Skip to content

Commit a0d52b4

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2mvx-f5qm-v2ch GHSA-cw73-5f7h-m4gv GHSA-hv5g-26jg-pc45 GHSA-j452-xhg8-qg39 GHSA-wg6q-6289-32hp GHSA-wg6q-6289-32hp
1 parent 27a53ed commit a0d52b4

File tree

6 files changed

+326
-49
lines changed

6 files changed

+326
-49
lines changed

‎advisories/github-reviewed/2026/04/GHSA-2mvx-f5qm-v2ch/GHSA-2mvx-f5qm-v2ch.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2mvx-f5qm-v2ch",
4+
"modified": "2026-04-16T21:34:40Z",
5+
"published": "2026-04-16T21:34:40Z",
6+
"aliases": [
7+
"CVE-2026-40308"
8+
],
9+
"summary": "Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar",
10+
"details": "### Summary\n\nAn unauthenticated Insecure Direct Object Reference (IDOR) and Denial of Service (DoS) vulnerability in the My Calendar plugin allows any unauthenticated user to extract calendar events (including private or hidden ones) from any sub-site on a WordPress Multisite network. On standard Single Site WordPress installations, this same endpoint crashes the PHP worker thread, creating an unauthenticated Denial of Service (DoS) vector.\n\n### Details\n\nThe vulnerability stems from the `mc_ajax_mcjs_action AJAX` function, which handles the `mcjs_action` endpoint. This endpoint is explicitly registered for unauthenticated users:\n```php\n<?php\n// In my-calendar-ajax.php\nadd_action( 'wp_ajax_nopriv_mcjs_action', 'mc_ajax_mcjs_action' );\n```\n\nWhen the behavior parameter is set to loadupcoming, the plugin accepts an args parameter from the $_REQUEST array. Instead of validating specific expected arguments, the plugin unsafely passes the entire string into PHP's parse_str() function:\n```php\n<?php\n$request = isset( $_REQUEST['args'] ) ? wp_unslash( sanitize_text_field( $_REQUEST['args'] ) ) : array();\n$request = str_replace( '|', '&', $request );\n$request = parse_str( $request, $args );\n// ...\n$response = my_calendar_upcoming_events( $args );\n```\n\nThis allows an attacker to inject arbitrary key-value pairs into the $args array. This array is then passed to the my_calendar_upcoming_events() function located in my-calendar-widgets.php.\n\nAt the beginning of this function, the plugin processes the attacker-controlled site argument:\n```php\n<?php\n// In my-calendar-widgets.php\nif ( $args['site'] ) {\n $args['site'] = ( 'global' === $args['site'] ) ? BLOG_ID_CURRENT_SITE : $args['site'];\n switch_to_blog( $args['site'] );\n}\n```\nThe plugin blindly passes the attacker's supplied site ID into WordPress core's `switch_to_blog()` function without checking if the requesting user has the appropriate network-level privileges (e.g., Super Admin).\n\nOn Multisite configurations, the database context switches to the targeted sub-site, queries its events, and returns the HTML-rendered events array in the JSON response, leading to Information Disclosure across tenant boundaries.\nOn Single Site configurations, the switch_to_blog() function does not exist in WordPress core. Calling it triggers an Uncaught PHP Error (Call to undefined function switch_to_blog()), resulting in a 500 Internal Server error (\"Critical Error\"). Repeated requests to this unauthenticated endpoint easily exhaust server resources.\n\n### PoC\n\n## 1. Multisite Information Disclosure - IDOR\n```\ncurl -s \"http://<target-domain>/wp-admin/admin-ajax.php?action=mcjs_action&behavior=loadupcoming&args=site=2\"\n```\n\n## 2. Single Site Denial of Service (DoS)\nIf the WordPress instance is not a Multisite, passing any truthy value to the site parameter will instantly crash the request thread:\n```\ncurl -i -s \"http://<target-domain>/wp-admin/admin-ajax.php?action=mcjs_action&behavior=loadupcoming&args=site=1\"\n```\n\n### Impact\n\n**Vulnerability Type**: Insecure Direct Object Reference (IDOR) / Information Exposure / Denial of Service (DoS)\n**Who is impacted**: All sites running the \"My Calendar\" plugin.\n\nAnonymous internet users can silently map the network and extract private, unpublished, or intranet-specific events from unlaunched/internal sub-sites.\nStandard Single Site users are vulnerable to an easy-to-execute application-layer DoS, as it costs an attacker negligible resources to constantly crash PHP worker threads at an unauthenticated endpoint.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "joedolson/my-calendar"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.7.7"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/joedolson/my-calendar"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-639"
51+
],
52+
"severity": "HIGH",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-04-16T21:34:40Z",
55+
"nvd_published_at": null
56+
}
57+
}

