Skip to content

Commit 5f237a6

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 27e00dd commit 5f237a6

155 files changed

Lines changed: 1968 additions & 275 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/github-reviewed/2025/09/GHSA-95h4-w6j8-2rp8/GHSA-95h4-w6j8-2rp8.json‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-95h4-w6j8-2rp8",
4-
"modified": "2026-01-09T00:30:27Z",
4+
"modified": "2026-03-05T21:30:23Z",
55
"published": "2025-09-02T15:31:08Z",
66
"aliases": [
77
"CVE-2025-9784"
@@ -69,15 +69,15 @@
6969
},
7070
{
7171
"type": "WEB",
72-
"url": "https://github.com/undertow-io/undertow/pull/1778"
72+
"url": "https://github.com/undertow-io/undertow/pull/1803"
7373
},
7474
{
7575
"type": "WEB",
7676
"url": "https://github.com/undertow-io/undertow/pull/1802"
7777
},
7878
{
7979
"type": "WEB",
80-
"url": "https://github.com/undertow-io/undertow/pull/1803"
80+
"url": "https://github.com/undertow-io/undertow/pull/1778"
8181
},
8282
{
8383
"type": "WEB",
@@ -107,6 +107,18 @@
107107
"type": "WEB",
108108
"url": "https://access.redhat.com/security/cve/CVE-2025-9784"
109109
},
110+
{
111+
"type": "WEB",
112+
"url": "https://access.redhat.com/errata/RHSA-2026:3892"
113+
},
114+
{
115+
"type": "WEB",
116+
"url": "https://access.redhat.com/errata/RHSA-2026:3891"
117+
},
118+
{
119+
"type": "WEB",
120+
"url": "https://access.redhat.com/errata/RHSA-2026:3889"
121+
},
110122
{
111123
"type": "WEB",
112124
"url": "https://access.redhat.com/errata/RHSA-2026:0386"

‎advisories/github-reviewed/2025/12/GHSA-6h4f-pj3g-q8fq/GHSA-6h4f-pj3g-q8fq.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6h4f-pj3g-q8fq",
4-
"modified": "2026-02-25T20:15:41Z",
4+
"modified": "2026-03-05T21:30:24Z",
55
"published": "2025-12-03T21:31:04Z",
66
"aliases": [
77
"CVE-2024-3884"
@@ -125,6 +125,18 @@
125125
"type": "WEB",
126126
"url": "https://access.redhat.com/security/cve/CVE-2024-3884"
127127
},
128+
{
129+
"type": "WEB",
130+
"url": "https://access.redhat.com/errata/RHSA-2026:3892"
131+
},
132+
{
133+
"type": "WEB",
134+
"url": "https://access.redhat.com/errata/RHSA-2026:3891"
135+
},
136+
{
137+
"type": "WEB",
138+
"url": "https://access.redhat.com/errata/RHSA-2026:3889"
139+
},
128140
{
129141
"type": "WEB",
130142
"url": "https://access.redhat.com/errata/RHSA-2026:0386"

‎advisories/github-reviewed/2026/01/GHSA-gv94-wp4h-vv8p/GHSA-gv94-wp4h-vv8p.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gv94-wp4h-vv8p",
4-
"modified": "2026-01-08T21:14:12Z",
4+
"modified": "2026-03-05T21:30:25Z",
55
"published": "2026-01-08T06:31:32Z",
66
"aliases": [
77
"CVE-2026-0707"
@@ -40,6 +40,14 @@
4040
"type": "ADVISORY",
4141
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0707"
4242
},
43+
{
44+
"type": "WEB",
45+
"url": "https://access.redhat.com/errata/RHSA-2026:3947"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://access.redhat.com/errata/RHSA-2026:3948"
50+
},
4351
{
4452
"type": "WEB",
4553
"url": "https://access.redhat.com/security/cve/CVE-2026-0707"

‎advisories/github-reviewed/2026/01/GHSA-j382-5jj3-vw4j/GHSA-j382-5jj3-vw4j.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j382-5jj3-vw4j",
4-
"modified": "2026-03-05T15:30:33Z",
4+
"modified": "2026-03-05T21:30:25Z",
55
"published": "2026-01-07T18:30:25Z",
66
"aliases": [
77
"CVE-2025-12543"
@@ -88,10 +88,22 @@
8888
"type": "WEB",
8989
"url": "https://access.redhat.com/errata/RHSA-2026:0386"
9090
},
91+
{
92+
"type": "WEB",
93+
"url": "https://access.redhat.com/errata/RHSA-2026:3889"
94+
},
9195
{
9296
"type": "WEB",
9397
"url": "https://access.redhat.com/errata/RHSA-2026:3890"
9498
},
99+
{
100+
"type": "WEB",
101+
"url": "https://access.redhat.com/errata/RHSA-2026:3891"
102+
},
103+
{
104+
"type": "WEB",
105+
"url": "https://access.redhat.com/errata/RHSA-2026:3892"
106+
},
95107
{
96108
"type": "WEB",
97109
"url": "https://access.redhat.com/security/cve/CVE-2025-12543"

