Skip to content

Commit c720cdc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent db2017f commit c720cdc

25 files changed

Lines changed: 1180 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-2fx4-vwf2-pw99/GHSA-2fx4-vwf2-pw99.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2fx4-vwf2-pw99",
4+
"modified": "2026-02-27T09:30:29Z",
5+
"published": "2026-02-27T09:30:29Z",
6+
"aliases": [
7+
"CVE-2025-9909"
8+
],
9+
"details": "A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engineered administrator can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9909"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/errata/RHSA-2025:21768"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://access.redhat.com/errata/RHSA-2025:21775"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://access.redhat.com/errata/RHSA-2025:23069"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://access.redhat.com/errata/RHSA-2025:23131"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://access.redhat.com/security/cve/CVE-2025-9909"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392836"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-647"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-27T08:17:08Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-38mc-hhxh-4rgq/GHSA-38mc-hhxh-4rgq.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-38mc-hhxh-4rgq",
4+
"modified": "2026-02-27T09:30:29Z",
5+
"published": "2026-02-27T09:30:29Z",
6+
"aliases": [
7+
"CVE-2026-27776"
8+
],
9+
"details": "IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only when IM-LogicDesigner is deployed on the system. Arbitrary code may be executed when some crafted file is imported by a user with the administrative privilege.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27776"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://global.intra-mart.support/hc/en-us/articles/55266898383641"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://jvn.jp/en/jp/JVN80500630"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-502"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-27T08:17:09Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-3j9h-rxgh-gc62/GHSA-3j9h-rxgh-gc62.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3j9h-rxgh-gc62",
4+
"modified": "2026-02-27T09:30:29Z",
5+
"published": "2026-02-27T09:30:29Z",
6+
"aliases": [
7+
"CVE-2026-3302"
8+
],
9+
"details": "A weakness has been identified in SourceCodester Doctor Appointment System 1.0. Affected by this issue is some unknown functionality of the file /register.php of the component Sign Up Page. Executing a manipulation of the argument Email can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3302"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/rayficom/Proof-of-Concept/blob/main/20260219/README.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.348053"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.348053"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.762427"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-27T07:17:12Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-3mcc-r9wq-f9g6/GHSA-3mcc-r9wq-f9g6.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3mcc-r9wq-f9g6",
4+
"modified": "2026-02-27T09:30:29Z",
5+
"published": "2026-02-27T09:30:29Z",
6+
"aliases": [
7+
"CVE-2025-9907"
8+
],
9+
"details": "A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is in test mode. The possible outcome includes leakage of internal infrastructure details, accidental disclosure of user or system credentials, privilege escalation if high-value tokens are exposed, and persistent sensitive data exposure to all users with read access on the event stream.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9907"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/errata/RHSA-2025:19201"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://access.redhat.com/errata/RHSA-2025:19221"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://access.redhat.com/errata/RHSA-2025:23069"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://access.redhat.com/errata/RHSA-2025:23131"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://access.redhat.com/security/cve/CVE-2025-9907"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392834"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-200"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-27T08:17:06Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-42rf-xhpv-2c8q/GHSA-42rf-xhpv-2c8q.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-42rf-xhpv-2c8q",
4+
"modified": "2026-02-27T09:30:29Z",
5+
"published": "2026-02-27T09:30:29Z",
6+
"aliases": [
7+
"CVE-2025-14149"
8+
],
9+
"details": "The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link attribute in all versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14149"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3470049/xpro-elementor-addons/trunk/widgets/image-scroller/layout/frontend.php?old=3122565&old_path=xpro-elementor-addons%2Ftrunk%2Fwidgets%2Fimage-scroller%2Flayout%2Ffrontend.php"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5569e2fa-ce20-4ad0-8089-7c9ec792cc44?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-27T07:17:09Z"
39+
}
40+
}

‎advisories/unreviewed/2026/02/GHSA-5hwv-xjx8-73mr/GHSA-5hwv-xjx8-73mr.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5hwv-xjx8-73mr",
4+
"modified": "2026-02-27T09:30:29Z",
5+
"published": "2026-02-27T09:30:29Z",
6+
"aliases": [
7+
"CVE-2026-1626"
8+
],
9+
"details": "An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH communication, if they are able to intercept or interact with the network traffic.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1626"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://sick.com/psirt"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.first.org/cvss/calculator/3.1"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0005.json"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0005.pdf"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-327"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-27T09:16:15Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-7g5x-9c4v-4w5r/GHSA-7g5x-9c4v-4w5r.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7g5x-9c4v-4w5r",
4+
"modified": "2026-02-27T09:30:29Z",
5+
"published": "2026-02-27T09:30:29Z",
6+
"aliases": [
7+
"CVE-2025-12150"
8+
],
9+
"details": "A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: \"none\", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12150"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/keycloak/keycloak/issues/43723"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://access.redhat.com/errata/RHSA-2025:21370"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://access.redhat.com/errata/RHSA-2025:21371"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://access.redhat.com/errata/RHSA-2025:22088"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://access.redhat.com/errata/RHSA-2025:22089"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://access.redhat.com/security/cve/CVE-2025-12150"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406192"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-347"
54+
],
55+
"severity": "LOW",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-02-27T09:16:15Z"
59+
}
60+
}

0 commit comments

Comments
 (0)