Skip to content

Commit 1d789ad

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3f3c-wc35-5wjv GHSA-6v7x-r5hj-8xc6 GHSA-g449-jq9r-wx9r GHSA-pjpj-3w53-j35f
1 parent f45c133 commit 1d789ad

4 files changed

Lines changed: 232 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-3f3c-wc35-5wjv/GHSA-3f3c-wc35-5wjv.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3f3c-wc35-5wjv",
4+
"modified": "2026-03-07T15:30:17Z",
5+
"published": "2026-03-07T15:30:17Z",
6+
"aliases": [
7+
"CVE-2026-3664"
8+
],
9+
"details": "A vulnerability was determined in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::compound_document::read_directory of the file source/detail/cryptography/compound_document.cpp of the component Encrypted XLSX File Parser. Executing a manipulation can lead to out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 147. Applying a patch is advised to resolve this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3664"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/xlnt-community/xlnt/issues/141"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/xlnt-community/xlnt/pull/147"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/oneafter/0128/blob/main/xl5/repro"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/xlnt-community/xlnt"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?ctiid.349553"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?id.349553"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?submit.764646"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-119"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-03-07T15:15:56Z"
63+
}
64+
}

‎advisories/unreviewed/2026/03/GHSA-6v7x-r5hj-8xc6/GHSA-6v7x-r5hj-8xc6.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6v7x-r5hj-8xc6",
4+
"modified": "2026-03-07T15:30:17Z",
5+
"published": "2026-03-07T15:30:17Z",
6+
"aliases": [
7+
"CVE-2026-3663"
8+
],
9+
"details": "A vulnerability was found in xlnt-community xlnt up to 1.6.1. This issue affects the function xlnt::detail::compound_document_istreambuf::xsgetn of the file source/detail/cryptography/compound_document.cpp of the component XLSX File Parser. Performing a manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit has been made public and could be used. The patch is named 147. It is recommended to apply a patch to fix this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3663"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/xlnt-community/xlnt/issues/139"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/xlnt-community/xlnt/pull/147"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/oneafter/0128/blob/main/xl3/repro"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/xlnt-community/xlnt"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?ctiid.349552"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?id.349552"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?submit.764644"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-119"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-03-07T15:15:56Z"
63+
}
64+
}

‎advisories/unreviewed/2026/03/GHSA-g449-jq9r-wx9r/GHSA-g449-jq9r-wx9r.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g449-jq9r-wx9r",
4+
"modified": "2026-03-07T15:30:17Z",
5+
"published": "2026-03-07T15:30:16Z",
6+
"aliases": [
7+
"CVE-2026-3662"
8+
],
9+
"details": "A vulnerability has been found in Wavlink WL-NU516U1 240425. This vulnerability affects the function usb_p910 of the file /cgi-bin/adm.cgi. Such manipulation of the argument Pr_mode leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3662"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jinhao118/cve/blob/main/WAVLINK_2.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349551"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349551"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.758228"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-07T14:16:06Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-pjpj-3w53-j35f/GHSA-pjpj-3w53-j35f.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pjpj-3w53-j35f",
4+
"modified": "2026-03-07T15:30:16Z",
5+
"published": "2026-03-07T15:30:16Z",
6+
"aliases": [
7+
"CVE-2026-3661"
8+
],
9+
"details": "A flaw has been found in Wavlink WL-NU516U1 240425. This affects the function ota_new_upgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument model causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3661"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jinhao118/cve/blob/main/WAVLINK_1.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349550"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349550"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.758227"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-07T14:16:05Z"
51+
}
52+
}

0 commit comments

Comments
 (0)