Skip to content

Commit 9c5ffc7

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 9fef5da commit 9c5ffc7

60 files changed

Lines changed: 2174 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/08/GHSA-23j5-3m4p-44jj/GHSA-23j5-3m4p-44jj.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-23j5-3m4p-44jj",
4+
"modified": "2026-08-03T03:31:57Z",
5+
"published": "2026-08-03T03:31:57Z",
6+
"aliases": [
7+
"CVE-2026-20473"
8+
],
9+
"details": "In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019722; Issue ID: MSV-7759.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20473"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://www.mediatek.com/product-security-bulletin/August-2026"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-416"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-08-03T03:16:42Z"
30+
}
31+
}

‎advisories/unreviewed/2026/08/GHSA-36p8-6qw9-45qf/GHSA-36p8-6qw9-45qf.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-36p8-6qw9-45qf",
4+
"modified": "2026-08-03T03:31:57Z",
5+
"published": "2026-08-03T03:31:57Z",
6+
"aliases": [
7+
"CVE-2026-20478"
8+
],
9+
"details": "In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981454 (Note: For MT6880, MT6890, MT6988, MT6990) / AUTO00851293 (Note: For MT2735, MT2737); Issue ID: MSV-7638.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20478"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://www.mediatek.com/product-security-bulletin/August-2026"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-787"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-08-03T03:16:42Z"
30+
}
31+
}

‎advisories/unreviewed/2026/08/GHSA-3732-9c5p-7h79/GHSA-3732-9c5p-7h79.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3732-9c5p-7h79",
4+
"modified": "2026-08-03T03:31:54Z",
5+
"published": "2026-08-03T03:31:54Z",
6+
"aliases": [
7+
"CVE-2026-18581"
8+
],
9+
"details": "A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input {{9|9|{ can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18581"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ggml-org/llama.cpp/issues/25282"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://drive.proton.me/urls/R8D8NGZ6Z0#C2cVZYn5z1Xc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/ggml-org/llama.cpp"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/cve/CVE-2026-18581"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/submit/799118"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/385409"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/385409/cti"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-617"
58+
],
59+
"severity": "LOW",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-08-03T01:16:43Z"
63+
}
64+
}

‎advisories/unreviewed/2026/08/GHSA-3q78-fqj5-g3mc/GHSA-3q78-fqj5-g3mc.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3q78-fqj5-g3mc",
4+
"modified": "2026-08-03T03:31:57Z",
5+
"published": "2026-08-03T03:31:57Z",
6+
"aliases": [
7+
"CVE-2026-58060"
8+
],
9+
"details": "In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58060"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/bcgit/bc-java/commit/311cabbb6fcead7647fec16681423a4439118276"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bcgit/bc-java/commit/6c9f30b3fdaa3f2140809278caebbffc55920922"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58060"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-789"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-08-03T03:16:45Z"
43+
}
44+
}

‎advisories/unreviewed/2026/08/GHSA-3xg4-36gp-wp4m/GHSA-3xg4-36gp-wp4m.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3xg4-36gp-wp4m",
4+
"modified": "2026-08-03T03:31:57Z",
5+
"published": "2026-08-03T03:31:57Z",
6+
"aliases": [
7+
"CVE-2026-20472"
8+
],
9+
"details": "In TFA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10991467; Issue ID: MSV-7764.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20472"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://www.mediatek.com/product-security-bulletin/August-2026"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-787"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-08-03T03:16:42Z"
30+
}
31+
}

‎advisories/unreviewed/2026/08/GHSA-4fw3-96wh-rv55/GHSA-4fw3-96wh-rv55.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4fw3-96wh-rv55",
4+
"modified": "2026-08-03T03:31:56Z",
5+
"published": "2026-08-03T03:31:56Z",
6+
"aliases": [
7+
"CVE-2026-20466"
8+
],
9+
"details": "In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: AUTO00845351 (Note: For MT2737) / ALPS11072643 (Note: For MT6880, MT6890, MT6990); Issue ID: MSV-6929.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20466"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://www.mediatek.com/product-security-bulletin/August-2026"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-787"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-08-03T03:16:41Z"
30+
}
31+
}

‎advisories/unreviewed/2026/08/GHSA-4m8h-6737-hrw6/GHSA-4m8h-6737-hrw6.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4m8h-6737-hrw6",
4+
"modified": "2026-08-03T03:31:55Z",
5+
"published": "2026-08-03T03:31:55Z",
6+
"aliases": [
7+
"CVE-2026-59646"
8+
],
9+
"details": "In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59646"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/bcgit/bc-java/commit/2d98721e71bbd822ffa0f84e088eea645cf679fa"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bcgit/bc-java/commit/2ea38942c7917f6d7ab4de93d8a5336d021df0d9"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59646"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-789"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-08-03T01:16:44Z"
43+
}
44+
}

‎advisories/unreviewed/2026/08/GHSA-4mwx-9cgq-h2wp/GHSA-4mwx-9cgq-h2wp.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4mwx-9cgq-h2wp",
4+
"modified": "2026-08-03T03:31:57Z",
5+
"published": "2026-08-03T03:31:57Z",
6+
"aliases": [
7+
"CVE-2026-58059"
8+
],
9+
"details": "In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-407"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-08-03T03:16:45Z"
39+
}
40+
}

‎advisories/unreviewed/2026/08/GHSA-629p-7h2h-8hf5/GHSA-629p-7h2h-8hf5.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-629p-7h2h-8hf5",
4+
"modified": "2026-08-03T03:31:56Z",
5+
"published": "2026-08-03T03:31:56Z",
6+
"aliases": [
7+
"CVE-2026-20467"
8+
],
9+
"details": "In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00837766; Issue ID: MSV-6767.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20467"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://www.mediatek.com/product-security-bulletin/August-2026"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-749"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-08-03T03:16:41Z"
30+
}
31+
}

‎advisories/unreviewed/2026/08/GHSA-639g-9ffj-23fc/GHSA-639g-9ffj-23fc.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-639g-9ffj-23fc",
4+
"modified": "2026-08-03T03:31:57Z",
5+
"published": "2026-08-03T03:31:57Z",
6+
"aliases": [
7+
"CVE-2026-20491"
8+
],
9+
"details": "In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981478 (Note: For MT6890, MT6990, MT6988) / AUTO00851173 (Note: For MT2735, MT2737); Issue ID: MSV-7652.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20491"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://www.mediatek.com/product-security-bulletin/August-2026"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-787"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-08-03T03:16:44Z"
30+
}
31+
}

0 commit comments

Comments
 (0)