Skip to content

Commit 80ad438

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-hvwj-8w5g-28rg GHSA-jx93-g359-86wm GHSA-r8jr-wg88-fq5c GHSA-rgq9-fqf5-fv58 GHSA-jx93-g359-86wm GHSA-r8jr-wg88-fq5c
1 parent 502f0c6 commit 80ad438

6 files changed

Lines changed: 221 additions & 91 deletions

File tree

advisories/unreviewed/2026/03/GHSA-hvwj-8w5g-28rg/GHSA-hvwj-8w5g-28rg.json renamed to advisories/github-reviewed/2026/03/GHSA-hvwj-8w5g-28rg/GHSA-hvwj-8w5g-28rg.json

Lines changed: 39 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hvwj-8w5g-28rg",
4-
"modified": "2026-03-12T12:30:29Z",
4+
"modified": "2026-03-12T17:39:04Z",
55
"published": "2026-03-12T12:30:29Z",
66
"aliases": [
77
"CVE-2026-3989"
88
],
9+
"summary": "SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization",
910
"details": "SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.",
10-
"severity": [],
11-
"affected": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "sglang"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.5.9"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1238
"references": [
1339
{
1440
"type": "ADVISORY",
1541
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3989"
1642
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/sgl-project/sglang"
46+
},
1747
{
1848
"type": "WEB",
1949
"url": "https://github.com/sgl-project/sglang/blob/main/scripts/playground/replay_request_dump.py"
@@ -24,10 +54,12 @@
2454
}
2555
],
2656
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
29-
"github_reviewed": false,
30-
"github_reviewed_at": null,
57+
"cwe_ids": [
58+
"CWE-502"
59+
],
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-12T17:39:04Z",
3163
"nvd_published_at": "2026-03-12T12:15:59Z"
3264
}
3365
}

‎advisories/github-reviewed/2026/03/GHSA-jx93-g359-86wm/GHSA-jx93-g359-86wm.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jx93-g359-86wm",
4+
"modified": "2026-03-12T17:38:54Z",
5+
"published": "2026-03-12T12:30:29Z",
6+
"aliases": [
7+
"CVE-2026-3060"
8+
],
9+
"summary": "SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module",
10+
"details": "SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "sglang"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.5.9"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3060"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/sgl-project/sglang"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/sgl-project/sglang/blob/main/python/sglang/srt/disaggregation/encode_receiver.py"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://orca.security/resources/blog/sglang-llm-framework-rce-vulnerabilities"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-502"
59+
],
60+
"severity": "CRITICAL",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-12T17:38:54Z",
63+
"nvd_published_at": "2026-03-12T12:15:59Z"
64+
}
65+
}

‎advisories/github-reviewed/2026/03/GHSA-r8jr-wg88-fq5c/GHSA-r8jr-wg88-fq5c.json‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r8jr-wg88-fq5c",
4+
"modified": "2026-03-12T17:38:28Z",
5+
"published": "2026-03-12T12:30:29Z",
6+
"aliases": [
7+
"CVE-2026-2366"
8+
],
9+
"summary": "Keycloak vulnerable to authorization bypass via the Admin API",
10+
"details": "A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "@keycloak/keycloak-admin-client"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "26.5.5"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.keycloak:keycloak-js-admin-client"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"last_affected": "26.5.5"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2366"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/keycloak/keycloak/issues/47062"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://access.redhat.com/security/cve/CVE-2026-2366"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439081"
73+
},
74+
{
75+
"type": "PACKAGE",
76+
"url": "https://github.com/keycloak/keycloak"
77+
}
78+
],
79+
"database_specific": {
80+
"cwe_ids": [
81+
"CWE-639"
82+
],
83+
"severity": "LOW",
84+
"github_reviewed": true,
85+
"github_reviewed_at": "2026-03-12T17:38:28Z",
86+
"nvd_published_at": "2026-03-12T11:15:55Z"
87+
}
88+
}

advisories/unreviewed/2026/03/GHSA-rgq9-fqf5-fv58/GHSA-rgq9-fqf5-fv58.json renamed to advisories/github-reviewed/2026/03/GHSA-rgq9-fqf5-fv58/GHSA-rgq9-fqf5-fv58.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rgq9-fqf5-fv58",
4-
"modified": "2026-03-12T15:30:25Z",
4+
"modified": "2026-03-12T17:38:58Z",
55
"published": "2026-03-12T12:30:29Z",
66
"aliases": [
77
"CVE-2026-3059"
88
],
9+
"summary": "SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker",
910
"details": "SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "sglang"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.5.9"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "WEB",
@@ -23,6 +44,10 @@
2344
"type": "ADVISORY",
2445
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3059"
2546
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/sgl-project/sglang"
50+
},
2651
{
2752
"type": "WEB",
2853
"url": "https://github.com/sgl-project/sglang/blob/main/python/sglang/multimodal_gen/runtime/scheduler_client.py"
@@ -37,8 +62,8 @@
3762
"CWE-502"
3863
],
3964
"severity": "CRITICAL",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-03-12T17:38:58Z",
4267
"nvd_published_at": "2026-03-12T12:15:59Z"
4368
}
4469
}

‎advisories/unreviewed/2026/03/GHSA-jx93-g359-86wm/GHSA-jx93-g359-86wm.json‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

‎advisories/unreviewed/2026/03/GHSA-r8jr-wg88-fq5c/GHSA-r8jr-wg88-fq5c.json‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

0 commit comments

Comments
 (0)