Skip to content

Commit f03416e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-pm8w-jq9r-x5rp GHSA-h9jc-64qv-h9cg GHSA-2q6q-x2rq-67q4 GHSA-35hg-m22v-mcj5 GHSA-3f67-8v72-vm9p GHSA-5hjj-hhq3-52wj GHSA-5qj3-gjq7-62fm GHSA-5v8v-xvjv-57x7 GHSA-7p84-m28m-q2vh GHSA-82h6-xw4j-pq2m GHSA-8p84-j4x4-c993 GHSA-9wvf-7g57-m92f GHSA-cf8w-8g67-48gv GHSA-f92h-cvpr-77r6 GHSA-gmx4-p9gm-fxcw GHSA-h6g8-c22x-m2px GHSA-pfp5-r4vh-w3r6 GHSA-qqxp-95qg-gqxr GHSA-w624-2cff-x5w8 GHSA-xhjx-m35j-wjqw
1 parent c911c63 commit f03416e

File tree

20 files changed

+920
-2
lines changed

20 files changed

+920
-2
lines changed

‎advisories/unreviewed/2026/02/GHSA-pm8w-jq9r-x5rp/GHSA-pm8w-jq9r-x5rp.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pm8w-jq9r-x5rp",
4-
"modified": "2026-03-24T12:30:24Z",
4+
"modified": "2026-04-06T09:31:42Z",
55
"published": "2026-02-09T15:30:31Z",
66
"aliases": [
77
"CVE-2025-14831"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://access.redhat.com/errata/RHSA-2026:5606"
4545
},
46+
{
47+
"type": "WEB",
48+
"url": "https://access.redhat.com/errata/RHSA-2026:6630"
49+
},
4650
{
4751
"type": "WEB",
4852
"url": "https://access.redhat.com/security/cve/CVE-2025-14831"

‎advisories/unreviewed/2026/03/GHSA-h9jc-64qv-h9cg/GHSA-h9jc-64qv-h9cg.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h9jc-64qv-h9cg",
4-
"modified": "2026-04-02T12:31:04Z",
4+
"modified": "2026-04-06T09:31:42Z",
55
"published": "2026-03-09T18:31:43Z",
66
"aliases": [
77
"CVE-2024-14027"
@@ -18,6 +18,10 @@
1818
"type": "WEB",
1919
"url": "https://git.kernel.org/stable/c/5a1e865e51063d6c56f673ec8ad4b6604321b455"
2020
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/9a3a2ae5efbbcaed37551218abed94e23c537157"
24+
},
2125
{
2226
"type": "WEB",
2327
"url": "https://git.kernel.org/stable/c/a71874379ec8c6e788a61d71b3ad014a8d9a5c08"

