Skip to content

Commit 8f637c7

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5m2g-4cf6-c3rg GHSA-8hhx-xq9j-xwfj GHSA-fmr2-m7gc-577w GHSA-vj55-4r38-w2gh GHSA-xfqp-wv94-qg88 GHSA-3g96-v3mg-9xp9 GHSA-65m8-95c4-38hm GHSA-6v6h-v95w-6g6x GHSA-77v4-gvxh-3ccf GHSA-839v-3vpr-fpgf GHSA-8p92-v8gg-gvcv GHSA-9284-m2hp-cfp4 GHSA-g8p2-q5wh-ppx2 GHSA-j28w-j889-vwc6 GHSA-jm25-jfc5-xhx6 GHSA-vq69-qj8j-4r8j GHSA-wc4c-6r77-mp37 GHSA-wqx8-r5jg-36w6 GHSA-xp3g-cfwm-4q5h
1 parent 34c98b4 commit 8f637c7

19 files changed

Lines changed: 375 additions & 37 deletions

File tree

advisories/unreviewed/2026/02/GHSA-5m2g-4cf6-c3rg/GHSA-5m2g-4cf6-c3rg.json renamed to advisories/github-reviewed/2026/02/GHSA-5m2g-4cf6-c3rg/GHSA-5m2g-4cf6-c3rg.json

Lines changed: 28 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5m2g-4cf6-c3rg",
4-
"modified": "2026-02-22T00:31:01Z",
4+
"modified": "2026-02-26T15:31:55Z",
55
"published": "2026-02-22T00:31:01Z",
66
"aliases": [
77
"CVE-2026-2896"
88
],
9+
"summary": "funadmin has Incorrect Privilege Assignment in its Configuration Handler",
910
"details": "A weakness has been identified in funadmin up to 7.1.0-rc4. This affects the function setConfig of the file app/backend/controller/Ajax.php of the component Configuration Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "Packagist",
25+
"name": "funadmin/funadmin"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"last_affected": "7.1.0-rc4"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -28,8 +49,8 @@
2849
"url": "https://github.com/I4m6da/CVE/issues/3"
2950
},
3051
{
31-
"type": "WEB",
32-
"url": "https://github.com/I4m6da/CVE/issues/3#issue-3884949083"
52+
"type": "PACKAGE",
53+
"url": "https://github.com/funadmin/funadmin"
3354
},
3455
{
3556
"type": "WEB",
@@ -49,8 +70,8 @@
4970
"CWE-266"
5071
],
5172
"severity": "MODERATE",
52-
"github_reviewed": false,
53-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-02-26T15:31:55Z",
5475
"nvd_published_at": "2026-02-22T00:15:59Z"
5576
}
5677
}

advisories/unreviewed/2026/02/GHSA-8hhx-xq9j-xwfj/GHSA-8hhx-xq9j-xwfj.json renamed to advisories/github-reviewed/2026/02/GHSA-8hhx-xq9j-xwfj/GHSA-8hhx-xq9j-xwfj.json

Lines changed: 28 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8hhx-xq9j-xwfj",
4-
"modified": "2026-02-22T00:31:01Z",
4+
"modified": "2026-02-26T15:31:24Z",
55
"published": "2026-02-22T00:31:01Z",
66
"aliases": [
77
"CVE-2026-2894"
88
],
9+
"summary": "funadmin exposes sensitive information via getMember function",
910
"details": "A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget.html. Such manipulation leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "Packagist",
25+
"name": "funadmin/funadmin"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"last_affected": "7.1.0-rc4"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -28,8 +49,8 @@
2849
"url": "https://github.com/I4m6da/CVE/issues/1"
2950
},
3051
{
31-
"type": "WEB",
32-
"url": "https://github.com/I4m6da/CVE/issues/1#issue-3884896592"
52+
"type": "PACKAGE",
53+
"url": "https://github.com/funadmin/funadmin"
3354
},
3455
{
3556
"type": "WEB",
@@ -49,8 +70,8 @@
4970
"CWE-200"
5071
],
5172
"severity": "MODERATE",
52-
"github_reviewed": false,
53-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-02-26T15:31:24Z",
5475
"nvd_published_at": "2026-02-21T23:15:59Z"
5576
}
5677
}

advisories/unreviewed/2026/02/GHSA-fmr2-m7gc-577w/GHSA-fmr2-m7gc-577w.json renamed to advisories/github-reviewed/2026/02/GHSA-fmr2-m7gc-577w/GHSA-fmr2-m7gc-577w.json

