Skip to content

Commit 3f8705b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6px9-j4qr-xfjw GHSA-262p-vjx5-45xh GHSA-2m8c-2374-465f GHSA-38j9-4vcr-j8qh GHSA-5qvq-qj3r-wm68 GHSA-5vfc-ccj9-49j9 GHSA-76wq-v5hf-jg5p GHSA-86jh-grmm-2v3h GHSA-f9v3-j2m7-4hpg GHSA-h4v8-qw7g-35xj GHSA-jj36-c637-m3x8 GHSA-pm7g-w2cf-q238
1 parent 201ce21 commit 3f8705b

12 files changed

Lines changed: 390 additions & 5 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-6px9-j4qr-xfjw/GHSA-6px9-j4qr-xfjw.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6px9-j4qr-xfjw",
4+
"modified": "2026-03-05T00:32:19Z",
5+
"published": "2026-03-05T00:32:19Z",
6+
"aliases": [
7+
"CVE-2026-29778"
8+
],
9+
"summary": "pyLoad has an Arbitrary File Write via Path Traversal in edit_package()",
10+
"details": "The edit_package() function implements insufficient sanitization for the pack_folder parameter. The current protection relies on a single-pass string replacement of \"../\", which can be bypassed using crafted recursive traversal sequences.\n\nExploitation\n\nAn authenticated user with MODIFY permission can bypass the sanitization by submitting a payload such as:\n`pack_folder=..././..././..././tmp`\n\nAfter the single-pass replacement, this becomes:\n`../../../tmp`\n\nBecause the traversal sequences are not properly validated, the resulting normalized path escapes the intended storage directory and writes files to /tmp or other locations.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "pyload-ng"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0.5.0b3.dev13"
29+
},
30+
{
31+
"last_affected": "0.5.0b3.dev96"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/pyload/pyload/security/advisories/GHSA-6px9-j4qr-xfjw"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/pyload/pyload"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-23"
51+
],
52+
"severity": "HIGH",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-03-05T00:32:19Z",
55+
"nvd_published_at": null
56+
}
57+
}

‎advisories/unreviewed/2026/03/GHSA-262p-vjx5-45xh/GHSA-262p-vjx5-45xh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-262p-vjx5-45xh",
4+
"modified": "2026-03-05T00:31:11Z",
5+
"published": "2026-03-05T00:31:11Z",
6+
"aliases": [
7+
"CVE-2026-2835"
8+
],
9+
"details": "An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desync Pingora’s request framing from backend servers’.\n\nImpact\n\nThis vulnerability primarily affects standalone Pingora deployments in front of certain backends that accept HTTP/1.0 requests. An attacker could craft a malicious payload following this request that Pingora forwards to the backend in order to:\n\n * Bypass proxy-level ACL controls and WAF logic\n\n\n\n\n * Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests\n\n\n\n\n * Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP\n\n\n\n\nCloudflare's CDN infrastructure was not affected by this vulnerability, as its ingress proxy layers forwarded HTTP/1.1 requests only, rejected ambiguous framing such as invalid Content-Length values, and forwarded a single Transfer-Encoding: chunked header for chunked requests.\n\n\nMitigation:\n\nPingora users should upgrade to Pingora v0.8.0 or higher that fixes this issue by correctly parsing message length headers per RFC 9112 and strictly adhering to more RFC guidelines, including that HTTP request bodies are never close-delimited.\n\nAs a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact “chunked” string match.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2835"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cloudflare/pingora"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-444"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-05T00:15:57Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-2m8c-2374-465f/GHSA-2m8c-2374-465f.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2m8c-2374-465f",
4+
"modified": "2026-03-05T00:31:11Z",
5+
"published": "2026-03-05T00:31:11Z",
6+
"aliases": [
7+
"CVE-2026-2836"
8+
],
9+
"details": "A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP cache key implementation generates cache keys using only the URI path, excluding critical factors such as the host header (authority). Operators relying on the default are vulnerable to cache poisoning, and cross-origin responses may be improperly served to users.\n\n\nImpact\n\nThis vulnerability affects users of Pingora's alpha proxy caching feature who relied on the default CacheKey implementation. An attacker could exploit this for:\n\n * Cross-tenant data leakage: In multi-tenant deployments, poison the cache so that users from one tenant receive cached responses from another tenant\n\n\n * Cache poisoning attacks: Serve malicious content to legitimate users by poisoning shared cache entries\n\n\n\n\nCloudflare's CDN infrastructure was not affected by this vulnerability, as Cloudflare's default cache key implementation uses multiple factors to prevent cache key poisoning and never made use of the previously provided default.\n\n\nMitigation:\n\nWe strongly recommend Pingora users to upgrade to Pingora v0.8.0 or higher, which removes the insecure default cache key implementation. Users must now explicitly implement their own callback that includes appropriate factors such as Host header, origin server HTTP scheme, and other attributes their cache should vary on.\n\n\nPingora users on previous versions may also remove any of their default CacheKey usage and implement their own that should at minimum include the host header / authority and upstream peer’s HTTP scheme.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2836"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cloudflare/pingora"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "HIGH",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-05T00:15:58Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-38j9-4vcr-j8qh/GHSA-38j9-4vcr-j8qh.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-38j9-4vcr-j8qh",
4-
"modified": "2026-03-03T21:31:16Z",
4+
"modified": "2026-03-05T00:31:10Z",
55
"published": "2026-03-03T21:31:16Z",
66
"aliases": [
77
"CVE-2026-29022"
88
],
99
"details": "dr_libs version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
@@ -27,6 +31,10 @@
2731
"type": "WEB",
2832
"url": "https://github.com/mackron/dr_libs/commit/8a7258cc66b49387ad58cc5b81568982a3560d49"
2933
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2026-001-dr-libs-heap-overflow.md"
37+
},
3038
{
3139
"type": "WEB",
3240
"url": "https://www.vulncheck.com/advisories/mackron-dr-libs-heap-buffer-overflow-via-wav-file"

