Skip to content

Commit 2672e7c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-22f9-qcfx-q3w3 GHSA-2r69-43cg-w872 GHSA-2wr3-vxcp-rxmc GHSA-7qg4-wvfj-q8vh GHSA-7xfw-wjqp-g457 GHSA-85xc-x9cc-h488 GHSA-8c32-r583-4rf7 GHSA-8wh6-84qg-rgc5 GHSA-8xm2-w3mq-82vh GHSA-9mjh-488m-qp5f GHSA-f283-4xfp-28w6 GHSA-g8xf-86vx-763p GHSA-j677-33p6-9vp7 GHSA-mfg9-9f84-64m4 GHSA-p3w8-qjhq-pfwj GHSA-qg2h-86fw-x9x4 GHSA-qgr7-38xj-4jpq GHSA-rcv7-3vfh-47x6 GHSA-wcpg-p923-mr58
1 parent 116eebc commit 2672e7c

File tree

19 files changed

+329
-54
lines changed

19 files changed

+329
-54
lines changed

‎advisories/unreviewed/2026/03/GHSA-22f9-qcfx-q3w3/GHSA-22f9-qcfx-q3w3.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-22f9-qcfx-q3w3",
4-
"modified": "2026-03-05T06:30:31Z",
4+
"modified": "2026-03-06T12:30:30Z",
55
"published": "2026-03-05T06:30:31Z",
66
"aliases": [
77
"CVE-2026-2418"
88
],
99
"details": "The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be authenticated as any user (such as admin) by simply knowing the email",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -21,7 +26,7 @@
2126
],
2227
"database_specific": {
2328
"cwe_ids": [],
24-
"severity": null,
29+
"severity": "CRITICAL",
2530
"github_reviewed": false,
2631
"github_reviewed_at": null,
2732
"nvd_published_at": "2026-03-05T06:16:51Z"

‎advisories/unreviewed/2026/03/GHSA-2r69-43cg-w872/GHSA-2r69-43cg-w872.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2r69-43cg-w872",
4-
"modified": "2026-03-05T21:30:47Z",
4+
"modified": "2026-03-06T12:30:30Z",
55
"published": "2026-03-05T21:30:47Z",
66
"aliases": [
77
"CVE-2026-26418"
88
],
99
"details": "Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-284"
38+
],
39+
"severity": "HIGH",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2026-03-05T19:16:04Z"

‎advisories/unreviewed/2026/03/GHSA-2wr3-vxcp-rxmc/GHSA-2wr3-vxcp-rxmc.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2wr3-vxcp-rxmc",
4+
"modified": "2026-03-06T12:30:31Z",
5+
"published": "2026-03-06T12:30:30Z",
6+
"aliases": [
7+
"CVE-2026-3589"
8+
],
9+
"details": "The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3589"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-03-06T10:16:22Z"
32+
}
33+
}

‎advisories/unreviewed/2026/03/GHSA-7qg4-wvfj-q8vh/GHSA-7qg4-wvfj-q8vh.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7qg4-wvfj-q8vh",
4-
"modified": "2026-03-05T21:30:45Z",
4+
"modified": "2026-03-06T12:30:30Z",
55
"published": "2026-03-05T21:30:45Z",
66
"aliases": [
77
"CVE-2025-13476"
88
],
99
"details": "Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension diversity, allowing Deep Packet Inspection (DPI) systems to trivially identify and block proxy traffic, undermining censorship circumvention. (CWE-327)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -25,7 +30,7 @@
2530
],
2631
"database_specific": {
2732
"cwe_ids": [],
28-
"severity": null,
33+
"severity": "CRITICAL",
2934
"github_reviewed": false,
3035
"github_reviewed_at": null,
3136
"nvd_published_at": "2026-03-05T19:15:58Z"

‎advisories/unreviewed/2026/03/GHSA-7xfw-wjqp-g457/GHSA-7xfw-wjqp-g457.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7xfw-wjqp-g457",
4-
"modified": "2026-03-05T21:30:47Z",
4+
"modified": "2026-03-06T12:30:30Z",
55
"published": "2026-03-05T21:30:47Z",
66
"aliases": [
77
"CVE-2026-26417"
88
],
99
"details": "A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-284"
34+
],
35+
"severity": "HIGH",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2026-03-05T19:16:04Z"

‎advisories/unreviewed/2026/03/GHSA-85xc-x9cc-h488/GHSA-85xc-x9cc-h488.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-85xc-x9cc-h488",
4-
"modified": "2026-03-05T21:30:46Z",
4+
"modified": "2026-03-06T12:30:30Z",
55
"published": "2026-03-05T21:30:46Z",
66
"aliases": [
77
"CVE-2025-70232"
88
],
99
"details": "Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetMACFilter.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-121"
38+
],
39+
"severity": "CRITICAL",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2026-03-05T19:16:01Z"

‎advisories/unreviewed/2026/03/GHSA-8c32-r583-4rf7/GHSA-8c32-r583-4rf7.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8c32-r583-4rf7",
4-
"modified": "2026-03-05T21:30:46Z",
4+
"modified": "2026-03-06T12:30:30Z",
55
"published": "2026-03-05T21:30:46Z",
66
"aliases": [
77
"CVE-2025-70230"
88
],
99
"details": "Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDDNS.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-121"
38+
],
39+
"severity": "CRITICAL",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2026-03-05T19:16:00Z"

‎advisories/unreviewed/2026/03/GHSA-8wh6-84qg-rgc5/GHSA-8wh6-84qg-rgc5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8wh6-84qg-rgc5",
4+
"modified": "2026-03-06T12:30:31Z",
5+
"published": "2026-03-06T12:30:31Z",
6+
"aliases": [
7+
"CVE-2026-28080"
8+
],
9+
"details": "Missing Authorization vulnerability in Rank Math Rank Math SEO PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO PRO: from n/a through 3.0.95.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28080"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://patchstack.com/database/wordpress/plugin/seo-by-rank-math-pro/vulnerability/wordpress-rank-math-seo-pro-plugin-3-0-95-broken-access-control-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-862"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-06T12:15:54Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-8xm2-w3mq-82vh/GHSA-8xm2-w3mq-82vh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8xm2-w3mq-82vh",
4+
"modified": "2026-03-06T12:30:31Z",
5+
"published": "2026-03-06T12:30:31Z",
6+
"aliases": [
7+
"CVE-2026-28106"
8+
],
9+
"details": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.This issue affects B2BKing Premium: from n/a through 5.3.80.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28106"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://patchstack.com/database/wordpress/plugin/b2bking/vulnerability/wordpress-b2bking-premium-plugin-5-3-80-open-redirection-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-601"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-06T12:15:55Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-9mjh-488m-qp5f/GHSA-9mjh-488m-qp5f.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9mjh-488m-qp5f",
4+
"modified": "2026-03-06T12:30:31Z",
5+
"published": "2026-03-06T12:30:31Z",
6+
"aliases": [
7+
"CVE-2026-1468"
8+
],
9+
"details": "QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges.\nThis software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1468"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cert.pl/posts/2026/03/CVE-2026-1468"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://opensolution.org/cms-system-quick-cms.html"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-352"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-06T11:16:08Z"
39+
}
40+
}

0 commit comments

Comments
 (0)