Skip to content

Commit f313fbc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-249q-vrhp-j59w GHSA-3fvx-8h8j-fxvf GHSA-58gv-j5qc-234v GHSA-5w89-2c2x-6x66 GHSA-7mr4-xjxg-34g6 GHSA-8jg2-726g-xh43 GHSA-cfp9-33rc-j74f GHSA-cqrx-3m42-5p5w GHSA-fv83-x2xw-2j55 GHSA-g2wf-gm3w-w9x3 GHSA-gc82-3hj3-59h8 GHSA-gjvh-7jh8-7xhm GHSA-jrg3-gfjw-hm96 GHSA-m4pr-4j3g-9v7v GHSA-mcrh-qj64-9c3p GHSA-rc2g-jh8w-mqh9 GHSA-x4jj-h2v8-hqqv GHSA-x64c-qgm9-xp36 GHSA-xj38-jxc5-rppx
1 parent b137d72 commit f313fbc

19 files changed

Lines changed: 766 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/04/GHSA-249q-vrhp-j59w/GHSA-249q-vrhp-j59w.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-249q-vrhp-j59w",
4+
"modified": "2026-04-08T03:32:13Z",
5+
"published": "2026-04-08T03:32:13Z",
6+
"aliases": [
7+
"CVE-2026-1343"
8+
],
9+
"details": "IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 allows an attacker to contact internal authentication endpoints which are protected by the Reverse Proxy.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1343"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.ibm.com/support/pages/node/7268253"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-918"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-08T01:16:40Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-3fvx-8h8j-fxvf/GHSA-3fvx-8h8j-fxvf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3fvx-8h8j-fxvf",
4+
"modified": "2026-04-08T03:32:14Z",
5+
"published": "2026-04-08T03:32:14Z",
6+
"aliases": [
7+
"CVE-2026-5726"
8+
],
9+
"details": "ASDA-Soft Stack-based Buffer Overflow Vulnerability",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5726"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00007_ASDA-Soft%20Stack-based%20Buffer%20Overflow%20Vulnerability%20(CVE-2026-5726).pdf"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-121"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-08T03:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-58gv-j5qc-234v/GHSA-58gv-j5qc-234v.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-58gv-j5qc-234v",
4+
"modified": "2026-04-08T03:32:13Z",
5+
"published": "2026-04-08T03:32:13Z",
6+
"aliases": [
7+
"CVE-2026-4788"
8+
],
9+
"details": "IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.37 stores sensitive information in log files that could be read by a local user.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4788"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.ibm.com/support/pages/node/7268267"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-532"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-08T01:16:41Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-5w89-2c2x-6x66/GHSA-5w89-2c2x-6x66.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5w89-2c2x-6x66",
4+
"modified": "2026-04-08T03:32:14Z",
5+
"published": "2026-04-08T03:32:14Z",
6+
"aliases": [
7+
"CVE-2026-27140"
8+
],
9+
"details": "SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27140"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://go.dev/cl/763768"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://go.dev/issue/78335"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://pkg.go.dev/vuln/GO-2026-4871"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2026-04-08T02:16:02Z"
40+
}
41+
}

‎advisories/unreviewed/2026/04/GHSA-7mr4-xjxg-34g6/GHSA-7mr4-xjxg-34g6.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7mr4-xjxg-34g6",
4+
"modified": "2026-04-08T03:32:14Z",
5+
"published": "2026-04-08T03:32:14Z",
6+
"aliases": [
7+
"CVE-2026-32289"
8+
],
9+
"details": "Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32289"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://go.dev/cl/763762"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://go.dev/issue/78331"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://pkg.go.dev/vuln/GO-2026-4865"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2026-04-08T02:16:03Z"
40+
}
41+
}

‎advisories/unreviewed/2026/04/GHSA-8jg2-726g-xh43/GHSA-8jg2-726g-xh43.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8jg2-726g-xh43",
4+
"modified": "2026-04-08T03:32:14Z",
5+
"published": "2026-04-08T03:32:14Z",
6+
"aliases": [
7+
"CVE-2026-1163"
8+
],
9+
"details": "An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1163"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://huntr.com/bounties/abe2d1c4-c21c-4608-8a8e-274565246a8b"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-613"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-08T03:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-cfp9-33rc-j74f/GHSA-cfp9-33rc-j74f.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cfp9-33rc-j74f",
4+
"modified": "2026-04-08T03:32:14Z",
5+
"published": "2026-04-08T03:32:14Z",
6+
"aliases": [
7+
"CVE-2026-27143"
8+
],
9+
"details": "Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27143"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://go.dev/cl/763765"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://go.dev/issue/78333"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://pkg.go.dev/vuln/GO-2026-4868"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2026-04-08T02:16:03Z"
40+
}
41+
}

‎advisories/unreviewed/2026/04/GHSA-cqrx-3m42-5p5w/GHSA-cqrx-3m42-5p5w.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cqrx-3m42-5p5w",
4+
"modified": "2026-04-08T03:32:14Z",
5+
"published": "2026-04-08T03:32:14Z",
6+
"aliases": [
7+
"CVE-2026-27144"
8+
],
9+
"details": "The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27144"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://go.dev/cl/763764"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://go.dev/issue/78371"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://pkg.go.dev/vuln/GO-2026-4867"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2026-04-08T02:16:03Z"
40+
}
41+
}

‎advisories/unreviewed/2026/04/GHSA-fv83-x2xw-2j55/GHSA-fv83-x2xw-2j55.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fv83-x2xw-2j55",
4+
"modified": "2026-04-08T03:32:14Z",
5+
"published": "2026-04-08T03:32:14Z",
6+
"aliases": [
7+
"CVE-2026-33810"
8+
],
9+
"details": "When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://go.dev/cl/763763"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://go.dev/issue/78332"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2026-04-08T02:16:03Z"
40+
}
41+
}

0 commit comments

Comments
 (0)