Skip to content

Commit ff0d699

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7c7h-p74x-w3h5 GHSA-7ppx-r2wh-w5w3 GHSA-96vc-39m3-22w5 GHSA-9p7j-9995-m88w GHSA-cggw-g858-xx4w GHSA-f9p6-prpf-3757 GHSA-fqm2-p6px-f54c GHSA-vrwp-qqhw-75c3 GHSA-xcv3-99jh-m22g
1 parent 6bce816 commit ff0d699

9 files changed

Lines changed: 352 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/06/GHSA-7c7h-p74x-w3h5/GHSA-7c7h-p74x-w3h5.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7c7h-p74x-w3h5",
4+
"modified": "2026-06-04T03:30:22Z",
5+
"published": "2026-06-04T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-7764"
8+
],
9+
"details": "An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.12 allows an unauthenticated attacker within radio range to disclose a small amount of kernel heap memory or cause a Denial of Service (kernel oops/panic) via a crafted 802.11ah beacon or probe response frame containing a malformed Vendor Information Element. The function morse_vendor_find_vendor_ie() does not validate the IE length against the expected structure size before its result is passed to morse_vendor_rx_caps_ops_ie() and morse_vendor_fill_sta_vendor_info(), which read at fixed offsets into the IE data. Because the length check only requires the IE to be longer than 3 bytes, an attacker can supply an undersized IE, causing a heap out-of-bounds read of up to 9 bytes. No authentication, association, or user interaction is required.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7764"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://www.morsemicro.com/security-advisories/MM-SA-2026-003"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-06-04T02:16:17Z"
28+
}
29+
}

‎advisories/unreviewed/2026/06/GHSA-7ppx-r2wh-w5w3/GHSA-7ppx-r2wh-w5w3.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7ppx-r2wh-w5w3",
4+
"modified": "2026-06-04T03:30:22Z",
5+
"published": "2026-06-04T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-10737"
8+
],
9+
"details": "The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10737"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/ajax.php#L155"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/ajax.php#L39"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L250"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2eafe150-2178-4355-88a8-67687bd446e4?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-862"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-06-04T02:16:17Z"
47+
}
48+
}

‎advisories/unreviewed/2026/06/GHSA-96vc-39m3-22w5/GHSA-96vc-39m3-22w5.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-96vc-39m3-22w5",
4+
"modified": "2026-06-04T03:30:22Z",
5+
"published": "2026-06-04T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-41011"
8+
],
9+
"details": "PackagePersister.validate_tgz builds \"tar -tf #{tgz} 2>&1\" where tgz = File.join(release_dir, 'packages', \"#{name}.tgz\") and name = package_meta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z_+.]+$/i) would reject the name, but in create_package (lines 74–79) the shell-out in save_package_source_blob runs before package.save, so validation fires too late.\n\nAffected versions:\n- BOSH: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41011"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cloudfoundry.org/blog/cve-2026-41011-package-name-command-injection"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-78"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-06-04T03:16:19Z"
39+
}
40+
}

‎advisories/unreviewed/2026/06/GHSA-9p7j-9995-m88w/GHSA-9p7j-9995-m88w.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9p7j-9995-m88w",
4+
"modified": "2026-06-04T03:30:22Z",
5+
"published": "2026-06-04T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-8829"
8+
],
9+
"details": "HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8829"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/libwww-perl/HTML-Parser/pull/56"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248be4d3a25e1c.patch"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-416"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-06-04T03:16:20Z"
34+
}
35+
}

‎advisories/unreviewed/2026/06/GHSA-cggw-g858-xx4w/GHSA-cggw-g858-xx4w.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cggw-g858-xx4w",
4+
"modified": "2026-06-04T03:30:22Z",
5+
"published": "2026-06-04T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-41859"
8+
],
9+
"details": "A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#bosh_api_response_body builds a Net::HTTP client with verify_mode = OpenSSL::SSL::VERIFY_NONE for every director call (/info, /deployments, /deployments/<name>/vms).\n\nAffected versions:\n- BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41859"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cloudfoundry.org/blog/cve-2026-41859-missing-tls-in-nats-sync"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-295"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-06-04T03:16:19Z"
39+
}
40+
}

‎advisories/unreviewed/2026/06/GHSA-f9p6-prpf-3757/GHSA-f9p6-prpf-3757.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f9p6-prpf-3757",
4+
"modified": "2026-06-04T03:30:22Z",
5+
"published": "2026-06-04T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-41858"
8+
],
9+
"details": "Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomize_password job exists solely to lock the local Administrator account behind an unguessable password as a hardening control. Because the password is derived from a predictable, clock-seeded PRNG, a network attacker who can estimate VM boot time can reconstruct a small candidate list and recover the Administrator password, defeating the hardening control.\n\nAffected versions:\n- windows-utilities-release: all versions prior to v0.23.0 (inclusive); fixed in v0.23.0 or later",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41858"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cloudfoundry.org/blog/cve-2026-41858-brute-forceable-windows-admin-creds"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-338"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-06-04T03:16:19Z"
35+
}
36+
}

‎advisories/unreviewed/2026/06/GHSA-fqm2-p6px-f54c/GHSA-fqm2-p6px-f54c.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fqm2-p6px-f54c",
4+
"modified": "2026-06-04T03:30:22Z",
5+
"published": "2026-06-04T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-41860"
8+
],
9+
"details": "CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials.\n\nAffected versions:\n- BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41860"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cloudfoundry.org/blog/cve-2026-41860-missing-tls-verify-on-bosh-monitor"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-326"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-06-04T03:16:20Z"
39+
}
40+
}

‎advisories/unreviewed/2026/06/GHSA-vrwp-qqhw-75c3/GHSA-vrwp-qqhw-75c3.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vrwp-qqhw-75c3",
4+
"modified": "2026-06-04T03:30:22Z",
5+
"published": "2026-06-04T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-10597"
8+
],
9+
"details": "OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to obtain user's email address.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10597"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.twcert.org.tw/en/cp-139-10948-78864-2.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.twcert.org.tw/tw/cp-132-10947-027a7-1.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-639"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-06-04T03:16:19Z"
43+
}
44+
}

‎advisories/unreviewed/2026/06/GHSA-xcv3-99jh-m22g/GHSA-xcv3-99jh-m22g.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xcv3-99jh-m22g",
4+
"modified": "2026-06-04T03:30:22Z",
5+
"published": "2026-06-04T03:30:22Z",
6+
"aliases": [
7+
"CVE-2026-8653"
8+
],
9+
"details": "The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8653"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://stylemixthemes.com/wordpress-lms-plugin"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f24749a8-e01d-436a-9ec8-3745a6b5eecf?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-06-04T02:16:17Z"
39+
}
40+
}

0 commit comments

Comments
 (0)