Skip to content

Commit f75cb41

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7qjx-378m-p8hm GHSA-376c-9hgg-2xx6 GHSA-7vqp-qmqp-chh2 GHSA-gr32-6rr4-7px2 GHSA-r5m9-wm49-959f
1 parent 4b637f5 commit f75cb41

5 files changed

Lines changed: 221 additions & 1 deletion

File tree

‎advisories/unreviewed/2025/02/GHSA-7qjx-378m-p8hm/GHSA-7qjx-378m-p8hm.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7qjx-378m-p8hm",
4-
"modified": "2026-04-06T15:31:19Z",
4+
"modified": "2026-06-02T06:30:25Z",
55
"published": "2025-02-25T18:31:24Z",
66
"aliases": [
77
"CVE-2025-26597"
@@ -90,6 +90,10 @@
9090
{
9191
"type": "WEB",
9292
"url": "https://access.redhat.com/errata/RHSA-2025:2500"
93+
},
94+
{
95+
"type": "WEB",
96+
"url": "http://www.openwall.com/lists/oss-security/2026/06/02/1"
9397
}
9498
],
9599
"database_specific": {

‎advisories/unreviewed/2026/06/GHSA-376c-9hgg-2xx6/GHSA-376c-9hgg-2xx6.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-376c-9hgg-2xx6",
4+
"modified": "2026-06-02T06:30:26Z",
5+
"published": "2026-06-02T06:30:26Z",
6+
"aliases": [
7+
"CVE-2026-10583"
8+
],
9+
"details": "A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. Affected by this issue is the function Import of the file internal/http/tts_config.go of the component TTS Configuration Endpoint. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10583"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/digitopvn/goclaw/issues/30"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/nextlevelbuilder/goclaw/issues/1132"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/nextlevelbuilder/goclaw"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/cve/CVE-2026-10583"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/submit/829407"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/367710"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/367710/cti"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-918"
58+
],
59+
"severity": "LOW",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-06-02T04:17:03Z"
63+
}
64+
}

‎advisories/unreviewed/2026/06/GHSA-7vqp-qmqp-chh2/GHSA-7vqp-qmqp-chh2.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7vqp-qmqp-chh2",
4+
"modified": "2026-06-02T06:30:26Z",
5+
"published": "2026-06-02T06:30:26Z",
6+
"aliases": [
7+
"CVE-2026-10581"
8+
],
9+
"details": "A flaw has been found in DedeCMS 5.7.88. Affected by this vulnerability is the function base64_decode of the file /plus/download.php?open=1. This manipulation of the argument Link causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10581"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/cve/CVE-2026-10581"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/829404"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/367676"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/367676/cti"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-918"
46+
],
47+
"severity": "LOW",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-06-02T04:17:02Z"
51+
}
52+
}

‎advisories/unreviewed/2026/06/GHSA-gr32-6rr4-7px2/GHSA-gr32-6rr4-7px2.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gr32-6rr4-7px2",
4+
"modified": "2026-06-02T06:30:26Z",
5+
"published": "2026-06-02T06:30:26Z",
6+
"aliases": [
7+
"CVE-2026-8206"
8+
],
9+
"details": "The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8206"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.4/ComponentLibrary/controller/CompLibFormHandler.php#L330"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.4/ComponentLibrary/controller/CompLibFormHandler.php#L48"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.4/ComponentLibrary/controller/ElementGenerator.php#L227"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/kirki/trunk/ComponentLibrary/controller/CompLibFormHandler.php#L330"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/browser/kirki/trunk/ComponentLibrary/controller/CompLibFormHandler.php#L48"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/browser/kirki/trunk/ComponentLibrary/controller/ElementGenerator.php#L227"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://plugins.trac.wordpress.org/changeset/3530843/kirki"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3b5630bd-5bce-4226-959f-5e81ae69b799?source=cve"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-269"
58+
],
59+
"severity": "CRITICAL",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-06-02T04:17:03Z"
63+
}
64+
}

‎advisories/unreviewed/2026/06/GHSA-r5m9-wm49-959f/GHSA-r5m9-wm49-959f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r5m9-wm49-959f",
4+
"modified": "2026-06-02T06:30:26Z",
5+
"published": "2026-06-02T06:30:26Z",
6+
"aliases": [
7+
"CVE-2026-3198"
8+
],
9+
"details": "MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3198"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://huntr.com/bounties/e57db731-97d3-40c3-a429-831ee959807f"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-284"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-06-02T04:17:03Z"
35+
}
36+
}

0 commit comments

Comments
 (0)