‎advisories/unreviewed/2026/03/GHSA-5qvq-qj3r-wm68/GHSA-5qvq-qj3r-wm68.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5qvq-qj3r-wm68",
4+
"modified": "2026-03-05T00:31:11Z",
5+
"published": "2026-03-05T00:31:11Z",
6+
"aliases": [
7+
"CVE-2025-70222"
8+
],
9+
"details": "Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70222"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70222"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://www.dlink.com/en/security-bulletin"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [],
32+
"severity": null,
33+
"github_reviewed": false,
34+
"github_reviewed_at": null,
35+
"nvd_published_at": "2026-03-04T22:16:12Z"
36+
}
37+
}

‎advisories/unreviewed/2026/03/GHSA-5vfc-ccj9-49j9/GHSA-5vfc-ccj9-49j9.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5vfc-ccj9-49j9",
4+
"modified": "2026-03-05T00:31:11Z",
5+
"published": "2026-03-05T00:31:11Z",
6+
"aliases": [
7+
"CVE-2026-22052"
8+
],
9+
"details": "ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22052"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.netapp.com/advisory/NTAP-20260304-0001"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "MODERATE",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-05T00:15:56Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-76wq-v5hf-jg5p/GHSA-76wq-v5hf-jg5p.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-76wq-v5hf-jg5p",
4-
"modified": "2026-03-03T18:31:33Z",
4+
"modified": "2026-03-05T00:31:10Z",
55
"published": "2026-03-03T18:31:33Z",
66
"aliases": [
77
"CVE-2025-63912"
88
],
99
"details": "Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to use a weak cryptography algorithm for data encryption, allowing attackers to trivially reverse the encyption and expose credentials.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-327"
2934
],
30-
"severity": null,
35+
"severity": "HIGH",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2026-03-03T18:16:23Z"

‎advisories/unreviewed/2026/03/GHSA-86jh-grmm-2v3h/GHSA-86jh-grmm-2v3h.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-86jh-grmm-2v3h",
4+
"modified": "2026-03-05T00:31:11Z",
5+
"published": "2026-03-05T00:31:11Z",
6+
"aliases": [
7+
"CVE-2026-2297"
8+
],
9+
"details": "The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2297"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/python/cpython/issues/145506"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/python/cpython/pull/145507"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "MODERATE",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2026-03-04T23:16:10Z"
49+
}
50+
}

‎advisories/unreviewed/2026/03/GHSA-f9v3-j2m7-4hpg/GHSA-f9v3-j2m7-4hpg.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f9v3-j2m7-4hpg",
4+
"modified": "2026-03-05T00:31:11Z",
5+
"published": "2026-03-05T00:31:11Z",
6+
"aliases": [
7+
"CVE-2026-2833"
8+
],
9+
"details": "An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads a request containing an Upgrade header, causing the proxy to pass through the rest of the bytes on the connection to a backend before the backend has accepted the upgrade. An attacker can thus directly forward a malicious payload after a request with an Upgrade header to that backend in a way that may be interpreted as a subsequent request header, bypassing proxy-level security controls and enabling cross-user session hijacking.\n\nImpact\n\nThis vulnerability primarily affects standalone Pingora deployments where a Pingora proxy is exposed to external traffic. An attacker could exploit this to:\n\n * Bypass proxy-level ACL controls and WAF logic\n\n\n\n\n * Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests\n\n\n\n\n * Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP\n\n\n\n\nCloudflare's CDN infrastructure was not affected by this vulnerability, as ingress proxies in the CDN stack maintain proper HTTP parsing boundaries and do not prematurely switch to upgraded connection forwarding mode.\n\n\nMitigation:\n\nPingora users should upgrade to Pingora v0.8.0 or higher\n\n\nAs a workaround, users may return an error on requests with the Upgrade header present in their request filter logic in order to stop processing bytes beyond the request header and disable downstream connection reuse.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2833"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cloudflare/pingora"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-444"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-05T00:15:57Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-h4v8-qw7g-35xj/GHSA-h4v8-qw7g-35xj.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h4v8-qw7g-35xj",
4-
"modified": "2026-03-04T21:32:44Z",
4+
"modified": "2026-03-05T00:31:10Z",
55
"published": "2026-03-03T21:31:15Z",
66
"aliases": [
77
"CVE-2025-13490"

0 commit comments

Comments
 (0)