Skip to content

Commit 9632124

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2665-m8rg-c7xp GHSA-2hp3-cccc-h69r GHSA-7948-p5vf-r2m4 GHSA-83cp-rj94-v2g2 GHSA-8pgv-26pm-rgm8 GHSA-gcxp-xg77-798j GHSA-jcjg-5j5x-r2hc GHSA-jgr4-277v-42mv GHSA-rfh7-7v27-6p9r
1 parent 493d991 commit 9632124

9 files changed

Lines changed: 512 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-2665-m8rg-c7xp/GHSA-2665-m8rg-c7xp.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2665-m8rg-c7xp",
4+
"modified": "2026-02-22T03:30:26Z",
5+
"published": "2026-02-22T03:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2908"
8+
],
9+
"details": "A security vulnerability has been detected in Tenda HG9 300001138. Affected by this issue is some unknown functionality of the file /boaform/formLoopBack of the component Loopback Detection Configuration Endpoint. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2908"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/QIU-DIE/cve-nneeww/issues/10"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347217"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347217"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.755202"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-22T02:16:57Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-2hp3-cccc-h69r/GHSA-2hp3-cccc-h69r.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2hp3-cccc-h69r",
4+
"modified": "2026-02-22T03:30:27Z",
5+
"published": "2026-02-22T03:30:27Z",
6+
"aliases": [
7+
"CVE-2026-2906"
8+
],
9+
"details": "A security flaw has been discovered in Tenda HG9 300001138. Affected is an unknown function of the file /boaform/formSamba of the component Samba Configuration Endpoint. The manipulation of the argument sambaCap results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2906"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/QIU-DIE/cve-nneeww/issues/8"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347215"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347215"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.755193"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-22T02:16:57Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-7948-p5vf-r2m4/GHSA-7948-p5vf-r2m4.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7948-p5vf-r2m4",
4+
"modified": "2026-02-22T03:30:26Z",
5+
"published": "2026-02-22T03:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2903"
8+
],
9+
"details": "A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function check_and_merge_special_rules of the file src/parse/ast.cc. This manipulation causes null pointer dereference. The attack can only be executed locally. The exploit has been published and may be used. Patch name: febeb977936f9519a25d9fbd10ff8256358cdb97. It is suggested to install a patch to address this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2903"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/skvadrik/re2c/issues/571"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/skvadrik/re2c/issues/571#issuecomment-3837675101"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/skvadrik/re2c/commit/febeb977936f9519a25d9fbd10ff8256358cdb97"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/oneafter/0202/blob/main/re/repro"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/skvadrik/re2c"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?ctiid.347210"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?id.347210"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/?submit.755030"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-404"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": false,
65+
"github_reviewed_at": null,
66+
"nvd_published_at": "2026-02-22T01:16:00Z"
67+
}
68+
}

‎advisories/unreviewed/2026/02/GHSA-83cp-rj94-v2g2/GHSA-83cp-rj94-v2g2.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-83cp-rj94-v2g2",
4+
"modified": "2026-02-22T03:30:26Z",
5+
"published": "2026-02-22T03:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2905"
8+
],
9+
"details": "A vulnerability was identified in Tenda HG9 300001138. This impacts an unknown function of the file /boaform/formWlanSetup of the component Wireless Configuration Endpoint. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2905"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/QIU-DIE/cve-nneeww/issues/7"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347214"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347214"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.755167"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-22T02:16:56Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-8pgv-26pm-rgm8/GHSA-8pgv-26pm-rgm8.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8pgv-26pm-rgm8",
4+
"modified": "2026-02-22T03:30:26Z",
5+
"published": "2026-02-22T03:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2909"
8+
],
9+
"details": "A vulnerability was detected in Tenda HG9 300001138. This affects an unknown part of the file /boaform/formPing of the component Diagnostic Ping Endpoint. Performing a manipulation of the argument pingAddr results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2909"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/QIU-DIE/cve-nneeww/issues/11"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347218"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347218"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.755211"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-22T02:16:58Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-gcxp-xg77-798j/GHSA-gcxp-xg77-798j.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gcxp-xg77-798j",
4+
"modified": "2026-02-22T03:30:26Z",
5+
"published": "2026-02-22T03:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2898"
8+
],
9+
"details": "A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the component Backend Endpoint. The manipulation of the argument cloud_account results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2898"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/I4m6da/CVE/issues/5"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/I4m6da/CVE/issues/5#issue-3890444166"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.347209"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.347209"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.753976"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-20"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-22T01:16:00Z"
55+
}
56+
}

0 commit comments

Comments
 (0)