Advisory Database Sync

Author: advisory-database[bot]

advisories/unreviewed/2026/01/GHSA-6v4g-392h-r9mh/GHSA-6v4g-392h-r9mh.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6v4g-392h-r9mh",
-  "modified": "2026-01-15T00:31:38Z",
+  "modified": "2026-03-12T15:30:22Z",
   "published": "2026-01-14T18:31:36Z",
   "aliases": [
     "CVE-2025-14242"
@@ -31,6 +31,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:0608"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:4477"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/security/cve/CVE-2025-14242"

advisories/unreviewed/2026/02/GHSA-35x7-r658-wx7f/GHSA-35x7-r658-wx7f.json

@@ -1,13 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-35x7-r658-wx7f",
-  "modified": "2026-02-26T09:30:27Z",
+  "modified": "2026-03-12T15:30:23Z",
   "published": "2026-02-26T09:30:27Z",
   "aliases": [
     "CVE-2026-1698"
   ],
   "details": "A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior.\n\nThis vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout\nof the WebClient and WebScheduler web apps.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"

advisories/unreviewed/2026/02/GHSA-3fqx-3cg9-chg9/GHSA-3fqx-3cg9-chg9.json

@@ -1,13 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3fqx-3cg9-chg9",
-  "modified": "2026-02-26T09:30:27Z",
+  "modified": "2026-03-12T15:30:22Z",
   "published": "2026-02-26T09:30:27Z",
   "aliases": [
     "CVE-2026-1692"
   ],
   "details": "A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a successfully authenticated user to a malicious website.\n\nThis vulnerability only affects the following two endpoints: GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"

advisories/unreviewed/2026/02/GHSA-4r52-fgmg-vqxc/GHSA-4r52-fgmg-vqxc.json

@@ -1,13 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4r52-fgmg-vqxc",
-  "modified": "2026-02-26T09:30:27Z",
+  "modified": "2026-03-12T15:30:22Z",
   "published": "2026-02-26T09:30:27Z",
   "aliases": [
     "CVE-2026-1696"
   ],
   "details": "Some HTTP security headers are not properly set by the web server when sending responses to the client application.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"

advisories/unreviewed/2026/02/GHSA-4v7c-97mg-h3wh/GHSA-4v7c-97mg-h3wh.json

@@ -1,13 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4v7c-97mg-h3wh",
-  "modified": "2026-02-26T09:30:27Z",
+  "modified": "2026-03-12T15:30:23Z",
   "published": "2026-02-26T09:30:27Z",
   "aliases": [
     "CVE-2026-1697"
   ],
   "details": "The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"

advisories/unreviewed/2026/02/GHSA-5w3f-m935-fxvq/GHSA-5w3f-m935-fxvq.json

@@ -1,13 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-5w3f-m935-fxvq",
-  "modified": "2026-02-26T09:30:27Z",
+  "modified": "2026-03-12T15:30:22Z",
   "published": "2026-02-26T09:30:27Z",
   "aliases": [
     "CVE-2026-1693"
   ],
   "details": "The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"

advisories/unreviewed/2026/02/GHSA-6hjh-5rvg-rp2f/GHSA-6hjh-5rvg-rp2f.json

@@ -1,13 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6hjh-5rvg-rp2f",
-  "modified": "2026-02-26T09:30:27Z",
+  "modified": "2026-03-12T15:30:22Z",
   "published": "2026-02-26T09:30:27Z",
   "aliases": [
     "CVE-2026-1694"
   ],
   "details": "HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"

advisories/unreviewed/2026/02/GHSA-7693-hmcm-7whx/GHSA-7693-hmcm-7whx.json

@@ -1,13 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7693-hmcm-7whx",
-  "modified": "2026-02-26T09:30:27Z",
+  "modified": "2026-03-12T15:30:22Z",
   "published": "2026-02-26T09:30:27Z",
   "aliases": [
     "CVE-2026-1695"
   ],
   "details": "An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to trick a legitimate user into loading content from another site upon unsuccessful user authentication on an unknown application (unknown client_id).\n\nThis vulnerability only affects the error page of the OAuth server.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear"

advisories/unreviewed/2026/02/GHSA-7qq5-wfv8-hvvh/GHSA-7qq5-wfv8-hvvh.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7qq5-wfv8-hvvh",
-  "modified": "2026-02-02T15:30:34Z",
+  "modified": "2026-03-12T15:30:22Z",
   "published": "2026-02-02T15:30:34Z",
   "aliases": [
     "CVE-2026-1757"
@@ -26,6 +26,10 @@
     {
       "type": "WEB",
       "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435940"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009"
     }
   ],
   "database_specific": {

advisories/unreviewed/2026/03/GHSA-36j3-r3wc-mhg7/GHSA-36j3-r3wc-mhg7.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-36j3-r3wc-mhg7",
-  "modified": "2026-03-11T21:31:03Z",
+  "modified": "2026-03-12T15:30:24Z",
   "published": "2026-03-11T21:31:03Z",
   "aliases": [
     "CVE-2025-70024"
   ],
   "details": "An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command was discovered in benkeen generatedata 4.0.14.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2026-03-11T21:16:13Z"