Skip to content

Commit 116eebc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-9rhw-f499-jxmh GHSA-cv64-6j2c-f8cg GHSA-cvvv-49vh-384q GHSA-q8x7-j9x6-2fpc GHSA-xmqp-rgcq-rmm2
1 parent dbb389b commit 116eebc

File tree

5 files changed

+205
-1
lines changed

5 files changed

+205
-1
lines changed

‎advisories/unreviewed/2026/03/GHSA-9rhw-f499-jxmh/GHSA-9rhw-f499-jxmh.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9rhw-f499-jxmh",
4+
"modified": "2026-03-06T09:31:33Z",
5+
"published": "2026-03-06T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-2830"
8+
],
9+
"details": "The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filepath’ parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2830"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/wp-all-import/trunk/controllers/admin/import.php#L185"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/wp-all-import/trunk/libraries/XmlImportTemplate.php#L53"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/wp-all-import/trunk/libraries/XmlImportTemplateCodeGenerator.php#L283"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/changeset/3474757"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/afc85535-962d-479d-8580-9d02f7412930?source=cve"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-94"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-06T08:16:27Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-cv64-6j2c-f8cg/GHSA-cv64-6j2c-f8cg.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cv64-6j2c-f8cg",
4+
"modified": "2026-03-06T09:31:33Z",
5+
"published": "2026-03-06T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-23925"
8+
],
9+
"details": "An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23925"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.zabbix.com/browse/ZBX-27567"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-863"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-06T09:15:56Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-cvvv-49vh-384q/GHSA-cvvv-49vh-384q.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cvvv-49vh-384q",
4+
"modified": "2026-03-06T09:31:33Z",
5+
"published": "2026-03-06T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-2331"
8+
],
9+
"details": "An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2331"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.first.org/cvss/calculator/3.1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.json"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sick.com/psirt"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-552"
50+
],
51+
"severity": "CRITICAL",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-06T08:16:27Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-q8x7-j9x6-2fpc/GHSA-q8x7-j9x6-2fpc.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-q8x7-j9x6-2fpc",
4-
"modified": "2026-03-06T06:30:32Z",
4+
"modified": "2026-03-06T09:31:32Z",
55
"published": "2026-03-04T18:31:52Z",
66
"aliases": [
77
"CVE-2025-12801"
@@ -27,6 +27,10 @@
2727
"type": "WEB",
2828
"url": "https://access.redhat.com/errata/RHSA-2026:3940"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://access.redhat.com/errata/RHSA-2026:3941"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "https://access.redhat.com/security/cve/CVE-2025-12801"

‎advisories/unreviewed/2026/03/GHSA-xmqp-rgcq-rmm2/GHSA-xmqp-rgcq-rmm2.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xmqp-rgcq-rmm2",
4+
"modified": "2026-03-06T09:31:33Z",
5+
"published": "2026-03-06T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-2330"
8+
],
9+
"details": "An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2330"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.first.org/cvss/calculator/3.1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.json"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sick.com/psirt"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-552"
50+
],
51+
"severity": "CRITICAL",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-06T08:16:27Z"
55+
}
56+
}

0 commit comments

Comments
 (0)