Publish Advisories

advisory-database[bot] · advisory-database[bot] · commit c4c80dca4595 · 2026-06-23T09:34:37.000Z
GHSA-59rx-q76w-hqrw GHSA-c866-5hw6-cqf9 GHSA-ccmj-8c3p-4qwj GHSA-hwwh-4hhw-h9jf GHSA-jg8v-92xc-cx65 GHSA-m6w2-p258-gxqp GHSA-2hm5-4cpf-66vx GHSA-9v4r-j6qw-wjw2 GHSA-hp5g-5g9f-49wq GHSA-jgxx-4fc8-ff8f GHSA-rq65-66g5-5pg2 GHSA-v62r-5pwf-6945 GHSA-vwqx-9g89-x938 GHSA-x74w-29rh-ccvr
diff --git a/advisories/unreviewed/2026/05/GHSA-59rx-q76w-hqrw/GHSA-59rx-q76w-hqrw.json b/advisories/unreviewed/2026/05/GHSA-59rx-q76w-hqrw/GHSA-59rx-q76w-hqrw.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-59rx-q76w-hqrw",
-  "modified": "2026-06-23T06:30:40Z",
+  "modified": "2026-06-23T09:32:23Z",
   "published": "2026-05-27T12:31:22Z",
   "aliases": [
     "CVE-2026-3012"
@@ -35,6 +35,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:25979"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:28053"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:28054"
diff --git a/advisories/unreviewed/2026/05/GHSA-c866-5hw6-cqf9/GHSA-c866-5hw6-cqf9.json b/advisories/unreviewed/2026/05/GHSA-c866-5hw6-cqf9/GHSA-c866-5hw6-cqf9.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-c866-5hw6-cqf9",
-  "modified": "2026-06-23T06:30:40Z",
+  "modified": "2026-06-23T09:32:23Z",
   "published": "2026-05-27T15:33:10Z",
   "aliases": [
     "CVE-2026-1933"
@@ -35,6 +35,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:25979"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:28053"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:28054"
diff --git a/advisories/unreviewed/2026/05/GHSA-ccmj-8c3p-4qwj/GHSA-ccmj-8c3p-4qwj.json b/advisories/unreviewed/2026/05/GHSA-ccmj-8c3p-4qwj/GHSA-ccmj-8c3p-4qwj.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-ccmj-8c3p-4qwj",
-  "modified": "2026-05-29T12:31:25Z",
+  "modified": "2026-06-23T09:32:23Z",
   "published": "2026-05-29T12:31:25Z",
   "aliases": [
     "CVE-2026-46579"
@@ -19,6 +19,14 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46579"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:27044"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:27063"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/security/cve/CVE-2026-46579"
diff --git a/advisories/unreviewed/2026/05/GHSA-hwwh-4hhw-h9jf/GHSA-hwwh-4hhw-h9jf.json b/advisories/unreviewed/2026/05/GHSA-hwwh-4hhw-h9jf/GHSA-hwwh-4hhw-h9jf.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hwwh-4hhw-h9jf",
-  "modified": "2026-06-23T06:30:39Z",
+  "modified": "2026-06-23T09:32:22Z",
   "published": "2026-05-26T15:32:11Z",
   "aliases": [
     "CVE-2026-4480"
@@ -35,6 +35,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:25979"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:28053"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:28054"
@@ -55,6 +59,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:28058"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:28132"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/security/cve/CVE-2026-4480"
diff --git a/advisories/unreviewed/2026/05/GHSA-jg8v-92xc-cx65/GHSA-jg8v-92xc-cx65.json b/advisories/unreviewed/2026/05/GHSA-jg8v-92xc-cx65/GHSA-jg8v-92xc-cx65.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-jg8v-92xc-cx65",
-  "modified": "2026-06-23T06:30:41Z",
+  "modified": "2026-06-23T09:32:23Z",
   "published": "2026-05-28T09:31:19Z",
   "aliases": [
     "CVE-2026-4408"
@@ -35,6 +35,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:25979"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:28053"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:28054"
@@ -55,6 +59,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:28058"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:28132"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/security/cve/CVE-2026-4408"
diff --git a/advisories/unreviewed/2026/05/GHSA-m6w2-p258-gxqp/GHSA-m6w2-p258-gxqp.json b/advisories/unreviewed/2026/05/GHSA-m6w2-p258-gxqp/GHSA-m6w2-p258-gxqp.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m6w2-p258-gxqp",
-  "modified": "2026-06-23T06:30:40Z",
+  "modified": "2026-06-23T09:32:23Z",
   "published": "2026-05-27T15:33:11Z",
   "aliases": [
     "CVE-2026-2340"
@@ -35,6 +35,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:25979"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:28053"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:28054"
diff --git a/advisories/unreviewed/2026/06/GHSA-2hm5-4cpf-66vx/GHSA-2hm5-4cpf-66vx.json b/advisories/unreviewed/2026/06/GHSA-2hm5-4cpf-66vx/GHSA-2hm5-4cpf-66vx.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2hm5-4cpf-66vx",
+  "modified": "2026-06-23T09:32:23Z",
+  "published": "2026-06-23T09:32:23Z",
+  "aliases": [
+    "CVE-2026-8163"
+  ],
+  "details": "The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8163"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/e471516a-6f43-4a89-8486-7a638845e197"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-06-23T07:16:20Z"