‎advisories/unreviewed/2026/04/GHSA-2q6q-x2rq-67q4/GHSA-2q6q-x2rq-67q4.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2q6q-x2rq-67q4",
4+
"modified": "2026-04-06T09:31:42Z",
5+
"published": "2026-04-06T09:31:42Z",
6+
"aliases": [
7+
"CVE-2026-5631"
8+
],
9+
"details": "A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extract_command_data of the file backend/server/server_utils.py of the component ws Endpoint. Such manipulation of the argument args leads to code injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5631"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/assafelovic/gpt-researcher/issues/1694"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/assafelovic/gpt-researcher"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/785858"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/355419"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/355419/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-06T07:16:01Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-35hg-m22v-mcj5/GHSA-35hg-m22v-mcj5.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-35hg-m22v-mcj5",
4+
"modified": "2026-04-06T09:31:42Z",
5+
"published": "2026-04-06T09:31:42Z",
6+
"aliases": [
7+
"CVE-2026-5630"
8+
],
9+
"details": "A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.py of the component Report API. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5630"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/assafelovic/gpt-researcher/issues/1693"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/assafelovic/gpt-researcher"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/785856"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/355418"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/355418/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-06T07:16:01Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-3f67-8v72-vm9p/GHSA-3f67-8v72-vm9p.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3f67-8v72-vm9p",
4+
"modified": "2026-04-06T09:31:42Z",
5+
"published": "2026-04-06T09:31:42Z",
6+
"aliases": [
7+
"CVE-2026-5635"
8+
],
9+
"details": "A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. Affected by this issue is some unknown functionality of the file /categorywise-products.php of the component Parameter Handler. The manipulation of the argument cid results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5635"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/f1rstb100d/CVE/issues/15"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://phpgurukul.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/785872"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/355423"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/355423/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-06T08:16:39Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-5hjj-hhq3-52wj/GHSA-5hjj-hhq3-52wj.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5hjj-hhq3-52wj",
4+
"modified": "2026-04-06T09:31:42Z",
5+
"published": "2026-04-06T09:31:42Z",
6+
"aliases": [
7+
"CVE-2026-31410"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION\n\nUse sb->s_uuid for a proper volume identifier as the primary choice.\nFor filesystems that do not provide a UUID, fall back to stfs.f_fsid\nobtained from vfs_statfs().",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31410"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/3a64125730cabc34fccfbc230c2667c2e14f7308"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/3d80ebe6d1b7bc9ad20fd9b0c1a0c56d804f8a0a"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/c283a6ffe6d5d6e5594d991286b9ce15951572e1"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://git.kernel.org/stable/c/ce00616bc1df675bfdacc968f2bf7c51f4669227"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2026-04-06T08:16:39Z"
40+
}
41+
}

‎advisories/unreviewed/2026/04/GHSA-5qj3-gjq7-62fm/GHSA-5qj3-gjq7-62fm.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5qj3-gjq7-62fm",
4+
"modified": "2026-04-06T09:31:42Z",
5+
"published": "2026-04-06T09:31:42Z",
6+
"aliases": [
7+
"CVE-2026-31409"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: unset conn->binding on failed binding request\n\nWhen a multichannel SMB2_SESSION_SETUP request with\nSMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true\nbut never clears it on the error path. This leaves the connection in\na binding state where all subsequent ksmbd_session_lookup_all() calls\nfall back to the global sessions table. This fix it by clearing\nconn->binding = false in the error path.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31409"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/282343cf8a4a5a3603b1cb0e17a7083e4a593b03"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/6260fc85ed1298a71d24a75d01f8b2e56d489a60"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/6ebef4a220a1ebe345de899ebb9ae394206fe921"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://git.kernel.org/stable/c/89afe5e2dbea6e9d8e5f11324149d06fa3a4efca"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://git.kernel.org/stable/c/9feb2d1bf86d9e5e66b8565f37f8d3a7d281a772"
36+
},
37+
{
38+
"type": "WEB",
39+
"url": "https://git.kernel.org/stable/c/d073870dab8f6dadced81d13d273ff0b21cb7f4e"
40+
}
41+
],
42+
"database_specific": {
43+
"cwe_ids": [],
44+
"severity": null,
45+
"github_reviewed": false,
46+
"github_reviewed_at": null,
47+
"nvd_published_at": "2026-04-06T08:16:38Z"
48+
}
49+
}

‎advisories/unreviewed/2026/04/GHSA-5v8v-xvjv-57x7/GHSA-5v8v-xvjv-57x7.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5v8v-xvjv-57x7",
4+
"modified": "2026-04-06T09:31:42Z",
5+
"published": "2026-04-06T09:31:42Z",
6+
"aliases": [
7+
"CVE-2026-37977"
8+
],
9+
"details": "A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the `azp` claim from a client-supplied JSON Web Token (JWT) is used to set the `Access-Control-Allow-Origin` header before the JWT signature is validated. When a specially crafted JWT with an attacker-controlled `azp` value is processed, this value is reflected as the CORS origin, even if the grant is later rejected. This can lead to the exposure of low-sensitivity information from authorization server error responses, weakening origin isolation, but only when a target client is misconfigured with `webOrigins: [\"*\"]`.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37977"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2026-37977"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455324"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-346"
34+
],
35+
"severity": "LOW",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-06T09:16:17Z"
39+
}
40+
}

0 commit comments

Comments
 (0)