Skip to content

Commit 4e65393

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 29aab74 commit 4e65393

26 files changed

Lines changed: 782 additions & 42 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-q4hc-vp2m-fr47/GHSA-q4hc-vp2m-fr47.json‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-q4hc-vp2m-fr47",
4-
"modified": "2026-03-23T03:31:39Z",
4+
"modified": "2026-03-24T03:31:19Z",
55
"published": "2026-02-23T18:32:02Z",
66
"aliases": [
77
"CVE-2025-14905"
@@ -51,6 +51,22 @@
5151
"type": "WEB",
5252
"url": "https://access.redhat.com/errata/RHSA-2026:5196"
5353
},
54+
{
55+
"type": "WEB",
56+
"url": "https://access.redhat.com/errata/RHSA-2026:5511"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://access.redhat.com/errata/RHSA-2026:5512"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://access.redhat.com/errata/RHSA-2026:5513"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://access.redhat.com/errata/RHSA-2026:5514"
69+
},
5470
{
5571
"type": "WEB",
5672
"url": "https://access.redhat.com/security/cve/CVE-2025-14905"

‎advisories/unreviewed/2026/03/GHSA-23f9-j3qr-h3hv/GHSA-23f9-j3qr-h3hv.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-23f9-j3qr-h3hv",
4-
"modified": "2026-03-19T18:31:19Z",
4+
"modified": "2026-03-24T03:31:19Z",
55
"published": "2026-03-19T18:31:19Z",
66
"aliases": [
77
"CVE-2025-67113"
88
],
99
"details": "OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into the firmware upgrade pipeline.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-94"
38+
],
39+
"severity": "CRITICAL",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2026-03-19T18:16:15Z"

‎advisories/unreviewed/2026/03/GHSA-2448-99wr-g9vj/GHSA-2448-99wr-g9vj.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2448-99wr-g9vj",
4+
"modified": "2026-03-24T03:31:19Z",
5+
"published": "2026-03-24T03:31:19Z",
6+
"aliases": [
7+
"CVE-2026-4676"
8+
],
9+
"details": "Use after free in Dawn in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4676"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://issues.chromium.org/issues/488613135"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-416"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-24T01:17:03Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-2f37-6r53-rgxp/GHSA-2f37-6r53-rgxp.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2f37-6r53-rgxp",
4+
"modified": "2026-03-24T03:31:19Z",
5+
"published": "2026-03-24T03:31:19Z",
6+
"aliases": [
7+
"CVE-2026-4678"
8+
],
9+
"details": "Use after free in WebGPU in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4678"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://issues.chromium.org/issues/491164019"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-416"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-24T01:17:03Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-3364-vw5q-hfh3/GHSA-3364-vw5q-hfh3.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3364-vw5q-hfh3",
4+
"modified": "2026-03-24T03:31:19Z",
5+
"published": "2026-03-24T03:31:19Z",
6+
"aliases": [
7+
"CVE-2026-4674"
8+
],
9+
"details": "Out of bounds read in CSS in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4674"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://issues.chromium.org/issues/488188166"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-125"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-24T01:17:02Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-3qwq-q9vm-5j42/GHSA-3qwq-q9vm-5j42.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3qwq-q9vm-5j42",
4+
"modified": "2026-03-24T03:31:19Z",
5+
"published": "2026-03-24T03:31:19Z",
6+
"aliases": [
7+
"CVE-2026-22739"
8+
],
9+
"details": "Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22739"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://spring.io/security/cve-2026-22739"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "HIGH",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-24T01:17:00Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-533q-m9mq-7v99/GHSA-533q-m9mq-7v99.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-533q-m9mq-7v99",
4-
"modified": "2026-03-19T18:31:19Z",
4+
"modified": "2026-03-24T03:31:19Z",
55
"published": "2026-03-19T18:31:19Z",
66
"aliases": [
77
"CVE-2025-67115"
88
],
99
"details": "A path traversal vulnerability in /ftl/web/setup.cgi in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote authenticated users to read arbitrary files from the filesystem via crafted values in the log_type parameter to /logsave.htm.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-22"
38+
],
39+
"severity": "MODERATE",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2026-03-19T18:16:15Z"

‎advisories/unreviewed/2026/03/GHSA-5v75-mv76-85fm/GHSA-5v75-mv76-85fm.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5v75-mv76-85fm",
4+
"modified": "2026-03-24T03:31:19Z",
5+
"published": "2026-03-24T03:31:19Z",
6+
"aliases": [
7+
"CVE-2026-4677"
8+
],
9+
"details": "Inappropriate implementation in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4677"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://issues.chromium.org/issues/490533968"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-125"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-24T01:17:03Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-68f7-rw23-22jh/GHSA-68f7-rw23-22jh.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-68f7-rw23-22jh",
4+
"modified": "2026-03-24T03:31:19Z",
5+
"published": "2026-03-24T03:31:19Z",
6+
"aliases": [
7+
"CVE-2026-4624"
8+
],
9+
"details": "A vulnerability was detected in SourceCodester Online Library Management System 1.0. The impacted element is an unknown function of the file /home.php of the component Parameter Handler. Performing a manipulation of the argument searchField results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4624"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/WHOAMI-xiaoyu/CVE/blob/main/CVE_6.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.352492"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.352492"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.775787"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-24T03:16:06Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-6f7w-7xmx-mx54/GHSA-6f7w-7xmx-mx54.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6f7w-7xmx-mx54",
4-
"modified": "2026-03-19T18:31:19Z",
4+
"modified": "2026-03-24T03:31:19Z",
55
"published": "2026-03-19T18:31:19Z",
66
"aliases": [
77
"CVE-2026-30694"
88
],
99
"details": "An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter component",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-94"
34+
],
35+
"severity": "CRITICAL",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2026-03-19T18:16:22Z"

0 commit comments

Comments
 (0)