Skip to content

Commit acb46e2

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 2530d07 commit acb46e2

59 files changed

Lines changed: 1602 additions & 38 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2025/10/GHSA-j3cp-7wh4-9f6c/GHSA-j3cp-7wh4-9f6c.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j3cp-7wh4-9f6c",
4-
"modified": "2025-10-15T15:30:28Z",
4+
"modified": "2026-03-27T18:31:21Z",
55
"published": "2025-10-15T15:30:28Z",
66
"aliases": [
77
"CVE-2025-53521"

‎advisories/unreviewed/2026/03/GHSA-2467-8w6f-pv35/GHSA-2467-8w6f-pv35.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2467-8w6f-pv35",
4+
"modified": "2026-03-27T18:31:27Z",
5+
"published": "2026-03-27T18:31:27Z",
6+
"aliases": [
7+
"CVE-2026-30569"
8+
],
9+
"details": "A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Inventory System 1.0. The vulnerability is located in the view_stock_availability.php file via the \"limit\" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30569"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-ViewStockAvailability-limit.md"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-03-27T17:16:28Z"
28+
}
29+
}

‎advisories/unreviewed/2026/03/GHSA-2fgq-8wh7-jwc9/GHSA-2fgq-8wh7-jwc9.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2fgq-8wh7-jwc9",
4+
"modified": "2026-03-27T18:31:27Z",
5+
"published": "2026-03-27T18:31:27Z",
6+
"aliases": [
7+
"CVE-2026-30570"
8+
],
9+
"details": "A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Inventory System 1.0 in the view_sales.php file via the \"limit\" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30570"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-ViewSales-limit.md"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-03-27T17:16:28Z"
28+
}
29+
}

‎advisories/unreviewed/2026/03/GHSA-2pvg-9372-g3rh/GHSA-2pvg-9372-g3rh.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2pvg-9372-g3rh",
4+
"modified": "2026-03-27T18:31:28Z",
5+
"published": "2026-03-27T18:31:28Z",
6+
"aliases": [
7+
"CVE-2026-4968"
8+
],
9+
"details": "A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file diary.php. Executing a manipulation can lead to cross-site request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. If you want to get the best quality for vulnerability data then you always have to consider VulDB.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4968"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gist.github.com/Mohdanass/50a525ba0a72e10fda85f0db11eeed92"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.353855"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.353855"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.777729"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-352"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-27T18:16:07Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-36m7-49vh-x3qh/GHSA-36m7-49vh-x3qh.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-36m7-49vh-x3qh",
4-
"modified": "2026-03-27T15:30:26Z",
4+
"modified": "2026-03-27T18:31:25Z",
55
"published": "2026-03-27T15:30:25Z",
66
"aliases": [
77
"CVE-2026-32859"
88
],
99
"details": "ByteDance Deer-Flow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. Attackers can store malicious content that executes in the browser context when users view artifacts, leading to session compromise, credential theft, and arbitrary script execution.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/03/GHSA-36r3-mw6j-7ffc/GHSA-36r3-mw6j-7ffc.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-36r3-mw6j-7ffc",
4+
"modified": "2026-03-27T18:31:27Z",
5+
"published": "2026-03-27T18:31:27Z",
6+
"aliases": [
7+
"CVE-2025-15615"
8+
],
9+
"details": "Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and render the authd service unavailable.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-rr83-v9v7-jjhp"
25+
},
26+
{
27+
"type": "ADVISORY",
28+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15615"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/ssl-tls-renegotiation-dos-in-wazuh-manager-authd-service"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-276"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-27T17:16:26Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-3gv6-g396-9v4r/GHSA-3gv6-g396-9v4r.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3gv6-g396-9v4r",
4+
"modified": "2026-03-27T18:31:27Z",
5+
"published": "2026-03-27T18:31:27Z",
6+
"aliases": [
7+
"CVE-2026-28367"
8+
],
9+
"details": "A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\\r\\r\\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28367"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2026-28367"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443260"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-444"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-27T17:16:27Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-3wqr-83x4-348r/GHSA-3wqr-83x4-348r.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3wqr-83x4-348r",
4+
"modified": "2026-03-27T18:31:27Z",
5+
"published": "2026-03-27T18:31:27Z",
6+
"aliases": [
7+
"CVE-2026-30574"
8+
],
9+
"details": "A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file. The application fails to verify if the requested sales quantity (txtqty) exceeds the available stock level. An attacker can manipulate the request to purchase a quantity that is significantly higher than the actual available stock.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30574"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/meifukun/Web-Security-PoCs/blob/main/Pharmacy-Product-Management-System/Logic-AddSales-Overselling.md"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-03-27T17:16:28Z"
28+
}
29+
}

‎advisories/unreviewed/2026/03/GHSA-43p7-xw3r-w4gp/GHSA-43p7-xw3r-w4gp.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-43p7-xw3r-w4gp",
4+
"modified": "2026-03-27T18:31:26Z",
5+
"published": "2026-03-27T18:31:26Z",
6+
"aliases": [
7+
"CVE-2026-30527"
8+
],
9+
"details": "A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management module within the admin panel. The application fails to properly sanitize user input supplied to the \"Category Name\" field when creating or updating a category. When an administrator or user visits the Category list page (or any page where this category is rendered), the injected JavaScript executes immediately in their browser.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30527"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/Stored-XSS-Category-Name.md"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-03-27T16:16:23Z"
28+
}
29+
}

‎advisories/unreviewed/2026/03/GHSA-44cv-6xv4-6x7h/GHSA-44cv-6xv4-6x7h.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-44cv-6xv4-6x7h",
4-
"modified": "2026-03-25T18:31:50Z",
4+
"modified": "2026-03-27T18:31:24Z",
55
"published": "2026-03-25T18:31:50Z",
66
"aliases": [
77
"CVE-2026-24970"
88
],
99
"details": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Energox energox allows Path Traversal.This issue affects Energox: from n/a through <= 1.2.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-22"
2530
],
26-
"severity": null,
31+
"severity": "HIGH",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-03-25T17:16:38Z"

0 commit comments

Comments
 (0)