Skip to content

Commit f16eed9

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent cfcf502 commit f16eed9

26 files changed

Lines changed: 315 additions & 34 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-9w39-mw48-92gc/GHSA-9w39-mw48-92gc.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9w39-mw48-92gc",
4-
"modified": "2026-04-27T15:30:28Z",
4+
"modified": "2026-05-21T00:30:25Z",
55
"published": "2026-03-18T18:31:17Z",
66
"aliases": [
77
"CVE-2026-23255"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: add proper RCU protection to /proc/net/ptype\n\nYin Fengwei reported an RCU stall in ptype_seq_show() and provided\na patch.\n\nReal issue is that ptype_seq_next() and ptype_seq_show() violate\nRCU rules.\n\nptype_seq_show() runs under rcu_read_lock(), and reads pt->dev\nto get device name without any barrier.\n\nAt the same time, concurrent writers can remove a packet_type structure\n(which is correctly freed after an RCU grace period) and clear pt->dev\nwithout an RCU grace period.\n\nDefine ptype_iter_state to carry a dev pointer along seq_net_private:\n\nstruct ptype_iter_state {\n\tstruct seq_net_private\tp;\n\tstruct net_device\t*dev; // added in this patch\n};\n\nWe need to record the device pointer in ptype_get_idx() and\nptype_seq_next() so that ptype_seq_show() is safe against\nconcurrent pt->dev changes.\n\nWe also need to add full RCU protection in ptype_seq_next().\n(Missing READ_ONCE() when reading list.next values)\n\nMany thanks to Dong Chenchen for providing a repro.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -33,7 +38,7 @@
3338
],
3439
"database_specific": {
3540
"cwe_ids": [],
36-
"severity": null,
41+
"severity": "MODERATE",
3742
"github_reviewed": false,
3843
"github_reviewed_at": null,
3944
"nvd_published_at": "2026-03-18T18:16:23Z"

‎advisories/unreviewed/2026/03/GHSA-p66j-qj5c-q58g/GHSA-p66j-qj5c-q58g.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-p66j-qj5c-q58g",
4-
"modified": "2026-03-18T18:31:18Z",
4+
"modified": "2026-05-21T00:30:26Z",
55
"published": "2026-03-18T18:31:18Z",
66
"aliases": [
77
"CVE-2026-23257"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup\n\nIn setup_nic_devices(), the initialization loop jumps to the label\nsetup_nic_dev_free on failure. The current cleanup loop while(i--)\nskip the failing index i, causing a memory leak.\n\nFix this by changing the loop to iterate from the current index i\ndown to 0.\n\nAlso, decrement i in the devlink_alloc failure path to point to the\nlast successfully allocated index.\n\nCompile tested only. Issue found using code review.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -44,8 +49,10 @@
4449
}
4550
],
4651
"database_specific": {
47-
"cwe_ids": [],
48-
"severity": null,
52+
"cwe_ids": [
53+
"CWE-193"
54+
],
55+
"severity": "MODERATE",
4956
"github_reviewed": false,
5057
"github_reviewed_at": null,
5158
"nvd_published_at": "2026-03-18T18:16:23Z"

‎advisories/unreviewed/2026/03/GHSA-wwv9-pvmj-9mc8/GHSA-wwv9-pvmj-9mc8.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wwv9-pvmj-9mc8",
4-
"modified": "2026-03-18T18:31:18Z",
4+
"modified": "2026-05-21T00:30:25Z",
55
"published": "2026-03-18T18:31:18Z",
66
"aliases": [
77
"CVE-2026-23256"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup\n\nIn setup_nic_devices(), the initialization loop jumps to the label\nsetup_nic_dev_free on failure. The current cleanup loop while(i--)\nskip the failing index i, causing a memory leak.\n\nFix this by changing the loop to iterate from the current index i\ndown to 0.\n\nCompile tested only. Issue found using code review.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -44,8 +49,10 @@
4449
}
4550
],
4651
"database_specific": {
47-
"cwe_ids": [],
48-
"severity": null,
52+
"cwe_ids": [
53+
"CWE-193"
54+
],
55+
"severity": "MODERATE",
4956
"github_reviewed": false,
5057
"github_reviewed_at": null,
5158
"nvd_published_at": "2026-03-18T18:16:23Z"

