Skip to content

Commit 0aeadf4

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 61449cb commit 0aeadf4

177 files changed

Lines changed: 6105 additions & 37 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/06/GHSA-qxh4-rprf-2mmj/GHSA-qxh4-rprf-2mmj.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qxh4-rprf-2mmj",
4-
"modified": "2026-08-25T06:31:16Z",
4+
"modified": "2026-08-27T06:31:21Z",
55
"published": "2026-06-29T12:31:44Z",
66
"aliases": [
77
"CVE-2026-41992"
@@ -42,6 +42,10 @@
4242
{
4343
"type": "WEB",
4444
"url": "http://www.openwall.com/lists/oss-security/2026/08/25/1"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "http://www.openwall.com/lists/oss-security/2026/08/27/2"
4549
}
4650
],
4751
"database_specific": {

‎advisories/unreviewed/2026/08/GHSA-2495-48wf-cqx2/GHSA-2495-48wf-cqx2.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2495-48wf-cqx2",
4+
"modified": "2026-08-27T06:31:31Z",
5+
"published": "2026-08-27T06:31:31Z",
6+
"aliases": [
7+
"CVE-2026-74750"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: defer key slot crypto freeing to workqueue\n\nKey slots are released through a kref and the existing release path\nfrees the AEAD transforms from an RCU callback. That is not safe for all\ncrypto implementations: crypto_free_aead can sleep, for example when an\nasync or hardware implementation has teardown work to complete.\n\nUse queue_rcu_work for key-slot release. This keeps the RCU grace period\nneeded by lockless key-slot readers, but runs the actual crypto teardown\nfrom workqueue context where sleeping is allowed. Once the rcu_work\ncallback runs, pre-existing RCU readers are gone, and the final kref put\nalready proves that no transform user remains, so the worker can release\nthe AEAD transforms and free the slot directly.\n\nThe previous patch drains ovpn_wq during module exit, so queued key-slot\nteardown work cannot outlive module text.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74750"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://git.kernel.org/stable/c/0f77ed5ee91946ea63e29f2e0ff9dc9e722d8da3"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://git.kernel.org/stable/c/2da3dfa1ddfe55a065f484750c83660e3bd4ac00"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [],
33+
"severity": "HIGH",
34+
"github_reviewed": false,
35+
"github_reviewed_at": null,
36+
"nvd_published_at": "2026-08-26T15:16:54Z"
37+
}
38+
}

‎advisories/unreviewed/2026/08/GHSA-28cj-v8rj-mq63/GHSA-28cj-v8rj-mq63.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-28cj-v8rj-mq63",
4+
"modified": "2026-08-27T06:31:33Z",
5+
"published": "2026-08-27T06:31:33Z",
6+
"aliases": [
7+
"CVE-2026-80580"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: bound mode sysfs output to the sysfs buffer\n\nmode_string() uses snprintf() which can return a value larger than the\nremaining buffer space. show_modes() accumulates the return value into i\nwithout checking whether i has reached PAGE_SIZE, causing the offset to\nadvance past the sysfs buffer if the modelist is long enough.\n\nAdd a size parameter to mode_string() and use scnprintf() to return\nonly the bytes actually written. Add an early return when offset\nalready exceeds the buffer. In show_modes(), stop accumulating once\nthe buffer is full.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80580"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://git.kernel.org/stable/c/873a1aa15c313263f2e18b38cf525623cc4fabf6"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://git.kernel.org/stable/c/d15d51fb26e830af58f3f21964f1c09c239077ea"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [],
33+
"severity": "HIGH",
34+
"github_reviewed": false,
35+
"github_reviewed_at": null,
36+
"nvd_published_at": "2026-08-26T15:17:14Z"
37+
}
38+
}

