Publish Advisories

advisory-database[bot] · advisory-database[bot] · commit 480d1ab2e754 · 2026-06-08T23:31:00.000Z
GHSA-xvp7-8vm8-xfxx GHSA-69r9-qgr7-g2wj GHSA-6269-cqxg-mhhv GHSA-8g87-j6q8-g93x GHSA-9hmg-827w-9rhj GHSA-ccfx-mfmx-2fx9 GHSA-cf92-gfcw-6v53 GHSA-fv7c-fp4j-7gwp GHSA-g47v-rwmh-r9f8 GHSA-gphh-9q3h-jgpp GHSA-hq28-crg7-95pr GHSA-m9g3-3g99-mhpx GHSA-mghp-5cq4-v6mg GHSA-pjwx-r37v-7724 GHSA-r42m-953q-6vjx GHSA-v87v-83h2-53w7
diff --git a/advisories/github-reviewed/2025/10/GHSA-xvp7-8vm8-xfxx/GHSA-xvp7-8vm8-xfxx.json b/advisories/github-reviewed/2025/10/GHSA-xvp7-8vm8-xfxx/GHSA-xvp7-8vm8-xfxx.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xvp7-8vm8-xfxx",
-  "modified": "2025-10-20T17:55:59Z",
+  "modified": "2026-06-08T23:28:41Z",
   "published": "2025-10-20T17:55:59Z",
   "aliases": [],
   "summary": "Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers",
@@ -26,11 +26,14 @@
               "introduced": "0"
             },
             {
-              "last_affected": "25.10.0"
+              "fixed": "25.11.0"
             }
           ]
         }
-      ]
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 25.10.0"
+      }
     }
   ],
   "references": [
@@ -62,6 +65,7 @@
   "database_specific": {
     "cwe_ids": [
       "CWE-209",
+      "CWE-215",
       "CWE-219"
     ],
     "severity": "MODERATE",
diff --git a/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json b/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-69r9-qgr7-g2wj",
-  "modified": "2026-04-15T22:36:04Z",
+  "modified": "2026-06-08T23:28:55Z",
   "published": "2026-04-09T21:31:30Z",
   "aliases": [
     "CVE-2026-34486"
@@ -188,6 +188,14 @@
     {
       "type": "WEB",
       "url": "https://www.herodevs.com/vulnerability-directory/cve-2026-34486"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat"
     }
   ],
   "database_specific": {
diff --git a/advisories/github-reviewed/2026/05/GHSA-6269-cqxg-mhhv/GHSA-6269-cqxg-mhhv.json b/advisories/github-reviewed/2026/05/GHSA-6269-cqxg-mhhv/GHSA-6269-cqxg-mhhv.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6269-cqxg-mhhv",
-  "modified": "2026-05-14T16:36:12Z",
+  "modified": "2026-06-08T23:30:27Z",
   "published": "2026-05-14T16:36:12Z",
   "aliases": [
     "CVE-2026-44898"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44898"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/lepture/mistune/commit/04880a0"
@@ -63,6 +67,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-14T16:36:12Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-26T21:16:39Z"
   }
 }
diff --git a/advisories/github-reviewed/2026/05/GHSA-8g87-j6q8-g93x/GHSA-8g87-j6q8-g93x.json b/advisories/github-reviewed/2026/05/GHSA-8g87-j6q8-g93x/GHSA-8g87-j6q8-g93x.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8g87-j6q8-g93x",
-  "modified": "2026-05-08T23:40:04Z",
+  "modified": "2026-06-08T23:30:19Z",
   "published": "2026-05-08T23:40:04Z",
   "aliases": [
     "CVE-2026-44708"
@@ -40,9 +40,17 @@
       "type": "WEB",
       "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44708"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/lepture/mistune"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
     }
   ],
   "database_specific": {
@@ -52,6 +60,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-08T23:40:04Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-26T21:16:38Z"
   }
 }
diff --git a/advisories/github-reviewed/2026/05/GHSA-9hmg-827w-9rhj/GHSA-9hmg-827w-9rhj.json b/advisories/github-reviewed/2026/05/GHSA-9hmg-827w-9rhj/GHSA-9hmg-827w-9rhj.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9hmg-827w-9rhj",
-  "modified": "2026-05-05T17:15:32Z",
+  "modified": "2026-06-08T23:28:00Z",
   "published": "2026-05-05T17:15:32Z",
   "aliases": [
     "CVE-2026-41164"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/nuts-foundation/nuts-node/security/advisories/GHSA-9hmg-827w-9rhj"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41164"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/nuts-foundation/nuts-node"
@@ -60,6 +64,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-05T17:15:32Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-26T18:16:47Z"
   }
 }