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-fmr2-m7gc-577w",
4-
"modified": "2026-02-22T00:31:01Z",
4+
"modified": "2026-02-26T15:31:41Z",
55
"published": "2026-02-22T00:31:01Z",
66
"aliases": [
77
"CVE-2026-2895"
88
],
9+
"summary": "funadmin has Weak Password Recovery Mechanism for Forgotten Password",
910
"details": "A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "Packagist",
25+
"name": "funadmin/funadmin"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"last_affected": "7.1.0-rc4"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -28,8 +49,8 @@
2849
"url": "https://github.com/I4m6da/CVE/issues/2"
2950
},
3051
{
31-
"type": "WEB",
32-
"url": "https://github.com/I4m6da/CVE/issues/2#issue-3884919985"
52+
"type": "PACKAGE",
53+
"url": "https://github.com/funadmin/funadmin"
3354
},
3455
{
3556
"type": "WEB",
@@ -48,9 +69,9 @@
4869
"cwe_ids": [
4970
"CWE-640"
5071
],
51-
"severity": "MODERATE",
52-
"github_reviewed": false,
53-
"github_reviewed_at": null,
72+
"severity": "LOW",
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-02-26T15:31:41Z",
5475
"nvd_published_at": "2026-02-21T23:15:59Z"
5576
}
5677
}

‎advisories/unreviewed/2023/12/GHSA-vj55-4r38-w2gh/GHSA-vj55-4r38-w2gh.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vj55-4r38-w2gh",
4-
"modified": "2025-10-22T00:32:57Z",
4+
"modified": "2026-02-26T15:30:29Z",
55
"published": "2023-12-08T18:30:42Z",
66
"aliases": [
77
"CVE-2023-47565"

‎advisories/unreviewed/2026/01/GHSA-xfqp-wv94-qg88/GHSA-xfqp-wv94-qg88.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xfqp-wv94-qg88",
4-
"modified": "2026-01-22T18:30:31Z",
4+
"modified": "2026-02-26T15:30:29Z",
55
"published": "2026-01-22T18:30:31Z",
66
"aliases": [
77
"CVE-2025-36588"
@@ -22,6 +22,10 @@
2222
{
2323
"type": "WEB",
2424
"url": "https://www.dell.com/support/kbdoc/en-us/000402262/dsa-2025-425-dell-powermaxos-dell-powermax-eem-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-unisphere-360-dell-solutions-enabler-virtual-appliance-security-update-for-multiple-vulnerabilities"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.dell.com/support/kbdoc/en-us/000429268/dsa-2026-102-dell-unisphere-for-powermax-and-powermax-eem-security-update-for-multiple-vulnerabilities"
2529
}
2630
],
2731
"database_specific": {

‎advisories/unreviewed/2026/02/GHSA-3g96-v3mg-9xp9/GHSA-3g96-v3mg-9xp9.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@
3030
],
3131
"database_specific": {
3232
"cwe_ids": [
33-
"CWE-1325"
33+
"CWE-1325",
34+
"CWE-770"
3435
],
3536
"severity": "MODERATE",
3637
"github_reviewed": false,

‎advisories/unreviewed/2026/02/GHSA-65m8-95c4-38hm/GHSA-65m8-95c4-38hm.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-65m8-95c4-38hm",
4+
"modified": "2026-02-26T15:30:31Z",
5+
"published": "2026-02-26T15:30:30Z",
6+
"aliases": [
7+
"CVE-2026-2244"
8+
],
9+
"details": "A vulnerability in Google Cloud Vertex AI Workbench from 7/21/2025 to 01/30/2026 allows an attacker to exfiltrate valid Google Cloud access tokens of other users via abuse of a built-in startup script.\n\nAll instances after January 30th, 2026 have been patched to protect from this vulnerability. No user action is required for this.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2244"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://docs.cloud.google.com/vertex-ai/docs/workbench/release-notes#February_20_2026"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-200"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-26T15:17:45Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-6v6h-v95w-6g6x/GHSA-6v6h-v95w-6g6x.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6v6h-v95w-6g6x",
4+
"modified": "2026-02-26T15:30:30Z",
5+
"published": "2026-02-26T15:30:30Z",
6+
"aliases": [
7+
"CVE-2026-3071"
8+
],
9+
"details": "Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code execution when loading a malicious model.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3071"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.hiddenlayer.com/sai-security-advisory/2026-02-flair"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-502"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-26T15:17:48Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-77v4-gvxh-3ccf/GHSA-77v4-gvxh-3ccf.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-77v4-gvxh-3ccf",
4-
"modified": "2026-02-26T09:30:27Z",
4+
"modified": "2026-02-26T15:30:30Z",
55
"published": "2026-02-26T09:30:27Z",
66
"aliases": [
77
"CVE-2026-28132"
88
],
99
"details": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews allows Code Injection.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.4.4.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-80"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-02-26T09:16:15Z"

‎advisories/unreviewed/2026/02/GHSA-839v-3vpr-fpgf/GHSA-839v-3vpr-fpgf.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,9 @@
4141
}
4242
],
4343
"database_specific": {
44-
"cwe_ids": [],
44+
"cwe_ids": [
45+
"CWE-269"
46+
],
4547
"severity": "CRITICAL",
4648
"github_reviewed": false,
4749
"github_reviewed_at": null,

0 commit comments

Comments
 (0)