Skip to content

Commit e6ec74f

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 463bf21 commit e6ec74f

59 files changed

Lines changed: 1936 additions & 25 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/02/GHSA-pm8w-jq9r-x5rp/GHSA-pm8w-jq9r-x5rp.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pm8w-jq9r-x5rp",
4-
"modified": "2026-04-17T15:31:05Z",
4+
"modified": "2026-04-22T21:31:17Z",
55
"published": "2026-02-09T15:30:31Z",
66
"aliases": [
77
"CVE-2025-14831"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
4545
},
46+
{
47+
"type": "WEB",
48+
"url": "https://access.redhat.com/errata/RHSA-2026:7477"
49+
},
4650
{
4751
"type": "WEB",
4852
"url": "https://access.redhat.com/errata/RHSA-2026:7335"

‎advisories/unreviewed/2026/02/GHSA-qvwr-8759-6g2c/GHSA-qvwr-8759-6g2c.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qvwr-8759-6g2c",
4-
"modified": "2026-02-25T12:30:29Z",
4+
"modified": "2026-04-22T21:31:17Z",
55
"published": "2026-02-25T12:30:29Z",
66
"aliases": [
77
"CVE-2026-3118"
@@ -19,6 +19,10 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3118"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
25+
},
2226
{
2327
"type": "WEB",
2428
"url": "https://access.redhat.com/security/cve/CVE-2026-3118"

‎advisories/unreviewed/2026/03/GHSA-3xw8-g6v7-h2gh/GHSA-3xw8-g6v7-h2gh.json‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3xw8-g6v7-h2gh",
4-
"modified": "2026-03-13T21:31:46Z",
4+
"modified": "2026-04-22T21:31:32Z",
55
"published": "2026-03-13T21:31:46Z",
66
"aliases": [
77
"CVE-2026-22192"
@@ -23,6 +23,14 @@
2323
"type": "ADVISORY",
2424
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22192"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic-Power_Preauth_root_RCE.txt"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://voltronicpower.com"
33+
},
2634
{
2735
"type": "WEB",
2836
"url": "https://wordpress.org/plugins/wpdiscuz"
@@ -31,13 +39,22 @@
3139
"type": "WEB",
3240
"url": "https://wordpress.org/plugins/wpdiscuz/#developers"
3341
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-authentication-bypass-via-localstorage"
49+
},
3450
{
3551
"type": "WEB",
3652
"url": "https://www.vulncheck.com/advisories/wpdiscuz-before-stored-cross-site-scripting-via-malicious-options-import"
3753
}
3854
],
3955
"database_specific": {
4056
"cwe_ids": [
57+
"CWE-306",
4158
"CWE-79"
4259
],
4360
"severity": "MODERATE",

‎advisories/unreviewed/2026/03/GHSA-c75f-55f6-f63q/GHSA-c75f-55f6-f63q.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-c75f-55f6-f63q",
4-
"modified": "2026-04-22T18:31:37Z",
4+
"modified": "2026-04-22T21:31:37Z",
55
"published": "2026-03-19T15:31:21Z",
66
"aliases": [
77
"CVE-2026-4424"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://access.redhat.com/errata/RHSA-2026:9026"
4545
},
46+
{
47+
"type": "WEB",
48+
"url": "https://access.redhat.com/errata/RHSA-2026:8944"
49+
},
4650
{
4751
"type": "WEB",
4852
"url": "https://access.redhat.com/errata/RHSA-2026:8908"

‎advisories/unreviewed/2026/03/GHSA-q226-8c4v-p73w/GHSA-q226-8c4v-p73w.json‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-q226-8c4v-p73w",
4-
"modified": "2026-03-13T21:31:46Z",
4+
"modified": "2026-04-22T21:31:32Z",
55
"published": "2026-03-13T21:31:46Z",
66
"aliases": [
77
"CVE-2026-22191"
@@ -23,6 +23,14 @@
2323
"type": "ADVISORY",
2424
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22191"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-POC.py"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-SicuroWeb-ATI-chain.txt"
33+
},
2634
{
2735
"type": "WEB",
2836
"url": "https://wordpress.org/plugins/wpdiscuz"
@@ -31,13 +39,26 @@
3139
"type": "WEB",
3240
"url": "https://wordpress.org/plugins/wpdiscuz/#developers"
3341
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.beghelli.it"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.vulncheck.com/advisories/beghelli-sicuro24-sicuroweb-angularjs-template-injection"
53+
},
3454
{
3555
"type": "WEB",
3656
"url": "https://www.vulncheck.com/advisories/wpdiscuz-before-server-side-shortcode-injection-via-email-notifications"
3757
}
3858
],
3959
"database_specific": {
4060
"cwe_ids": [
61+
"CWE-1336",
4162
"CWE-94"
4263
],
4364
"severity": "MODERATE",

