Skip to content

Commit 0e905a0

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-33v8-g7j5-qg76 GHSA-3vp9-wjw8-vgmx GHSA-44f4-gvwj-6qg3 GHSA-6p45-jv22-32gp GHSA-6wvc-gg7r-g28h GHSA-7cj7-rcw6-p68v GHSA-fgh4-4rfj-927q GHSA-fvh3-672c-7p6c GHSA-h3gg-7vcj-v4m8 GHSA-mhrg-94vw-45c5 GHSA-mxjh-5564-f256 GHSA-pvrh-63rh-cj2q GHSA-vgx8-59x9-v7v9 GHSA-vxrf-632h-2jj6 GHSA-x9gr-c22h-6mqf
1 parent 7d61fca commit 0e905a0

15 files changed

Lines changed: 616 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-33v8-g7j5-qg76/GHSA-33v8-g7j5-qg76.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-33v8-g7j5-qg76",
4+
"modified": "2026-03-27T06:31:43Z",
5+
"published": "2026-03-27T06:31:43Z",
6+
"aliases": [
7+
"CVE-2026-27650"
8+
],
9+
"details": "OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary OS command may be executed on the products.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27650"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN83788689"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.buffalo.jp/news/detail/20260323-01.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-78"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-27T06:16:38Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-3vp9-wjw8-vgmx/GHSA-3vp9-wjw8-vgmx.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3vp9-wjw8-vgmx",
4+
"modified": "2026-03-27T06:31:43Z",
5+
"published": "2026-03-27T06:31:43Z",
6+
"aliases": [
7+
"CVE-2026-33280"
8+
],
9+
"details": "Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33280"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN83788689"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.buffalo.jp/news/detail/20260323-01.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-912"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-27T06:16:38Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-44f4-gvwj-6qg3/GHSA-44f4-gvwj-6qg3.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-44f4-gvwj-6qg3",
4+
"modified": "2026-03-27T06:31:43Z",
5+
"published": "2026-03-27T06:31:43Z",
6+
"aliases": [
7+
"CVE-2026-22744"
8+
],
9+
"details": "In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts the value directly into the @field:{VALUE} RediSearch TAG block without escaping characters.This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22744"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://spring.io/security/cve-2026-22744"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "HIGH",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-27T06:16:38Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-6p45-jv22-32gp/GHSA-6p45-jv22-32gp.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6p45-jv22-32gp",
4+
"modified": "2026-03-27T06:31:43Z",
5+
"published": "2026-03-27T06:31:43Z",
6+
"aliases": [
7+
"CVE-2026-34353"
8+
],
9+
"details": "In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34353"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/ocaml/ocaml/issues/14655"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ocaml/ocaml/pull/14674"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-190"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-27T06:16:39Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-6wvc-gg7r-g28h/GHSA-6wvc-gg7r-g28h.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6wvc-gg7r-g28h",
4+
"modified": "2026-03-27T06:31:42Z",
5+
"published": "2026-03-27T06:31:42Z",
6+
"aliases": [
7+
"CVE-2024-14028"
8+
],
9+
"details": "Use after free vulnerability in Softing smartLink HW-DP or smartLink HW-PN webserver allows HTTP DoS.\nThis issue affects:\nsmartLink HW-DP: through 1.31\nsmartLink HW-PN: before 1.02.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-14028"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://industrial.softing.com/fileadmin/psirt/downloads/2024/CVE-2024-14028.html"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://industrial.softing.com/fileadmin/psirt/downloads/2024/CVE-2024-14028.json"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-416"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-27T06:16:35Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-7cj7-rcw6-p68v/GHSA-7cj7-rcw6-p68v.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7cj7-rcw6-p68v",
4+
"modified": "2026-03-27T06:31:43Z",
5+
"published": "2026-03-27T06:31:43Z",
6+
"aliases": [
7+
"CVE-2026-22743"
8+
],
9+
"details": "Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as a filter expression key in Neo4jVectorFilterExpressionConverter of spring-ai-neo4j-store, doKey() embeds the key into a backtick-delimited Cypher property accessor (node.`metadata.`) after stripping only double quotes, without escaping embedded backticks.This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22743"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://spring.io/security/cve-2026-22743"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "HIGH",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-27T06:16:37Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-fgh4-4rfj-927q/GHSA-fgh4-4rfj-927q.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fgh4-4rfj-927q",
4+
"modified": "2026-03-27T06:31:43Z",
5+
"published": "2026-03-27T06:31:43Z",
6+
"aliases": [
7+
"CVE-2026-33559"
8+
],
9+
"details": "WordPress Plugin \"OpenStreetMap\" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a logged-in user with a page-creating/editing privilege can embed some malicious script with a crafted HTTP request. When a victim user accesses this page, the script may be executed in the user's web browser.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33559"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN48058823"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://wordpress.org/plugins/osm"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-27T06:16:39Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-fvh3-672c-7p6c/GHSA-fvh3-672c-7p6c.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fvh3-672c-7p6c",
4+
"modified": "2026-03-27T06:31:42Z",
5+
"published": "2026-03-27T06:31:42Z",
6+
"aliases": [
7+
"CVE-2026-22738"
8+
],
9+
"details": "In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected.\nThis issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22738"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://spring.io/security/cve-2026-22738"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "CRITICAL",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-27T06:16:37Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-h3gg-7vcj-v4m8/GHSA-h3gg-7vcj-v4m8.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h3gg-7vcj-v4m8",
4+
"modified": "2026-03-27T06:31:43Z",
5+
"published": "2026-03-27T06:31:43Z",
6+
"aliases": [
7+
"CVE-2026-33366"
8+
],
9+
"details": "Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to forcibly reboot the product without authentication.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33366"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN83788689"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.buffalo.jp/news/detail/20260323-01.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-306"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-27T06:16:38Z"
43+
}
44+
}

0 commit comments

Comments
 (0)