Skip to content

Commit 1f1a427

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-28gr-56hr-prp6 GHSA-5xf3-gmx4-529v GHSA-33x2-ppm4-v46v GHSA-5239-wwwm-4pmq GHSA-84j4-wrx9-vrgx GHSA-8h86-g282-cx65 GHSA-97m6-jj73-c64q GHSA-cgfg-qq46-f464 GHSA-cqhc-m7m4-j634 GHSA-r5jq-wvhc-w6jv
1 parent f784813 commit 1f1a427

10 files changed

Lines changed: 438 additions & 2 deletions

File tree

‎advisories/unreviewed/2025/04/GHSA-28gr-56hr-prp6/GHSA-28gr-56hr-prp6.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-28gr-56hr-prp6",
4-
"modified": "2025-04-09T21:31:05Z",
4+
"modified": "2026-03-22T06:30:14Z",
55
"published": "2025-04-02T15:31:36Z",
66
"aliases": [
77
"CVE-2025-2786"
@@ -19,6 +19,10 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2786"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/grafana/tempo-operator/pull/1145"
25+
},
2226
{
2327
"type": "WEB",
2428
"url": "https://access.redhat.com/errata/RHSA-2025:3607"

‎advisories/unreviewed/2025/04/GHSA-5xf3-gmx4-529v/GHSA-5xf3-gmx4-529v.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5xf3-gmx4-529v",
4-
"modified": "2025-04-09T21:31:05Z",
4+
"modified": "2026-03-22T06:30:14Z",
55
"published": "2025-04-02T15:31:36Z",
66
"aliases": [
77
"CVE-2025-2842"
@@ -19,6 +19,10 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2842"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/grafana/tempo-operator/pull/1144"
25+
},
2226
{
2327
"type": "WEB",
2428
"url": "https://access.redhat.com/errata/RHSA-2025:3607"

‎advisories/unreviewed/2026/03/GHSA-33x2-ppm4-v46v/GHSA-33x2-ppm4-v46v.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-33x2-ppm4-v46v",
4+
"modified": "2026-03-22T06:30:14Z",
5+
"published": "2026-03-22T06:30:14Z",
6+
"aliases": [
7+
"CVE-2026-4538"
8+
],
9+
"details": "A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through a pull request but has not reacted yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4538"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/pytorch/pytorch/pull/176791"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/pytorch/pytorch"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.352326"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.352326"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.774681"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-20"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-22T05:16:20Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-5239-wwwm-4pmq/GHSA-5239-wwwm-4pmq.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5239-wwwm-4pmq",
4+
"modified": "2026-03-22T06:30:15Z",
5+
"published": "2026-03-22T06:30:15Z",
6+
"aliases": [
7+
"CVE-2026-4539"
8+
],
9+
"details": "A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4539"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/pygments/pygments/issues/3058"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/pygments/pygments"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.352327"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.352327"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.774685"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-400"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-22T06:16:20Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-84j4-wrx9-vrgx/GHSA-84j4-wrx9-vrgx.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-84j4-wrx9-vrgx",
4+
"modified": "2026-03-22T06:30:14Z",
5+
"published": "2026-03-22T06:30:14Z",
6+
"aliases": [
7+
"CVE-2026-3427"
8+
],
9+
"details": "The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `jsonText` block attribute in all versions up to, and including, 27.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3427"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/Yoast/wordpress-seo/pull/23035"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.0/inc/class-wpseo-utils.php#L915"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.0/src/generators/schema/howto.php#L125"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/changeset/3475308/wordpress-seo"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fee1fef5-5716-49e0-a04e-d0dae527fcfc?source=cve"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-22T04:16:24Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-8h86-g282-cx65/GHSA-8h86-g282-cx65.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8h86-g282-cx65",
4+
"modified": "2026-03-22T06:30:14Z",
5+
"published": "2026-03-22T06:30:14Z",
6+
"aliases": [
7+
"CVE-2026-4536"
8+
],
9+
"details": "A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0. This issue affects some unknown processing. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4536"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LTX-GOD/Mycve/blob/main/Acrel_Co_Ltd.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.352324"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.352324"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.774423"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-284"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-22T05:16:19Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-97m6-jj73-c64q/GHSA-97m6-jj73-c64q.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-97m6-jj73-c64q",
4+
"modified": "2026-03-22T06:30:14Z",
5+
"published": "2026-03-22T06:30:14Z",
6+
"aliases": [
7+
"CVE-2026-4534"
8+
],
9+
"details": "A flaw has been found in Tenda FH451 1.0.0.9. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. This manipulation of the argument GO causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4534"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Litengzheng/vul_db/blob/main/FH451/vul_41/README.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.352322"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.352322"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.774342"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-22T05:16:19Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-cgfg-qq46-f464/GHSA-cgfg-qq46-f464.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cgfg-qq46-f464",
4+
"modified": "2026-03-22T06:30:14Z",
5+
"published": "2026-03-22T06:30:14Z",
6+
"aliases": [
7+
"CVE-2026-4537"
8+
],
9+
"details": "A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controller/ipsec.lua. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4537"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/qazmn/my_cve/blob/main/cudy_cve/Cudy_TR1200_Command_Injection.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.352325"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.352325"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.774447"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-22T05:16:20Z"
51+
}
52+
}

0 commit comments

Comments
 (0)