‎advisories/unreviewed/2026/03/GHSA-qgvm-cj9x-53jj/GHSA-qgvm-cj9x-53jj.json‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qgvm-cj9x-53jj",
4-
"modified": "2026-03-13T21:31:46Z",
4+
"modified": "2026-04-22T21:31:32Z",
55
"published": "2026-03-13T21:31:46Z",
66
"aliases": [
77
"CVE-2026-22199"
@@ -23,6 +23,14 @@
2323
"type": "ADVISORY",
2424
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22199"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic-Power_Preauth_root_RCE.txt"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://voltronicpower.com"
33+
},
2634
{
2735
"type": "WEB",
2836
"url": "https://wordpress.org/plugins/wpdiscuz"
@@ -31,13 +39,22 @@
3139
"type": "WEB",
3240
"url": "https://wordpress.org/plugins/wpdiscuz/#developers"
3341
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-path-traversal-via-upload-cgi"
49+
},
3450
{
3551
"type": "WEB",
3652
"url": "https://www.vulncheck.com/advisories/wpdiscuz-before-vote-manipulation-via-nonce-oracle-and-ip-rotation"
3753
}
3854
],
3955
"database_specific": {
4056
"cwe_ids": [
57+
"CWE-22",
4158
"CWE-290"
4259
],
4360
"severity": "MODERATE",

‎advisories/unreviewed/2026/04/GHSA-24rc-w3ff-pw6w/GHSA-24rc-w3ff-pw6w.json‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-24rc-w3ff-pw6w",
4+
"modified": "2026-04-22T21:31:44Z",
5+
"published": "2026-04-22T21:31:43Z",
6+
"aliases": [
7+
"CVE-2026-4812"
8+
],
9+
"details": "The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4812"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-page_link.php#L144"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-post_object.php#L155"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-post_object.php#L92"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-relationship.php#L118"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-relationship.php#L171"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-relationship.php#L180"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-relationship.php#L187"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/tags/6.7.0/includes/fields/class-acf-field-user.php#L435"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-page_link.php#L144"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-post_object.php#L155"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-post_object.php#L92"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-relationship.php#L118"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-relationship.php#L171"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-relationship.php#L180"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-relationship.php#L187"
81+
},
82+
{
83+
"type": "WEB",
84+
"url": "https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field-user.php#L435"
85+
},
86+
{
87+
"type": "WEB",
88+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/51e3a976-a1a3-411a-b88c-f1cb2aa8d5eb?source=cve"
89+
}
90+
],
91+
"database_specific": {
92+
"cwe_ids": [
93+
"CWE-862"
94+
],
95+
"severity": "MODERATE",
96+
"github_reviewed": false,
97+
"github_reviewed_at": null,
98+
"nvd_published_at": "2026-04-15T04:17:48Z"
99+
}
100+
}

‎advisories/unreviewed/2026/04/GHSA-2755-2mm4-rm5c/GHSA-2755-2mm4-rm5c.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2755-2mm4-rm5c",
4+
"modified": "2026-04-22T21:32:11Z",
5+
"published": "2026-04-22T21:32:11Z",
6+
"aliases": [
7+
"CVE-2026-6019"
8+
],
9+
"details": "http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes \" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6019"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/python/cpython/issues/90309"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/python/cpython/pull/148848"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-150"
42+
],
43+
"severity": "LOW",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-04-22T20:16:42Z"
47+
}
48+
}

‎advisories/unreviewed/2026/04/GHSA-3hwj-7r29-g5vv/GHSA-3hwj-7r29-g5vv.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3hwj-7r29-g5vv",
4+
"modified": "2026-04-22T21:32:10Z",
5+
"published": "2026-04-22T21:32:10Z",
6+
"aliases": [
7+
"CVE-2026-28950"
8+
],
9+
"details": "A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2. Notifications marked for deletion could be unexpectedly retained on the device.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28950"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://support.apple.com/en-us/127002"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://support.apple.com/en-us/127003"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-04-22T19:17:00Z"
32+
}
33+
}

0 commit comments

Comments
 (0)