Skip to content

Commit cba4aac

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent c690a6a commit cba4aac

53 files changed

Lines changed: 1497 additions & 34 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/01/GHSA-4p29-qhc7-mxqr/GHSA-4p29-qhc7-mxqr.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2026/01/GHSA-9jwr-p39p-hwg2/GHSA-9jwr-p39p-hwg2.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-120"
30+
],
2931
"severity": "HIGH",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2026/01/GHSA-9w9c-6cc9-mc59/GHSA-9w9c-6cc9-mc59.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9w9c-6cc9-mc59",
4-
"modified": "2026-01-04T00:30:16Z",
4+
"modified": "2026-02-27T00:31:42Z",
55
"published": "2026-01-02T18:30:33Z",
66
"aliases": [
77
"CVE-2025-34171"
88
],
99
"details": "Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/01/GHSA-jgfq-mgxg-4qwm/GHSA-jgfq-mgxg-4qwm.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jgfq-mgxg-4qwm",
4-
"modified": "2026-01-27T09:30:29Z",
4+
"modified": "2026-02-27T00:31:43Z",
55
"published": "2026-01-27T09:30:29Z",
66
"aliases": [
77
"CVE-2026-21721"
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-863"
30+
],
2931
"severity": "HIGH",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2026/01/GHSA-m62x-gm5x-3x29/GHSA-m62x-gm5x-3x29.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-770"
30+
],
2931
"severity": "HIGH",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2026/01/GHSA-pc4j-j33v-hr73/GHSA-pc4j-j33v-hr73.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,9 @@
2929
}
3030
],
3131
"database_specific": {
32-
"cwe_ids": [],
32+
"cwe_ids": [
33+
"CWE-120"
34+
],
3335
"severity": "HIGH",
3436
"github_reviewed": false,
3537
"github_reviewed_at": null,

‎advisories/unreviewed/2026/01/GHSA-w4ch-7p82-3m56/GHSA-w4ch-7p82-3m56.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-w4ch-7p82-3m56",
4-
"modified": "2026-01-23T18:31:28Z",
4+
"modified": "2026-02-27T00:31:43Z",
55
"published": "2026-01-23T18:31:28Z",
66
"aliases": [
77
"CVE-2026-22979"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix memory leak in skb_segment_list for GRO packets\n\nWhen skb_segment_list() is called during packet forwarding, it handles\npackets that were aggregated by the GRO engine.\n\nHistorically, the segmentation logic in skb_segment_list assumes that\nindividual segments are split from a parent SKB and may need to carry\ntheir own socket memory accounting. Accordingly, the code transfers\ntruesize from the parent to the newly created segments.\n\nPrior to commit ed4cccef64c1 (\"gro: fix ownership transfer\"), this\ntruesize subtraction in skb_segment_list() was valid because fragments\nstill carry a reference to the original socket.\n\nHowever, commit ed4cccef64c1 (\"gro: fix ownership transfer\") changed\nthis behavior by ensuring that fraglist entries are explicitly\norphaned (skb->sk = NULL) to prevent illegal orphaning later in the\nstack. This change meant that the entire socket memory charge remained\nwith the head SKB, but the corresponding accounting logic in\nskb_segment_list() was never updated.\n\nAs a result, the current code unconditionally adds each fragment's\ntruesize to delta_truesize and subtracts it from the parent SKB. Since\nthe fragments are no longer charged to the socket, this subtraction\nresults in an effective under-count of memory when the head is freed.\nThis causes sk_wmem_alloc to remain non-zero, preventing socket\ndestruction and leading to a persistent memory leak.\n\nThe leak can be observed via KMEMLEAK when tearing down the networking\nenvironment:\n\nunreferenced object 0xffff8881e6eb9100 (size 2048):\n comm \"ping\", pid 6720, jiffies 4295492526\n backtrace:\n kmem_cache_alloc_noprof+0x5c6/0x800\n sk_prot_alloc+0x5b/0x220\n sk_alloc+0x35/0xa00\n inet6_create.part.0+0x303/0x10d0\n __sock_create+0x248/0x640\n __sys_socket+0x11b/0x1d0\n\nSince skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST\npackets constructed by GRO, the truesize adjustment is removed.\n\nThe call to skb_release_head_state() must be preserved. As documented in\ncommit cf673ed0e057 (\"net: fix fraglist segmentation reference count\nleak\"), it is still required to correctly drop references to SKB\nextensions that may be overwritten during __copy_skb_header().",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -36,8 +41,10 @@
3641
}
3742
],
3843
"database_specific": {
39-
"cwe_ids": [],
40-
"severity": null,
44+
"cwe_ids": [
45+
"CWE-401"
46+
],
47+
"severity": "MODERATE",
4148
"github_reviewed": false,
4249
"github_reviewed_at": null,
4350
"nvd_published_at": "2026-01-23T16:15:53Z"

‎advisories/unreviewed/2026/02/GHSA-24q2-h758-fvwc/GHSA-24q2-h758-fvwc.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-24q2-h758-fvwc",
4+
"modified": "2026-02-27T00:31:45Z",
5+
"published": "2026-02-27T00:31:45Z",
6+
"aliases": [
7+
"CVE-2026-20791"
8+
],
9+
"details": "Charging station authentication identifiers are publicly accessible via web-based mapping platforms.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20791"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://chargemap.com/en-us/support"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-05.json"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-05"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-522"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-27T00:16:56Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-2g52-f4rf-8vm9/GHSA-2g52-f4rf-8vm9.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2g52-f4rf-8vm9",
4-
"modified": "2026-02-18T21:31:23Z",
4+
"modified": "2026-02-27T00:31:44Z",
55
"published": "2026-02-18T21:31:23Z",
66
"aliases": [
77
"CVE-2025-12343"

‎advisories/unreviewed/2026/02/GHSA-2wp6-xhp6-g2gw/GHSA-2wp6-xhp6-g2gw.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2wp6-xhp6-g2gw",
4+
"modified": "2026-02-27T00:31:45Z",
5+
"published": "2026-02-27T00:31:45Z",
6+
"aliases": [
7+
"CVE-2026-25113"
8+
],
9+
"details": "The WebSocket Application Programming Interface lacks restrictions on \nthe number of authentication requests. This absence of rate limiting may\n allow an attacker to conduct denial-of-service attacks by suppressing \nor mis-routing legitimate charger telemetry, or conduct brute-force \nattacks to gain unauthorized access.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25113"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-06.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://swtchenergy.com/contact"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-06"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-307"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-27T00:16:56Z"
43+
}
44+
}

0 commit comments

Comments
 (0)