8r-5f3r-4w9p.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5j8r-5f3r-4w9p",
4+
"modified": "2026-01-26T06:30:28Z",
5+
"published": "2026-01-26T06:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1418"
8+
],
9+
"details": "A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 10c73b82cf0e367383d091db38566a0e4fe71772. It is best practice to apply a patch to resolve this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1418"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/gpac/gpac/issues/3425"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/gpac/gpac/issues/3425#issue-3801961068"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/enocknt/gpac/commit/10c73b82cf0e367383d091db38566a0e4fe71772"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.342807"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.342807"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.736544"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-119"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-01-26T04:16:10Z"
59+
}
60+
}

‎advisories/unreviewed/2026/01/GHSA-9438-qf7w-49rg/GHSA-9438-qf7w-49rg.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9438-qf7w-49rg",
4+
"modified": "2026-01-26T06:30:28Z",
5+
"published": "2026-01-26T06:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1417"
8+
],
9+
"details": "A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dump_isom_rtp of the file applications/mp4box/filedump.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: f96bd57c3ccdcde4335a0be28cd3e8fe296993de. Applying a patch is the recommended action to fix this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1417"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/gpac/gpac/issues/3426"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/gpac/gpac/issues/3426#issue-3802172856"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/enocknt/gpac/commit/f96bd57c3ccdcde4335a0be28cd3e8fe296993de"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.342806"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.342806"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.736543"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-404"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-01-26T04:16:10Z"
59+
}
60+
}

‎advisories/unreviewed/2026/01/GHSA-98q6-pq9m-chf7/GHSA-98q6-pq9m-chf7.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-98q6-pq9m-chf7",
4+
"modified": "2026-01-26T06:30:28Z",
5+
"published": "2026-01-26T06:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1419"
8+
],
9+
"details": "A weakness has been identified in D-Link DCS700l 1.03.09. Affected is an unknown function of the file /setDayNightMode of the component Web Form Handler. Executing a manipulation of the argument LightSensorControl can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1419"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://tzh00203.notion.site/D-Link-DCS700l-v1-03-09-Command-Injection-Vulnerability-in-LightSensorControl-Parameter-2e6b5c52018a80ada0f6d7e72efd7a45?source=copy_link"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.342815"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.342815"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.736554"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.dlink.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-01-26T05:16:05Z"
55+
}
56+
}

‎advisories/unreviewed/2026/01/GHSA-f48h-x82c-69jw/GHSA-f48h-x82c-69jw.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f48h-x82c-69jw",
4+
"modified": "2026-01-26T06:30:28Z",
5+
"published": "2026-01-26T06:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1421"
8+
],
9+
"details": "A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1421"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://code-projects.org"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/geo-chen/code-projects/blob/main/Online%20Examination%20System%20In%20PHP%20With%20Source%20Code.md#finding-1-stored-xss-in-all-add-pages"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.342837"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.342837"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.736605"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-01-26T06:16:04Z"
55+
}
56+
}

‎advisories/unreviewed/2026/01/GHSA-f8m2-v594-mjj5/GHSA-f8m2-v594-mjj5.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f8m2-v594-mjj5",
4+
"modified": "2026-01-26T06:30:28Z",
5+
"published": "2026-01-26T06:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1420"
8+
],
9+
"details": "A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapsk_crypto causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1420"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow_WifiExtraSet/Tenda%20AC23_Buffer_Overflow_WifiExtraSet.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow_WifiExtraSet/Tenda%20AC23_Buffer_Overflow_WifiExtraSet.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.342836"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.342836"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.736559"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.tenda.com.cn"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-119"
54+
],
55+
"severity": "HIGH",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-01-26T06:16:04Z"
59+
}
60+
}

‎advisories/unreviewed/2026/01/GHSA-q4m9-3fr6-f83p/GHSA-q4m9-3fr6-f83p.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q4m9-3fr6-f83p",
4+
"modified": "2026-01-26T06:30:28Z",
5+
"published": "2026-01-26T06:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1416"
8+
],
9+
"details": "A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump.c. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as d45c264c20addf0c1cc05124ede33f8ffa800e68. It is advisable to implement a patch to correct this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1416"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/gpac/gpac/issues/3427"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/gpac/gpac/issues/3427#issue-3802197432"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/enocknt/gpac/commit/d45c264c20addf0c1cc05124ede33f8ffa800e68"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.342805"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.342805"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.736542"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-404"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-01-26T04:16:09Z"
59+
}
60+
}

0 commit comments

Comments
 (0)