Skip to content

Commit ace7bff

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5rv4-3jvj-f68v GHSA-6m36-rgr7-cxwp GHSA-72rq-263w-2jx8 GHSA-9rv8-797j-7r85 GHSA-m5mm-h952-fxjj GHSA-m69x-r9q9-whf9 GHSA-p2r3-72mr-vwg2 GHSA-w6qc-qw25-92c3 GHSA-xcgv-f626-23hx
1 parent 03f1c80 commit ace7bff

9 files changed

Lines changed: 454 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-5rv4-3jvj-f68v/GHSA-5rv4-3jvj-f68v.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5rv4-3jvj-f68v",
4+
"modified": "2026-02-23T03:30:21Z",
5+
"published": "2026-02-23T03:30:21Z",
6+
"aliases": [
7+
"CVE-2026-2960"
8+
],
9+
"details": "A flaw has been found in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_468D64 of the file /boafrm/formDhcpv6s. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2960"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-66-LX/cve-new/issues/27"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347327"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347327"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.754512"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.dlink.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-23T01:16:17Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-6m36-rgr7-cxwp/GHSA-6m36-rgr7-cxwp.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6m36-rgr7-cxwp",
4+
"modified": "2026-02-23T03:30:22Z",
5+
"published": "2026-02-23T03:30:21Z",
6+
"aliases": [
7+
"CVE-2026-2961"
8+
],
9+
"details": "A vulnerability has been found in D-Link DWR-M960 1.01.07. This affects the function sub_4196C4 of the file /boafrm/formVpnConfigSetup of the component VPN Configuration Endpoint. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2961"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-66-LX/cve-new/issues/28"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347328"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347328"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.754513"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.dlink.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-23T01:16:17Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-72rq-263w-2jx8/GHSA-72rq-263w-2jx8.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-72rq-263w-2jx8",
4+
"modified": "2026-02-23T03:30:22Z",
5+
"published": "2026-02-23T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-2964"
8+
],
9+
"details": "A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1. Impacted is the function extend in the library lib/WebAudioRecorder.js of the component Dynamic Config Handling. Such manipulation leads to improperly controlled modification of object prototype attributes. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2964"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.347331"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.347331"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.755221"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-94"
42+
],
43+
"severity": "LOW",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-23T02:16:39Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-9rv8-797j-7r85/GHSA-9rv8-797j-7r85.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9rv8-797j-7r85",
4+
"modified": "2026-02-23T03:30:22Z",
5+
"published": "2026-02-23T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-24494"
8+
],
9+
"details": "SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticated attacker to access sensitive backend database data via a crafted store_id parameter in a POST request.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24494"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.spartanssec.com/post/multiple-unauthenticated-sql-injection-vulnerabilities"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-23T02:16:39Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-m5mm-h952-fxjj/GHSA-m5mm-h952-fxjj.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m5mm-h952-fxjj",
4+
"modified": "2026-02-23T03:30:22Z",
5+
"published": "2026-02-23T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-2966"
8+
],
9+
"details": "A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2966"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/mg_sendnsreq.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/mg_sendnsreq.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.347333"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.347333"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.755304"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [],
49+
"severity": "MODERATE",
50+
"github_reviewed": false,
51+
"github_reviewed_at": null,
52+
"nvd_published_at": "2026-02-23T03:15:59Z"
53+
}
54+
}

‎advisories/unreviewed/2026/02/GHSA-m69x-r9q9-whf9/GHSA-m69x-r9q9-whf9.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m69x-r9q9-whf9",
4+
"modified": "2026-02-23T03:30:22Z",
5+
"published": "2026-02-23T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-2963"
8+
],
9+
"details": "A vulnerability was determined in Jinher OA C6 up to 20260210. This issue affects some unknown processing of the file /C6/Jhsoft.Web.officesupply/OfficeSupplyTypeRight.aspx. This manipulation of the argument id/offsnum causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2963"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.347330"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.347330"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.755216"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuln.ricky.place/Jinher/C6"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-23T01:16:18Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-p2r3-72mr-vwg2/GHSA-p2r3-72mr-vwg2.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p2r3-72mr-vwg2",
4+
"modified": "2026-02-23T03:30:22Z",
5+
"published": "2026-02-23T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-2962"
8+
],
9+
"details": "A vulnerability was found in D-Link DWR-M960 1.01.07. This vulnerability affects the function sub_460F30 of the file /boafrm/formDateReboot of the component Scheduled Reboot Configuration Endpoint. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2962"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-66-LX/cve-new/issues/29"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347329"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347329"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.754517"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.dlink.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-23T01:16:17Z"
55+
}
56+
}

0 commit comments

Comments
 (0)