Skip to content

Commit d089564

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent fc34571 commit d089564

File tree

45 files changed

+1098
-35
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+1098
-35
lines changed

‎advisories/github-reviewed/2026/03/GHSA-j443-wcqq-xprh/GHSA-j443-wcqq-xprh.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j443-wcqq-xprh",
4+
"modified": "2026-03-11T00:32:49Z",
5+
"published": "2026-03-11T00:32:49Z",
6+
"aliases": [],
7+
"summary": "Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go",
8+
"details": "### Summary\n\nA critical vulnerability has been identified at https://security.snyk.io/package/linux/chainguard:latest/terraform-provider-sendgrid, associated with the underlying Go version.\n\nIf the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via `Config.Clone()` combined with modification or `GetConfigForClient` — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list.\n\nAs a result, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.\n\n### Details\n\nIf the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via `Config.Clone()` combined with modification or `GetConfigForClient` — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list.\n\nConsequently, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/arslanbekov/terraform-provider-sendgrid"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "1.1.3-0.20250606002314-b4a2dfeb7b0f"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/arslanbekov/terraform-provider-sendgrid/security/advisories/GHSA-j443-wcqq-xprh"
40+
},
41+
{
42+
"type": "ADVISORY",
43+
"url": "https://github.com/advisories/GHSA-h355-32pf-p2xm"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/arslanbekov/terraform-provider-sendgrid"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TERRAFORMPROVIDERSENDGRID-15265295"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-295"
57+
],
58+
"severity": "CRITICAL",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-03-11T00:32:49Z",
61+
"nvd_published_at": null
62+
}
63+
}

advisories/unreviewed/2026/03/GHSA-jw5g-f64p-6x78/GHSA-jw5g-f64p-6x78.json renamed to advisories/github-reviewed/2026/03/GHSA-jw5g-f64p-6x78/GHSA-jw5g-f64p-6x78.json

Lines changed: 31 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jw5g-f64p-6x78",
4-
"modified": "2026-03-10T09:31:46Z",
4+
"modified": "2026-03-11T00:31:16Z",
55
"published": "2026-03-10T09:31:46Z",
66
"aliases": [
77
"CVE-2026-1776"
88
],
9-
"details": "Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.",
9+
"summary": "Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation",
10+
"details": "Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
13-
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "RubyGems",
21+
"name": "camaleon_cms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.4.5.0"
29+
},
30+
{
31+
"last_affected": "2.9.1"
32+
}
33+
]
34+
}
35+
]
1436
}
1537
],
16-
"affected": [],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -31,6 +52,10 @@
3152
"type": "WEB",
3253
"url": "https://camaleon.website"
3354
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/owen2345/camaleon-cms"
58+
},
3459
{
3560
"type": "WEB",
3661
"url": "https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read"
@@ -41,8 +66,8 @@
4166
"CWE-22"
4267
],
4368
"severity": "MODERATE",
44-
"github_reviewed": false,
45-
"github_reviewed_at": null,
69+
"github_reviewed": true,
70+
"github_reviewed_at": "2026-03-11T00:31:16Z",
4671
"nvd_published_at": "2026-03-10T07:38:01Z"
4772
}
4873
}

