Skip to content

Commit 2493c06

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent f509047 commit 2493c06

293 files changed

Lines changed: 8929 additions & 169 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2022/05/GHSA-qw7j-w352-g8m7/GHSA-qw7j-w352-g8m7.json‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qw7j-w352-g8m7",
4-
"modified": "2022-05-02T03:13:43Z",
4+
"modified": "2026-04-14T18:30:24Z",
55
"published": "2022-05-02T03:13:43Z",
66
"aliases": [
77
"CVE-2009-0238"
88
],
99
"details": "Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -26,6 +31,10 @@
2631
"type": "WEB",
2732
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968"
2833
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0238"
37+
},
2938
{
3039
"type": "WEB",
3140
"url": "http://blogs.zdnet.com/security/?p=2658"

‎advisories/unreviewed/2025/07/GHSA-cq9g-6hw9-rmv4/GHSA-cq9g-6hw9-rmv4.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cq9g-6hw9-rmv4",
4-
"modified": "2025-07-09T00:30:33Z",
4+
"modified": "2026-04-14T18:30:24Z",
55
"published": "2025-07-09T00:30:33Z",
66
"aliases": [
77
"CVE-2025-49534"

‎advisories/unreviewed/2025/07/GHSA-jv4h-v294-5xfv/GHSA-jv4h-v294-5xfv.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jv4h-v294-5xfv",
4-
"modified": "2025-07-09T00:30:33Z",
4+
"modified": "2026-04-14T18:30:24Z",
55
"published": "2025-07-09T00:30:33Z",
66
"aliases": [
77
"CVE-2025-49547"

‎advisories/unreviewed/2025/12/GHSA-8cv9-4g7x-5c7f/GHSA-8cv9-4g7x-5c7f.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8cv9-4g7x-5c7f",
4-
"modified": "2025-12-09T18:30:34Z",
4+
"modified": "2026-04-14T18:30:25Z",
55
"published": "2025-12-09T18:30:34Z",
66
"aliases": [
77
"CVE-2025-10655"
88
],
99
"details": "SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/03/GHSA-2vwv-vqpv-v8vc/GHSA-2vwv-vqpv-v8vc.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2vwv-vqpv-v8vc",
4-
"modified": "2026-03-31T15:31:55Z",
4+
"modified": "2026-04-14T18:30:26Z",
55
"published": "2026-03-30T09:31:29Z",
66
"aliases": [
77
"CVE-2026-5121"
@@ -26,6 +26,14 @@
2626
{
2727
"type": "WEB",
2828
"url": "https://access.redhat.com/security/cve/CVE-2026-5121"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452945"
33+
},
34+
{
35+
"type": "ADVISORY",
36+
"url": "https://github.com/advisories/GHSA-2vwv-vqpv-v8vc"
2937
}
3038
],
3139
"database_specific": {

‎advisories/unreviewed/2026/04/GHSA-249v-qr3v-pf7r/GHSA-249v-qr3v-pf7r.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-249v-qr3v-pf7r",
4+
"modified": "2026-04-14T18:30:42Z",
5+
"published": "2026-04-14T18:30:42Z",
6+
"aliases": [
7+
"CVE-2026-32222"
8+
],
9+
"details": "Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32222"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32222"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-822"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-14T18:17:30Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-25qr-g262-c7jp/GHSA-25qr-g262-c7jp.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-25qr-g262-c7jp",
4+
"modified": "2026-04-14T18:30:34Z",
5+
"published": "2026-04-14T18:30:34Z",
6+
"aliases": [
7+
"CVE-2025-63939"
8+
],
9+
"details": "Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitem_name POST parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63939"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2025-63939"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-14T16:16:33Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-27pw-mrx7-45mq/GHSA-27pw-mrx7-45mq.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-27pw-mrx7-45mq",
4+
"modified": "2026-04-14T18:30:34Z",
5+
"published": "2026-04-14T18:30:34Z",
6+
"aliases": [
7+
"CVE-2025-65135"
8+
],
9+
"details": "In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65135"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2025-65135/poc.md"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2025-65135"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-14T16:16:34Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-28h6-3mx2-8gjg/GHSA-28h6-3mx2-8gjg.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-28h6-3mx2-8gjg",
4-
"modified": "2026-04-08T21:33:32Z",
4+
"modified": "2026-04-14T18:30:29Z",
55
"published": "2026-04-08T21:33:32Z",
66
"aliases": [
77
"CVE-2026-30818"
88
],
99
"details": "An OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute arbitrary code when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow the attacker to modify device configuration, access sensitive information, or further compromise system integrity.\n\nThis issue affects AX53 v1.0: before 1.7.1 Build 20260213.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/04/GHSA-2969-3f7h-gmhq/GHSA-2969-3f7h-gmhq.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2969-3f7h-gmhq",
4-
"modified": "2026-04-13T15:31:43Z",
4+
"modified": "2026-04-14T18:30:33Z",
55
"published": "2026-04-13T15:31:43Z",
66
"aliases": [
77
"CVE-2026-31282"
88
],
99
"details": "Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-284"
34+
],
35+
"severity": "CRITICAL",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2026-04-13T15:17:33Z"

0 commit comments

Comments
 (0)