advisories/unreviewed/2026/04/GHSA-cw73-5f7h-m4gv/GHSA-cw73-5f7h-m4gv.json renamed to advisories/github-reviewed/2026/04/GHSA-cw73-5f7h-m4gv/GHSA-cw73-5f7h-m4gv.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cw73-5f7h-m4gv",
4-
"modified": "2026-04-16T15:31:32Z",
4+
"modified": "2026-04-16T21:33:09Z",
55
"published": "2026-04-15T18:31:57Z",
66
"aliases": [
77
"CVE-2026-30625"
88
],
9+
"summary": "Upsonic: remote code execution vulnerability in its MCP server/task creation functionality",
910
"details": "Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist exists, certain allowed commands (npm, npx) accept argument flags that enable execution of arbitrary OS commands. Maliciously crafted MCP tasks may lead to remote code execution with the privileges of the Upsonic process. In version 0.72.0 Upsonic added a warning about using Stdio servers being able to execute commands directly on the machine.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "upsonic"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.72.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,10 @@
2344
"type": "WEB",
2445
"url": "https://github.com/Upsonic/Upsonic/commit/855053fce0662227d9246268ff4a0844b481a305"
2546
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/Upsonic/Upsonic"
50+
},
2651
{
2752
"type": "WEB",
2853
"url": "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem"
@@ -33,8 +58,8 @@
3358
"CWE-77"
3459
],
3560
"severity": "CRITICAL",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-04-16T21:33:09Z",
3863
"nvd_published_at": "2026-04-15T16:16:36Z"
3964
}
4065
}

advisories/unreviewed/2026/04/GHSA-hv5g-26jg-pc45/GHSA-hv5g-26jg-pc45.json renamed to advisories/github-reviewed/2026/04/GHSA-hv5g-26jg-pc45/GHSA-hv5g-26jg-pc45.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hv5g-26jg-pc45",
4-
"modified": "2026-04-15T18:31:58Z",
4+
"modified": "2026-04-16T21:33:30Z",
55
"published": "2026-04-15T18:31:58Z",
66
"aliases": [
77
"CVE-2026-6290"
88
],
9+
"summary": "Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token",
910
"details": "Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are\nthe same as the permissions they have in the org containing the notebook.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "www.velocidex.com/golang/velociraptor"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.76.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -22,15 +43,19 @@
2243
{
2344
"type": "WEB",
2445
"url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-6290"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/Velocidex/velociraptor"
2550
}
2651
],
2752
"database_specific": {
2853
"cwe_ids": [
2954
"CWE-863"
3055
],
3156
"severity": "HIGH",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-04-16T21:33:30Z",
3459
"nvd_published_at": "2026-04-15T18:17:25Z"
3560
}
3661
}

advisories/unreviewed/2026/04/GHSA-j452-xhg8-qg39/GHSA-j452-xhg8-qg39.json renamed to advisories/github-reviewed/2026/04/GHSA-j452-xhg8-qg39/GHSA-j452-xhg8-qg39.json

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j452-xhg8-qg39",
4-
"modified": "2026-04-15T21:30:17Z",
4+
"modified": "2026-04-16T21:33:53Z",
55
"published": "2026-04-15T18:31:58Z",
66
"aliases": [
77
"CVE-2026-5758"
88
],
9+
"summary": "Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution",
910
"details": "JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "protocol-buffers-schema"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.6.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,16 +44,22 @@
2344
"type": "WEB",
2445
"url": "https://github.com/mafintosh/protocol-buffers-schema/pull/70"
2546
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/mafintosh/protocol-buffers-schema"
50+
},
2651
{
2752
"type": "WEB",
2853
"url": "https://morielharush.github.io/2026/04/12/cve-2026-5758-protocol-buffers-schema-prototype-pollution"
2954
}
3055
],
3156
"database_specific": {
32-
"cwe_ids": [],
57+
"cwe_ids": [
58+
"CWE-1321"
59+
],
3360
"severity": "MODERATE",
34-
"github_reviewed": false,
35-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-04-16T21:33:53Z",
3663
"nvd_published_at": "2026-04-15T18:17:24Z"
3764
}
3865
}

0 commit comments

Comments
 (0)