Skip to content

Commit 237385e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2p4m-4mc7-m8w7 GHSA-3w3m-7xpm-xrwg GHSA-3whp-4f2f-273p GHSA-642c-46j5-rhcm GHSA-686w-7c78-3m4c GHSA-94gm-fw3p-4pf2 GHSA-9r9x-93jv-xc8p GHSA-fm7r-p7x2-h4j8 GHSA-fvv2-g9g4-w446 GHSA-g3m6-556h-mp43 GHSA-gcmm-29vw-qxj6 GHSA-gww4-6rrf-6f3g GHSA-q5cv-phmc-fwgp GHSA-q5gc-m94w-rw4r
1 parent af2b059 commit 237385e

14 files changed

Lines changed: 714 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-2p4m-4mc7-m8w7/GHSA-2p4m-4mc7-m8w7.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2p4m-4mc7-m8w7",
4+
"modified": "2026-03-09T06:31:13Z",
5+
"published": "2026-03-09T06:31:13Z",
6+
"aliases": [
7+
"CVE-2026-3796"
8+
],
9+
"details": "A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureIO_Imp.sys of the component Mini Filter Driver. Executing a manipulation can lead to improper access controls. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3796"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cwjchoi01/FocusKiller"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/cwjchoi01/FocusKiller/tree/main/FocusKiller"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.349763"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.349763"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.758991"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-266"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-09T04:15:58Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-3w3m-7xpm-xrwg/GHSA-3w3m-7xpm-xrwg.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3w3m-7xpm-xrwg",
4+
"modified": "2026-03-09T06:31:14Z",
5+
"published": "2026-03-09T06:31:14Z",
6+
"aliases": [
7+
"CVE-2026-3806"
8+
],
9+
"details": "A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0. This issue affects some unknown processing of the file /room_rates.php. This manipulation of the argument q causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3806"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Resort-Reservation-System---SQLi2.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349772"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349772"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.768999"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-09T06:16:09Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-3whp-4f2f-273p/GHSA-3whp-4f2f-273p.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3whp-4f2f-273p",
4+
"modified": "2026-03-09T06:31:13Z",
5+
"published": "2026-03-09T06:31:13Z",
6+
"aliases": [
7+
"CVE-2026-3799"
8+
],
9+
"details": "A flaw has been found in Tenda i3 1.0.0.6(2204). This impacts the function formSetCfm of the file /goform/setcfm. This manipulation of the argument funcpara1 causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3799"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-i3-setcfm-funcpara1-buffer-overflow"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349766"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349766"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.768976"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-09T04:16:04Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-642c-46j5-rhcm/GHSA-642c-46j5-rhcm.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-642c-46j5-rhcm",
4+
"modified": "2026-03-09T06:31:13Z",
5+
"published": "2026-03-09T06:31:13Z",
6+
"aliases": [
7+
"CVE-2026-3630"
8+
],
9+
"details": "Delta Electronics COMMGR2 has \n\nStack-based Buffer Overflow vulnerability.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3630"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00005_COMMGR%202%20Multiple%20Vulnerabilities%20(CVE-2026-3630,%20CVE-2026-3631).pdf"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "CRITICAL",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-09T04:15:58Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-686w-7c78-3m4c/GHSA-686w-7c78-3m4c.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-686w-7c78-3m4c",
4+
"modified": "2026-03-09T06:31:13Z",
5+
"published": "2026-03-09T06:31:13Z",
6+
"aliases": [
7+
"CVE-2026-3798"
8+
],
9+
"details": "A vulnerability was detected in Comfast CF-AC100 2.6.0.8. This affects the function sub_44AC14 of the file /cgi-bin/mbox-config?method=SET&section=ping_config of the component Request Path Handler. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3798"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jinhao118/cve/blob/main/ComFast%20CF-AC100-V2.6.0.8_1.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349765"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349765"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.766443"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-09T04:16:02Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-94gm-fw3p-4pf2/GHSA-94gm-fw3p-4pf2.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-94gm-fw3p-4pf2",
4+
"modified": "2026-03-09T06:31:14Z",
5+
"published": "2026-03-09T06:31:14Z",
6+
"aliases": [
7+
"CVE-2026-3801"
8+
],
9+
"details": "A vulnerability was found in Tenda i3 1.0.0.6(2204). Affected by this vulnerability is the function formSetAutoPing of the file /goform/setAutoPing. Performing a manipulation of the argument ping1/ping2 results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3801"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-i3-setautoping-ping1-buffer-overflow"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-i3-setautoping-ping2-buffer-overflow"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.349768"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.349768"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.768980"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.768982"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.tenda.com.cn"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-119"
58+
],
59+
"severity": "HIGH",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-03-09T04:16:08Z"
63+
}
64+
}

‎advisories/unreviewed/2026/03/GHSA-9r9x-93jv-xc8p/GHSA-9r9x-93jv-xc8p.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9r9x-93jv-xc8p",
4+
"modified": "2026-03-09T06:31:14Z",
5+
"published": "2026-03-09T06:31:14Z",
6+
"aliases": [
7+
"CVE-2026-3803"
8+
],
9+
"details": "A vulnerability was identified in Tenda i3 1.0.0.6(2204). This affects the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet. The manipulation of the argument index leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3803"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-i3-formWifiMacFilterGet-index-buffer-overflow"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349770"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349770"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.768984"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-09T06:16:08Z"
55+
}
56+
}

0 commit comments

Comments
 (0)