Skip to content

Commit ad959ab

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent f09acfb commit ad959ab

58 files changed

Lines changed: 604 additions & 90 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2021/12/GHSA-xqxh-cq77-r6qh/GHSA-xqxh-cq77-r6qh.json‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,28 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xqxh-cq77-r6qh",
4-
"modified": "2021-12-23T00:01:42Z",
4+
"modified": "2026-03-09T15:30:31Z",
55
"published": "2021-12-18T00:00:51Z",
66
"aliases": [
77
"CVE-2021-22054"
88
],
99
"details": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
1419
"type": "ADVISORY",
1520
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22054"
1621
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.greynoise.io/blog/new-ssrf-exploitation-surge"
25+
},
1726
{
1827
"type": "WEB",
1928
"url": "https://www.vmware.com/security/advisories/VMSA-2021-0029.html"

‎advisories/unreviewed/2026/01/GHSA-5hf5-c2h8-jm8p/GHSA-5hf5-c2h8-jm8p.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5hf5-c2h8-jm8p",
4-
"modified": "2026-01-29T12:30:25Z",
4+
"modified": "2026-03-09T15:30:32Z",
55
"published": "2026-01-29T12:30:25Z",
66
"aliases": [
77
"CVE-2025-7015"

‎advisories/unreviewed/2026/01/GHSA-8p85-wwv8-94x9/GHSA-8p85-wwv8-94x9.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8p85-wwv8-94x9",
4-
"modified": "2026-01-29T15:30:27Z",
4+
"modified": "2026-03-09T15:30:32Z",
55
"published": "2026-01-29T15:30:27Z",
66
"aliases": [
77
"CVE-2025-7013"

‎advisories/unreviewed/2026/01/GHSA-97vc-35gm-9r7r/GHSA-97vc-35gm-9r7r.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-97vc-35gm-9r7r",
4-
"modified": "2026-01-29T12:30:25Z",
4+
"modified": "2026-03-09T15:30:32Z",
55
"published": "2026-01-29T12:30:25Z",
66
"aliases": [
77
"CVE-2026-1469"
88
],
99
"details": "Stored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload through the ‘comment’ and ‘brand’ parameters in ‘/index.php’. The payload is stored by the application and subsequently displayed without proper sanitization when other users access it. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/01/GHSA-fw4r-9q4w-pxx8/GHSA-fw4r-9q4w-pxx8.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-fw4r-9q4w-pxx8",
4-
"modified": "2026-01-28T21:31:23Z",
4+
"modified": "2026-03-09T15:30:32Z",
55
"published": "2026-01-28T21:31:23Z",
66
"aliases": [
77
"CVE-2026-0749"
88
],
99
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Form Builder allows Cross-Site Scripting (XSS).This issue affects Drupal: from 7.X-1.0 through 7.X-1.22.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/01/GHSA-gq6h-g93p-6wqx/GHSA-gq6h-g93p-6wqx.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gq6h-g93p-6wqx",
4-
"modified": "2026-01-09T18:31:36Z",
4+
"modified": "2026-03-09T15:30:31Z",
55
"published": "2026-01-09T18:31:36Z",
66
"aliases": [
77
"CVE-2025-15035"
88
],
99
"details": "Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbitrary server file, leading to possible loss of critical system files and service interruption or degraded functionality.This issue affects Archer AXE75 v1.6: ≤ build 20250107.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/01/GHSA-mwhx-x3mr-hv49/GHSA-mwhx-x3mr-hv49.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mwhx-x3mr-hv49",
4-
"modified": "2026-01-29T15:30:27Z",
4+
"modified": "2026-03-09T15:30:32Z",
55
"published": "2026-01-29T15:30:27Z",
66
"aliases": [
77
"CVE-2025-7014"

‎advisories/unreviewed/2026/01/GHSA-mxrg-rhmf-2mjf/GHSA-mxrg-rhmf-2mjf.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mxrg-rhmf-2mjf",
4-
"modified": "2026-01-28T21:31:23Z",
4+
"modified": "2026-03-09T15:30:32Z",
55
"published": "2026-01-28T21:31:23Z",
66
"aliases": [
77
"CVE-2026-0750"
88
],
99
"details": "Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This issue affects Drupal Commerce Paybox: from 7-x-1.0 through 7.X-1.5.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/01/GHSA-rgqc-2558-hgcm/GHSA-rgqc-2558-hgcm.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rgqc-2558-hgcm",
4-
"modified": "2026-01-29T12:30:25Z",
4+
"modified": "2026-03-09T15:30:32Z",
55
"published": "2026-01-29T12:30:25Z",
66
"aliases": [
77
"CVE-2025-7016"

‎advisories/unreviewed/2026/01/GHSA-wgr9-gc72-49xj/GHSA-wgr9-gc72-49xj.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wgr9-gc72-49xj",
4-
"modified": "2026-01-27T03:31:33Z",
4+
"modified": "2026-03-09T15:30:31Z",
55
"published": "2026-01-26T21:30:36Z",
66
"aliases": [
77
"CVE-2025-14756"
88
],
99
"details": "Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a limited character length via crafted input in the browser developer console, possibly leading to service disruption or full compromise.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

0 commit comments

Comments
 (0)