diff --git a/advisories/github-reviewed/2026/05/GHSA-ccfx-mfmx-2fx9/GHSA-ccfx-mfmx-2fx9.json b/advisories/github-reviewed/2026/05/GHSA-ccfx-mfmx-2fx9/GHSA-ccfx-mfmx-2fx9.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-ccfx-mfmx-2fx9",
-  "modified": "2026-05-14T16:36:18Z",
+  "modified": "2026-06-08T23:30:31Z",
   "published": "2026-05-14T16:36:18Z",
   "aliases": [
     "CVE-2026-44899"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/lepture/mistune/security/advisories/GHSA-ccfx-mfmx-2fx9"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44899"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/lepture/mistune"
@@ -59,6 +63,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-14T16:36:18Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-26T21:16:39Z"
   }
 }
diff --git a/advisories/github-reviewed/2026/05/GHSA-cf92-gfcw-6v53/GHSA-cf92-gfcw-6v53.json b/advisories/github-reviewed/2026/05/GHSA-cf92-gfcw-6v53/GHSA-cf92-gfcw-6v53.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-cf92-gfcw-6v53",
-  "modified": "2026-05-06T20:40:17Z",
+  "modified": "2026-06-08T23:28:03Z",
   "published": "2026-05-06T20:40:17Z",
   "aliases": [
     "CVE-2026-42448"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-cf92-gfcw-6v53"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42448"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/magic-wormhole/magic-wormhole"
@@ -55,6 +59,6 @@
     "severity": "LOW",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-06T20:40:17Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-26T18:16:48Z"
   }
 }
diff --git a/advisories/github-reviewed/2026/05/GHSA-fv7c-fp4j-7gwp/GHSA-fv7c-fp4j-7gwp.json b/advisories/github-reviewed/2026/05/GHSA-fv7c-fp4j-7gwp/GHSA-fv7c-fp4j-7gwp.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fv7c-fp4j-7gwp",
-  "modified": "2026-05-08T20:34:07Z",
+  "modified": "2026-06-08T23:28:08Z",
   "published": "2026-05-08T20:34:07Z",
   "aliases": [
     "CVE-2026-44728"
@@ -65,6 +65,10 @@
       "type": "WEB",
       "url": "https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44728"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/babel/babel"
@@ -78,6 +82,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-08T20:34:07Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-26T18:16:50Z"
   }
 }
diff --git a/advisories/github-reviewed/2026/05/GHSA-g47v-rwmh-r9f8/GHSA-g47v-rwmh-r9f8.json b/advisories/github-reviewed/2026/05/GHSA-g47v-rwmh-r9f8/GHSA-g47v-rwmh-r9f8.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-g47v-rwmh-r9f8",
-  "modified": "2026-05-08T23:12:51Z",
+  "modified": "2026-06-08T23:30:15Z",
   "published": "2026-05-08T23:12:51Z",
   "aliases": [
     "CVE-2026-44844"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-g47v-rwmh-r9f8"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44844"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/GOVCERT-LU/eml_parser"
@@ -55,6 +59,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-08T23:12:51Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-26T21:16:39Z"
   }
 }
diff --git a/advisories/github-reviewed/2026/05/GHSA-gphh-9q3h-jgpp/GHSA-gphh-9q3h-jgpp.json b/advisories/github-reviewed/2026/05/GHSA-gphh-9q3h-jgpp/GHSA-gphh-9q3h-jgpp.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-gphh-9q3h-jgpp",
-  "modified": "2026-05-08T20:36:22Z",
+  "modified": "2026-06-08T23:29:16Z",
   "published": "2026-05-08T20:36:22Z",
   "aliases": [
     "CVE-2026-44209"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/masci/banks/security/advisories/GHSA-gphh-9q3h-jgpp"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44209"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/masci/banks/pull/74"
@@ -59,6 +63,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-08T20:36:22Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-26T21:16:37Z"
   }
 }
diff --git a/advisories/github-reviewed/2026/05/GHSA-hq28-crg7-95pr/GHSA-hq28-crg7-95pr.json b/advisories/github-reviewed/2026/05/GHSA-hq28-crg7-95pr/GHSA-hq28-crg7-95pr.json
@@ -1,14 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hq28-crg7-95pr",
-  "modified": "2026-05-08T22:24:45Z",
+  "modified": "2026-06-08T23:30:00Z",
