Skip to content

Commit 59b7635

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-c693-x898-5g4h GHSA-m2v5-74w2-qhcj GHSA-p897-vf7j-f5h8 GHSA-w2mh-qq9q-453x
1 parent c920936 commit 59b7635

4 files changed

Lines changed: 224 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/06/GHSA-c693-x898-5g4h/GHSA-c693-x898-5g4h.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c693-x898-5g4h",
4+
"modified": "2026-06-21T12:30:52Z",
5+
"published": "2026-06-21T12:30:52Z",
6+
"aliases": [
7+
"CVE-2026-12798"
8+
],
9+
"details": "A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument spec_path causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12798"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gist.github.com/YLChen-007/c1104c529975699ba347feedfbe02c5a"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/cve/CVE-2026-12798"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/811290"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/372560"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/372560/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-918"
50+
],
51+
"severity": "LOW",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-06-21T10:16:17Z"
55+
}
56+
}

‎advisories/unreviewed/2026/06/GHSA-m2v5-74w2-qhcj/GHSA-m2v5-74w2-qhcj.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m2v5-74w2-qhcj",
4+
"modified": "2026-06-21T12:30:52Z",
5+
"published": "2026-06-21T12:30:52Z",
6+
"aliases": [
7+
"CVE-2026-12799"
8+
],
9+
"details": "A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12799"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gist.github.com/YLChen-007/3ace22e33e468d0166fe609c9fdf4184"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/cve/CVE-2026-12799"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/811291"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/372561"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/372561/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-266"
50+
],
51+
"severity": "LOW",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-06-21T10:16:17Z"
55+
}
56+
}

‎advisories/unreviewed/2026/06/GHSA-p897-vf7j-f5h8/GHSA-p897-vf7j-f5h8.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p897-vf7j-f5h8",
4+
"modified": "2026-06-21T12:30:52Z",
5+
"published": "2026-06-21T12:30:52Z",
6+
"aliases": [
7+
"CVE-2026-12797"
8+
],
9+
"details": "A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banned_keywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12797"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gist.github.com/YLChen-007/078179224f07cc4e39e4f141a18c817a"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/cve/CVE-2026-12797"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/811288"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/372559"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/372559/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-285"
50+
],
51+
"severity": "LOW",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-06-21T10:16:16Z"
55+
}
56+
}

‎advisories/unreviewed/2026/06/GHSA-w2mh-qq9q-453x/GHSA-w2mh-qq9q-453x.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w2mh-qq9q-453x",
4+
"modified": "2026-06-21T12:30:52Z",
5+
"published": "2026-06-21T12:30:52Z",
6+
"aliases": [
7+
"CVE-2026-12796"
8+
],
9+
"details": "A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12796"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gist.github.com/YLChen-007/5fa8af12e1b183674d7ca96d852fb697"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/cve/CVE-2026-12796"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/811287"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/372558"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/372558/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-613"
50+
],
51+
"severity": "LOW",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-06-21T10:16:15Z"
55+
}
56+
}

0 commit comments

Comments
 (0)