Skip to content

Commit d1a165c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-pcjv-393q-rqf2 GHSA-78xx-4783-fh7x GHSA-cc62-3p5g-fr7j GHSA-4773-3jfm-qmx3 GHSA-636g-4q6w-639h GHSA-6hcq-hmm3-jj3c GHSA-8hfc-fq58-r658 GHSA-f53h-mxv9-cp98 GHSA-m9r6-9wmx-24jv GHSA-mf92-479x-3373 GHSA-mgvc-8q2h-5pgc GHSA-pgvr-52h5-9c35 GHSA-wx98-99rr-664q
1 parent 39eed15 commit d1a165c

File tree

13 files changed

+378
-3
lines changed

13 files changed

+378
-3
lines changed

‎advisories/unreviewed/2024/01/GHSA-pcjv-393q-rqf2/GHSA-pcjv-393q-rqf2.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pcjv-393q-rqf2",
4-
"modified": "2025-08-04T21:30:36Z",
4+
"modified": "2026-03-20T00:31:26Z",
55
"published": "2024-01-18T06:30:25Z",
66
"aliases": [
77
"CVE-2023-6816"
@@ -59,6 +59,10 @@
5959
"type": "WEB",
6060
"url": "https://access.redhat.com/errata/RHSA-2024:2996"
6161
},
62+
{
63+
"type": "WEB",
64+
"url": "https://access.redhat.com/errata/RHSA-2024:2995"
65+
},
6266
{
6367
"type": "WEB",
6468
"url": "https://access.redhat.com/errata/RHSA-2024:2170"

‎advisories/unreviewed/2026/02/GHSA-78xx-4783-fh7x/GHSA-78xx-4783-fh7x.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-78xx-4783-fh7x",
4-
"modified": "2026-02-06T21:30:47Z",
4+
"modified": "2026-03-20T00:31:26Z",
55
"published": "2026-02-02T18:31:33Z",
66
"aliases": [
77
"CVE-2026-22225"
@@ -23,6 +23,10 @@
2323
"type": "ADVISORY",
2424
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22225"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.tp-link.com/en/support/download/archer-axe75/v1/#Firmware"
29+
},
2630
{
2731
"type": "WEB",
2832
"url": "https://www.tp-link.com/en/support/download/archer-be230/v1.20/#Firmware"
@@ -31,6 +35,10 @@
3135
"type": "WEB",
3236
"url": "https://www.tp-link.com/sg/support/download/archer-be230/v1.20/#Firmware"
3337
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.tp-link.com/us/support/download/archer-axe75/v1/#Firmware"
41+
},
3442
{
3543
"type": "WEB",
3644
"url": "https://www.tp-link.com/us/support/download/archer-be230/v1.20/#Firmware"

‎advisories/unreviewed/2026/02/GHSA-cc62-3p5g-fr7j/GHSA-cc62-3p5g-fr7j.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cc62-3p5g-fr7j",
4-
"modified": "2026-02-06T21:30:47Z",
4+
"modified": "2026-03-20T00:31:26Z",
55
"published": "2026-02-02T18:31:33Z",
66
"aliases": [
77
"CVE-2026-0630"
@@ -23,6 +23,10 @@
2323
"type": "ADVISORY",
2424
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0630"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.tp-link.com/en/support/download/archer-axe75/v1/#Firmware"
29+
},
2630
{
2731
"type": "WEB",
2832
"url": "https://www.tp-link.com/en/support/download/archer-be230/v1.20/#Firmware"
@@ -31,6 +35,10 @@
3135
"type": "WEB",
3236
"url": "https://www.tp-link.com/sg/support/download/archer-be230/v1.20/#Firmware"
3337
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.tp-link.com/us/support/download/archer-axe75/v1/#Firmware"
41+
},
3442
{
3543
"type": "WEB",
3644
"url": "https://www.tp-link.com/us/support/download/archer-be230/v1.20/#Firmware"

‎advisories/unreviewed/2026/03/GHSA-4773-3jfm-qmx3/GHSA-4773-3jfm-qmx3.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4773-3jfm-qmx3",
4+
"modified": "2026-03-20T00:31:28Z",
5+
"published": "2026-03-20T00:31:28Z",
6+
"aliases": [
7+
"CVE-2026-22737"
8+
],
9+
"details": "Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22737"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://spring.io/security/cve-2026-22737"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "MODERATE",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-20T00:16:15Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-636g-4q6w-639h/GHSA-636g-4q6w-639h.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-636g-4q6w-639h",
4+
"modified": "2026-03-20T00:31:28Z",
5+
"published": "2026-03-20T00:31:28Z",
6+
"aliases": [
7+
"CVE-2026-3948"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3948"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-03-19T23:16:45Z"
24+
}
25+
}

‎advisories/unreviewed/2026/03/GHSA-6hcq-hmm3-jj3c/GHSA-6hcq-hmm3-jj3c.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6hcq-hmm3-jj3c",
4+
"modified": "2026-03-20T00:31:28Z",
5+
"published": "2026-03-20T00:31:28Z",
6+
"aliases": [
7+
"CVE-2026-22735"
8+
],
9+
"details": "Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22735"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://spring.io/security/cve-2026-22735"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "LOW",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-20T00:16:15Z"
33+
}
34+
}

‎advisories/unreviewed/2026/03/GHSA-8hfc-fq58-r658/GHSA-8hfc-fq58-r658.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8hfc-fq58-r658",
4+
"modified": "2026-03-20T00:31:28Z",
5+
"published": "2026-03-20T00:31:28Z",
6+
"aliases": [
7+
"CVE-2026-22731"
8+
],
9+
"details": "Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.\nThis issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.\nThis CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22731"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://spring.io/security/cve-2026-22731"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-288"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-19T23:16:41Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-f53h-mxv9-cp98/GHSA-f53h-mxv9-cp98.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f53h-mxv9-cp98",
4+
"modified": "2026-03-20T00:31:28Z",
5+
"published": "2026-03-20T00:31:28Z",
6+
"aliases": [
7+
"CVE-2026-4342"
8+
],
9+
"details": "A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4342"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/kubernetes/kubernetes/issues/137893"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "http://www.openwall.com/lists/oss-security/2026/03/19/9"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-20"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-19T22:16:43Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-m9r6-9wmx-24jv/GHSA-m9r6-9wmx-24jv.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m9r6-9wmx-24jv",
4+
"modified": "2026-03-20T00:31:28Z",
5+
"published": "2026-03-20T00:31:28Z",
6+
"aliases": [
7+
"CVE-2026-4159"
8+
],
9+
"details": "1-byte OOB heap read in wc_PKCS7_DecodeEnvelopedData via zero-length encrypted content. A vulnerability existed in wolfSSL 5.8.4 and earlier, where a 1-byte out-of-bounds heap read in wc_PKCS7_DecodeEnvelopedData could be triggered by a crafted CMS EnvelopedData message with zero-length encrypted content. Note that PKCS7 support is disabled by default.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4159"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/wolfSSL/wolfssl/pull/9945"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-125"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-19T22:16:42Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-mf92-479x-3373/GHSA-mf92-479x-3373.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mf92-479x-3373",
4+
"modified": "2026-03-20T00:31:28Z",
5+
"published": "2026-03-20T00:31:28Z",
6+
"aliases": [
7+
"CVE-2026-22732"
8+
],
9+
"details": "When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. \nThis issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22732"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://spring.io/security/cve-2026-22732"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "CRITICAL",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-03-19T23:16:41Z"
33+
}
34+
}

0 commit comments

Comments
 (0)