Skip to content

Commit 17e66de

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2vwv-vqpv-v8vc GHSA-c75f-55f6-f63q GHSA-xrqh-48jh-pjv2 GHSA-fjqg-327f-q6hw GHSA-gq9g-w427-pc6x GHSA-hhv5-qpmh-pc66 GHSA-j3m8-qm5j-mgwc GHSA-vjmw-64m9-xqq5
1 parent baafd1f commit 17e66de

8 files changed

Lines changed: 196 additions & 3 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-2vwv-vqpv-v8vc/GHSA-2vwv-vqpv-v8vc.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2vwv-vqpv-v8vc",
4-
"modified": "2026-04-22T18:31:37Z",
4+
"modified": "2026-04-23T09:32:56Z",
55
"published": "2026-03-30T09:31:29Z",
66
"aliases": [
77
"CVE-2026-5121"
@@ -82,6 +82,10 @@
8282
{
8383
"type": "WEB",
8484
"url": "https://access.redhat.com/errata/RHSA-2026:8510"
85+
},
86+
{
87+
"type": "WEB",
88+
"url": "https://access.redhat.com/errata/RHSA-2026:10065"
8589
}
8690
],
8791
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-c75f-55f6-f63q/GHSA-c75f-55f6-f63q.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-c75f-55f6-f63q",
4-
"modified": "2026-04-22T21:31:37Z",
4+
"modified": "2026-04-23T09:32:56Z",
55
"published": "2026-03-19T15:31:21Z",
66
"aliases": [
77
"CVE-2026-4424"
@@ -90,6 +90,10 @@
9090
{
9191
"type": "WEB",
9292
"url": "https://access.redhat.com/errata/RHSA-2026:8492"
93+
},
94+
{
95+
"type": "WEB",
96+
"url": "https://access.redhat.com/errata/RHSA-2026:10065"
9397
}
9498
],
9599
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-xrqh-48jh-pjv2/GHSA-xrqh-48jh-pjv2.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xrqh-48jh-pjv2",
4-
"modified": "2026-04-22T18:31:36Z",
4+
"modified": "2026-04-23T09:32:56Z",
55
"published": "2026-03-13T21:31:51Z",
66
"aliases": [
77
"CVE-2026-4111"
@@ -90,6 +90,10 @@
9090
{
9191
"type": "WEB",
9292
"url": "https://access.redhat.com/errata/RHSA-2026:5063"
93+
},
94+
{
95+
"type": "WEB",
96+
"url": "https://access.redhat.com/errata/RHSA-2026:10065"
9397
}
9498
],
9599
"database_specific": {

‎advisories/unreviewed/2026/04/GHSA-fjqg-327f-q6hw/GHSA-fjqg-327f-q6hw.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fjqg-327f-q6hw",
4+
"modified": "2026-04-23T09:32:57Z",
5+
"published": "2026-04-23T09:32:57Z",
6+
"aliases": [
7+
"CVE-2026-4106"
8+
],
9+
"details": "The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4106"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/9477ead2-3990-4aae-8e66-09ee2f4daa3e"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-04-23T07:16:41Z"
28+
}
29+
}

‎advisories/unreviewed/2026/04/GHSA-gq9g-w427-pc6x/GHSA-gq9g-w427-pc6x.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gq9g-w427-pc6x",
4+
"modified": "2026-04-23T09:32:57Z",
5+
"published": "2026-04-23T09:32:57Z",
6+
"aliases": [
7+
"CVE-2026-4512"
8+
],
9+
"details": "The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() function. This allows administrators on multisite installations (who do not have the unfiltered_html capability) to inject arbitrary JavaScript that executes for all visitors to the WordPress login page.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4512"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/6dfb4378-fe6a-4462-af10-8e7504e3d593"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-04-23T07:16:41Z"
28+
}
29+
}

‎advisories/unreviewed/2026/04/GHSA-hhv5-qpmh-pc66/GHSA-hhv5-qpmh-pc66.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hhv5-qpmh-pc66",
4+
"modified": "2026-04-23T09:32:56Z",
5+
"published": "2026-04-23T09:32:56Z",
6+
"aliases": [
7+
"CVE-2025-10549"
8+
],
9+
"details": "EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITY\\SYSTEM.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10549"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://r.sec-consult.com/controlio"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-427"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-04-23T07:16:39Z"
34+
}
35+
}

‎advisories/unreviewed/2026/04/GHSA-j3m8-qm5j-mgwc/GHSA-j3m8-qm5j-mgwc.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j3m8-qm5j-mgwc",
4+
"modified": "2026-04-23T09:32:56Z",
5+
"published": "2026-04-23T09:32:56Z",
6+
"aliases": [
7+
"CVE-2026-34488"
8+
],
9+
"details": "IP Setting Software contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrative privileges.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34488"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://i-pro.com/products_and_solutions/en/surveillance/solutions/technologies/cyber-security/psirt/security-advisories"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://jvn.jp/en/jp/JVN42090270"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-427"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-23T07:16:40Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-vjmw-64m9-xqq5/GHSA-vjmw-64m9-xqq5.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vjmw-64m9-xqq5",
4+
"modified": "2026-04-23T09:32:57Z",
5+
"published": "2026-04-23T09:32:57Z",
6+
"aliases": [
7+
"CVE-2026-41040"
8+
],
9+
"details": "GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41040"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://growi.co.jp/news/44"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://jvn.jp/en/jp/JVN46728373"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-1333"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-23T07:16:41Z"
43+
}
44+
}

0 commit comments

Comments
 (0)