‎advisories/unreviewed/2026/08/GHSA-28f5-gvgw-386q/GHSA-28f5-gvgw-386q.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-28f5-gvgw-386q",
4-
"modified": "2026-08-27T00:30:27Z",
4+
"modified": "2026-08-27T06:31:23Z",
55
"published": "2026-08-18T18:31:59Z",
66
"aliases": [
77
"CVE-2026-75485"
@@ -23,6 +23,14 @@
2323
"type": "WEB",
2424
"url": "https://access.redhat.com/errata/RHSA-2026:60386"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://access.redhat.com/errata/RHSA-2026:60387"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://access.redhat.com/errata/RHSA-2026:60388"
33+
},
2634
{
2735
"type": "WEB",
2836
"url": "https://access.redhat.com/errata/RHSA-2026:60389"
@@ -31,6 +39,10 @@
3139
"type": "WEB",
3240
"url": "https://access.redhat.com/errata/RHSA-2026:60390"
3341
},
42+
{
43+
"type": "WEB",
44+
"url": "https://access.redhat.com/errata/RHSA-2026:60391"
45+
},
3446
{
3547
"type": "WEB",
3648
"url": "https://access.redhat.com/security/cve/CVE-2026-75485"

‎advisories/unreviewed/2026/08/GHSA-2cc7-72rv-6m2m/GHSA-2cc7-72rv-6m2m.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2cc7-72rv-6m2m",
4+
"modified": "2026-08-27T06:31:32Z",
5+
"published": "2026-08-27T06:31:32Z",
6+
"aliases": [
7+
"CVE-2026-80573"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: iforce - validate input packet lengths\n\niforce_process_packet() reads fixed fields from joystick, wheel and\nstatus packets without first checking their lengths. In particular, the\nshared hats-and-buttons helper unconditionally reads data[6]. The status\ntail is a sequence of 16-bit effect addresses, but an incomplete final\naddress is also consumed. A successful zero-length USB URB additionally\nreads the packet ID before the common parser is called.\n\nReject the zero-length USB transfer, require the seven-byte joystick and\nwheel prefixes and the two-byte status prefix, and consume only complete\nstatus-tail addresses.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80573"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/0ec411167655ef3ff3e84f6af685e962aff9a75b"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/2c083ab16e33fbff3ab8c752fbf8118ed3dd31ce"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/5232529eaf57f08fe37484e301579a1915b93d14"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://git.kernel.org/stable/c/5751c781d3c97ab6ce0e2a966156ed882152c415"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://git.kernel.org/stable/c/609be40988898a4d75225ade0ea5c1734757dd33"
36+
},
37+
{
38+
"type": "WEB",
39+
"url": "https://git.kernel.org/stable/c/84e5cb517f445dadbd5f8bf4ec513540e51f9c36"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://git.kernel.org/stable/c/a64a8b6b31cd669f0449138e53cc2592d454ccf1"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://git.kernel.org/stable/c/e73d7a7d913d89141321f5f3f16343ecc200d152"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [],
52+
"severity": null,
53+
"github_reviewed": false,
54+
"github_reviewed_at": null,
55+
"nvd_published_at": "2026-08-26T15:17:13Z"
56+
}
57+
}

‎advisories/unreviewed/2026/08/GHSA-2j95-j9fx-32w6/GHSA-2j95-j9fx-32w6.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2j95-j9fx-32w6",
4+
"modified": "2026-08-27T06:31:29Z",
5+
"published": "2026-08-27T06:31:29Z",
6+
"aliases": [
7+
"CVE-2026-77539"
8+
],
9+
"details": "A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77539"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-20"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-08-26T10:16:41Z"
35+
}
36+
}

‎advisories/unreviewed/2026/08/GHSA-2jf4-529g-mpwh/GHSA-2jf4-529g-mpwh.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2jf4-529g-mpwh",
4+
"modified": "2026-08-27T06:31:31Z",
5+
"published": "2026-08-27T06:31:31Z",
6+
"aliases": [
7+
"CVE-2026-80531"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: avoid UAF on sc->tempip in xrep_tempfile_create\n\nLOLLM noticed a potential UAF if the tempfile creation code fails after\nit set sc->tempip. Fix that.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80531"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://git.kernel.org/stable/c/08a20776ce33a2a52d856911e447c59424f0465a"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://git.kernel.org/stable/c/0c88e10d12de9ca7cbed1467bb1b52310101bff8"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://git.kernel.org/stable/c/96246a3200d32a43766152e56bc7ae2d93604d74"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://git.kernel.org/stable/c/cd1f876d1bc2e94f271e07c606cacd85b109108a"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [],
41+
"severity": "HIGH",
42+
"github_reviewed": false,
43+
"github_reviewed_at": null,
44+
"nvd_published_at": "2026-08-26T15:17:07Z"
45+
}
46+
}

