Skip to content

Commit 36b0ddd

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-wvhq-3h88-rf6g GHSA-58qh-jxh9-rvp5 GHSA-62xf-gv4m-h3vc GHSA-gvgc-7vpx-c4jp GHSA-h886-6wvm-63qx GHSA-hwjj-g6g7-p8cf GHSA-jhr5-g8vv-6x3q GHSA-jmvf-vwrm-vhw5 GHSA-jv85-6mgr-3w99
1 parent 6c09dc8 commit 36b0ddd

File tree

9 files changed

+165
-14
lines changed

9 files changed

+165
-14
lines changed

‎advisories/unreviewed/2026/01/GHSA-wvhq-3h88-rf6g/GHSA-wvhq-3h88-rf6g.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wvhq-3h88-rf6g",
4-
"modified": "2026-01-29T15:30:27Z",
4+
"modified": "2026-02-26T00:31:23Z",
55
"published": "2026-01-27T18:32:15Z",
66
"aliases": [
77
"CVE-2025-15467"
@@ -46,6 +46,10 @@
4646
{
4747
"type": "WEB",
4848
"url": "http://www.openwall.com/lists/oss-security/2026/01/27/10"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "http://www.openwall.com/lists/oss-security/2026/02/25/6"
4953
}
5054
],
5155
"database_specific": {

‎advisories/unreviewed/2026/02/GHSA-58qh-jxh9-rvp5/GHSA-58qh-jxh9-rvp5.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-58qh-jxh9-rvp5",
4-
"modified": "2026-02-20T18:31:34Z",
4+
"modified": "2026-02-26T00:31:23Z",
55
"published": "2026-02-20T18:31:34Z",
66
"aliases": [
77
"CVE-2025-67969"
88
],
99
"details": "Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through <= 1.5.1.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-862"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-02-20T16:22:03Z"

‎advisories/unreviewed/2026/02/GHSA-62xf-gv4m-h3vc/GHSA-62xf-gv4m-h3vc.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,9 @@
3333
}
3434
],
3535
"database_specific": {
36-
"cwe_ids": [],
36+
"cwe_ids": [
37+
"CWE-824"
38+
],
3739
"severity": "CRITICAL",
3840
"github_reviewed": false,
3941
"github_reviewed_at": null,

‎advisories/unreviewed/2026/02/GHSA-gvgc-7vpx-c4jp/GHSA-gvgc-7vpx-c4jp.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gvgc-7vpx-c4jp",
4-
"modified": "2026-02-20T18:31:33Z",
4+
"modified": "2026-02-26T00:31:23Z",
55
"published": "2026-02-20T18:31:33Z",
66
"aliases": [
77
"CVE-2025-67547"
88
],
99
"details": "Missing Authorization vulnerability in uixthemes Konte konte allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Konte: from n/a through <= 2.4.6.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-862"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-02-20T16:22:02Z"

‎advisories/unreviewed/2026/02/GHSA-h886-6wvm-63qx/GHSA-h886-6wvm-63qx.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h886-6wvm-63qx",
4-
"modified": "2026-02-20T18:31:34Z",
4+
"modified": "2026-02-26T00:31:23Z",
55
"published": "2026-02-20T18:31:34Z",
66
"aliases": [
77
"CVE-2025-67998"
88
],
99
"details": "Authentication Bypass Using an Alternate Path or Channel vulnerability in kamleshyadav Miraculous Elementor miraculous-el allows Authentication Abuse.This issue affects Miraculous Elementor: from n/a through <= 2.0.7.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-288"
2530
],
26-
"severity": null,
31+
"severity": "HIGH",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-02-20T16:22:06Z"

‎advisories/unreviewed/2026/02/GHSA-hwjj-g6g7-p8cf/GHSA-hwjj-g6g7-p8cf.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
],
3535
"database_specific": {
3636
"cwe_ids": [
37+
"CWE-457",
3738
"CWE-908"
3839
],
3940
"severity": "CRITICAL",

‎advisories/unreviewed/2026/02/GHSA-jhr5-g8vv-6x3q/GHSA-jhr5-g8vv-6x3q.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jhr5-g8vv-6x3q",
4-
"modified": "2026-02-20T18:31:34Z",
4+
"modified": "2026-02-26T00:31:23Z",
55
"published": "2026-02-20T18:31:34Z",
66
"aliases": [
77
"CVE-2025-67973"
88
],
99
"details": "Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-862"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-02-20T16:22:03Z"

‎advisories/unreviewed/2026/02/GHSA-jmvf-vwrm-vhw5/GHSA-jmvf-vwrm-vhw5.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jmvf-vwrm-vhw5",
4+
"modified": "2026-02-26T00:31:24Z",
5+
"published": "2026-02-26T00:31:24Z",
6+
"aliases": [
7+
"CVE-2026-2694"
8+
],
9+
"details": "The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capability check on the 'can_edit' and 'can_delete' function in all versions up to, and including, 6.15.16. This makes it possible for authenticated attackers, with Contributor-level access and above, to update or trash events, organizers and venues via REST API.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2694"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.16/src/Tribe/REST/V1/Endpoints/Single_Event.php#L498"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.16/src/Tribe/REST/V1/Endpoints/Single_Event.php#L563"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.16/src/Tribe/REST/V1/Endpoints/Single_Venue.php#L529"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.16/src/Tribe/REST/V1/Endpoints/Single_Venue.php#L583"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/changeset/3468694/the-events-calendar"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/67351a37-a457-48d6-b40a-95a7e3a0d746?source=cve"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-285"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-25T22:16:28Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-jv85-6mgr-3w99/GHSA-jv85-6mgr-3w99.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jv85-6mgr-3w99",
4+
"modified": "2026-02-26T00:31:25Z",
5+
"published": "2026-02-26T00:31:24Z",
6+
"aliases": [
7+
"CVE-2026-3209"
8+
],
9+
"details": "A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.4-s.4 mitigates this issue. The identifier of the patch is 5e37c4e85fae68e756be5019a28ca903b161fdd5. Upgrading the affected component is advised.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3209"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/fosrl/pangolin/pull/2511"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/fosrl/pangolin/commit/5e37c4e85fae68e756be5019a28ca903b161fdd5"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://gist.github.com/henrrrychau/0457bef6776d0c99688f9cf55cdf55f7"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/fosrl/pangolin"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/fosrl/pangolin/releases/tag/1.15.4-s.4"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?ctiid.347796"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?id.347796"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/?submit.765676"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-266"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": false,
65+
"github_reviewed_at": null,
66+
"nvd_published_at": "2026-02-25T23:16:21Z"
67+
}
68+
}

0 commit comments

Comments
 (0)