Skip to content

Commit 62cce36

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-53mr-6c8q-9789 GHSA-7gxw-q9j5-mrj4 GHSA-c96x-rpm4-349p GHSA-g977-h85w-h2xj GHSA-h7xc-4mv8-59fj
1 parent 402511a commit 62cce36

5 files changed

Lines changed: 112 additions & 22 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-53mr-6c8q-9789/GHSA-53mr-6c8q-9789.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-53mr-6c8q-9789",
4-
"modified": "2026-04-06T23:40:36Z",
4+
"modified": "2026-05-06T18:40:45Z",
55
"published": "2026-04-03T21:59:31Z",
66
"aliases": [
77
"CVE-2026-35029"
@@ -47,6 +47,10 @@
4747
{
4848
"type": "PACKAGE",
4949
"url": "https://github.com/BerriAI/litellm"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "http://seclists.org/fulldisclosure/2026/Apr/17"
5054
}
5155
],
5256
"database_specific": {

advisories/unreviewed/2026/04/GHSA-7gxw-q9j5-mrj4/GHSA-7gxw-q9j5-mrj4.json renamed to advisories/github-reviewed/2026/04/GHSA-7gxw-q9j5-mrj4/GHSA-7gxw-q9j5-mrj4.json

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,30 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7gxw-q9j5-mrj4",
4-
"modified": "2026-04-27T21:31:03Z",
4+
"modified": "2026-05-06T18:40:16Z",
55
"published": "2026-04-27T21:31:03Z",
66
"aliases": [
77
"CVE-2026-5362"
88
],
9+
"summary": "Pimcore has an authenticated Cross-site Scripting issue",
910
"details": "An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered.\n\nThis issue affects pimcore: v12.3.3.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
13-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "pimcore/pimcore"
22+
},
23+
"versions": [
24+
"12.3.3"
25+
]
1426
}
1527
],
16-
"affected": [],
1728
"references": [
1829
{
1930
"type": "ADVISORY",
@@ -24,7 +35,7 @@
2435
"url": "https://fluidattacks.com/es/advisories/mago"
2536
},
2637
{
27-
"type": "WEB",
38+
"type": "PACKAGE",
2839
"url": "https://github.com/pimcore/pimcore"
2940
}
3041
],
@@ -33,8 +44,8 @@
3344
"CWE-79"
3445
],
3546
"severity": "MODERATE",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
47+
"github_reviewed": true,
48+
"github_reviewed_at": "2026-05-06T18:40:16Z",
3849
"nvd_published_at": "2026-04-27T21:16:42Z"
3950
}
4051
}

advisories/unreviewed/2026/04/GHSA-c96x-rpm4-349p/GHSA-c96x-rpm4-349p.json renamed to advisories/github-reviewed/2026/04/GHSA-c96x-rpm4-349p/GHSA-c96x-rpm4-349p.json

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,53 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-c96x-rpm4-349p",
4-
"modified": "2026-04-27T21:31:02Z",
4+
"modified": "2026-05-06T18:38:23Z",
55
"published": "2026-04-27T21:31:02Z",
66
"aliases": [
77
"CVE-2026-40970"
88
],
9+
"summary": "Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.",
910
"details": "When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.\n\nAffected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.springframework.boot:spring-boot-elasticsearch"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "4.0.0"
29+
},
30+
{
31+
"fixed": "4.0.6"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40970"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/spring-projects/spring-boot"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/spring-projects/spring-boot/releases/tag/v4.0.6"
50+
},
2251
{
2352
"type": "WEB",
2453
"url": "https://spring.io/security/cve-2026-40970"
@@ -29,8 +58,8 @@
2958
"CWE-295"
3059
],
3160
"severity": "MODERATE",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-05-06T18:38:23Z",
3463
"nvd_published_at": "2026-04-27T19:16:52Z"
3564
}
3665
}

advisories/unreviewed/2026/04/GHSA-g977-h85w-h2xj/GHSA-g977-h85w-h2xj.json renamed to advisories/github-reviewed/2026/04/GHSA-g977-h85w-h2xj/GHSA-g977-h85w-h2xj.json

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-g977-h85w-h2xj",
4-
"modified": "2026-04-09T18:31:28Z",
4+
"modified": "2026-05-06T18:41:01Z",
55
"published": "2026-04-09T18:31:28Z",
66
"aliases": [
77
"CVE-2026-5970"
88
],
9+
"summary": "MetaGPT has an Injection issue",
910
"details": "A vulnerability was detected in FoundationAgents MetaGPT up to 0.8.1. This affects the function check_solution of the component HumanEvalBenchmark/MBPPBenchmark. Performing a manipulation results in code injection. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through a pull request but has not reacted yet.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "PyPI",
25+
"name": "metagpt"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"last_affected": "0.8.1"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -32,7 +53,7 @@
3253
"url": "https://github.com/FoundationAgents/MetaGPT/pull/1988"
3354
},
3455
{
35-
"type": "WEB",
56+
"type": "PACKAGE",
3657
"url": "https://github.com/FoundationAgents/MetaGPT"
3758
},
3859
{
@@ -53,8 +74,8 @@
5374
"CWE-74"
5475
],
5576
"severity": "MODERATE",
56-
"github_reviewed": false,
57-
"github_reviewed_at": null,
77+
"github_reviewed": true,
78+
"github_reviewed_at": "2026-05-06T18:41:01Z",
5879
"nvd_published_at": "2026-04-09T18:17:04Z"
5980
}
6081
}

advisories/unreviewed/2026/04/GHSA-h7xc-4mv8-59fj/GHSA-h7xc-4mv8-59fj.json renamed to advisories/github-reviewed/2026/04/GHSA-h7xc-4mv8-59fj/GHSA-h7xc-4mv8-59fj.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h7xc-4mv8-59fj",
4-
"modified": "2026-04-27T21:31:04Z",
4+
"modified": "2026-05-06T18:39:48Z",
55
"published": "2026-04-27T21:31:03Z",
66
"aliases": [
77
"CVE-2026-7158"
88
],
9+
"summary": "mcp-url-downloader has a Server-Side Request Forgery issue",
910
"details": "A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. Affected by this issue is the function _validate_url_safe of the file src/mcp_url_downloader/server.py. Such manipulation of the argument url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "PyPI",
25+
"name": "mcp-url-downloader"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"last_affected": "0.1.0"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -27,6 +48,10 @@
2748
"type": "WEB",
2849
"url": "https://github.com/dmitryglhf/url-download-mcp/issues/2"
2950
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/dmitryglhf/url-download-mcp"
54+
},
3055
{
3156
"type": "WEB",
3257
"url": "https://vuldb.com/submit/802062"
@@ -45,8 +70,8 @@
4570
"CWE-918"
4671
],
4772
"severity": "MODERATE",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-05-06T18:39:48Z",
5075
"nvd_published_at": "2026-04-27T21:16:44Z"
5176
}
5277
}

0 commit comments

Comments
 (0)