Skip to content

Commit ae71970

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent cba4aac commit ae71970

43 files changed

Lines changed: 1953 additions & 2 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/02/GHSA-26rx-qf83-fc58/GHSA-26rx-qf83-fc58.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-26rx-qf83-fc58",
4+
"modified": "2026-02-27T03:30:27Z",
5+
"published": "2026-02-27T03:30:27Z",
6+
"aliases": [
7+
"CVE-2026-24452"
8+
],
9+
"details": "An OS command injection \n vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an \nauthenticated attacker to achieve remote code execution on the system by\n supplying a crafted template file to the devices route.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24452"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-78"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-27T02:16:18Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-28pj-7rwg-vxrf/GHSA-28pj-7rwg-vxrf.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-28pj-7rwg-vxrf",
4+
"modified": "2026-02-27T03:30:26Z",
5+
"published": "2026-02-27T03:30:26Z",
6+
"aliases": [
7+
"CVE-2026-25774"
8+
],
9+
"details": "Charging station authentication identifiers are publicly accessible via web-based mapping platforms.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25774"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-07.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-07"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.ev.energy/en-us"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-522"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-27T01:16:20Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-5m2v-c6pj-9qqh/GHSA-5m2v-c6pj-9qqh.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5m2v-c6pj-9qqh",
4+
"modified": "2026-02-27T03:30:26Z",
5+
"published": "2026-02-27T03:30:26Z",
6+
"aliases": [
7+
"CVE-2026-24663"
8+
],
9+
"details": "An OS command injection vulnerability exists in XWEB Pro version 1.12.1 \nand prior, enabling an unauthenticated attacker to achieve remote code \nexecution on the system by sending a crafted request to the libraries \ninstallation route and injecting malicious input into the request body.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24663"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-78"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-27T01:16:18Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-5wgh-57jj-2j34/GHSA-5wgh-57jj-2j34.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5wgh-57jj-2j34",
4+
"modified": "2026-02-27T03:30:27Z",
5+
"published": "2026-02-27T03:30:27Z",
6+
"aliases": [
7+
"CVE-2026-25196"
8+
],
9+
"details": "An OS command injection \nvulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an \nauthenticated attacker to achieve remote code execution on the system by\n injecting malicious input into the Wi-Fi SSID and/or password fields \ncan lead to remote code execution when the configuration is processed.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25196"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-78"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-27T02:16:20Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-6pvr-hxgm-74hg/GHSA-6pvr-hxgm-74hg.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6pvr-hxgm-74hg",
4+
"modified": "2026-02-27T03:30:26Z",
5+
"published": "2026-02-27T03:30:26Z",
6+
"aliases": [
7+
"CVE-2026-20910"
8+
],
9+
"details": "An OS command injection \nvulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an \nauthenticated attacker to achieve remote code execution on the system by\n injecting malicious input into the devices field of the firmware update\n update action to achieve remote code execution.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20910"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-78"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-27T01:16:17Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-6xjh-63ff-92mc/GHSA-6xjh-63ff-92mc.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6xjh-63ff-92mc",
4+
"modified": "2026-02-27T03:30:26Z",
5+
"published": "2026-02-27T03:30:26Z",
6+
"aliases": [
7+
"CVE-2021-4456"
8+
],
9+
"details": "Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.\n\nThe functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.\n\nThe documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4456"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://metacpan.org/dist/Net-CIDR/changes"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [
32+
"CWE-704"
33+
],
34+
"severity": null,
35+
"github_reviewed": false,
36+
"github_reviewed_at": null,
37+
"nvd_published_at": "2026-02-27T01:16:13Z"
38+
}
39+
}

‎advisories/unreviewed/2026/02/GHSA-7r34-g88h-g49f/GHSA-7r34-g88h-g49f.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7r34-g88h-g49f",
4+
"modified": "2026-02-27T03:30:26Z",
5+
"published": "2026-02-27T03:30:26Z",
6+
"aliases": [
7+
"CVE-2026-21718"
8+
],
9+
"details": "An authentication bypass vulnerability exists in Copeland XWEB Pro \nversion 1.12.1 and prior, enabling any attackers to bypass the \nauthentication requirement and achieve pre-authenticated code execution \non the system.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21718"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-327"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-27T01:16:18Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-92fm-h5h6-cjf9/GHSA-92fm-h5h6-cjf9.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-92fm-h5h6-cjf9",
4+
"modified": "2026-02-27T03:30:26Z",
5+
"published": "2026-02-27T03:30:26Z",
6+
"aliases": [
7+
"CVE-2026-21389"
8+
],
9+
"details": "An OS command injection \nvulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an \nauthenticated attacker to achieve remote code execution on the system by\n injecting malicious input into the request body sent to the contacts \nimport route.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21389"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-78"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-27T01:16:17Z"
43+
}
44+
}

0 commit comments

Comments
 (0)