Skip to content

Commit 8bdaa4b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 3335f0b commit 8bdaa4b

26 files changed

Lines changed: 693 additions & 17 deletions

File tree

‎advisories/unreviewed/2026/05/GHSA-2ch8-2mw7-grmm/GHSA-2ch8-2mw7-grmm.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2ch8-2mw7-grmm",
4+
"modified": "2026-05-07T15:38:40Z",
5+
"published": "2026-05-07T15:38:40Z",
6+
"aliases": [
7+
"CVE-2026-8092"
8+
],
9+
"details": "Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, and Firefox ESR 115.35.2.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8092"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1806249%2C2021977%2C2022576%2C2022722%2C2024439%2C2027883%2C2029463%2C2030323%2C2032042%2C2032043%2C2033270%2C2033637%2C2034422%2C2034496%2C2035879%2C2036516"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-40"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-41"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-42"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2026-05-07T13:16:14Z"
40+
}
41+
}

‎advisories/unreviewed/2026/05/GHSA-2xx6-qf7x-grqh/GHSA-2xx6-qf7x-grqh.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2xx6-qf7x-grqh",
4+
"modified": "2026-05-07T15:38:41Z",
5+
"published": "2026-05-07T15:38:41Z",
6+
"aliases": [
7+
"CVE-2025-63706"
8+
],
9+
"details": "NPM package next-npm-version1.0.1 is vulnerable to Command injection.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63706"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/afeiship/next-npm-version/issues/1"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://gist.github.com/6en6ar/607368f1fc8fe429f03c6e0d9486ba72"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://www.npmjs.com/package/@jswork/next-npm-version"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [],
32+
"severity": null,
33+
"github_reviewed": false,
34+
"github_reviewed_at": null,
35+
"nvd_published_at": "2026-05-07T15:16:04Z"
36+
}
37+
}

‎advisories/unreviewed/2026/05/GHSA-4345-ccpc-8955/GHSA-4345-ccpc-8955.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4345-ccpc-8955",
4+
"modified": "2026-05-07T15:38:40Z",
5+
"published": "2026-05-07T15:38:40Z",
6+
"aliases": [
7+
"CVE-2026-8090"
8+
],
9+
"details": "Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, and Firefox ESR 115.35.2.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8090"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2034352"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-40"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-41"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-42"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-416"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-05-07T13:16:13Z"
47+
}
48+
}

‎advisories/unreviewed/2026/05/GHSA-568w-37qx-3qc6/GHSA-568w-37qx-3qc6.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-568w-37qx-3qc6",
4+
"modified": "2026-05-07T15:38:42Z",
5+
"published": "2026-05-07T15:38:42Z",
6+
"aliases": [
7+
"CVE-2026-42011"
8+
],
9+
"details": "A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42011"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2026-42011"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-295"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-05-07T15:16:09Z"
39+
}
40+
}

‎advisories/unreviewed/2026/05/GHSA-5ghx-9783-29rc/GHSA-5ghx-9783-29rc.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5ghx-9783-29rc",
4+
"modified": "2026-05-07T15:38:40Z",
5+
"published": "2026-05-07T15:38:40Z",
6+
"aliases": [
7+
"CVE-2026-8094"
8+
],
9+
"details": "Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8094"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2035939"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://www.mozilla.org/security/advisories/mfsa2026-41"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-05-07T13:16:14Z"
32+
}
33+
}

‎advisories/unreviewed/2026/05/GHSA-7h2m-m8vj-598h/GHSA-7h2m-m8vj-598h.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7h2m-m8vj-598h",
4-
"modified": "2026-05-05T18:33:24Z",
4+
"modified": "2026-05-07T15:38:31Z",
55
"published": "2026-05-05T18:33:24Z",
66
"aliases": [
77
"CVE-2026-35192"
88
],
99
"details": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nResponse headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/05/GHSA-8f47-4rh3-x44m/GHSA-8f47-4rh3-x44m.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@
4242
],
4343
"database_specific": {
4444
"cwe_ids": [
45-
"CWE-200"
45+
"CWE-200",
46+
"CWE-312"
4647
],
4748
"severity": "MODERATE",
4849
"github_reviewed": false,

‎advisories/unreviewed/2026/05/GHSA-8jh2-3mw6-6pfm/GHSA-8jh2-3mw6-6pfm.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8jh2-3mw6-6pfm",
4+
"modified": "2026-05-07T15:38:41Z",
5+
"published": "2026-05-07T15:38:41Z",
6+
"aliases": [
7+
"CVE-2025-63705"
8+
],
9+
"details": "NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63705"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://gist.github.com/6en6ar/a2ac44da0f4e580190be3e66cfbb9a4a"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://www.npmjs.com/package/node-ts-ocr"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-05-07T15:16:04Z"
32+
}
33+
}

‎advisories/unreviewed/2026/05/GHSA-9439-7mjc-q3p7/GHSA-9439-7mjc-q3p7.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9439-7mjc-q3p7",
4+
"modified": "2026-05-07T15:38:40Z",
5+
"published": "2026-05-07T15:38:40Z",
6+
"aliases": [
7+
"CVE-2025-14341"
8+
],
9+
"details": "Improperly controlled modification of Dynamically-Determined object attributes, Allocation of resources without limits or throttling vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Excessive Allocation, Flooding.\n\nThis issue affects DivvyDrive: from 4.8.2.19 before 4.8.3.2.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14341"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0182"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-770"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-05-07T14:16:00Z"
35+
}
36+
}

‎advisories/unreviewed/2026/05/GHSA-c3xh-mwgm-9f7j/GHSA-c3xh-mwgm-9f7j.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c3xh-mwgm-9f7j",
4+
"modified": "2026-05-07T15:38:42Z",
5+
"published": "2026-05-07T15:38:42Z",
6+
"aliases": [
7+
"CVE-2026-36458"
8+
],
9+
"details": "ChestnutCMS v1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated in the admin backend and injected into a SQL query when the template is rendered.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-36458"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/errors11/CVE/blob/main/CVE-2026-36458.md"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/liweiyi/ChestnutCMS.git"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-05-07T15:16:05Z"
32+
}
33+
}

0 commit comments

Comments
 (0)