Skip to content

Commit bb98158

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2fmw-p7gw-97jj GHSA-38jp-gj76-pm7x GHSA-47ph-5j6m-fmgx GHSA-57jm-2xq8-jwj3 GHSA-7w2h-4285-9pwr GHSA-934v-v4wh-rf2c GHSA-cqj6-j4f4-mcpp GHSA-f256-j3x2-h7wh GHSA-fj46-cfm8-7pc4 GHSA-m8fj-fqgq-fj22 GHSA-mg73-f2jm-wph7 GHSA-qhmq-843h-9vq8 GHSA-r8mv-7fwh-cfvr GHSA-v2vh-hr2h-f29r GHSA-vq86-4hgw-x482 GHSA-vv96-h3xf-q33j GHSA-w3pf-j6xr-fj68 GHSA-x6c4-87pg-m84f GHSA-xqg5-5x64-93r9
1 parent b6c5c52 commit bb98158

19 files changed

Lines changed: 876 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-2fmw-p7gw-97jj/GHSA-2fmw-p7gw-97jj.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2fmw-p7gw-97jj",
4+
"modified": "2026-02-24T03:30:19Z",
5+
"published": "2026-02-24T03:30:19Z",
6+
"aliases": [
7+
"CVE-2025-11845"
8+
],
9+
"details": "A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11845"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-476"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-24T02:15:59Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-38jp-gj76-pm7x/GHSA-38jp-gj76-pm7x.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-38jp-gj76-pm7x",
4+
"modified": "2026-02-24T03:30:20Z",
5+
"published": "2026-02-24T03:30:20Z",
6+
"aliases": [
7+
"CVE-2026-3064"
8+
],
9+
"details": "A security vulnerability has been detected in HummerRisk up to 1.5.0. Affected by this issue is some unknown functionality of the file ResourceCreateService.java of the component Cloud Task Scheduler. Such manipulation of the argument regionId leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3064"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/AnalogyC0de/public_exp/issues/8"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347415"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347415"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.757695"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-24T03:16:03Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-47ph-5j6m-fmgx/GHSA-47ph-5j6m-fmgx.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-47ph-5j6m-fmgx",
4+
"modified": "2026-02-24T03:30:20Z",
5+
"published": "2026-02-24T03:30:20Z",
6+
"aliases": [
7+
"CVE-2026-3054"
8+
],
9+
"details": "A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3054"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.347412"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.347412"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.757609"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-79"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-24T03:16:02Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-57jm-2xq8-jwj3/GHSA-57jm-2xq8-jwj3.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-57jm-2xq8-jwj3",
4+
"modified": "2026-02-24T03:30:19Z",
5+
"published": "2026-02-24T03:30:19Z",
6+
"aliases": [
7+
"CVE-2026-3046"
8+
],
9+
"details": "A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This vulnerability affects unknown code of the file /check_profile_old.php. The manipulation of the argument profile_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3046"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ltranquility/cve_submit/issues/3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.347406"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.347406"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.757247"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-24T01:16:15Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-7w2h-4285-9pwr/GHSA-7w2h-4285-9pwr.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7w2h-4285-9pwr",
4+
"modified": "2026-02-24T03:30:19Z",
5+
"published": "2026-02-24T03:30:19Z",
6+
"aliases": [
7+
"CVE-2025-9120"
8+
],
9+
"details": "Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Carbonite Safe Server Backup allows Code Injection. \n\nThe vulnerability could be exploited through an open port, potentially allowing unauthorized access.\n\nThis issue affects Carbonite Safe Server Backup: through 6.8.3.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9120"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.carbonite.com/articles/Security-Bulletin-for-Carbonite-Safe-Server-Backup-09-12-2025"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-94"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-24T01:16:12Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-934v-v4wh-rf2c/GHSA-934v-v4wh-rf2c.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-934v-v4wh-rf2c",
4+
"modified": "2026-02-24T03:30:20Z",
5+
"published": "2026-02-24T03:30:20Z",
6+
"aliases": [
7+
"CVE-2025-13942"
8+
],
9+
"details": "A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UPnP SOAP requests.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13942"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-null-pointer-dereference-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-02-24-2026"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-78"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-24T03:16:00Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-cqj6-j4f4-mcpp/GHSA-cqj6-j4f4-mcpp.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cqj6-j4f4-mcpp",
4+
"modified": "2026-02-24T03:30:19Z",
5+
"published": "2026-02-24T03:30:19Z",
6+
"aliases": [
7+
"CVE-2026-3049"
8+
],
9+
"details": "A vulnerability was detected in horilla-opensource horilla up to 1.0.2. This issue affects the function get of the file horilla_generics/global_search.py of the component Query Parameter Handler. The manipulation of the argument prev_url results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.3 is capable of addressing this issue. The patch is identified as 730b5a44ff060916780c44a4bdbc8ced70a2cd27. The affected component should be upgraded.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3049"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/horilla-opensource/horilla-crm/commit/730b5a44ff060916780c44a4bdbc8ced70a2cd27"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/Stolichnayer/Horilla-CRM-Open-Redirect"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/horilla-opensource/horilla-crm/releases/tag/1.0.3"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.347407"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.347407"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.757296"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-601"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-02-24T01:16:16Z"
59+
}
60+
}

‎advisories/unreviewed/2026/02/GHSA-f256-j3x2-h7wh/GHSA-f256-j3x2-h7wh.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f256-j3x2-h7wh",
4+
"modified": "2026-02-24T03:30:19Z",
5+
"published": "2026-02-24T03:30:19Z",
6+
"aliases": [
7+
"CVE-2026-3051"
8+
],
9+
"details": "A vulnerability has been found in DataLinkDC dinky up to 1.2.5. The affected element is the function getProjectDir of the file dinky-admin/src/main/java/org/dinky/utils/GitRepository.java of the component Project Name Handler. Such manipulation of the argument projectName leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3051"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/AnalogyC0de/public_exp/issues/5"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/AnalogyC0de/public_exp/issues/5#issue-3935000629"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.347409"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.347409"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.757586"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-22"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-24T01:16:16Z"
55+
}
56+
}

0 commit comments

Comments
 (0)