Skip to content

Commit 057b01c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5h6h-2wjp-jc72 GHSA-69w3-r845-3855 GHSA-6pq9-8556-qr3w GHSA-86mw-26q3-c8pr GHSA-h2gf-w3wm-8xqj GHSA-qr22-6jgj-x8qh GHSA-v8wq-rjpf-669f GHSA-xv4p-823r-9vr8
1 parent 17b574b commit 057b01c

8 files changed

Lines changed: 276 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/04/GHSA-5h6h-2wjp-jc72/GHSA-5h6h-2wjp-jc72.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5h6h-2wjp-jc72",
4+
"modified": "2026-04-07T06:30:27Z",
5+
"published": "2026-04-07T06:30:27Z",
6+
"aliases": [
7+
"CVE-2026-20433"
8+
],
9+
"details": "In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01088681; Issue ID: MSV-4460.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20433"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://corp.mediatek.com/product-security-bulletin/April-2026"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-787"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-07T04:17:12Z"
30+
}
31+
}

‎advisories/unreviewed/2026/04/GHSA-69w3-r845-3855/GHSA-69w3-r845-3855.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-69w3-r845-3855",
4+
"modified": "2026-04-07T06:30:28Z",
5+
"published": "2026-04-07T06:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1839"
8+
],
9+
"details": "A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as `rng_state.pth`, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1839"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/huggingface/transformers/commit/03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://huntr.com/bounties/3c77bb97-e493-493d-9a88-c57f5c536485"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-502"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-07T06:16:41Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-6pq9-8556-qr3w/GHSA-6pq9-8556-qr3w.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6pq9-8556-qr3w",
4+
"modified": "2026-04-07T06:30:27Z",
5+
"published": "2026-04-07T06:30:27Z",
6+
"aliases": [
7+
"CVE-2026-20431"
8+
],
9+
"details": "In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01106496; Issue ID: MSV-4467.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20431"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://corp.mediatek.com/product-security-bulletin/April-2026"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-770"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-07T04:16:59Z"
30+
}
31+
}

‎advisories/unreviewed/2026/04/GHSA-86mw-26q3-c8pr/GHSA-86mw-26q3-c8pr.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-86mw-26q3-c8pr",
4+
"modified": "2026-04-07T06:30:27Z",
5+
"published": "2026-04-07T06:30:27Z",
6+
"aliases": [
7+
"CVE-2026-20432"
8+
],
9+
"details": "In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01406170; Issue ID: MSV-4461.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20432"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://corp.mediatek.com/product-security-bulletin/April-2026"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-787"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-07T04:17:12Z"
30+
}
31+
}

‎advisories/unreviewed/2026/04/GHSA-h2gf-w3wm-8xqj/GHSA-h2gf-w3wm-8xqj.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h2gf-w3wm-8xqj",
4+
"modified": "2026-04-07T06:30:27Z",
5+
"published": "2026-04-07T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-65115"
8+
],
9+
"details": "Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65115"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-118/index.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-73"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-07T06:16:40Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-qr22-6jgj-x8qh/GHSA-qr22-6jgj-x8qh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qr22-6jgj-x8qh",
4+
"modified": "2026-04-07T06:30:27Z",
5+
"published": "2026-04-07T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-65116"
8+
],
9+
"details": "Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65116"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-118/index.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-763"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-07T06:16:41Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-v8wq-rjpf-669f/GHSA-v8wq-rjpf-669f.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v8wq-rjpf-669f",
4+
"modified": "2026-04-07T06:30:27Z",
5+
"published": "2026-04-07T06:30:27Z",
6+
"aliases": [
7+
"CVE-2026-0740"
8+
],
9+
"details": "The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0740"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://ninjaforms.com/extensions/file-uploads"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0b606ded-ab50-486a-9337-97ee9f452f12?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-434"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-07T05:16:06Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-xv4p-823r-9vr8/GHSA-xv4p-823r-9vr8.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xv4p-823r-9vr8",
4+
"modified": "2026-04-07T06:30:27Z",
5+
"published": "2026-04-07T06:30:27Z",
6+
"aliases": [
7+
"CVE-2026-20446"
8+
],
9+
"details": "In sec boot, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service, if an attacker has physical access to the device, with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09963054; Issue ID: MSV-3899.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20446"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://corp.mediatek.com/product-security-bulletin/April-2026"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-787"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-07T04:17:13Z"
30+
}
31+
}

0 commit comments

Comments
 (0)