Skip to content

Commit dc1f3b6

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-hrx4-rccm-xj6c GHSA-35x7-r658-wx7f GHSA-3fqx-3cg9-chg9 GHSA-4r52-fgmg-vqxc GHSA-4v7c-97mg-h3wh GHSA-5w3f-m935-fxvq GHSA-6hjh-5rvg-rp2f GHSA-7693-hmcm-7whx GHSA-77v4-gvxh-3ccf GHSA-827f-mrm2-f6xh GHSA-8fr6-83vj-w7xh GHSA-9284-m2hp-cfp4 GHSA-jxpv-ww5c-x2c3 GHSA-wc4c-6r77-mp37
1 parent 6ba72df commit dc1f3b6

File tree

14 files changed

+413
-2
lines changed

14 files changed

+413
-2
lines changed

‎advisories/unreviewed/2025/12/GHSA-hrx4-rccm-xj6c/GHSA-hrx4-rccm-xj6c.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hrx4-rccm-xj6c",
4-
"modified": "2026-02-17T12:31:07Z",
4+
"modified": "2026-02-26T09:30:27Z",
55
"published": "2025-12-05T18:31:11Z",
66
"aliases": [
77
"CVE-2025-14104"
@@ -47,6 +47,10 @@
4747
"type": "WEB",
4848
"url": "https://access.redhat.com/errata/RHSA-2026:2800"
4949
},
50+
{
51+
"type": "WEB",
52+
"url": "https://access.redhat.com/errata/RHSA-2026:3406"
53+
},
5054
{
5155
"type": "WEB",
5256
"url": "https://access.redhat.com/security/cve/CVE-2025-14104"

‎advisories/unreviewed/2026/02/GHSA-35x7-r658-wx7f/GHSA-35x7-r658-wx7f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-35x7-r658-wx7f",
4+
"modified": "2026-02-26T09:30:27Z",
5+
"published": "2026-02-26T09:30:27Z",
6+
"aliases": [
7+
"CVE-2026-1698"
8+
],
9+
"details": "A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior.\n\nThis vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout\nof the WebClient and WebScheduler web apps.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1698"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.pcvue.com/security/#SB2026-2"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-644"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-26T08:16:19Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-3fqx-3cg9-chg9/GHSA-3fqx-3cg9-chg9.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3fqx-3cg9-chg9",
4+
"modified": "2026-02-26T09:30:27Z",
5+
"published": "2026-02-26T09:30:27Z",
6+
"aliases": [
7+
"CVE-2026-1692"
8+
],
9+
"details": "A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a successfully authenticated user to a malicious website.\n\nThis vulnerability only affects the following two endpoints: GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1692"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.pcvue.com/security/#SB2026-2"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-1385"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-26T08:16:18Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-4r52-fgmg-vqxc/GHSA-4r52-fgmg-vqxc.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4r52-fgmg-vqxc",
4+
"modified": "2026-02-26T09:30:27Z",
5+
"published": "2026-02-26T09:30:27Z",
6+
"aliases": [
7+
"CVE-2026-1696"
8+
],
9+
"details": "Some HTTP security headers are not properly set by the web server when sending responses to the client application.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1696"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.pcvue.com/security/#SB2026-2"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-26T08:16:19Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-4v7c-97mg-h3wh/GHSA-4v7c-97mg-h3wh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4v7c-97mg-h3wh",
4+
"modified": "2026-02-26T09:30:27Z",
5+
"published": "2026-02-26T09:30:27Z",
6+
"aliases": [
7+
"CVE-2026-1697"
8+
],
9+
"details": "The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1697"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.pcvue.com/security/#SB2026-2"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-614"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-26T08:16:19Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-5w3f-m935-fxvq/GHSA-5w3f-m935-fxvq.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5w3f-m935-fxvq",
4+
"modified": "2026-02-26T09:30:27Z",
5+
"published": "2026-02-26T09:30:27Z",
6+
"aliases": [
7+
"CVE-2026-1693"
8+
],
9+
"details": "The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1693"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.pcvue.com/security/#SB2026-2"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-477"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-26T08:16:18Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-6hjh-5rvg-rp2f/GHSA-6hjh-5rvg-rp2f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6hjh-5rvg-rp2f",
4+
"modified": "2026-02-26T09:30:27Z",
5+
"published": "2026-02-26T09:30:27Z",
6+
"aliases": [
7+
"CVE-2026-1694"
8+
],
9+
"details": "HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1694"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.pcvue.com/security/#SB2026-2"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-201"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-26T08:16:18Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-7693-hmcm-7whx/GHSA-7693-hmcm-7whx.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7693-hmcm-7whx",
4+
"modified": "2026-02-26T09:30:27Z",
5+
"published": "2026-02-26T09:30:27Z",
6+
"aliases": [
7+
"CVE-2026-1695"
8+
],
9+
"details": "An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to trick a legitimate user into loading content from another site upon unsuccessful user authentication on an unknown application (unknown client_id).\n\nThis vulnerability only affects the error page of the OAuth server.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1695"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.pcvue.com/security/#SB2026-2"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-26T08:16:19Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-77v4-gvxh-3ccf/GHSA-77v4-gvxh-3ccf.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-77v4-gvxh-3ccf",
4+
"modified": "2026-02-26T09:30:27Z",
5+
"published": "2026-02-26T09:30:27Z",
6+
"aliases": [
7+
"CVE-2026-28132"
8+
],
9+
"details": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews allows Code Injection.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.4.4.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28132"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://patchstack.com/database/Wordpress/Plugin/woocommerce-photo-reviews/vulnerability/wordpress-woocommerce-photo-reviews-plugin-1-4-4-content-injection-vulnerability?_s_id=cve"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-80"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-02-26T09:16:15Z"
30+
}
31+
}

‎advisories/unreviewed/2026/02/GHSA-827f-mrm2-f6xh/GHSA-827f-mrm2-f6xh.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-827f-mrm2-f6xh",
4+
"modified": "2026-02-26T09:30:27Z",
5+
"published": "2026-02-26T09:30:27Z",
6+
"aliases": [
7+
"CVE-2026-28131"
8+
],
9+
"details": "Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through <= 1.14.4.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28131"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://patchstack.com/database/Wordpress/Plugin/addon-elements-for-elementor-page-builder/vulnerability/wordpress-elementor-addon-elements-plugin-1-14-4-sensitive-data-exposure-vulnerability?_s_id=cve"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-201"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-02-26T09:16:15Z"
30+
}
31+
}

0 commit comments

Comments
 (0)