Skip to content

Commit c11875b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-f8fx-v7gq-23j6 GHSA-22w8-2mrr-vh7h GHSA-2gq9-pvgx-5r3p GHSA-42fj-xxgc-m676 GHSA-6w48-2g9j-v9q5 GHSA-74cf-pgh9-m5q2 GHSA-9r5j-7r2x-rv4g GHSA-9rgr-9qh8-m839 GHSA-f3jc-x246-gfjr GHSA-hjq4-x3rq-hvhc GHSA-jhpx-cpvq-8cwm GHSA-m67m-4jp2-2c59 GHSA-qfr8-p287-9w92 GHSA-qvjf-2rj3-8wrg GHSA-qx99-h65p-8xpj GHSA-rv5f-ccpm-xjj4 GHSA-vpcc-r2qv-r2q4 GHSA-wpxg-vxg7-5xm5
1 parent 9ffa092 commit c11875b

File tree

18 files changed

+642
-3
lines changed

18 files changed

+642
-3
lines changed

‎advisories/unreviewed/2026/02/GHSA-f8fx-v7gq-23j6/GHSA-f8fx-v7gq-23j6.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f8fx-v7gq-23j6",
4-
"modified": "2026-02-09T12:30:22Z",
4+
"modified": "2026-03-09T12:31:38Z",
55
"published": "2026-02-09T12:30:22Z",
66
"aliases": [
77
"CVE-2025-10463"

‎advisories/unreviewed/2026/03/GHSA-22w8-2mrr-vh7h/GHSA-22w8-2mrr-vh7h.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-22w8-2mrr-vh7h",
4+
"modified": "2026-03-09T12:31:39Z",
5+
"published": "2026-03-09T12:31:39Z",
6+
"aliases": [
7+
"CVE-2026-3816"
8+
],
9+
"details": "A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.56.0 is able to resolve this issue. The identifier of the patch is e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Upgrading the affected component is recommended.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3816"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/DefectDojo/django-DefectDojo/pull/14408"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/DefectDojo/django-DefectDojo/commit/e8f1e5131535b8fd80a7b1b3085d676295fdcd41"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.56.0"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfdj_zip_bomb_dos_oom.md"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfdj_zip_bomb_dos_oom.md#supporting-materialreferences"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?ctiid.349782"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?id.349782"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/?submit.769524"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-404"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": false,
65+
"github_reviewed_at": null,
66+
"nvd_published_at": "2026-03-09T11:16:06Z"
67+
}
68+
}

‎advisories/unreviewed/2026/03/GHSA-2gq9-pvgx-5r3p/GHSA-2gq9-pvgx-5r3p.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2gq9-pvgx-5r3p",
4+
"modified": "2026-03-09T12:31:38Z",
5+
"published": "2026-03-09T12:31:38Z",
6+
"aliases": [
7+
"CVE-2025-33022"
8+
],
9+
"details": "Rejected reason: The reporter agreed to not assign CVE ID",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33022"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-03-09T10:15:59Z"
24+
}
25+
}

‎advisories/unreviewed/2026/03/GHSA-42fj-xxgc-m676/GHSA-42fj-xxgc-m676.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-42fj-xxgc-m676",
4+
"modified": "2026-03-09T12:31:39Z",
5+
"published": "2026-03-09T12:31:39Z",
6+
"aliases": [
7+
"CVE-2025-15576"
8+
],
9+
"details": "If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may nonetheless be able to access a shared directory via a nullfs mount, if the administrator has configured one.\n\nIn this case, cooperating processes in the two jails may establish a connection using a unix domain socket and exchange directory descriptors with each other.\n\nWhen performing a filesystem name lookup, at each step of the lookup, the kernel checks whether the lookup would descend below the jail root of the current process. If the jail root directory is not encountered, the lookup continues.\n\nIn a configuration where processes in two different jails are able to exchange file descriptors using a unix domain socket, it is possible for a jailed process to receive a directory for a descriptor that is below that process' jail root. This enables full filesystem access for a jailed process, breaking the chroot.\n\nNote that the system administrator is still responsible for ensuring that an unprivileged user on the jail host is not able to pass directory descriptors to a jailed process, even in a patched kernel.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15576"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:04.jail.asc"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-269"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-03-09T12:16:11Z"
30+
}
31+
}

