Skip to content

Commit 09f6aa1

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3p45-hx6j-c7f5 GHSA-3wcf-94mw-cwgf GHSA-4v5f-2v2r-748m GHSA-57gg-9j2p-5v4x GHSA-8fpq-5wcx-76h3 GHSA-hc3c-8h8r-vcg7 GHSA-jgmr-x24h-q8jj GHSA-mgq6-mc59-8j8m GHSA-mq4m-44x6-6r2v GHSA-p2x5-x87w-v2xj GHSA-qcjm-vmrx-v935 GHSA-qpg9-jg2w-m84x GHSA-x5j5-9mrv-74fr
1 parent 1d76e9e commit 09f6aa1

13 files changed

Lines changed: 648 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/08/GHSA-3p45-hx6j-c7f5/GHSA-3p45-hx6j-c7f5.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3p45-hx6j-c7f5",
4+
"modified": "2026-08-29T15:30:20Z",
5+
"published": "2026-08-29T15:30:20Z",
6+
"aliases": [
7+
"CVE-2026-82451"
8+
],
9+
"details": "Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/getformwork/formwork/security/advisories/GHSA-hpgc-57cm-66pc"
25+
},
26+
{
27+
"type": "ADVISORY",
28+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82451"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/getformwork/formwork"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/getformwork/formwork/blob/89d1908572e55809d6ee1771f59a816494c29573/panel/views/statistics/index.php"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.vulncheck.com/advisories/formwork-through-2.3.14-stored-xss-via-referer-header"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-08-29T14:16:38Z"
51+
}
52+
}

‎advisories/unreviewed/2026/08/GHSA-3wcf-94mw-cwgf/GHSA-3wcf-94mw-cwgf.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3wcf-94mw-cwgf",
4+
"modified": "2026-08-29T15:30:20Z",
5+
"published": "2026-08-29T15:30:20Z",
6+
"aliases": [
7+
"CVE-2026-82453"
8+
],
9+
"details": "rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82453"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/iot-ecology/rust-iot-platform"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/iot-ecology/rust-iot-platform/blob/5df942ab6bc46a3bf83dbee8c7970554f92c972d/api/src/biz/user_biz.rs"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/rust-iot-platform-cleartext-password-storage-via-user-model"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-256"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-08-29T14:16:38Z"
47+
}
48+
}

‎advisories/unreviewed/2026/08/GHSA-4v5f-2v2r-748m/GHSA-4v5f-2v2r-748m.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4v5f-2v2r-748m",
4+
"modified": "2026-08-29T15:30:19Z",
5+
"published": "2026-08-29T15:30:19Z",
6+
"aliases": [
7+
"CVE-2026-82448"
8+
],
9+
"details": "Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82448"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gitlab.com/Shinobi-Systems/Shinobi"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gitlab.com/Shinobi-Systems/Shinobi/-/blob/f04e685b8bd4c6190fcd62993131b86a76c2b806/libs/childNode/utils.js"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://gitlab.com/Shinobi-Systems/Shinobi/-/commit/5a76c74f3977661ff3f9fd55a260db352c0b19c0"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://gitlab.com/Shinobi-Systems/Shinobi/-/merge_requests/554"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.vulncheck.com/advisories/shinobi-before-commit-5a76c74f-arbitrary-database-query-execution-via-hardcoded-child-node-key"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-798"
50+
],
51+
"severity": "CRITICAL",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-08-29T13:16:38Z"
55+
}
56+
}

‎advisories/unreviewed/2026/08/GHSA-57gg-9j2p-5v4x/GHSA-57gg-9j2p-5v4x.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-57gg-9j2p-5v4x",
4+
"modified": "2026-08-29T15:30:19Z",
5+
"published": "2026-08-29T15:30:19Z",
6+
"aliases": [
7+
"CVE-2026-82447"
8+
],
9+
"details": "Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82447"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Skyvern-AI/skyvern/commit/d723de621d5b3a340f3cc4d5b46bfe40a9a3124e"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/Skyvern-AI/skyvern"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/Skyvern-AI/skyvern/blob/v1.0.44/skyvern/forge/sdk/prompting.py"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/Skyvern-AI/skyvern/blob/v1.0.44/skyvern/forge/sdk/workflow/models/block.py"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.vulncheck.com/advisories/skyvern-before-1.0.45-sandbox-escape-via-textpromptblock"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-1336"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-08-29T13:16:38Z"
55+
}
56+
}

‎advisories/unreviewed/2026/08/GHSA-8fpq-5wcx-76h3/GHSA-8fpq-5wcx-76h3.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8fpq-5wcx-76h3",
4+
"modified": "2026-08-29T15:30:20Z",
5+
"published": "2026-08-29T15:30:20Z",
6+
"aliases": [
7+
"CVE-2026-82454"
8+
],
9+
"details": "The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82454"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/omnivore-app/omnivore/pull/4652"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/omnivore-app/omnivore/commit/abf53d6508755d3d22a994e28e370a9193ea977a"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/omnivore-app/omnivore"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.vulncheck.com/advisories/omnivore-before-android-0.227.0-authentication-bypass-via-apple-sign-in"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-347"
46+
],
47+
"severity": "CRITICAL",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-08-29T14:16:38Z"
51+
}
52+
}

‎advisories/unreviewed/2026/08/GHSA-hc3c-8h8r-vcg7/GHSA-hc3c-8h8r-vcg7.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hc3c-8h8r-vcg7",
4+
"modified": "2026-08-29T15:30:20Z",
5+
"published": "2026-08-29T15:30:20Z",
6+
"aliases": [
7+
"CVE-2026-82452"
8+
],
9+
"details": "rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82452"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/iot-ecology/rust-iot-platform"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/iot-ecology/rust-iot-platform/blob/5df942ab6bc46a3bf83dbee8c7970554f92c972d/api/src/controller/user_router.rs"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/rust-iot-platform-authentication-bypass-via-missing-request-guards"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-306"
42+
],
43+
"severity": "CRITICAL",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-08-29T14:16:38Z"
47+
}
48+
}

‎advisories/unreviewed/2026/08/GHSA-jgmr-x24h-q8jj/GHSA-jgmr-x24h-q8jj.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jgmr-x24h-q8jj",
4+
"modified": "2026-08-29T15:30:19Z",
5+
"published": "2026-08-29T15:30:19Z",
6+
"aliases": [
7+
"CVE-2026-82450"
8+
],
9+
"details": "BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82450"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/BookStackApp/BookStack/commit/e210cc32e4cbb1efeae5c5c9d0fef8e3c6a752e6"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/BookStackApp/BookStack"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/bookstack-before-26.05.4-remote-code-execution-via-book-cover"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-434"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-08-29T14:16:37Z"
47+
}
48+
}

0 commit comments

Comments
 (0)