‎advisories/unreviewed/2026/05/GHSA-2wvj-gvc7-gfhx/GHSA-2wvj-gvc7-gfhx.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2wvj-gvc7-gfhx",
4-
"modified": "2026-05-20T12:30:36Z",
4+
"modified": "2026-05-21T00:30:27Z",
55
"published": "2026-05-20T12:30:36Z",
66
"aliases": [
77
"CVE-2026-41292"
88
],
99
"details": "NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red"

‎advisories/unreviewed/2026/05/GHSA-2xw5-2v9x-wc8m/GHSA-2xw5-2v9x-wc8m.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,9 @@
3737
}
3838
],
3939
"database_specific": {
40-
"cwe_ids": [],
40+
"cwe_ids": [
41+
"CWE-416"
42+
],
4143
"severity": "HIGH",
4244
"github_reviewed": false,
4345
"github_reviewed_at": null,

‎advisories/unreviewed/2026/05/GHSA-4j6h-qqh4-vpw7/GHSA-4j6h-qqh4-vpw7.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,9 @@
4141
}
4242
],
4343
"database_specific": {
44-
"cwe_ids": [],
44+
"cwe_ids": [
45+
"CWE-401"
46+
],
4547
"severity": "HIGH",
4648
"github_reviewed": false,
4749
"github_reviewed_at": null,

‎advisories/unreviewed/2026/05/GHSA-5jp8-75xr-qrmf/GHSA-5jp8-75xr-qrmf.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5jp8-75xr-qrmf",
4-
"modified": "2026-05-20T12:30:37Z",
4+
"modified": "2026-05-21T00:30:27Z",
55
"published": "2026-05-20T12:30:37Z",
66
"aliases": [
77
"CVE-2026-42959"
88
],
99
"details": "NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red"

‎advisories/unreviewed/2026/05/GHSA-5mhm-vj5h-r98h/GHSA-5mhm-vj5h-r98h.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5mhm-vj5h-r98h",
4+
"modified": "2026-05-21T00:30:27Z",
5+
"published": "2026-05-21T00:30:27Z",
6+
"aliases": [
7+
"CVE-2026-47782"
8+
],
9+
"details": "Android App \"RoboForm Password Manager\" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user confirmation nor notification. If a URL to some malicious web page is given through an intent, RoboForm may silently download files without user confirmation nor notification.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47782"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/vu/JVNVU93461473"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://play.google.com/store/apps/details?id=com.siber.roboform"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.roboform.com/news-android"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-357"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-05-20T23:16:35Z"
47+
}
48+
}

‎advisories/unreviewed/2026/05/GHSA-6522-r5fq-99gw/GHSA-6522-r5fq-99gw.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6522-r5fq-99gw",
4-
"modified": "2026-05-20T12:30:37Z",
4+
"modified": "2026-05-21T00:30:27Z",
55
"published": "2026-05-20T12:30:37Z",
66
"aliases": [
77
"CVE-2026-44390"
88
],
99
"details": "NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don't share a suffix above the root can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for this but it didn't account for the case where records would not share any suffix above the root. That causes Unbound to go in a different code path because of the compression tree lookup failure and eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch with a fix that increments the compression counter regardless of the compression tree lookup. This is a complement fix to CVE-2024-8508.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber"

‎advisories/unreviewed/2026/05/GHSA-6m8x-q95v-ph67/GHSA-6m8x-q95v-ph67.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6m8x-q95v-ph67",
4-
"modified": "2026-05-06T12:30:26Z",
4+
"modified": "2026-05-21T00:30:26Z",
55
"published": "2026-05-06T12:30:26Z",
66
"aliases": [
77
"CVE-2026-43077"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Fix minimum RX size check for decryption\n\nThe check for the minimum receive buffer size did not take the\ntag size into account during decryption. Fix this by adding the\nrequired extra length.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -49,7 +54,7 @@
4954
],
5055
"database_specific": {
5156
"cwe_ids": [],
52-
"severity": null,
57+
"severity": "MODERATE",
5358
"github_reviewed": false,
5459
"github_reviewed_at": null,
5560
"nvd_published_at": "2026-05-06T10:16:20Z"

0 commit comments

Comments
 (0)