Skip to content

Commit 094fc4d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 0998a54 commit 094fc4d

32 files changed

Lines changed: 1591 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-2mc2-45rp-r4w4/GHSA-2mc2-45rp-r4w4.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2mc2-45rp-r4w4",
4+
"modified": "2026-03-21T00:31:42Z",
5+
"published": "2026-03-21T00:31:42Z",
6+
"aliases": [
7+
"CVE-2026-21732"
8+
],
9+
"details": "A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device.\n\n\n\nAn edge case using a very large value in switch statements in GPU shader code can cause a segmentation fault in the GPU shader compiler due to an out-of-bounds write access.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21732"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-823"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-03-20T23:16:42Z"
30+
}
31+
}

‎advisories/unreviewed/2026/03/GHSA-2mjq-54qg-7w6j/GHSA-2mjq-54qg-7w6j.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2mjq-54qg-7w6j",
4+
"modified": "2026-03-21T00:31:44Z",
5+
"published": "2026-03-21T00:31:43Z",
6+
"aliases": [
7+
"CVE-2026-3864"
8+
],
9+
"details": "A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export. This may lead to deletion or modification of directories on the NFS server.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3864"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/kubernetes/kubernetes/issues/137797"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://groups.google.com/g/kubernetes-security-announce/c/i4ZKN9VLcUE"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "http://www.openwall.com/lists/oss-security/2026/03/17/1"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-22"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-20T23:16:48Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-2v87-3m5p-q6cw/GHSA-2v87-3m5p-q6cw.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2v87-3m5p-q6cw",
4+
"modified": "2026-03-21T00:31:44Z",
5+
"published": "2026-03-21T00:31:44Z",
6+
"aliases": [
7+
"CVE-2026-32666"
8+
],
9+
"details": "WebCTRL systems that communicate over BACnet inherit the protocol's lack\n of network layer authentication. WebCTRL does not implement additional \nvalidation of BACnet traffic so an attacker with network access could \nspoof BACnet packets directed at either the WebCTRL server or associated\n AutomatedLogic controllers. Spoofed packets may be processed as \nlegitimate.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32666"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.automatedlogic.com/en/company/security-commitment"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-290"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-21T00:16:26Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-365r-wjfh-hwpv/GHSA-365r-wjfh-hwpv.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-365r-wjfh-hwpv",
4+
"modified": "2026-03-21T00:31:43Z",
5+
"published": "2026-03-21T00:31:43Z",
6+
"aliases": [
7+
"CVE-2026-32663"
8+
],
9+
"details": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32663"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-613"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-20T23:16:44Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-3pgw-qmv2-hv8m/GHSA-3pgw-qmv2-hv8m.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3pgw-qmv2-hv8m",
4+
"modified": "2026-03-21T00:31:43Z",
5+
"published": "2026-03-21T00:31:43Z",
6+
"aliases": [
7+
"CVE-2026-29796"
8+
],
9+
"details": "WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29796"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-306"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-20T23:16:43Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-3wf8-vwmj-p686/GHSA-3wf8-vwmj-p686.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3wf8-vwmj-p686",
4+
"modified": "2026-03-21T00:31:44Z",
5+
"published": "2026-03-21T00:31:44Z",
6+
"aliases": [
7+
"CVE-2026-3474"
8+
],
9+
"details": "The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 1.6.3. This is due to the action() function in the TemplateData class passing user-supplied input from the 'emailkit-editor-template' REST API parameter directly to file_get_contents() without any path validation, sanitization, or restriction to an allowed directory. This makes it possible for authenticated attackers, with Administrator-level access, to read arbitrary files on the server (such as /etc/passwd or wp-config.php) by supplying a traversal path. The file contents are stored as post meta and can subsequently be retrieved via the fetch-data REST API endpoint. Notably, the CheckForm class in the same plugin implements proper path validation using realpath() and directory restriction, demonstrating that the developer was aware of the risk but failed to apply the same protections to the TemplateData endpoint.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3474"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/emailkit/tags/1.6.2/includes/Admin/Api/TemplateData.php#L48"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/emailkit/tags/1.6.2/includes/Admin/Api/TemplateData.php#L49"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/emailkit/tags/1.6.2/includes/Admin/Api/TemplateData.php#L50"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/emailkit/trunk/includes/Admin/Api/TemplateData.php#L48"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/browser/emailkit/trunk/includes/Admin/Api/TemplateData.php#L49"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/browser/emailkit/trunk/includes/Admin/Api/TemplateData.php#L50"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3484455%40emailkit&new=3484455%40emailkit&sfp_email=&sfph_mail="
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c11ebc-5c83-46a2-a8dd-b838cd50ddc6?source=cve"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-22"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-03-21T00:16:28Z"
63+
}
64+
}

‎advisories/unreviewed/2026/03/GHSA-43v8-mm65-g3xj/GHSA-43v8-mm65-g3xj.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-43v8-mm65-g3xj",
4+
"modified": "2026-03-21T00:31:42Z",
5+
"published": "2026-03-21T00:31:42Z",
6+
"aliases": [
7+
"CVE-2026-2378"
8+
],
9+
"details": "ArcSearch for Android versions prior to 1.12.7 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2378"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://arc.net/security/bulletins"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-1021"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-20T22:16:27Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-4cjx-ppvr-f9w8/GHSA-4cjx-ppvr-f9w8.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4cjx-ppvr-f9w8",
4+
"modified": "2026-03-21T00:31:43Z",
5+
"published": "2026-03-21T00:31:43Z",
6+
"aliases": [
7+
"CVE-2026-2598"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2598"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-03-20T23:16:43Z"
24+
}
25+
}

‎advisories/unreviewed/2026/03/GHSA-4p22-4q7x-9xpq/GHSA-4p22-4q7x-9xpq.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4p22-4q7x-9xpq",
4+
"modified": "2026-03-21T00:31:44Z",
5+
"published": "2026-03-21T00:31:44Z",
6+
"aliases": [
7+
"CVE-2026-25086"
8+
],
9+
"details": "Under certain conditions, an attacker could bind to the same port used \nby WebCTRL. This could allow the attacker to craft and send malicious \npackets and impersonate the WebCTRL service without requiring code \ninjection into the WebCTRL software.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25086"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.automatedlogic.com/en/company/security-commitment"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-605"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-21T00:16:25Z"
43+
}
44+
}

0 commit comments

Comments
 (0)