Skip to content

Commit 8e99717

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-58c3-hjfx-2gmq GHSA-93px-8x98-j7p2 GHSA-96ff-3rwm-724g GHSA-45rr-9399-9pp6 GHSA-4v27-f65g-fr6x GHSA-6fmm-qmfj-8phm GHSA-6rfh-4m76-4764 GHSA-84xh-4ccm-v989 GHSA-92rh-qgqp-3674 GHSA-956f-fcv4-hgpq GHSA-9q67-w6wv-xp8c GHSA-9xf5-rrg6-jj77 GHSA-cwx4-752x-q9c8 GHSA-j4r5-rc95-5xpf GHSA-jv98-ppxj-hj8j GHSA-p3cx-frrm-35m8 GHSA-p9xj-crp8-gj65 GHSA-pv38-vw9w-mvfx GHSA-pvwh-rjjc-mwgp GHSA-r9cv-9j6h-2cv2
1 parent 7807dd2 commit 8e99717

20 files changed

Lines changed: 892 additions & 3 deletions

File tree

‎advisories/unreviewed/2024/01/GHSA-58c3-hjfx-2gmq/GHSA-58c3-hjfx-2gmq.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-58c3-hjfx-2gmq",
4-
"modified": "2026-03-05T21:30:23Z",
4+
"modified": "2026-03-12T03:31:05Z",
55
"published": "2024-01-11T00:30:25Z",
66
"aliases": [
77
"CVE-2023-41974"
@@ -23,6 +23,14 @@
2323
"type": "WEB",
2424
"url": "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://support.apple.com/en-us/120949"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://support.apple.com/en-us/126632"
33+
},
2634
{
2735
"type": "WEB",
2836
"url": "https://support.apple.com/en-us/HT213938"

‎advisories/unreviewed/2024/01/GHSA-93px-8x98-j7p2/GHSA-93px-8x98-j7p2.json‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-93px-8x98-j7p2",
4-
"modified": "2025-10-22T00:32:59Z",
4+
"modified": "2026-03-12T03:31:06Z",
55
"published": "2024-01-23T03:31:08Z",
66
"aliases": [
77
"CVE-2024-23222"
@@ -87,6 +87,26 @@
8787
"type": "WEB",
8888
"url": "https://support.apple.com/en-us/HT214055"
8989
},
90+
{
91+
"type": "WEB",
92+
"url": "https://support.apple.com/en-us/126632"
93+
},
94+
{
95+
"type": "WEB",
96+
"url": "https://support.apple.com/en-us/120311"
97+
},
98+
{
99+
"type": "WEB",
100+
"url": "https://support.apple.com/en-us/120310"
101+
},
102+
{
103+
"type": "WEB",
104+
"url": "https://support.apple.com/en-us/120309"
105+
},
106+
{
107+
"type": "WEB",
108+
"url": "https://support.apple.com/en-us/120304"
109+
},
90110
{
91111
"type": "WEB",
92112
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2VJMEDT4GL42AQVHSYOT6DIVJDZWIV4"

‎advisories/unreviewed/2025/11/GHSA-96ff-3rwm-724g/GHSA-96ff-3rwm-724g.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-96ff-3rwm-724g",
4-
"modified": "2026-03-05T21:30:23Z",
4+
"modified": "2026-03-12T03:31:05Z",
55
"published": "2025-11-05T21:31:01Z",
66
"aliases": [
77
"CVE-2023-43000"
@@ -35,6 +35,10 @@
3535
"type": "WEB",
3636
"url": "https://support.apple.com/en-us/120338"
3737
},
38+
{
39+
"type": "WEB",
40+
"url": "https://support.apple.com/en-us/126632"
41+
},
3842
{
3943
"type": "WEB",
4044
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000"

