Skip to content

Commit 83d9767

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 8fbc646 commit 83d9767

54 files changed

Lines changed: 2440 additions & 1 deletion

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2025/10/GHSA-h546-6x4h-w6q7/GHSA-h546-6x4h-w6q7.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h546-6x4h-w6q7",
4-
"modified": "2025-10-22T21:31:33Z",
4+
"modified": "2026-04-24T00:31:50Z",
55
"published": "2025-10-22T18:30:38Z",
66
"aliases": [
77
"CVE-2025-24934"
@@ -22,6 +22,10 @@
2222
{
2323
"type": "WEB",
2424
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-25:09.netinet.asc"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.usenix.org/system/files/conference/usenixsecurity26/sec26_prepub_ben-simhon.pdf"
2529
}
2630
],
2731
"database_specific": {

‎advisories/unreviewed/2026/04/GHSA-245p-p394-pw8w/GHSA-245p-p394-pw8w.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-245p-p394-pw8w",
4+
"modified": "2026-04-24T00:31:52Z",
5+
"published": "2026-04-24T00:31:52Z",
6+
"aliases": [
7+
"CVE-2026-27841"
8+
],
9+
"details": "A vulnerability in SenseLive X3050's web management interface allows state-changing operations to be triggered without proper Cross-Site Request Forgery (CSRF) protections. Because the application does not enforce server-side validation of request origin or implement CSRF tokens, a malicious external webpage could cause a user's browser to submit unauthorized configuration requests to the device.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27841"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://senselive.io/contact"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-352"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-04-24T00:16:26Z"
47+
}
48+
}

‎advisories/unreviewed/2026/04/GHSA-2hv5-4h3g-4hjv/GHSA-2hv5-4h3g-4hjv.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2hv5-4h3g-4hjv",
4+
"modified": "2026-04-24T00:31:51Z",
5+
"published": "2026-04-24T00:31:51Z",
6+
"aliases": [
7+
"CVE-2026-41343"
8+
],
9+
"details": "OpenClaw before 2026.3.31 lacks a shared pre-auth concurrency budget on the public LINE webhook path, allowing attackers to cause transient availability loss. Remote attackers can flood the webhook endpoint with concurrent requests before signature verification to exhaust resources and degrade service availability.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-qcc3-jqwp-5vh2"
25+
},
26+
{
27+
"type": "ADVISORY",
28+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41343"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/openclaw/openclaw/commit/57c47d8c7fbf5a2e70cc4dec2380977968903cad"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-line-webhook-handler-pre-auth-concurrency"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-799"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-04-23T22:16:40Z"
47+
}
48+
}

‎advisories/unreviewed/2026/04/GHSA-2m77-r9w3-w44v/GHSA-2m77-r9w3-w44v.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2m77-r9w3-w44v",
4+
"modified": "2026-04-24T00:31:51Z",
5+
"published": "2026-04-24T00:31:51Z",
6+
"aliases": [
7+
"CVE-2026-2708"
8+
],
9+
"details": "A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2708"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2026-2708"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440743"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/500"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/513"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-444"
42+
],
43+
"severity": "LOW",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-04-23T22:16:29Z"
47+
}
48+
}

‎advisories/unreviewed/2026/04/GHSA-2xp4-qhr4-xqm2/GHSA-2xp4-qhr4-xqm2.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2xp4-qhr4-xqm2",
4+
"modified": "2026-04-24T00:31:51Z",
5+
"published": "2026-04-24T00:31:51Z",
6+
"aliases": [
7+
"CVE-2026-41347"
8+
],
9+
"details": "OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery attacks. Attackers can exploit this by sending malicious requests from a browser in trusted-proxy deployments to perform unauthorized actions on HTTP operator endpoints.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-mhr7-2xmv-4c4q"
25+
},
26+
{
27+
"type": "ADVISORY",
28+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41347"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/openclaw/openclaw/commit/6b3f99a11f4d070fa5ed2533abbb3d7329ea4f0d"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/openclaw-cross-site-request-forgery-via-missing-browser-origin-validation-in-http-operator-endpoints"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-352"
42+
],
43+
"severity": "LOW",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-04-23T22:16:41Z"
47+
}
48+
}

‎advisories/unreviewed/2026/04/GHSA-36qx-4ghf-xq84/GHSA-36qx-4ghf-xq84.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-36qx-4ghf-xq84",
4+
"modified": "2026-04-24T00:31:52Z",
5+
"published": "2026-04-24T00:31:52Z",
6+
"aliases": [
7+
"CVE-2026-41361"
8+
],
9+
"details": "OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges. Attackers can exploit this by crafting URLs targeting internal or non-routable IPv6 addresses to bypass SSRF protections.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g86v-f9qv-rh6m"
25+
},
26+
{
27+
"type": "ADVISORY",
28+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41361"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/openclaw-ssrf-guard-bypass-via-ipv6-special-use-ranges"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-184"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-23T22:16:43Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-37hj-44gj-w9gc/GHSA-37hj-44gj-w9gc.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-37hj-44gj-w9gc",
4+
"modified": "2026-04-24T00:31:52Z",
5+
"published": "2026-04-24T00:31:52Z",
6+
"aliases": [
7+
"CVE-2026-29197"
8+
],
9+
"details": "In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in the required permission check, allowing authenticated users without the proper permissions to read apps-engine logs.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29197"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/RocketChat/Rocket.Chat/pull/40125"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://hackerone.com/reports/3589551"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-284"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-04-24T00:16:27Z"
34+
}
35+
}

‎advisories/unreviewed/2026/04/GHSA-394x-274p-mqc6/GHSA-394x-274p-mqc6.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-394x-274p-mqc6",
4+
"modified": "2026-04-24T00:31:52Z",
5+
"published": "2026-04-24T00:31:52Z",
6+
"aliases": [
7+
"CVE-2026-41359"
8+
],
9+
"details": "OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Telegram configuration and cron persistence settings via the send endpoint. Attackers with operator.write credentials can exploit insufficient access controls to reach sensitive administrative functionality and modify persistence mechanisms.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-767m-xrhc-fxm7"
25+
},
26+
{
27+
"type": "ADVISORY",
28+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41359"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/openclaw/openclaw/commit/b7d70ade3b9900dbe97bd73be9c02e924ff3c986"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-operator-write-to-admin-class-telegram-config-and-cron-persistence"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-269"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-04-23T22:16:43Z"
47+
}
48+
}

0 commit comments

Comments
 (0)