Skip to content

Commit 441ee0a

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-gcf2-x38g-f7w4 GHSA-xg43-qr5w-q4jr GHSA-32gp-2g42-v9vc GHSA-4wh8-2pqj-9gw4 GHSA-85rw-g4f4-jprr GHSA-cr37-3vx9-9f5f GHSA-f493-gq25-5c5x GHSA-qfqj-xxqv-cxfw GHSA-qp9q-4rh4-m8jc GHSA-vm9p-5mrq-6w5f
1 parent 007f346 commit 441ee0a

10 files changed

Lines changed: 386 additions & 2 deletions

File tree

‎advisories/unreviewed/2026/05/GHSA-gcf2-x38g-f7w4/GHSA-gcf2-x38g-f7w4.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@
2626
],
2727
"database_specific": {
2828
"cwe_ids": [
29-
"CWE-200"
29+
"CWE-200",
30+
"CWE-862"
3031
],
3132
"severity": "MODERATE",
3233
"github_reviewed": false,

‎advisories/unreviewed/2026/05/GHSA-xg43-qr5w-q4jr/GHSA-xg43-qr5w-q4jr.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
],
2727
"database_specific": {
2828
"cwe_ids": [
29+
"CWE-610",
2930
"CWE-73"
3031
],
3132
"severity": "HIGH",

‎advisories/unreviewed/2026/06/GHSA-32gp-2g42-v9vc/GHSA-32gp-2g42-v9vc.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-32gp-2g42-v9vc",
4+
"modified": "2026-06-03T03:30:24Z",
5+
"published": "2026-06-03T03:30:24Z",
6+
"aliases": [
7+
"CVE-2026-9516"
8+
],
9+
"details": "Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws.\n\nTo skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the restore is skipped and the scalar is left with its string pointer offset into its own buffer and a shortened length.\n\nWhen that scalar is later freed, the allocator receives an invalid pointer and the interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any caller.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9516"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/rurban/Cpanel-JSON-XS/commit/dfe1b41a36caba51dc12a2917fe50285d1ffaa7b.patch"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-755"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-06-03T01:16:23Z"
34+
}
35+
}

‎advisories/unreviewed/2026/06/GHSA-4wh8-2pqj-9gw4/GHSA-4wh8-2pqj-9gw4.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4wh8-2pqj-9gw4",
4+
"modified": "2026-06-03T03:30:24Z",
5+
"published": "2026-06-03T03:30:24Z",
6+
"aliases": [
7+
"CVE-2026-10694"
8+
],
9+
"details": "A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function include of the file /index.php. The manipulation of the argument page results in file inclusion. The attack can be launched remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10694"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Mikkoseven/cve/issues/4"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/cve/CVE-2026-10694"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/830903"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/367963"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/367963/cti"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.sourcecodester.com"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-73"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-06-03T01:16:23Z"
59+
}
60+
}

‎advisories/unreviewed/2026/06/GHSA-85rw-g4f4-jprr/GHSA-85rw-g4f4-jprr.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-85rw-g4f4-jprr",
4-
"modified": "2026-06-01T09:31:12Z",
4+
"modified": "2026-06-03T03:30:24Z",
55
"published": "2026-06-01T09:31:11Z",
66
"aliases": [
77
"CVE-2026-35563"
88
],
99
"details": "It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP \nhostname. While the underlying code validates the certificate chain \nagainst a trusted authority, the absence of endpoint identification \nallows a valid certificate issued for an entirely unrelated host to be \nimproperly accepted. This oversight leaves the connection highly \nvulnerable to server impersonation and complete connection compromise.\n\n\nThe\n root cause of this vulnerability lies in the incomplete TLS server \nidentity verification within the LDAP client implementation.\n\n\n\n\nThe attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client's configured trust store.\n\n\n\n\nThe hostname verification has been enforced in the new version of the LDAP API",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/06/GHSA-cr37-3vx9-9f5f/GHSA-cr37-3vx9-9f5f.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cr37-3vx9-9f5f",
4+
"modified": "2026-06-03T03:30:25Z",
5+
"published": "2026-06-03T03:30:25Z",
6+
"aliases": [
7+
"CVE-2026-10704"
8+
],
9+
"details": "A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the function Login of the file /admin/admin_class_novo.php of the component Administrative Control Panel. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10704"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/nuiifornet/A033/blob/main/pizzafy-vulnerability.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/cve/CVE-2026-10704"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/831321"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/368017"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/368017/cti"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.sourcecodester.com"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-74"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-06-03T02:16:17Z"
59+
}
60+
}

‎advisories/unreviewed/2026/06/GHSA-f493-gq25-5c5x/GHSA-f493-gq25-5c5x.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f493-gq25-5c5x",
4+
"modified": "2026-06-03T03:30:24Z",
5+
"published": "2026-06-03T03:30:24Z",
6+
"aliases": [
7+
"CVE-2026-10693"
8+
],
9+
"details": "A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10693"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://medium.com/@hemantrajbhati5555/broken-access-control-in-sourcecodester-online-boat-reservation-system-1-0-4ed0380d2222"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/cve/CVE-2026-10693"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/830894"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/367962"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/367962/cti"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.sourcecodester.com"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-266"
54+
],
55+
"severity": "LOW",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-06-03T01:16:21Z"
59+
}
60+
}

‎advisories/unreviewed/2026/06/GHSA-qfqj-xxqv-cxfw/GHSA-qfqj-xxqv-cxfw.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qfqj-xxqv-cxfw",
4+
"modified": "2026-06-03T03:30:24Z",
5+
"published": "2026-06-03T03:30:24Z",
6+
"aliases": [
7+
"CVE-2026-9334"
8+
],
9+
"details": "Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.\n\ndecode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.\n\nA caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9334"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-843"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-06-03T01:16:23Z"
34+
}
35+
}

‎advisories/unreviewed/2026/06/GHSA-qp9q-4rh4-m8jc/GHSA-qp9q-4rh4-m8jc.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qp9q-4rh4-m8jc",
4+
"modified": "2026-06-03T03:30:25Z",
5+
"published": "2026-06-03T03:30:25Z",
6+
"aliases": [
7+
"CVE-2026-10705"
8+
],
9+
"details": "A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10705"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/dask/dask/issues/12403"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/dask/dask/pull/12401"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/dask/dask"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/cve/CVE-2026-10705"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/submit/831411"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/368018"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/368018/cti"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-400"
58+
],
59+
"severity": "LOW",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-06-03T02:16:17Z"
63+
}
64+
}

0 commit comments

Comments
 (0)