Skip to content

Commit c69b7a5

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2rgv-5m49-97j4 GHSA-c7j6-24cr-x2rf GHSA-g8fh-6crc-6rfw GHSA-j38v-jpjg-hvr2 GHSA-mcjh-pcfv-25rh GHSA-ppfx-mp77-6vfg GHSA-v6gq-gxgm-g38r
1 parent 94fda91 commit c69b7a5

7 files changed

Lines changed: 272 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/05/GHSA-2rgv-5m49-97j4/GHSA-2rgv-5m49-97j4.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2rgv-5m49-97j4",
4+
"modified": "2026-05-12T06:31:39Z",
5+
"published": "2026-05-12T06:31:39Z",
6+
"aliases": [
7+
"CVE-2026-7255"
8+
],
9+
"details": "** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to brute-force the password and bypass authentication.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7255"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zyxel.com/global/en/support/end-of-life"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-307"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-05-12T04:16:29Z"
35+
}
36+
}

‎advisories/unreviewed/2026/05/GHSA-c7j6-24cr-x2rf/GHSA-c7j6-24cr-x2rf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c7j6-24cr-x2rf",
4+
"modified": "2026-05-12T06:31:39Z",
5+
"published": "2026-05-12T06:31:39Z",
6+
"aliases": [
7+
"CVE-2026-7256"
8+
],
9+
"details": "** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device by sending a crafted HTTP request.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7256"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zyxel.com/global/en/support/end-of-life"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-78"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-05-12T04:16:29Z"
35+
}
36+
}

‎advisories/unreviewed/2026/05/GHSA-g8fh-6crc-6rfw/GHSA-g8fh-6crc-6rfw.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g8fh-6crc-6rfw",
4+
"modified": "2026-05-12T06:31:39Z",
5+
"published": "2026-05-12T06:31:39Z",
6+
"aliases": [
7+
"CVE-2026-41530"
8+
],
9+
"details": "The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name, then the archived files may be extracted to an unexpected folder.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41530"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN68350834"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.chitora.com/jvn68350834.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-22"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-05-12T06:16:09Z"
43+
}
44+
}

‎advisories/unreviewed/2026/05/GHSA-j38v-jpjg-hvr2/GHSA-j38v-jpjg-hvr2.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j38v-jpjg-hvr2",
4+
"modified": "2026-05-12T06:31:39Z",
5+
"published": "2026-05-12T06:31:39Z",
6+
"aliases": [
7+
"CVE-2026-7287"
8+
],
9+
"details": "** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs” binary in Zyxel NWA1100-N customized firmware version 1.00(AACE.1)C0 could allow an attacker to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request to a vulnerable device.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7287"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zyxel.com/global/en/support/end-of-life"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-120"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-05-12T04:16:29Z"
35+
}
36+
}

‎advisories/unreviewed/2026/05/GHSA-mcjh-pcfv-25rh/GHSA-mcjh-pcfv-25rh.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mcjh-pcfv-25rh",
4+
"modified": "2026-05-12T06:31:39Z",
5+
"published": "2026-05-12T06:31:39Z",
6+
"aliases": [
7+
"CVE-2026-41872"
8+
],
9+
"details": "\"Kura Sushi Official App\" provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or altering, the communication on push notifications between the affected application and the relevant server.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41872"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://apps.apple.com/jp/app/id942355925"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://jvn.jp/en/jp/JVN38632731"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://play.google.com/store/apps/details?id=jp.co.kura_corpo&hl=ja"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-295"
42+
],
43+
"severity": "CRITICAL",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-05-12T06:16:09Z"
47+
}
48+
}

‎advisories/unreviewed/2026/05/GHSA-ppfx-mp77-6vfg/GHSA-ppfx-mp77-6vfg.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ppfx-mp77-6vfg",
4+
"modified": "2026-05-12T06:31:39Z",
5+
"published": "2026-05-12T06:31:39Z",
6+
"aliases": [
7+
"CVE-2026-7257"
8+
],
9+
"details": "** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow a local attacker with administrator privileges to download and decrypt a backup configuration file.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7257"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zyxel.com/global/en/support/end-of-life"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-922"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-05-12T04:16:29Z"
35+
}
36+
}

‎advisories/unreviewed/2026/05/GHSA-v6gq-gxgm-g38r/GHSA-v6gq-gxgm-g38r.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v6gq-gxgm-g38r",
4+
"modified": "2026-05-12T06:31:39Z",
5+
"published": "2026-05-12T06:31:39Z",
6+
"aliases": [
7+
"CVE-2026-45430"
8+
],
9+
"details": "The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45430"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://backdropcms.org/security/backdrop-sa-contrib-2026-001"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-05-12T04:16:28Z"
35+
}
36+
}

0 commit comments

Comments
 (0)