Skip to content

Commit d0a5254

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-43wm-f3cq-hfrw GHSA-6995-8cjx-mq6q GHSA-9hwv-m488-9fjx GHSA-mvfh-9xv2-5xj7 GHSA-wrqv-g27w-82rr GHSA-xjrj-8prq-9366 GHSA-xqpr-gx4w-53xf
1 parent 064f966 commit d0a5254

7 files changed

Lines changed: 388 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-43wm-f3cq-hfrw/GHSA-43wm-f3cq-hfrw.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-43wm-f3cq-hfrw",
4+
"modified": "2026-02-16T03:30:17Z",
5+
"published": "2026-02-16T03:30:17Z",
6+
"aliases": [
7+
"CVE-2026-2526"
8+
],
9+
"details": "A vulnerability was found in Wavlink WL-WN579A3 up to 20210219. This impacts the function multi_ssid of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument SSID2G2 results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2526"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/multi_ssid.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.346114"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.346114"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.748073"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-16T02:16:06Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-6995-8cjx-mq6q/GHSA-6995-8cjx-mq6q.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6995-8cjx-mq6q",
4+
"modified": "2026-02-16T03:30:17Z",
5+
"published": "2026-02-16T03:30:17Z",
6+
"aliases": [
7+
"CVE-2026-2524"
8+
],
9+
"details": "A flaw has been found in Open5GS 2.7.6. The impacted element is the function mme_s11_handle_create_session_response of the component MME. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2524"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/open5gs/open5gs/issues/4284"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/open5gs/open5gs/issues/4284#issue-3808462406"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/open5gs/open5gs"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.346112"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.346112"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.738369"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-404"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-02-16T01:15:54Z"
59+
}
60+
}

‎advisories/unreviewed/2026/02/GHSA-9hwv-m488-9fjx/GHSA-9hwv-m488-9fjx.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9hwv-m488-9fjx",
4+
"modified": "2026-02-16T03:30:17Z",
5+
"published": "2026-02-16T03:30:17Z",
6+
"aliases": [
7+
"CVE-2026-2528"
8+
],
9+
"details": "A vulnerability was identified in Wavlink WL-WN579A3 up to 20210219. Affected by this vulnerability is the function Delete_Mac_list of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2528"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/Delete_Mac_list.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.346116"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.346116"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.748075"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-16T02:16:06Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-mvfh-9xv2-5xj7/GHSA-mvfh-9xv2-5xj7.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mvfh-9xv2-5xj7",
4+
"modified": "2026-02-16T03:30:17Z",
5+
"published": "2026-02-16T03:30:17Z",
6+
"aliases": [
7+
"CVE-2026-2523"
8+
],
9+
"details": "A vulnerability was detected in Open5GS up to 2.7.6. The affected element is the function smf_gn_handle_create_pdp_context_request of the file /src/smf/gn-handler.c of the component SMF. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2523"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/open5gs/open5gs/issues/4285"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/open5gs/open5gs/issues/4285#issue-3809055236"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/open5gs/open5gs"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.346111"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.346111"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.738342"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-617"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-02-16T01:15:53Z"
59+
}
60+
}

‎advisories/unreviewed/2026/02/GHSA-wrqv-g27w-82rr/GHSA-wrqv-g27w-82rr.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wrqv-g27w-82rr",
4+
"modified": "2026-02-16T03:30:17Z",
5+
"published": "2026-02-16T03:30:17Z",
6+
"aliases": [
7+
"CVE-2026-2527"
8+
],
9+
"details": "A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219. Affected is an unknown function of the file /cgi-bin/login.cgi. Executing a manipulation of the argument key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2527"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/login.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.346115"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.346115"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.748074"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-16T02:16:06Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-xjrj-8prq-9366/GHSA-xjrj-8prq-9366.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xjrj-8prq-9366",
4+
"modified": "2026-02-16T03:30:17Z",
5+
"published": "2026-02-16T03:30:17Z",
6+
"aliases": [
7+
"CVE-2026-2529"
8+
],
9+
"details": "A security flaw has been discovered in Wavlink WL-WN579A3 up to 20210219. Affected by this issue is the function DeleteMac of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list results in command injection. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2529"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/DeleteMac.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.346117"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.346117"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.748076"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-16T02:16:07Z"
51+
}
52+
}

0 commit comments

Comments
 (0)