‎advisories/unreviewed/2026/03/GHSA-45rr-9399-9pp6/GHSA-45rr-9399-9pp6.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-45rr-9399-9pp6",
4+
"modified": "2026-03-12T03:31:06Z",
5+
"published": "2026-03-12T03:31:06Z",
6+
"aliases": [
7+
"CVE-2026-3974"
8+
],
9+
"details": "A vulnerability was identified in Tenda W3 1.0.0.3(2204). This vulnerability affects the function formexeCommand of the file /goform/exeCommand of the component HTTP Handler. Such manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3974"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-w3-formexeCommand-cmdinput-buffer-overflow"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.350409"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.350409"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.769177"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-12T03:15:58Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-4v27-f65g-fr6x/GHSA-4v27-f65g-fr6x.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4v27-f65g-fr6x",
4+
"modified": "2026-03-12T03:31:05Z",
5+
"published": "2026-03-12T03:31:05Z",
6+
"aliases": [
7+
"CVE-2023-43010"
8+
],
9+
"details": "The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS 16.7.15, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43010"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://support.apple.com/en-us/120300"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://support.apple.com/en-us/120877"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://support.apple.com/en-us/120879"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://support.apple.com/en-us/126632"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://support.apple.com/en-us/126646"
36+
}
37+
],
38+
"database_specific": {
39+
"cwe_ids": [],
40+
"severity": null,
41+
"github_reviewed": false,
42+
"github_reviewed_at": null,
43+
"nvd_published_at": "2026-03-12T01:15:54Z"
44+
}
45+
}

‎advisories/unreviewed/2026/03/GHSA-6fmm-qmfj-8phm/GHSA-6fmm-qmfj-8phm.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6fmm-qmfj-8phm",
4+
"modified": "2026-03-12T03:31:06Z",
5+
"published": "2026-03-12T03:31:06Z",
6+
"aliases": [
7+
"CVE-2026-3226"
8+
],
9+
"details": "The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all 10 functions in the SendEmailAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check before dispatching to handler functions. The wp_rest nonce is embedded in the frontend JavaScript for all authenticated users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger arbitrary email notifications to admins, instructors, and users, enabling email flooding, social engineering, and impersonation of admin decisions regarding instructor requests.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3226"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.7/inc/Ajax/AbstractAjax.php#L17"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.7/inc/Ajax/SendEmailAjax.php#L40"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.7/inc/class-lp-assets.php#L123"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/changeset?old_path=/learnpress/tags/4.3.2.7/inc/Ajax/SendEmailAjax.php&new_path=/learnpress/tags/4.3.3/inc/Ajax/SendEmailAjax.php"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/520018db-d33b-4f2c-aaa5-611de792e11f?source=cve"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-862"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-12T03:15:57Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-6rfh-4m76-4764/GHSA-6rfh-4m76-4764.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6rfh-4m76-4764",
4+
"modified": "2026-03-12T03:31:06Z",
5+
"published": "2026-03-12T03:31:06Z",
6+
"aliases": [
7+
"CVE-2025-15038"
8+
],
9+
"details": "An Out-of-Bounds\nRead vulnerability exists in the ASUS Business System\nControl Interface driver. This vulnerability can be triggered by a unprivileged local user\nsending a specially crafted IOCTL  request, potentially leading\nto a disclosure of\nkernel information or a system crash. Refer to the \"Security Update for ASUS \nBusiness System Control Interface\" section on the ASUS Security Advisory for more information.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15038"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.asus.com/content/security-advisory"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-125"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-12T03:15:57Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-84xh-4ccm-v989/GHSA-84xh-4ccm-v989.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-84xh-4ccm-v989",
4+
"modified": "2026-03-12T03:31:06Z",
5+
"published": "2026-03-12T03:31:06Z",
6+
"aliases": [
7+
"CVE-2026-3970"
8+
],
9+
"details": "A flaw has been found in Tenda i3 1.0.0.6(2204). Affected is the function formwrlSSIDget of the file /goform/wifiSSIDget. Executing a manipulation of the argument index can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3970"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Svigo-o/Tenda_vul/tree/main/tenda-i3-formwrlSSIDget-index-buffer-overflow"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.350405"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.350405"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.768995"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-12T01:15:55Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-92rh-qgqp-3674/GHSA-92rh-qgqp-3674.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-92rh-qgqp-3674",
4+
"modified": "2026-03-12T03:31:06Z",
5+
"published": "2026-03-12T03:31:06Z",
6+
"aliases": [
7+
"CVE-2026-1878"
8+
],
9+
"details": "An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerability is due to improper access control on the installation directory, which enables the exploitation of a race condition where the legitimate installer is substituted with an unexpected payload immediately after download, resulting in arbitrary code execution. Refer to the \"Security Update for ASUS ROG peripheral driver\" section on the ASUS Security Advisory for more information.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1878"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.asus.com/security-advisory"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-494"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-12T03:15:57Z"
35+
}
36+
}

0 commit comments

Comments
 (0)