Skip to content

Commit b8b97a1

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent be30634 commit b8b97a1

133 files changed

Lines changed: 3410 additions & 62 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/01/GHSA-82cg-rxq8-hc7m/GHSA-82cg-rxq8-hc7m.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-82cg-rxq8-hc7m",
4-
"modified": "2026-01-29T09:31:49Z",
4+
"modified": "2026-02-11T21:30:29Z",
55
"published": "2026-01-29T09:31:49Z",
66
"aliases": [
77
"CVE-2026-23563"

‎advisories/unreviewed/2026/02/GHSA-238q-xh37-pmhj/GHSA-238q-xh37-pmhj.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-238q-xh37-pmhj",
4+
"modified": "2026-02-11T21:30:40Z",
5+
"published": "2026-02-11T21:30:40Z",
6+
"aliases": [
7+
"CVE-2024-26477"
8+
],
9+
"details": "An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazon_sns, export endpoints.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26477"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/Ev3rR3d/Statping_Poc"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/Ev3rR3d/Statping_Poc/tree/main/CVE-2024-26477"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://github.com/statping-ng/statping-ng"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://statping-ng.github.io"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2026-02-11T20:16:05Z"
40+
}
41+
}

‎advisories/unreviewed/2026/02/GHSA-28wx-v484-3qch/GHSA-28wx-v484-3qch.json‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-28wx-v484-3qch",
4-
"modified": "2026-02-08T15:30:58Z",
4+
"modified": "2026-02-11T21:30:35Z",
55
"published": "2026-02-08T15:30:58Z",
66
"aliases": [
77
"CVE-2026-2152"
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-77"
49+
"CWE-77",
50+
"CWE-78"
5051
],
5152
"severity": "HIGH",
5253
"github_reviewed": false,

‎advisories/unreviewed/2026/02/GHSA-2ffm-9xhq-mwc8/GHSA-2ffm-9xhq-mwc8.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2ffm-9xhq-mwc8",
4+
"modified": "2026-02-11T21:30:42Z",
5+
"published": "2026-02-11T21:30:42Z",
6+
"aliases": [
7+
"CVE-2020-37210"
8+
],
9+
"details": "SpotIE 2.9.5 contains a denial of service vulnerability in the registration key input that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Key' field to trigger an application crash.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37210"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/47855"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/spotie-key-denial-of-service"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "http://www.nsauditor.com"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-120"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-11T21:16:16Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-2g4f-4pwh-qvx6/GHSA-2g4f-4pwh-qvx6.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2g4f-4pwh-qvx6",
4+
"modified": "2026-02-11T21:30:39Z",
5+
"published": "2026-02-11T21:30:39Z",
6+
"aliases": [
7+
"CVE-2025-69873"
8+
],
9+
"details": "ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69873"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-02-11T19:15:50Z"
28+
}
29+
}

‎advisories/unreviewed/2026/02/GHSA-2prw-jcj2-h5xf/GHSA-2prw-jcj2-h5xf.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2prw-jcj2-h5xf",
4+
"modified": "2026-02-11T21:30:40Z",
5+
"published": "2026-02-11T21:30:39Z",
6+
"aliases": [
7+
"CVE-2026-2318"
8+
],
9+
"details": "Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2318"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_10.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/363930141"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-02-11T19:15:51Z"
32+
}
33+
}

‎advisories/unreviewed/2026/02/GHSA-32vw-wgfh-pxr5/GHSA-32vw-wgfh-pxr5.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-32vw-wgfh-pxr5",
4-
"modified": "2026-02-03T21:31:51Z",
4+
"modified": "2026-02-11T21:30:33Z",
55
"published": "2026-02-03T21:31:51Z",
66
"aliases": [
77
"CVE-2025-62501"
88
],
99
"details": "SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credentials are reused.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/02/GHSA-349p-7f27-qvx8/GHSA-349p-7f27-qvx8.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-349p-7f27-qvx8",
4+
"modified": "2026-02-11T21:30:40Z",
5+
"published": "2026-02-11T21:30:40Z",
6+
"aliases": [
7+
"CVE-2020-37173"
8+
],
9+
"details": "AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37173"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://avideo.com"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/WWBN/AVideo"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.exploit-db.com/exploits/47997"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.vulncheck.com/advisories/avideo-platform-information-disclosure-user-enumeration"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-359"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-11T21:16:10Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-34wv-c7h9-3524/GHSA-34wv-c7h9-3524.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-34wv-c7h9-3524",
4+
"modified": "2026-02-11T21:30:42Z",
5+
"published": "2026-02-11T21:30:42Z",
6+
"aliases": [
7+
"CVE-2020-37212"
8+
],
9+
"details": "SpotMSN 2.4.6 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character payload and paste it into the 'Name' field to trigger an application crash.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37212"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/47869"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/spotmsn-name-denial-of-service"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "http://www.nsauditor.com"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-120"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-11T21:16:16Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-35f2-992w-gmjg/GHSA-35f2-992w-gmjg.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-35f2-992w-gmjg",
4+
"modified": "2026-02-11T21:30:42Z",
5+
"published": "2026-02-11T21:30:42Z",
6+
"aliases": [
7+
"CVE-2020-37208"
8+
],
9+
"details": "SpotFTP 3.0.0.0 contains a buffer overflow vulnerability in the registration key input field that allows attackers to crash the application. Attackers can generate a 1000-character payload and paste it into the 'Key' field to trigger an application crash and denial of service.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37208"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/47849"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/spotftp-ftp-password-recovery-key-denial-of-service"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "http://www.nsauditor.com"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-787"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-11T21:16:16Z"
47+
}
48+
}

0 commit comments

Comments
 (0)