Skip to content

Commit f07148c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent d4a639c commit f07148c

File tree

40 files changed

+1134
-43
lines changed

40 files changed

+1134
-43
lines changed

‎advisories/unreviewed/2025/09/GHSA-hhgh-xj97-6f9r/GHSA-hhgh-xj97-6f9r.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hhgh-xj97-6f9r",
4-
"modified": "2025-12-12T21:31:32Z",
4+
"modified": "2026-03-04T15:30:32Z",
55
"published": "2025-09-24T12:30:20Z",
66
"aliases": [
77
"CVE-2025-39889"
@@ -42,6 +42,10 @@
4242
{
4343
"type": "WEB",
4444
"url": "https://git.kernel.org/stable/c/d4ca2fd218caafbf50e3343ba1260c6a23b5676a"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://git.kernel.org/stable/c/ed503d340a501e414114ddc614a3aae4f6e9eae2"
4549
}
4650
],
4751
"database_specific": {

‎advisories/unreviewed/2026/01/GHSA-hmr2-524c-vv28/GHSA-hmr2-524c-vv28.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hmr2-524c-vv28",
4-
"modified": "2026-01-20T18:31:55Z",
4+
"modified": "2026-03-04T15:30:32Z",
55
"published": "2026-01-19T06:30:27Z",
66
"aliases": [
77
"CVE-2026-0943"
@@ -33,7 +33,9 @@
3333
}
3434
],
3535
"database_specific": {
36-
"cwe_ids": [],
36+
"cwe_ids": [
37+
"CWE-476"
38+
],
3739
"severity": "HIGH",
3840
"github_reviewed": false,
3941
"github_reviewed_at": null,

‎advisories/unreviewed/2026/02/GHSA-92hq-qvrx-74gm/GHSA-92hq-qvrx-74gm.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-92hq-qvrx-74gm",
4-
"modified": "2026-02-11T15:30:27Z",
4+
"modified": "2026-03-04T15:30:32Z",
55
"published": "2026-02-11T15:30:27Z",
66
"aliases": [
77
"CVE-2025-8668"

‎advisories/unreviewed/2026/03/GHSA-266w-wvvg-f3wv/GHSA-266w-wvvg-f3wv.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-266w-wvvg-f3wv",
4-
"modified": "2026-03-03T21:31:16Z",
4+
"modified": "2026-03-04T15:30:34Z",
55
"published": "2026-03-03T21:31:16Z",
66
"aliases": [
77
"CVE-2025-66945"
88
],
99
"details": "A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-787"
34+
],
35+
"severity": "CRITICAL",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2026-03-03T20:16:44Z"

‎advisories/unreviewed/2026/03/GHSA-293m-75qg-jwrv/GHSA-293m-75qg-jwrv.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-77"
49+
"CWE-77",
50+
"CWE-78"
5051
],
5152
"severity": "HIGH",
5253
"github_reviewed": false,

