Skip to content

Commit 21a6732

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6jrq-hjxp-2x5r GHSA-7f6p-98mw-r63r GHSA-97q5-qf47-hvrw GHSA-mqx2-c63m-7p93 GHSA-pccm-93c8-h8qm GHSA-v758-4p42-wqcm GHSA-whhc-f8fh-m5cr GHSA-xh63-cv27-942f
1 parent 64c9b16 commit 21a6732

8 files changed

Lines changed: 226 additions & 2 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-6jrq-hjxp-2x5r/GHSA-6jrq-hjxp-2x5r.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6jrq-hjxp-2x5r",
4-
"modified": "2026-04-02T21:32:52Z",
4+
"modified": "2026-04-21T12:30:24Z",
55
"published": "2026-03-31T15:31:56Z",
66
"aliases": [
77
"CVE-2026-3308"
@@ -31,6 +31,10 @@
3131
"type": "WEB",
3232
"url": "https://github.com/ArtifexSoftware/mupdf"
3333
},
34+
{
35+
"type": "WEB",
36+
"url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00020.html"
37+
},
3438
{
3539
"type": "WEB",
3640
"url": "https://www.kb.cert.org/vuls/id/951662"

‎advisories/unreviewed/2026/04/GHSA-7f6p-98mw-r63r/GHSA-7f6p-98mw-r63r.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7f6p-98mw-r63r",
4+
"modified": "2026-04-21T12:30:24Z",
5+
"published": "2026-04-21T12:30:24Z",
6+
"aliases": [
7+
"CVE-2026-41036"
8+
],
9+
"details": "This vulnerability exists in Quantum Networks router due to inadequate sanitization of user-supplied input in the management CLI interface. An authenticated remote attacker could exploit this vulnerability by injecting arbitrary OS commands on the targeted device.\n\nSuccessful exploitation of this vulnerability could allow the attacker to perform remote code execution with root privileges on the targeted device.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41036"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0200"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-78"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-21T10:16:30Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-97q5-qf47-hvrw/GHSA-97q5-qf47-hvrw.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-97q5-qf47-hvrw",
4-
"modified": "2026-04-16T18:31:22Z",
4+
"modified": "2026-04-21T12:30:24Z",
55
"published": "2026-04-16T18:31:22Z",
66
"aliases": [
77
"CVE-2026-41082"
@@ -26,6 +26,10 @@
2626
{
2727
"type": "WEB",
2828
"url": "https://github.com/ocaml/opam/releases/tag/2.5.1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00021.html"
2933
}
3034
],
3135
"database_specific": {

‎advisories/unreviewed/2026/04/GHSA-mqx2-c63m-7p93/GHSA-mqx2-c63m-7p93.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mqx2-c63m-7p93",
4+
"modified": "2026-04-21T12:30:24Z",
5+
"published": "2026-04-21T12:30:24Z",
6+
"aliases": [
7+
"CVE-2026-41038"
8+
],
9+
"details": "This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing password guessing or brute-force attacks against user accounts, leading to unauthorized access to the targeted device.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41038"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0200"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-521"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-21T11:16:20Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-pccm-93c8-h8qm/GHSA-pccm-93c8-h8qm.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pccm-93c8-h8qm",
4+
"modified": "2026-04-21T12:30:24Z",
5+
"published": "2026-04-21T12:30:24Z",
6+
"aliases": [
7+
"CVE-2026-39467"
8+
],
9+
"details": "Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through 3.106.0.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39467"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://patchstack.com/database/wordpress/plugin/ml-slider/vulnerability/wordpress-responsive-slider-by-metaslider-plugin-3-106-0-php-object-injection-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-502"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-21T10:16:29Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-v758-4p42-wqcm/GHSA-v758-4p42-wqcm.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v758-4p42-wqcm",
4+
"modified": "2026-04-21T12:30:24Z",
5+
"published": "2026-04-21T12:30:24Z",
6+
"aliases": [
7+
"CVE-2026-41039"
8+
],
9+
"details": "This vulnerability exists in Quantum Networks router due to improper access control and insecure default configuration in the web-based management interface. An unauthenticated attacker could exploit this vulnerability by accessing exposed API endpoints on the targeted device.\n\nSuccessful exploitation of this vulnerability could allow the attacker to access sensitive information, including internal endpoints, scripts and directories on the targeted device.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41039"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0200"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-306"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-21T11:16:20Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-whhc-f8fh-m5cr/GHSA-whhc-f8fh-m5cr.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-whhc-f8fh-m5cr",
4+
"modified": "2026-04-21T12:30:24Z",
5+
"published": "2026-04-21T12:30:24Z",
6+
"aliases": [
7+
"CVE-2026-41037"
8+
],
9+
"details": "This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA protection for failed login attempts in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing brute force attacks against administrative credentials, leading to unauthorized access with root privileges on the targeted device.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41037"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0200"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-307"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-21T10:16:30Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-xh63-cv27-942f/GHSA-xh63-cv27-942f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xh63-cv27-942f",
4+
"modified": "2026-04-21T12:30:24Z",
5+
"published": "2026-04-21T12:30:24Z",
6+
"aliases": [
7+
"CVE-2026-3317"
8+
],
9+
"details": "Reflected Cross-Site Scripting (XSS) vulnerability in Navigate Content Management System. The vulnerability is present in the '/blog' endpoint because user input is not properly sanitized through designed query parameters. This results in unsafe HTML rendering, which could allow a remote attacker to execute JavaScript code in the victim's browser.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3317"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-navigate-cms-application"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-21T10:16:30Z"
35+
}
36+
}

0 commit comments

Comments
 (0)