Skip to content

Commit 8fca93b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5fj6-q8x2-56g8 GHSA-hg24-p7xv-jhq8 GHSA-25fg-84xv-353x GHSA-445m-jc4j-p5gf GHSA-5c89-ppg6-hr22 GHSA-5fjm-c352-35cv GHSA-5jxj-w72m-5c8f GHSA-769c-phxp-jfff GHSA-79wq-mgjf-5cc2 GHSA-7gjx-r4jj-vjx7 GHSA-8rxc-fxqr-8jx3 GHSA-cqhp-94c2-gjjc GHSA-cwm4-pqjw-r7wj GHSA-f5x4-gf23-wqm9 GHSA-ffq4-j9j8-23g6 GHSA-frr2-5qjr-h4hw GHSA-j5q3-pwqh-x9p9 GHSA-jvjc-r7p7-fpch GHSA-mfj7-9xw3-8j4j GHSA-qvmh-94p6-pp46 GHSA-rh96-w7cw-pph4 GHSA-w49q-28cv-9prc GHSA-wm74-pvww-q7h2 GHSA-wv7p-q4p2-p6pf
1 parent 3594786 commit 8fca93b

File tree

24 files changed

+697
-9
lines changed

24 files changed

+697
-9
lines changed

‎advisories/unreviewed/2026/01/GHSA-5fj6-q8x2-56g8/GHSA-5fj6-q8x2-56g8.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5fj6-q8x2-56g8",
4-
"modified": "2026-01-16T21:30:36Z",
4+
"modified": "2026-03-23T21:30:49Z",
55
"published": "2026-01-16T18:31:33Z",
66
"aliases": [
77
"CVE-2025-51602"
@@ -23,6 +23,10 @@
2323
"type": "WEB",
2424
"url": "https://code.videolan.org/videolan/vlc/-/issues/29146"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://lists.debian.org/debian-lts-announce/2026/03/msg00011.html"
29+
},
2630
{
2731
"type": "WEB",
2832
"url": "https://www.videolan.org/security/sb-vlc3022.html"

‎advisories/unreviewed/2026/02/GHSA-hg24-p7xv-jhq8/GHSA-hg24-p7xv-jhq8.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hg24-p7xv-jhq8",
4-
"modified": "2026-02-13T12:31:21Z",
4+
"modified": "2026-03-23T21:30:49Z",
55
"published": "2026-02-13T12:31:21Z",
66
"aliases": [
77
"CVE-2026-2443"
@@ -26,6 +26,10 @@
2626
{
2727
"type": "WEB",
2828
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439671"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/487"
2933
}
3034
],
3135
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-25fg-84xv-353x/GHSA-25fg-84xv-353x.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-25fg-84xv-353x",
4+
"modified": "2026-03-23T21:30:51Z",
5+
"published": "2026-03-23T21:30:51Z",
6+
"aliases": [
7+
"CVE-2026-2298"
8+
],
9+
"details": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2026.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2298"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://help.salesforce.com/s/articleView?id=005299346&type=1"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-88"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-03-23T20:16:25Z"
30+
}
31+
}