‎advisories/unreviewed/2026/03/GHSA-32r6-gffx-pj25/GHSA-32r6-gffx-pj25.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-32r6-gffx-pj25",
4+
"modified": "2026-03-04T15:30:35Z",
5+
"published": "2026-03-04T15:30:35Z",
6+
"aliases": [
7+
"CVE-2025-40896"
8+
],
9+
"details": "The server certificate was not verified when an Arc agent connected to a Guardian or CMC.\n\n\n\nA malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. This could result in theft of the client token and sensitive information (such as assets and alerts), impersonation of the server, or injection of spoofed data (such as false asset information or vulnerabilities) into the Guardian or CMC.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40896"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://security.nozominetworks.com/NN-2025:18-01"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-295"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-04T14:16:14Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-39w6-g297-pmf5/GHSA-39w6-g297-pmf5.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-39w6-g297-pmf5",
4+
"modified": "2026-03-04T15:30:36Z",
5+
"published": "2026-03-04T15:30:36Z",
6+
"aliases": [
7+
"CVE-2026-23235"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix out-of-bounds access in sysfs attribute read/write\n\nSome f2fs sysfs attributes suffer from out-of-bounds memory access and\nincorrect handling of integer values whose size is not 4 bytes.\n\nFor example:\nvm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out\nvm:~# cat /sys/fs/f2fs/vde/carve_out\n65537\nvm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold\nvm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold\n1\n\ncarve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit\ninteger. However, the sysfs interface allows setting it to a value\nlarger than 255, resulting in an out-of-range update.\n\natgc_age_threshold maps to {struct atgc_management}->age_threshold,\nwhich is a 64-bit integer, but its sysfs interface cannot correctly set\nvalues larger than UINT_MAX.\n\nThe root causes are:\n1. __sbi_store() treats all default values as unsigned int, which\nprevents updating integers larger than 4 bytes and causes out-of-bounds\nwrites for integers smaller than 4 bytes.\n\n2. f2fs_sbi_show() also assumes all default values are unsigned int,\nleading to out-of-bounds reads and incorrect access to integers larger\nthan 4 bytes.\n\nThis patch introduces {struct f2fs_attr}->size to record the actual size\nof the integer associated with each sysfs attribute. With this\ninformation, sysfs read and write operations can correctly access and\nupdate values according to their real data size, avoiding memory\ncorruption and truncation.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23235"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/3a905e183c047577b154f08a78ac3039e9454703"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/438a405fbad6882df0e34b3e1a16839a71f04240"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/4ef30b9f1641c9e877792df6b049f1cf507d002d"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://git.kernel.org/stable/c/6a6c07a9b49e43f0df42d7118fc76aa555c73d98"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://git.kernel.org/stable/c/98ea0039dbfdd00e5cc1b9a8afa40434476c0955"
36+
},
37+
{
38+
"type": "WEB",
39+
"url": "https://git.kernel.org/stable/c/d4a594dd952df123cbdcdee9b9640d9d55e4a954"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://git.kernel.org/stable/c/e85a99db9ab85dfc30d93b0ca0e9156f3127f55a"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://git.kernel.org/stable/c/eebd72cff518ac87e660aefb8a41224bd88c32ce"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [],
52+
"severity": null,
53+
"github_reviewed": false,
54+
"github_reviewed_at": null,
55+
"nvd_published_at": "2026-03-04T15:16:13Z"
56+
}
57+
}

‎advisories/unreviewed/2026/03/GHSA-52jv-jcqf-q243/GHSA-52jv-jcqf-q243.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-52jv-jcqf-q243",
4-
"modified": "2026-03-04T00:30:22Z",
4+
"modified": "2026-03-04T15:30:34Z",
55
"published": "2026-03-04T00:30:22Z",
66
"aliases": [
77
"CVE-2026-3224"
88
],
99
"details": "Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-287"
2530
],
26-
"severity": null,
31+
"severity": "CRITICAL",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-03-03T22:16:29Z"

‎advisories/unreviewed/2026/03/GHSA-52vv-5wf4-fghj/GHSA-52vv-5wf4-fghj.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-52vv-5wf4-fghj",
4-
"modified": "2026-03-04T00:30:22Z",
4+
"modified": "2026-03-04T15:30:34Z",
55
"published": "2026-03-04T00:30:22Z",
66
"aliases": [
77
"CVE-2026-3130"
88
],
99
"details": "Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-841"
2530
],
26-
"severity": null,
31+
"severity": "CRITICAL",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-03-03T22:16:29Z"

‎advisories/unreviewed/2026/03/GHSA-5j7r-7m6v-52v3/GHSA-5j7r-7m6v-52v3.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5j7r-7m6v-52v3",
4+
"modified": "2026-03-04T15:30:35Z",
5+
"published": "2026-03-04T15:30:35Z",
6+
"aliases": [
7+
"CVE-2025-70341"
8+
],
9+
"details": "Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70341"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/App-Auto-Patch/App-Auto-Patch/issues/203"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/App-Auto-Patch/App-Auto-Patch/pull/202"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://github.com/App-Auto-Patch/App-Auto-Patch/blob/main/App-Auto-Patch-via-Dialog.zsh"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://github.com/malvector/CVE-2025-70341"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2026-03-04T15:16:12Z"
40+
}
41+
}

0 commit comments

Comments
 (0)