Skip to content

Commit 98eac91

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-g7mr-vm94-3rv7 GHSA-242m-692q-2xxx GHSA-2xxp-g6g6-xch7 GHSA-4fxw-3p35-q323 GHSA-4hx4-54fm-qc8q GHSA-6f87-4ph2-cp38 GHSA-fmvf-422w-w34q GHSA-gw5f-5fmc-2xp2 GHSA-p824-jmv3-c7rj GHSA-ppc7-gg9m-7hwq GHSA-q4m3-x4h7-c3c2 GHSA-q6m3-mcr7-qwwq GHSA-qw58-mhg6-q49h GHSA-wrr6-q4vw-3g77
1 parent f72c3f8 commit 98eac91

14 files changed

Lines changed: 345 additions & 16 deletions

File tree

‎advisories/unreviewed/2025/11/GHSA-g7mr-vm94-3rv7/GHSA-g7mr-vm94-3rv7.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-g7mr-vm94-3rv7",
4-
"modified": "2026-04-09T12:31:10Z",
4+
"modified": "2026-04-16T12:31:39Z",
55
"published": "2025-11-18T21:32:31Z",
66
"aliases": [
77
"CVE-2025-61662"
@@ -31,6 +31,10 @@
3131
"type": "WEB",
3232
"url": "https://access.redhat.com/security/cve/CVE-2025-61662"
3333
},
34+
{
35+
"type": "WEB",
36+
"url": "https://access.redhat.com/errata/RHSA-2026:7243"
37+
},
3438
{
3539
"type": "WEB",
3640
"url": "https://access.redhat.com/errata/RHSA-2026:6492"

‎advisories/unreviewed/2026/04/GHSA-242m-692q-2xxx/GHSA-242m-692q-2xxx.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-242m-692q-2xxx",
4+
"modified": "2026-04-16T12:31:42Z",
5+
"published": "2026-04-16T12:31:42Z",
6+
"aliases": [
7+
"CVE-2026-3369"
8+
],
9+
"details": "The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded image title in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3369"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3477632/real-time-auto-find-and-replace"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/497c2f5f-ed7d-486e-baf2-aefbe3dc412f?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-16T12:16:08Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-2xxp-g6g6-xch7/GHSA-2xxp-g6g6-xch7.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2xxp-g6g6-xch7",
4+
"modified": "2026-04-16T12:31:41Z",
5+
"published": "2026-04-16T12:31:41Z",
6+
"aliases": [
7+
"CVE-2024-4867"
8+
],
9+
"details": "The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser.\n\nBy leveraging this cross-site scripting vulnerability, a malicious actor can cause the browser to redirect to a malicious website, make changes to the UI of the web page, or retrieve information from the browser. However, session hijacking is not possible as all session-related sensitive cookies are protected by the httpOnly flag.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4867"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3391"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-16T10:16:13Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-4fxw-3p35-q323/GHSA-4fxw-3p35-q323.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4fxw-3p35-q323",
4+
"modified": "2026-04-16T12:31:41Z",
5+
"published": "2026-04-16T12:31:41Z",
6+
"aliases": [
7+
"CVE-2024-8010"
8+
],
9+
"details": "The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references.\n\nBy leveraging this vulnerability, a malicious actor can read confidential files from the product's file system or access limited HTTP resources reachable via HTTP GET requests to the vulnerable product.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8010"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3581"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-611"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-16T10:16:14Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-4hx4-54fm-qc8q/GHSA-4hx4-54fm-qc8q.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4hx4-54fm-qc8q",
4-
"modified": "2026-04-15T21:30:19Z",
4+
"modified": "2026-04-16T12:31:41Z",
55
"published": "2026-04-15T21:30:19Z",
66
"aliases": [
77
"CVE-2026-6319"
88
],
99
"details": "Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-416"
2934
],
30-
"severity": null,
35+
"severity": "HIGH",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2026-04-15T20:16:42Z"

‎advisories/unreviewed/2026/04/GHSA-6f87-4ph2-cp38/GHSA-6f87-4ph2-cp38.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6f87-4ph2-cp38",
4+
"modified": "2026-04-16T12:31:41Z",
5+
"published": "2026-04-16T12:31:41Z",
6+
"aliases": [
7+
"CVE-2024-10242"
8+
],
9+
"details": "The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to inject malicious script payloads into the input parameters, which are then executed by the victim's browser.\n\nSuccessful exploitation can enable an attacker to redirect the user's browser to a malicious website, modify the UI of the web page, or retrieve information from the browser. However, the impact is limited as session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10242"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3741"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-16T10:16:12Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-fmvf-422w-w34q/GHSA-fmvf-422w-w34q.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-fmvf-422w-w34q",
4-
"modified": "2026-04-15T21:30:19Z",
4+
"modified": "2026-04-16T12:31:40Z",
55
"published": "2026-04-15T21:30:19Z",
66
"aliases": [
77
"CVE-2026-6318"
88
],
99
"details": "Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-416"
2934
],
30-
"severity": null,
35+
"severity": "HIGH",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2026-04-15T20:16:42Z"

‎advisories/unreviewed/2026/04/GHSA-gw5f-5fmc-2xp2/GHSA-gw5f-5fmc-2xp2.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gw5f-5fmc-2xp2",
4+
"modified": "2026-04-16T12:31:41Z",
5+
"published": "2026-04-16T12:31:41Z",
6+
"aliases": [
7+
"CVE-2025-12624"
8+
],
9+
"details": "Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts.\n\nThe security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12624"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-613"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-16T11:16:26Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-p824-jmv3-c7rj/GHSA-p824-jmv3-c7rj.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-p824-jmv3-c7rj",
4-
"modified": "2026-04-15T21:30:19Z",
4+
"modified": "2026-04-16T12:31:40Z",
55
"published": "2026-04-15T21:30:19Z",
66
"aliases": [
77
"CVE-2026-6306"
88
],
99
"details": "Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-122"
2934
],
30-
"severity": null,
35+
"severity": "HIGH",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2026-04-15T20:16:39Z"

‎advisories/unreviewed/2026/04/GHSA-ppc7-gg9m-7hwq/GHSA-ppc7-gg9m-7hwq.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ppc7-gg9m-7hwq",
4+
"modified": "2026-04-16T12:31:41Z",
5+
"published": "2026-04-16T12:31:41Z",
6+
"aliases": [
7+
"CVE-2025-6024"
8+
],
9+
"details": "The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.\nAn attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6024"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-16T10:16:14Z"
35+
}
36+
}

0 commit comments

Comments
 (0)