‎advisories/github-reviewed/2026/03/GHSA-rmrf-g9r3-73pm/GHSA-rmrf-g9r3-73pm.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rmrf-g9r3-73pm",
4+
"modified": "2026-03-11T00:33:30Z",
5+
"published": "2026-03-11T00:33:30Z",
6+
"aliases": [
7+
"CVE-2026-31866"
8+
],
9+
"summary": "flagd Vulnerable to Allocation of Resources Without Limits or Throttling",
10+
"details": "## Details\n\nflagd exposes OFREP (`/ofrep/v1/evaluate/...`) and gRPC (`evaluation.v1`, `evaluation.v2`) endpoints for feature flag evaluation. These endpoints are designed to be publicly accessible by client applications.\n\nThe evaluation context included in request payloads is read into memory without any size restriction. An attacker can send a single HTTP request with an arbitrarily large body, causing flagd to allocate a corresponding amount of memory. This leads to immediate memory exhaustion and process termination (e.g., OOMKill in Kubernetes environments).\n\nflagd does not natively enforce authentication on its evaluation endpoints. While operators may deploy flagd behind an authenticating reverse proxy or similar infrastructure, the endpoints themselves impose no access control by default.\n\n## Impact\n\n- **Denial of Service:** A single crafted request can crash the flagd process.\n- **Service Disruption:** All applications relying on the affected flagd instance for feature flag evaluation will lose access to flag evaluations until the process restarts.\n- **Repeated Exploitation:** An attacker can continuously send oversized requests to prevent recovery.\n\n## Affected Endpoints\n\n- `/ofrep/v1/evaluate/flags/{flagKey}` (OFREP single flag evaluation)\n- `/ofrep/v1/evaluate/flags` (OFREP bulk evaluation)\n- `flagd.evaluation.v1.Service/ResolveBoolean` (gRPC/Connect)\n- `flagd.evaluation.v1.Service/ResolveString` (gRPC/Connect)\n- `flagd.evaluation.v1.Service/ResolveFloat` (gRPC/Connect)\n- `flagd.evaluation.v1.Service/ResolveInt` (gRPC/Connect)\n- `flagd.evaluation.v1.Service/ResolveObject` (gRPC/Connect)\n- `flagd.evaluation.v1.Service/ResolveAll` (gRPC/Connect)\n- `flagd.evaluation.v2.Service/ResolveBoolean` (gRPC/Connect)\n- `flagd.evaluation.v2.Service/ResolveString` (gRPC/Connect)\n- `flagd.evaluation.v2.Service/ResolveFloat` (gRPC/Connect)\n- `flagd.evaluation.v2.Service/ResolveInt` (gRPC/Connect)\n- `flagd.evaluation.v2.Service/ResolveObject` (gRPC/Connect)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/open-feature/flagd/flagd"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.14.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/open-feature/flagd/security/advisories/GHSA-rmrf-g9r3-73pm"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/open-feature/flagd/commit/25c5fd7e80c26eb2c00b20317b2456fe6f927ea3"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/open-feature/flagd"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-770"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-11T00:33:30Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2026/03/GHSA-v8w9-8mx6-g223/GHSA-v8w9-8mx6-g223.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v8w9-8mx6-g223",
4+
"modified": "2026-03-11T00:31:47Z",
5+
"published": "2026-03-11T00:31:47Z",
6+
"aliases": [],
7+
"summary": "Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })",
8+
"details": "## Summary\n\nWhen using `parseBody({ dot: true })` in HonoRequest, specially crafted form field names such as `__proto__.x` could create objects containing a `__proto__` property.\n\nIf the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object.\n\n## Details\n\nThe `parseBody({ dot: true })` feature supports dot notation to construct nested objects from form field names.\n\nIn previous versions, the `__proto__` path segment was not filtered. As a result, specially crafted keys such as `__proto__.x` could produce objects containing `__proto__` properties.\n\nWhile this behavior does not directly modify `Object.prototype` within Hono itself, it may become exploitable if the parsed result is later merged into regular JavaScript objects using unsafe merge patterns.\n\n## Impact\n\nApplications that merge parsed form data into regular objects using unsafe patterns (for example recursive deep merge utilities) may become vulnerable to prototype pollution.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "hono"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "4.12.7"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/honojs/hono/commit/ef902257e0beacbb83d2a9549b3b83e03514a6fe"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/honojs/hono"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-1321"
53+
],
54+
"severity": "MODERATE",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-11T00:31:47Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/unreviewed/2026/01/GHSA-x6px-8wp8-5cwq/GHSA-x6px-8wp8-5cwq.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-x6px-8wp8-5cwq",
4-
"modified": "2026-01-15T21:31:48Z",
4+
"modified": "2026-03-11T00:31:30Z",
55
"published": "2026-01-15T21:31:48Z",
66
"aliases": [
77
"CVE-2026-0203"

‎advisories/unreviewed/2026/02/GHSA-q4hc-vp2m-fr47/GHSA-q4hc-vp2m-fr47.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-q4hc-vp2m-fr47",
4-
"modified": "2026-03-02T09:30:29Z",
4+
"modified": "2026-03-11T00:31:30Z",
55
"published": "2026-02-23T18:32:02Z",
66
"aliases": [
77
"CVE-2025-14905"
@@ -35,6 +35,10 @@
3535
"type": "WEB",
3636
"url": "https://access.redhat.com/errata/RHSA-2026:3504"
3737
},
38+
{
39+
"type": "WEB",
40+
"url": "https://access.redhat.com/errata/RHSA-2026:4207"
41+
},
3842
{
3943
"type": "WEB",
4044
"url": "https://access.redhat.com/security/cve/CVE-2025-14905"

‎advisories/unreviewed/2026/03/GHSA-225v-w4gw-cgwv/GHSA-225v-w4gw-cgwv.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-225v-w4gw-cgwv",
4-
"modified": "2026-03-10T21:32:18Z",
4+
"modified": "2026-03-11T00:31:30Z",
55
"published": "2026-03-10T21:32:18Z",
66
"aliases": [
77
"CVE-2026-0111"
@@ -14,6 +14,10 @@
1414
"type": "ADVISORY",
1515
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0111"
1616
},
17+
{
18+
"type": "WEB",
19+
"url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01"
20+
},
1721
{
1822
"type": "WEB",
1923
"url": "https://source.android.com/security/bulletin/pixel/2026-03-01"

‎advisories/unreviewed/2026/03/GHSA-228j-8x4w-rvcx/GHSA-228j-8x4w-rvcx.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-228j-8x4w-rvcx",
4-
"modified": "2026-03-10T21:32:18Z",
4+
"modified": "2026-03-11T00:31:30Z",
55
"published": "2026-03-10T21:32:18Z",
66
"aliases": [
77
"CVE-2026-0113"
@@ -14,6 +14,10 @@
1414
"type": "ADVISORY",
1515
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0113"
1616
},
17+
{
18+
"type": "WEB",
19+
"url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01"
20+
},
1721
{
1822
"type": "WEB",
1923
"url": "https://source.android.com/security/bulletin/pixel/2026-03-01"

‎advisories/unreviewed/2026/03/GHSA-2h2g-8rx7-4c64/GHSA-2h2g-8rx7-4c64.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2h2g-8rx7-4c64",
4+
"modified": "2026-03-11T00:31:36Z",
5+
"published": "2026-03-11T00:31:36Z",
6+
"aliases": [
7+
"CVE-2026-21362"
8+
],
9+
"details": "Illustrator versions 29.8.4, 30.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21362"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://helpx.adobe.com/security/products/illustrator/apsb26-18.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-787"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-10T23:16:43Z"
35+
}
36+
}

0 commit comments

Comments
 (0)