‎advisories/unreviewed/2026/03/GHSA-445m-jc4j-p5gf/GHSA-445m-jc4j-p5gf.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-445m-jc4j-p5gf",
4+
"modified": "2026-03-23T21:30:52Z",
5+
"published": "2026-03-23T21:30:52Z",
6+
"aliases": [
7+
"CVE-2026-4368"
8+
],
9+
"details": "Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4368"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "HIGH",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-23T21:17:17Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-5c89-ppg6-hr22/GHSA-5c89-ppg6-hr22.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5c89-ppg6-hr22",
4+
"modified": "2026-03-23T21:30:51Z",
5+
"published": "2026-03-23T21:30:51Z",
6+
"aliases": [
7+
"CVE-2026-0898"
8+
],
9+
"details": "An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. This vulnerability does not affect Robot Runtime users. A bad actor could create a website that includes malicious code. The vulnerability may be exploited if a Pega Robot Studio developer is deceived into visiting this website during interrogation mode in Robot Studio.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0898"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.pega.com/support-doc/pega-security-advisory-p25-vulnerability-remediation-note"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-284"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-23T19:16:39Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-5fjm-c352-35cv/GHSA-5fjm-c352-35cv.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5fjm-c352-35cv",
4+
"modified": "2026-03-23T21:30:52Z",
5+
"published": "2026-03-23T21:30:52Z",
6+
"aliases": [
7+
"CVE-2026-32851"
8+
],
9+
"details": "MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the Attendees parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32851"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://karmainsecurity.com/KIS-2026-05"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://mailenable.com/Standard-ReleaseNotes.txt"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.mailenable.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.mailenable.com/rss/article.asp?Source=RSSADMIN&ID=MAILENABLEVERSION1055"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.vulncheck.com/advisories/mailenable-reflected-xss-via-freebusy-aspx-attendees-parameter"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-23T20:16:27Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-5jxj-w72m-5c8f/GHSA-5jxj-w72m-5c8f.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5jxj-w72m-5c8f",
4-
"modified": "2026-03-23T18:30:31Z",
4+
"modified": "2026-03-23T21:30:51Z",
55
"published": "2026-03-23T18:30:31Z",
66
"aliases": [
77
"CVE-2026-32845"
88
],
99
"details": "cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors that allows attackers to trigger out-of-bounds reads by supplying crafted glTF/GLB input files with attacker-controlled size values. Attackers can exploit unchecked arithmetic operations in sparse accessor validation to cause heap buffer over-reads in cgltf_calc_index_bound(), resulting in denial of service crashes and potential memory disclosure.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/03/GHSA-769c-phxp-jfff/GHSA-769c-phxp-jfff.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-769c-phxp-jfff",
4-
"modified": "2026-03-17T18:30:33Z",
4+
"modified": "2026-03-23T21:30:49Z",
55
"published": "2026-03-17T18:30:33Z",
66
"aliases": [
77
"CVE-2026-32292"
@@ -23,6 +23,10 @@
2323
"type": "ADVISORY",
2424
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32292"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://dl.gl-inet.com/release/kvm/release/RM1/1.7.2"
29+
},
2630
{
2731
"type": "WEB",
2832
"url": "https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network"

‎advisories/unreviewed/2026/03/GHSA-79wq-mgjf-5cc2/GHSA-79wq-mgjf-5cc2.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-79wq-mgjf-5cc2",
4+
"modified": "2026-03-23T21:30:51Z",
5+
"published": "2026-03-23T21:30:51Z",
6+
"aliases": [
7+
"CVE-2025-52204"
8+
],
9+
"details": "A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52204"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/j0qq3r/CVE-2025-52204"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://znuny.com"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "http://znunyitsm.com"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [],
32+
"severity": null,
33+
"github_reviewed": false,
34+
"github_reviewed_at": null,
35+
"nvd_published_at": "2026-03-23T20:16:23Z"
36+
}
37+
}

‎advisories/unreviewed/2026/03/GHSA-7gjx-r4jj-vjx7/GHSA-7gjx-r4jj-vjx7.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7gjx-r4jj-vjx7",
4+
"modified": "2026-03-23T21:30:51Z",
5+
"published": "2026-03-23T21:30:51Z",
6+
"aliases": [
7+
"CVE-2025-15606"
8+
],
9+
"details": "A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitization, allows crafted requests to trigger a processing error that causes the httpd service to crash. Successful exploitation may allow the attacker to cause service interruption, resulting in a DoS condition.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15606"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.tp-link.com/en/support/download/td-w8961n/v4/#Firmware"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.tp-link.com/us/support/faq/5028"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-20"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-23T19:16:38Z"
39+
}
40+
}

0 commit comments

Comments
 (0)