   "published": "2026-05-08T22:24:45Z",
   "aliases": [
     "CVE-2026-44832"
   ],
   "summary": "Snipe-IT has Privilege Escalation via API Permissions Assignment",
   "details": "### Impact\nAn authenticated user with only `users.edit` permission can escalate their own privileges to `admin` by sending a PATCH request to `/api/v1/users/{id}` with `permissions[admin]=1`. The API controller only strips the `superuser` key from the permissions array, allowing `admin` and all other permission keys to be set by any user who can update users.\n\n### Patches\nPatched in https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569, fix was released in v8.4.1\n\n### Workarounds\nNone.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
@@ -40,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-hq28-crg7-95pr"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44832"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569"
@@ -57,6 +65,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-08T22:24:45Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-26T20:16:20Z"
   }
 }
diff --git a/advisories/github-reviewed/2026/05/GHSA-m9g3-3g99-mhpx/GHSA-m9g3-3g99-mhpx.json b/advisories/github-reviewed/2026/05/GHSA-m9g3-3g99-mhpx/GHSA-m9g3-3g99-mhpx.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m9g3-3g99-mhpx",
-  "modified": "2026-05-08T20:49:40Z",
+  "modified": "2026-06-08T23:29:22Z",
   "published": "2026-05-08T20:49:40Z",
   "aliases": [
     "CVE-2026-44214"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g99-mhpx"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44214"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/rexxars/eventsource-encoder"
@@ -60,6 +64,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-08T20:49:40Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-26T20:16:19Z"
   }
 }
diff --git a/advisories/github-reviewed/2026/05/GHSA-mghp-5cq4-v6mg/GHSA-mghp-5cq4-v6mg.json b/advisories/github-reviewed/2026/05/GHSA-mghp-5cq4-v6mg/GHSA-mghp-5cq4-v6mg.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mghp-5cq4-v6mg",
-  "modified": "2026-05-08T23:25:37Z",
+  "modified": "2026-06-08T23:30:05Z",
   "published": "2026-05-08T23:25:37Z",
   "aliases": [
     "CVE-2026-44833"
@@ -40,6 +40,14 @@
       "type": "WEB",
       "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-mghp-5cq4-v6mg"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44833"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/grokability/snipe-it/commit/e37649212861a337e68a624e589c3540b7a82373"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/grokability/snipe-it"
@@ -52,6 +60,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-08T23:25:37Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-26T20:16:20Z"
   }
 }
diff --git a/advisories/github-reviewed/2026/05/GHSA-pjwx-r37v-7724/GHSA-pjwx-r37v-7724.json b/advisories/github-reviewed/2026/05/GHSA-pjwx-r37v-7724/GHSA-pjwx-r37v-7724.json
diff --git a/advisories/github-reviewed/2026/05/GHSA-r42m-953q-6vjx/GHSA-r42m-953q-6vjx.json b/advisories/github-reviewed/2026/05/GHSA-r42m-953q-6vjx/GHSA-r42m-953q-6vjx.json
diff --git a/advisories/github-reviewed/2026/05/GHSA-v87v-83h2-53w7/GHSA-v87v-83h2-53w7.json b/advisories/github-reviewed/2026/05/GHSA-v87v-83h2-53w7/GHSA-v87v-83h2-53w7.json

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"schema_version": "1.4.0",`
`3`	`3`	`"id": "GHSA-xvp7-8vm8-xfxx",`
`4`		`- "modified": "2025-10-20T17:55:59Z",`
	`4`	`+ "modified": "2026-06-08T23:28:41Z",`
`5`	`5`	`"published": "2025-10-20T17:55:59Z",`
`6`	`6`	`"aliases": [],`
`7`	`7`	`"summary": "Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers",`
`@@ -26,11 +26,14 @@`
`26`	`26`	`"introduced": "0"`
`27`	`27`	`},`
`28`	`28`	`{`
`29`		`- "last_affected": "25.10.0"`
	`29`	`+ "fixed": "25.11.0"`
`30`	`30`	`}`
`31`	`31`	`]`
`32`	`32`	`}`
`33`		`- ]`
	`33`	`+ ],`
	`34`	`+ "database_specific": {`
	`35`	`+ "last_known_affected_version_range": "<= 25.10.0"`
	`36`	`+ }`
`34`	`37`	`}`
`35`	`38`	`],`
`36`	`39`	`"references": [`
`@@ -62,6 +65,7 @@`
`62`	`65`	`"database_specific": {`
`63`	`66`	`"cwe_ids": [`
`64`	`67`	`"CWE-209",`
	`68`	`+ "CWE-215",`
`65`	`69`	`"CWE-219"`
`66`	`70`	`],`
`67`	`71`	`"severity": "MODERATE",`