Skip to content

Commit 7203f64

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 4c83c82 commit 7203f64

31 files changed

Lines changed: 1305 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-354p-69pj-7hrh/GHSA-354p-69pj-7hrh.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-354p-69pj-7hrh",
4+
"modified": "2026-02-18T06:30:18Z",
5+
"published": "2026-02-18T06:30:18Z",
6+
"aliases": [
7+
"CVE-2026-27038"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27038"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-02-18T04:16:01Z"
24+
}
25+
}

‎advisories/unreviewed/2026/02/GHSA-3gjc-g73c-46x5/GHSA-3gjc-g73c-46x5.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3gjc-g73c-46x5",
4+
"modified": "2026-02-18T06:30:18Z",
5+
"published": "2026-02-18T06:30:18Z",
6+
"aliases": [
7+
"CVE-2026-27036"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27036"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-02-18T04:16:01Z"
24+
}
25+
}

‎advisories/unreviewed/2026/02/GHSA-4292-3qv2-cv3v/GHSA-4292-3qv2-cv3v.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4292-3qv2-cv3v",
4+
"modified": "2026-02-18T06:30:19Z",
5+
"published": "2026-02-18T06:30:19Z",
6+
"aliases": [
7+
"CVE-2025-12037"
8+
],
9+
"details": "The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12037"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/log/wp-404-auto-redirect-to-similar-post"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c20059de-9d81-4318-a015-8e402945828c?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-18T05:16:08Z"
39+
}
40+
}

‎advisories/unreviewed/2026/02/GHSA-43j7-cmcw-j9hr/GHSA-43j7-cmcw-j9hr.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-43j7-cmcw-j9hr",
4+
"modified": "2026-02-18T06:30:18Z",
5+
"published": "2026-02-18T06:30:18Z",
6+
"aliases": [
7+
"CVE-2025-12074"
8+
],
9+
"details": "The Context Blog theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.5 via the 'context_blog_modal_popup' due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12074"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://themes.svn.wordpress.org/context-blog/1.2.1/inc/ajax/modal-popup.php"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://themes.trac.wordpress.org/changeset/297968"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://wordpress.org/themes/context-blog"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.postmagthemes.com/downloads/context-blog-free-wordpress-theme"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/25552fdb-c55b-4390-a614-7c007c5fe7b1?source=cve"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-200"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-18T05:16:16Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-4r69-36rj-xggj/GHSA-4r69-36rj-xggj.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4r69-36rj-xggj",
4+
"modified": "2026-02-18T06:30:19Z",
5+
"published": "2026-02-18T06:30:19Z",
6+
"aliases": [
7+
"CVE-2025-11737"
8+
],
9+
"details": "The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_sns_title' parameter in all versions up to, and including, 9.112.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11737"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3402996%40vk-all-in-one-expansion-unit&new=3402996%40vk-all-in-one-expansion-unit&sfp_email=&sfph_mail="
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e7efb39-fada-4167-825c-21cc31948a63?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-18T06:16:31Z"
39+
}
40+
}

‎advisories/unreviewed/2026/02/GHSA-4wq4-57x2-fmhv/GHSA-4wq4-57x2-fmhv.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4wq4-57x2-fmhv",
4+
"modified": "2026-02-18T06:30:19Z",
5+
"published": "2026-02-18T06:30:19Z",
6+
"aliases": [
7+
"CVE-2025-6460"
8+
],
9+
"details": "The Display During Conditional Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6460"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3455051"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://wordpress.org/plugins/display-during-conditional-shortcode/#developers"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ad39a3b0-5434-4595-a052-4b6e4adb2247?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-18T05:16:18Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-568p-hhxc-vvx8/GHSA-568p-hhxc-vvx8.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-568p-hhxc-vvx8",
4+
"modified": "2026-02-18T06:30:19Z",
5+
"published": "2026-02-18T06:30:19Z",
6+
"aliases": [
7+
"CVE-2026-1368"
8+
],
9+
"details": "The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1368"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/218e6655-c5aa-4bce-86b2-cad3bb20020c"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-02-18T06:16:34Z"
28+
}
29+
}

‎advisories/unreviewed/2026/02/GHSA-5g55-5vv7-848g/GHSA-5g55-5vv7-848g.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5g55-5vv7-848g",
4+
"modified": "2026-02-18T06:30:19Z",
5+
"published": "2026-02-18T06:30:19Z",
6+
"aliases": [
7+
"CVE-2025-12122"
8+
],
9+
"details": "The Popup Box – Easily Create WordPress Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12122"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3410472%40popup-box&new=3410472%40popup-box&sfp_email=&sfph_mail="
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a7eeb557-0528-422a-aae7-3f99154953df?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-78"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-18T06:16:33Z"
39+
}
40+
}

‎advisories/unreviewed/2026/02/GHSA-69fg-c96p-c6fq/GHSA-69fg-c96p-c6fq.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-69fg-c96p-c6fq",
4+
"modified": "2026-02-18T06:30:19Z",
5+
"published": "2026-02-18T06:30:19Z",
6+
"aliases": [
7+
"CVE-2026-2641"
8+
],
9+
"details": "A weakness has been identified in universal-ctags ctags up to 6.2.1. The affected element is the function parseExpression/parseExprList of the file parsers/v.c of the component V Language Parser. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2641"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/universal-ctags/ctags/issues/4369"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/oneafter/0116/blob/main/poc.v"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/universal-ctags/ctags"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.346397"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.346397"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.752768"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-404"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-02-18T06:16:35Z"
59+
}
60+
}

‎advisories/unreviewed/2026/02/GHSA-763r-9v7r-f8fj/GHSA-763r-9v7r-f8fj.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-763r-9v7r-f8fj",
4+
"modified": "2026-02-18T06:30:18Z",
5+
"published": "2026-02-18T06:30:18Z",
6+
"aliases": [
7+
"CVE-2026-27032"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27032"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-02-18T04:16:00Z"
24+
}
25+
}

0 commit comments

Comments
 (0)