Skip to content

Commit baafd1f

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-78pv-qq8x-94px GHSA-g347-f6xx-g55w GHSA-p6p5-j5xg-r643 GHSA-p88x-88cf-mv94 GHSA-qmq6-f8pr-cx5x GHSA-wrv8-79m2-qg24
1 parent 7081720 commit baafd1f

6 files changed

Lines changed: 242 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/04/GHSA-78pv-qq8x-94px/GHSA-78pv-qq8x-94px.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-78pv-qq8x-94px",
4+
"modified": "2026-04-23T06:30:22Z",
5+
"published": "2026-04-23T06:30:22Z",
6+
"aliases": [
7+
"CVE-2026-41990"
8+
],
9+
"details": "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41990"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://dev.gnupg.org/T8208"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-787"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-23T05:16:05Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-g347-f6xx-g55w/GHSA-g347-f6xx-g55w.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g347-f6xx-g55w",
4+
"modified": "2026-04-23T06:30:22Z",
5+
"published": "2026-04-23T06:30:22Z",
6+
"aliases": [
7+
"CVE-2026-40529"
8+
],
9+
"details": "CMS ALAYA provided by KANATA Limited contains an SQL injection vulnerability. Information stored in the database may be obtained or altered by an attacker with access to the administrative interface.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40529"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN08026319"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-23T05:16:04Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-p6p5-j5xg-r643/GHSA-p6p5-j5xg-r643.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p6p5-j5xg-r643",
4+
"modified": "2026-04-23T06:30:22Z",
5+
"published": "2026-04-23T06:30:22Z",
6+
"aliases": [
7+
"CVE-2026-3361"
8+
],
9+
"details": "The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl_address' post meta value in versions up to, and including, 2.2.261 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and opens an injected map marker info window.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3361"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3482539/wp-store-locator"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b6cbb5-d82d-4035-b0c8-5c1aaee31993?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-23T04:16:18Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-p88x-88cf-mv94/GHSA-p88x-88cf-mv94.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p88x-88cf-mv94",
4+
"modified": "2026-04-23T06:30:22Z",
5+
"published": "2026-04-23T06:30:22Z",
6+
"aliases": [
7+
"CVE-2026-3007"
8+
],
9+
"details": "Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS’ courselet feature.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3007"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-042"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "MODERATE",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-04-23T04:16:07Z"
33+
}
34+
}

‎advisories/unreviewed/2026/04/GHSA-qmq6-f8pr-cx5x/GHSA-qmq6-f8pr-cx5x.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qmq6-f8pr-cx5x",
4+
"modified": "2026-04-23T06:30:22Z",
5+
"published": "2026-04-23T06:30:22Z",
6+
"aliases": [
7+
"CVE-2026-41988"
8+
],
9+
"details": "uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "WEB",
20+
"url": "https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"
21+
},
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41988"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-670"
34+
],
35+
"severity": "LOW",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-23T05:16:05Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-wrv8-79m2-qg24/GHSA-wrv8-79m2-qg24.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wrv8-79m2-qg24",
4+
"modified": "2026-04-23T06:30:22Z",
5+
"published": "2026-04-23T06:30:22Z",
6+
"aliases": [
7+
"CVE-2026-41989"
8+
],
9+
"details": "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://dev.gnupg.org/T8211"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-787"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-23T05:16:05Z"
43+
}
44+
}

0 commit comments

Comments
 (0)