Publish Advisories

GHSA-5882-5rx9-xgxp
GHSA-2mcm-79hx-8fxw
GHSA-33mw-q7rj-mjwj
GHSA-xxpj-q764-9r6q

Author: advisory-database[bot]

advisories/github-reviewed/2026/01/GHSA-5882-5rx9-xgxp/GHSA-5882-5rx9-xgxp.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-5882-5rx9-xgxp",
-  "modified": "2026-02-12T20:09:29Z",
+  "modified": "2026-06-05T16:23:37Z",
   "published": "2026-01-16T20:59:16Z",
   "aliases": [
     "CVE-2026-26216"
@@ -44,6 +44,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26216"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/crawl4ai/PYSEC-2026-33.yaml"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/unclecode/crawl4ai"

advisories/github-reviewed/2026/02/GHSA-2mcm-79hx-8fxw/GHSA-2mcm-79hx-8fxw.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2mcm-79hx-8fxw",
-  "modified": "2026-02-03T19:22:54Z",
+  "modified": "2026-06-05T16:23:51Z",
   "published": "2026-02-03T15:30:23Z",
   "aliases": [
     "CVE-2025-13473"
@@ -86,6 +86,10 @@
       "type": "PACKAGE",
       "url": "https://github.com/django/django"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-42.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://groups.google.com/g/django-announce"

advisories/github-reviewed/2026/02/GHSA-33mw-q7rj-mjwj/GHSA-33mw-q7rj-mjwj.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-33mw-q7rj-mjwj",
-  "modified": "2026-02-03T19:29:47Z",
+  "modified": "2026-06-05T16:24:05Z",
   "published": "2026-02-03T15:30:23Z",
   "aliases": [
     "CVE-2025-14550"
@@ -90,6 +90,10 @@
       "type": "PACKAGE",
       "url": "https://github.com/django/django"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-43.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://groups.google.com/g/django-announce"

advisories/github-reviewed/2026/06/GHSA-xxpj-q764-9r6q/GHSA-xxpj-q764-9r6q.json

@@ -0,0 +1,64 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xxpj-q764-9r6q",
+  "modified": "2026-06-05T16:22:29Z",
+  "published": "2026-06-05T16:22:28Z",
+  "aliases": [
+    "CVE-2026-47388"
+  ],
+  "summary": "NocoDB: Missing Ownership Check in MCP Attachment Read",
+  "details": "### Summary\nA low-privilege MCP token holder with knowledge of an attachment path could read any\nfile in shared storage, including attachments belonging to other bases and workspaces,\nbecause the MCP `readAttachment` tool did not verify the file's ownership.\n\n### Details\nThe MCP `readAttachment` tool accepts caller-supplied `path`/`url` values and streams\nthe file via the storage adapter. The handler now looks up the path in\n`nc_file_references` and requires a non-deleted row whose `base_id` matches the\ncaller's MCP context before streaming; otherwise it returns\n`Attachment is not accessible from this MCP context`. The lookup tolerates both\n`download/uploads/...` and `uploads/...` styles.\n\n### Impact\nArbitrary read against shared storage scoped to attachments the caller's MCP context\nshould not see. Exploitation requires an MCP token and a known attachment path.\n\n### Credit\nThis issue was reported by [@helwor-01](https://github.com/helwor-01).",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "nocodb"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2026.05.1"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 2026.05.0"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-xxpj-q764-9r6q"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/nocodb/nocodb"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nocodb/nocodb/releases/tag/2026.05.1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-639"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-06-05T16:22:28Z",
+    "nvd_published_at": null
+  }
+}