Skip to content

Commit e208b40

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 7407d48 commit e208b40

File tree

43 files changed

+984
-45
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+984
-45
lines changed

‎advisories/unreviewed/2026/02/GHSA-vrv3-8mcq-ppf5/GHSA-vrv3-8mcq-ppf5.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vrv3-8mcq-ppf5",
4-
"modified": "2026-03-11T18:30:26Z",
4+
"modified": "2026-03-30T21:31:02Z",
55
"published": "2026-02-27T18:31:05Z",
66
"aliases": [
77
"CVE-2026-3277"
88
],
99
"details": "The OpenID Connect (OIDC) authentication configuration in PowerShell \nUniversal before 2026.1.3 stores the OIDC client secret in cleartext in \nthe .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/03/GHSA-22vj-v4r3-878v/GHSA-22vj-v4r3-878v.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-22vj-v4r3-878v",
4+
"modified": "2026-03-30T21:31:04Z",
5+
"published": "2026-03-30T21:31:04Z",
6+
"aliases": [
7+
"CVE-2026-21716"
8+
],
9+
"details": "An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.\n\nAs a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21716"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "LOW",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-30T20:16:19Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-326m-34v3-gv5p/GHSA-326m-34v3-gv5p.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-326m-34v3-gv5p",
4+
"modified": "2026-03-30T21:31:04Z",
5+
"published": "2026-03-30T21:31:04Z",
6+
"aliases": [
7+
"CVE-2026-21717"
8+
],
9+
"details": "A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.\n\nThe most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x**.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21717"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "MODERATE",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-30T20:16:20Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-33r5-g5m3-5m79/GHSA-33r5-g5m3-5m79.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-33r5-g5m3-5m79",
4+
"modified": "2026-03-30T21:31:04Z",
5+
"published": "2026-03-30T21:31:04Z",
6+
"aliases": [
7+
"CVE-2026-3502"
8+
],
9+
"details": "TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3502"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://trueconf.com/blog/update/trueconf-8-5"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-494"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-30T19:16:27Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-3hqq-48gq-cwg4/GHSA-3hqq-48gq-cwg4.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3hqq-48gq-cwg4",
4+
"modified": "2026-03-30T21:31:04Z",
5+
"published": "2026-03-30T21:31:04Z",
6+
"aliases": [
7+
"CVE-2026-30307"
8+
],
9+
"details": "Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on fragile regular expressions to parse command structures; while it attempts to intercept dangerous operations, it fails to account for standard Shell command substitution Roo Code (specifically$(...)and backticks ...). An attacker can construct a command such as git log --grep=\"$(malicious_command)\", forcing Syntx to misidentify it as a safe git operation and automatically approve it. The underlying Shell prioritizes the execution of the malicious code injected within the arguments, resulting in Remote Code Execution without any user interaction.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30307"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/7"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://roocode.com"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-03-30T20:16:21Z"
32+
}
33+
}

‎advisories/unreviewed/2026/03/GHSA-3m9f-mrx3-g4mq/GHSA-3m9f-mrx3-g4mq.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3m9f-mrx3-g4mq",
4+
"modified": "2026-03-30T21:31:04Z",
5+
"published": "2026-03-30T21:31:04Z",
6+
"aliases": [
7+
"CVE-2026-30306"
8+
],
9+
"details": "In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30306"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/4"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://marketplace.visualstudio.com/items?itemName=rahmanazhar.saka-dev"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-03-30T21:17:08Z"
32+
}
33+
}

‎advisories/unreviewed/2026/03/GHSA-4wq3-67r2-ggw9/GHSA-4wq3-67r2-ggw9.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4wq3-67r2-ggw9",
4+
"modified": "2026-03-30T21:31:04Z",
5+
"published": "2026-03-30T21:31:04Z",
6+
"aliases": [
7+
"CVE-2026-5150"
8+
],
9+
"details": "A security vulnerability has been detected in code-projects Accounting System 1.0. This issue affects some unknown processing of the file /viewin_costumer.php of the component Parameter Handler. Such manipulation of the argument cos_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5150"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Xu-Zhihan/CVE/issues/11"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/780199"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/354183"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/354183/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-30T20:16:24Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-57pm-w85h-x97q/GHSA-57pm-w85h-x97q.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-74"
49+
"CWE-74",
50+
"CWE-89"
5051
],
5152
"severity": "MODERATE",
5253
"github_reviewed": false,

‎advisories/unreviewed/2026/03/GHSA-5cjp-jw39-92hv/GHSA-5cjp-jw39-92hv.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5cjp-jw39-92hv",
4-
"modified": "2026-03-30T18:31:17Z",
4+
"modified": "2026-03-30T21:31:03Z",
55
"published": "2026-03-30T18:31:17Z",
66
"aliases": [
77
"CVE-2026-30562"
88
],
99
"details": "A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_stock.php file via the \"msg\" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "CRITICAL",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2026-03-30T16:16:05Z"

‎advisories/unreviewed/2026/03/GHSA-5vxj-h27x-942q/GHSA-5vxj-h27x-942q.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-74"
49+
"CWE-74",
50+
"CWE-89"
5051
],
5152
"severity": "MODERATE",
5253
"github_reviewed": false,

0 commit comments

Comments
 (0)