+  }
+}
diff --git a/advisories/unreviewed/2026/06/GHSA-9v4r-j6qw-wjw2/GHSA-9v4r-j6qw-wjw2.json b/advisories/unreviewed/2026/06/GHSA-9v4r-j6qw-wjw2/GHSA-9v4r-j6qw-wjw2.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9v4r-j6qw-wjw2",
+  "modified": "2026-06-23T09:32:23Z",
+  "published": "2026-06-23T09:32:23Z",
+  "aliases": [
+    "CVE-2026-8379"
+  ],
+  "details": "The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating identifiers.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8379"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/71619406-19bb-437f-9538-fdf73de98827"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-06-23T07:16:21Z"
+  }
+}
diff --git a/advisories/unreviewed/2026/06/GHSA-hp5g-5g9f-49wq/GHSA-hp5g-5g9f-49wq.json b/advisories/unreviewed/2026/06/GHSA-hp5g-5g9f-49wq/GHSA-hp5g-5g9f-49wq.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hp5g-5g9f-49wq",
+  "modified": "2026-06-23T09:32:23Z",
+  "published": "2026-06-23T09:32:23Z",
+  "aliases": [
+    "CVE-2026-11374"
+  ],
+  "details": "In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted\n by an unauthenticated user, leading to account takeover.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11374"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-287"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-06-23T09:16:28Z"
+  }
+}
diff --git a/advisories/unreviewed/2026/06/GHSA-jgxx-4fc8-ff8f/GHSA-jgxx-4fc8-ff8f.json b/advisories/unreviewed/2026/06/GHSA-jgxx-4fc8-ff8f/GHSA-jgxx-4fc8-ff8f.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jgxx-4fc8-ff8f",
+  "modified": "2026-06-23T09:32:23Z",
+  "published": "2026-06-23T09:32:23Z",
+  "aliases": [
+    "CVE-2026-7842"
+  ],
+  "details": "The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks before using them in SQL queries, allowing authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database. The ImportData module must be enabled via the Infility Global WordPress plugin before 2.15.20's module toggle page.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7842"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/210303c4-0964-4a01-ac8e-13d7c7f424a2"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-06-23T07:16:20Z"
+  }
+}
diff --git a/advisories/unreviewed/2026/06/GHSA-rq65-66g5-5pg2/GHSA-rq65-66g5-5pg2.json b/advisories/unreviewed/2026/06/GHSA-rq65-66g5-5pg2/GHSA-rq65-66g5-5pg2.json
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rq65-66g5-5pg2",
+  "modified": "2026-06-23T09:32:23Z",
+  "published": "2026-06-23T09:32:23Z",
+  "aliases": [
+    "CVE-2026-9733"
+  ],
+  "details": "Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.\n\nWhen no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function.\n\nA predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9733"
+    },
+    {
+      "type": "WEB",
+      "url": "https://datatracker.ietf.org/doc/html/rfc6749#section-10.12"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/HAYAJO/Mojolicious-Plugin-Web-Auth-0.17/source/lib/Mojolicious/Plugin/Web/Auth/OAuth2.pm#L129-131"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.metacpan.org/patches/M/Mojolicious-Plugin-Web-Auth/0.17/CVE-2026-9733-r2.patch"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-338"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-06-23T08:16:26Z"
+  }
+}
diff --git a/advisories/unreviewed/2026/06/GHSA-v62r-5pwf-6945/GHSA-v62r-5pwf-6945.json b/advisories/unreviewed/2026/06/GHSA-v62r-5pwf-6945/GHSA-v62r-5pwf-6945.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-v62r-5pwf-6945",
+  "modified": "2026-06-23T09:32:23Z",
+  "published": "2026-06-23T09:32:23Z",
+  "aliases": [
+    "CVE-2026-8378"
+  ],
+  "details": "The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability exploitable by users with Subscriber-level access and above against an administrator viewing the file management interface.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8378"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/19f5dd94-b16c-4ad2-9586-d15ddecf9805"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-06-23T07:16:21Z"
+  }
+}
diff --git a/advisories/unreviewed/2026/06/GHSA-vwqx-9g89-x938/GHSA-vwqx-9g89-x938.json b/advisories/unreviewed/2026/06/GHSA-vwqx-9g89-x938/GHSA-vwqx-9g89-x938.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vwqx-9g89-x938",
+  "modified": "2026-06-23T09:32:23Z",
+  "published": "2026-06-23T09:32:23Z",
+  "aliases": [
+    "CVE-2026-10521"
+  ],
+  "details": "An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10521"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.certvde.com/en/advisories/VDE-2026-068"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-425"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-06-23T08:16:23Z"
+  }
+}
diff --git a/advisories/unreviewed/2026/06/GHSA-x74w-29rh-ccvr/GHSA-x74w-29rh-ccvr.json b/advisories/unreviewed/2026/06/GHSA-x74w-29rh-ccvr/GHSA-x74w-29rh-ccvr.json
