Skip to content

Commit ece2748

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 25c26b9 commit ece2748

170 files changed

Lines changed: 2749 additions & 210 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/09/GHSA-22q7-8jfc-2936/GHSA-22q7-8jfc-2936.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-400"
30+
],
2931
"severity": "HIGH",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2026/09/GHSA-2636-fg22-863m/GHSA-2636-fg22-863m.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2636-fg22-863m",
4+
"modified": "2026-09-16T00:31:32Z",
5+
"published": "2026-09-16T00:31:32Z",
6+
"aliases": [
7+
"CVE-2026-92255"
8+
],
9+
"details": "Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memory contents.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92255"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-arp-import-overread.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-out-of-bounds-read-in-filter-arp-put-file-cgi-via-string-api-misuse"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-125"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-09-15T22:17:04Z"
43+
}
44+
}

‎advisories/unreviewed/2026/09/GHSA-2fvm-cppx-f9c5/GHSA-2fvm-cppx-f9c5.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2fvm-cppx-f9c5",
4+
"modified": "2026-09-16T00:31:31Z",
5+
"published": "2026-09-16T00:31:31Z",
6+
"aliases": [
7+
"CVE-2026-76873"
8+
],
9+
"details": "Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostname fields. A LAN-based attacker can inject malicious script through these hostname fields, which is later rendered by network_config.js and network_security.js in the web management interface.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76873"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-dhcp-lan-xss.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-via-dhcp-and-arp-hostname-fields"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-09-15T22:17:02Z"
43+
}
44+
}

‎advisories/unreviewed/2026/09/GHSA-2gwv-2f5x-4gq5/GHSA-2gwv-2f5x-4gq5.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-287"
30+
],
2931
"severity": "CRITICAL",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2026/09/GHSA-2h2p-7gw7-xqx7/GHSA-2h2p-7gw7-xqx7.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2h2p-7gw7-xqx7",
4-
"modified": "2026-09-15T21:33:05Z",
4+
"modified": "2026-09-16T00:31:28Z",
55
"published": "2026-09-15T21:33:05Z",
66
"aliases": [
77
"CVE-2026-91747"
88
],
99
"details": "Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-416"
2934
],
30-
"severity": null,
35+
"severity": "LOW",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2026-09-15T21:16:48Z"

‎advisories/unreviewed/2026/09/GHSA-2ph5-2xfp-qvgm/GHSA-2ph5-2xfp-qvgm.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2ph5-2xfp-qvgm",
4-
"modified": "2026-09-15T21:31:16Z",
4+
"modified": "2026-09-16T00:31:23Z",
55
"published": "2026-09-15T21:31:16Z",
66
"aliases": [
77
"CVE-2026-55317"
88
],
99
"details": "In printf of printf.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-20"
30+
],
31+
"severity": "MODERATE",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2026-09-15T19:17:21Z"

‎advisories/unreviewed/2026/09/GHSA-2q2m-g9vr-6rgh/GHSA-2q2m-g9vr-6rgh.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-287"
30+
],
2931
"severity": "CRITICAL",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2026/09/GHSA-2vp6-w498-hg23/GHSA-2vp6-w498-hg23.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-287"
30+
],
2931
"severity": "CRITICAL",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2026/09/GHSA-2xxw-x28h-g67h/GHSA-2xxw-x28h-g67h.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-287"
30+
],
2931
"severity": "CRITICAL",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2026/09/GHSA-3863-8rfp-v9rw/GHSA-3863-8rfp-v9rw.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3863-8rfp-v9rw",
4+
"modified": "2026-09-16T00:31:35Z",
5+
"published": "2026-09-16T00:31:35Z",
6+
"aliases": [
7+
"CVE-2026-92184"
8+
],
9+
"details": "A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/ag_ui_strands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request forgery. The attack can be executed remotely. The patch is identified as bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189. It is advisable to implement a patch to correct this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92184"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ag-ui-protocol/ag-ui/issues/2432"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/ag-ui-protocol/ag-ui/pull/2491"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/ag-ui-protocol/ag-ui/commit/bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/ag-ui-protocol/ag-ui"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/cve/CVE-2026-92184"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/submit/934100"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/404437"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/vuln/404437/cti"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-918"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": false,
65+
"github_reviewed_at": null,
66+
"nvd_published_at": "2026-09-16T00:17:30Z"
67+
}
68+
}

0 commit comments

Comments
 (0)