‎advisories/github-reviewed/2026/03/GHSA-573f-x89g-hqp9/GHSA-573f-x89g-hqp9.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-573f-x89g-hqp9",
4+
"modified": "2026-03-05T21:29:54Z",
5+
"published": "2026-03-05T21:29:54Z",
6+
"aliases": [
7+
"CVE-2026-3419"
8+
],
9+
"summary": "Fastify's Missing End Anchor in \"subtypeNameReg\" Allows Malformed Content-Types to Pass Validation",
10+
"details": "# Description\n\nFastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of [RFC 9110 §8.3.1](https://httpwg.org/specs/rfc9110.html#field.content-type). For example, a request sent with `Content-Type: application/json garbage` passes validation and is processed normally, rather than being rejected with `415 Unsupported Media Type`.\n\nWhen regex-based content-type parsers are in use (a documented Fastify feature), the malformed value is matched against registered parsers using the full string including the trailing garbage. This means a request with an invalid content-type may be routed to and processed by a parser it should never have reached.\n\n## Impact\n\nAn attacker can send requests with RFC-invalid `Content-Type` headers that bypass validity checks, reach content-type parser matching, and be processed by the server. Requests that should be rejected at the validation stage are instead handled as if the content-type were valid.\n\n## Workarounds\n\nDeploy a WAF rule to protect against this\n\n## Fix\n\nThe fix is available starting with v5.8.1.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "fastify"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "5.7.2"
29+
},
30+
{
31+
"fixed": "5.8.1"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 5.8.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/fastify/fastify/security/advisories/GHSA-573f-x89g-hqp9"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/fastify/fastify/commit/67f6c9b32cb3623d3c9470cc17ed830dd2f083d7"
49+
},
50+
{
51+
"type": "PACKAGE",
52+
"url": "https://github.com/fastify/fastify"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://httpwg.org/specs/rfc9110.html#field.content-type"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-185"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-03-05T21:29:54Z",
66+
"nvd_published_at": null
67+
}
68+
}

‎advisories/unreviewed/2022/05/GHSA-2h24-74j8-q5hx/GHSA-2h24-74j8-q5hx.json‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2h24-74j8-q5hx",
4-
"modified": "2022-05-24T17:12:46Z",
4+
"modified": "2026-03-05T21:30:23Z",
55
"published": "2022-05-24T17:12:46Z",
66
"aliases": [
77
"CVE-2020-9375"
88
],
99
"details": "TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexpected Referer field.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -18,6 +23,10 @@
1823
"type": "WEB",
1924
"url": "https://thewhiteh4t.github.io/2020/02/27/CVE-2020-9375-TP-Link-Archer-C50-v3-Denial-of-Service.html"
2025
},
26+
{
27+
"type": "WEB",
28+
"url": "https://thewhiteh4t.github.io/blog/cve-2020-9375-tplink"
29+
},
2130
{
2231
"type": "WEB",
2332
"url": "https://www.tp-link.com/in/support/download/archer-c50/v3/#Firmware"
@@ -28,7 +37,9 @@
2837
}
2938
],
3039
"database_specific": {
31-
"cwe_ids": [],
40+
"cwe_ids": [
41+
"CWE-772"
42+
],
3243
"severity": "HIGH",
3344
"github_reviewed": false,
3445
"github_reviewed_at": null,

‎advisories/unreviewed/2022/05/GHSA-3jm5-8qwr-jvwm/GHSA-3jm5-8qwr-jvwm.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3jm5-8qwr-jvwm",
4-
"modified": "2022-05-13T01:52:48Z",
4+
"modified": "2026-03-05T21:30:23Z",
55
"published": "2022-05-13T01:52:48Z",
66
"aliases": [
77
"CVE-2018-5383"
@@ -70,6 +70,7 @@
7070
],
7171
"database_specific": {
7272
"cwe_ids": [
73+
"CWE-325",
7374
"CWE-347"
7475
],
7576
"severity": "MODERATE",

‎advisories/unreviewed/2022/05/GHSA-82r9-7ww3-jr86/GHSA-82r9-7ww3-jr86.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-82r9-7ww3-jr86",
4-
"modified": "2024-12-27T21:30:30Z",
4+
"modified": "2026-03-05T21:30:22Z",
55
"published": "2022-05-17T00:13:28Z",
66
"aliases": [
77
"CVE-2017-7921"
@@ -27,6 +27,10 @@
2727
"type": "WEB",
2828
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7921"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20170314"

‎advisories/unreviewed/2022/05/GHSA-pvh9-p4pw-h78q/GHSA-pvh9-p4pw-h78q.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pvh9-p4pw-h78q",
4-
"modified": "2022-05-24T17:43:33Z",
4+
"modified": "2026-03-05T21:30:23Z",
55
"published": "2022-05-24T17:43:33Z",
66
"aliases": [
77
"CVE-2021-22681"
@@ -22,6 +22,10 @@
2222
{
2323
"type": "WEB",
2424
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22681"
2529
}
2630
],
2731
"database_specific": {

‎advisories/unreviewed/2024/01/GHSA-58c3-hjfx-2gmq/GHSA-58c3-hjfx-2gmq.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-58c3-hjfx-2gmq",
4-
"modified": "2025-11-04T21:31:03Z",
4+
"modified": "2026-03-05T21:30:23Z",
55
"published": "2024-01-11T00:30:25Z",
66
"aliases": [
77
"CVE-2023-41974"
@@ -19,13 +19,21 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41974"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit"
25+
},
2226
{
2327
"type": "WEB",
2428
"url": "https://support.apple.com/en-us/HT213938"
2529
},
2630
{
2731
"type": "WEB",
2832
"url": "https://support.apple.com/kb/HT213938"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41974"
2937
}
3038
],
3139
"database_specific": {

0 commit comments

Comments
 (0)