‎advisories/unreviewed/2026/08/GHSA-2pwq-qhmm-3vg8/GHSA-2pwq-qhmm-3vg8.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2pwq-qhmm-3vg8",
4+
"modified": "2026-08-27T06:31:34Z",
5+
"published": "2026-08-27T06:31:34Z",
6+
"aliases": [
7+
"CVE-2026-47878"
8+
],
9+
"details": "DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist.\nSpring Batch 6.0.0 - 6.0.4\nSpring Batch 5.2.6 and earlier",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47878"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://spring.io/security/cve-2026-47878"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "MODERATE",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-08-27T06:17:17Z"
33+
}
34+
}

‎advisories/unreviewed/2026/08/GHSA-3268-6g62-7794/GHSA-3268-6g62-7794.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3268-6g62-7794",
4+
"modified": "2026-08-27T06:31:32Z",
5+
"published": "2026-08-27T06:31:32Z",
6+
"aliases": [
7+
"CVE-2026-80569"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F54 report size to the allocated buffer\n\nrmi_f54_work() reads a diagnostics report from the device into\nf54->report_data, sizing the transfer with rmi_f54_get_report_size():\n\n\treport_size = rmi_f54_get_report_size(f54);\n\t...\n\tfor (i = 0; i < report_size; i += F54_REPORT_DATA_SIZE) {\n\t\tint size = min(F54_REPORT_DATA_SIZE, report_size - i);\n\t\t...\n\t\trmi_read_block(.., f54->report_data + i, size);\n\t}\n\nreport_data is allocated once at probe from F54's own electrode counts\n(array3_size(f54->num_tx_electrodes, f54->num_rx_electrodes, sizeof(u16))),\nbut rmi_f54_get_report_size() computes the size from\ndrv_data->num_*_electrodes when those are set, i.e. from the F55\nfunction's electrode counts. Both counts come straight from device\nqueries (F54 and F55 each report up to 255 electrodes) and nothing\nconstrains the F55 counts to the F54 ones.\n\nA malicious or malfunctioning RMI4 device that reports larger F55\nelectrode counts than its F54 counts makes report_size exceed the\nallocation, so the read loop writes past report_data (and the V4L2\ndequeue memcpy() then reads past it). On conforming hardware the F55\nconfigured electrodes are a subset of the F54 physical electrodes, so\nreport_size never exceeds the buffer and well-behaved devices are\nunaffected.\n\nRecord the allocation size and reject a report that does not fit,\nmirroring the existing zero-size check.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80569"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://git.kernel.org/stable/c/12be3c6ca9589afd6ade41a59c761866e526634d"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://git.kernel.org/stable/c/42eaf0e6f79c487f419737314cf0760f7331d368"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://git.kernel.org/stable/c/49c5adc2b7d6e43c5cf033e1c86fdb9c16ababb1"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://git.kernel.org/stable/c/6b06aab79ff166d5781ce792d91acc2e58b1770b"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://git.kernel.org/stable/c/6b3bdd44d4cd7d5e35de1d0f06d4930f3cecd403"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://git.kernel.org/stable/c/b2f596f00d27703ce09167201ba57f55be8d2f9a"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://git.kernel.org/stable/c/b3932101c9c457148038392bc977f9b31e125a86"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://git.kernel.org/stable/c/b7b9a8b1c303b62371698e396654d6724c79cb74"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [],
57+
"severity": "HIGH",
58+
"github_reviewed": false,
59+
"github_reviewed_at": null,
60+
"nvd_published_at": "2026-08-26T15:17:12Z"
61+
}
62+
}

0 commit comments

Comments
 (0)