‎advisories/unreviewed/2026/03/GHSA-6w48-2g9j-v9q5/GHSA-6w48-2g9j-v9q5.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6w48-2g9j-v9q5",
4-
"modified": "2026-03-09T09:30:31Z",
4+
"modified": "2026-03-09T12:31:38Z",
55
"published": "2026-03-09T09:30:31Z",
66
"aliases": [
77
"CVE-2026-24713"
@@ -17,6 +17,10 @@
1717
{
1818
"type": "WEB",
1919
"url": "https://lists.apache.org/thread/vopgv6y2ccw403b0zv7rvojjrh7x1j5p"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://www.openwall.com/lists/oss-security/2026/03/09/4"
2024
}
2125
],
2226
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-74cf-pgh9-m5q2/GHSA-74cf-pgh9-m5q2.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-74cf-pgh9-m5q2",
4-
"modified": "2026-03-09T09:30:31Z",
4+
"modified": "2026-03-09T12:31:38Z",
55
"published": "2026-03-09T09:30:31Z",
66
"aliases": [
77
"CVE-2026-24015"
@@ -17,6 +17,10 @@
1717
{
1818
"type": "WEB",
1919
"url": "https://lists.apache.org/thread/j769ywdqm46zl3oz5lbffsldklg0ow7p"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://www.openwall.com/lists/oss-security/2026/03/09/5"
2024
}
2125
],
2226
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-9r5j-7r2x-rv4g/GHSA-9r5j-7r2x-rv4g.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9r5j-7r2x-rv4g",
4+
"modified": "2026-03-09T12:31:39Z",
5+
"published": "2026-03-09T12:31:38Z",
6+
"aliases": [
7+
"CVE-2025-69219"
8+
],
9+
"details": "A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low.\n\nYou should upgrade to version 6.0.0 of the provider to avoid even that risk.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69219"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/apache/airflow/pull/61662"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "http://www.openwall.com/lists/oss-security/2026/03/09/1"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [
32+
"CWE-913"
33+
],
34+
"severity": null,
35+
"github_reviewed": false,
36+
"github_reviewed_at": null,
37+
"nvd_published_at": "2026-03-09T11:16:05Z"
38+
}
39+
}

‎advisories/unreviewed/2026/03/GHSA-9rgr-9qh8-m839/GHSA-9rgr-9qh8-m839.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9rgr-9qh8-m839",
4+
"modified": "2026-03-09T12:31:39Z",
5+
"published": "2026-03-09T12:31:38Z",
6+
"aliases": [
7+
"CVE-2026-3814"
8+
],
9+
"details": "A security flaw has been discovered in UTT HiPER 810G up to 1.7.7-1711. Affected by this issue is the function strcpy of the file /goform/getOneApConfTempEntry. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3814"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/whoami648/cve/blob/main/vul/9.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349780"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349780"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.769163"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-119"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-09T10:16:03Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-f3jc-x246-gfjr/GHSA-f3jc-x246-gfjr.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f3jc-x246-gfjr",
4+
"modified": "2026-03-09T12:31:38Z",
5+
"published": "2026-03-09T12:31:38Z",
6+
"aliases": [
7+
"CVE-2026-3813"
8+
],
9+
"details": "A vulnerability was identified in opencc JFlow up to 5badc00db382d7cb82dad231e6a866b18e0addfe. Affected by this vulnerability is the function Calculate of the file src/main/java/bp/wf/httphandler/WF_CCForm.java. Such manipulation leads to injection. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3813"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gitee.com/opencc/JFlow"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gitee.com/opencc/JFlow/issues/IE8R2F"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.349779"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.349779"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.769112"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-09T10:16:03Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-hjq4-x3rq-hvhc/GHSA-hjq4-x3rq-hvhc.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hjq4-x3rq-hvhc",
4+
"modified": "2026-03-09T12:31:39Z",
5+
"published": "2026-03-09T12:31:38Z",
6+
"aliases": [
7+
"CVE-2025-40638"
8+
],
9+
"details": "A reflected Cross-Site Scripting (XSS) vulnerability has been \nfound in Eventobot. This vulnerability allows an attacker to execute \nJavaScript code in the victim's browser by sending him/her a malicious \nURL using the 'name' parameter in '/search-results'. This vulnerability \ncan be exploited to steal sensitive user data, such as session cookies, \nor to perform actions on behalf of the user.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40638"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-eventobot"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-09T10:16:00Z"
35+
}
36+
}

0 commit comments

Comments
 (0)