Skip to content

Commit a1ec1ee

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-223g-f5mq-gw33 GHSA-935g-9rq5-q95c GHSA-mm7j-mhhj-hj36 GHSA-mmpc-xjxr-5hf8
1 parent be10267 commit a1ec1ee

4 files changed

Lines changed: 147 additions & 14 deletions

File tree

‎advisories/github-reviewed/2026/05/GHSA-223g-f5mq-gw33/GHSA-223g-f5mq-gw33.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-223g-f5mq-gw33",
4+
"modified": "2026-05-13T01:39:04Z",
5+
"published": "2026-05-13T01:39:04Z",
6+
"aliases": [
7+
"CVE-2026-44720"
8+
],
9+
"summary": "OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover",
10+
"details": "### Overview\n\nA critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. The issue has been fixed.\n\n**Advisory**: https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-223g-f5mq-gw33",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "openlearnx"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.0.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-223g-f5mq-gw33"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/th30d4y/OpenLearnX"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/th30d4y/OpenLearnX/releases/tag/v2.0.4"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-287",
55+
"CWE-347"
56+
],
57+
"severity": "MODERATE",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-05-13T01:39:04Z",
60+
"nvd_published_at": null
61+
}
62+
}

advisories/unreviewed/2026/05/GHSA-935g-9rq5-q95c/GHSA-935g-9rq5-q95c.json renamed to advisories/github-reviewed/2026/05/GHSA-935g-9rq5-q95c/GHSA-935g-9rq5-q95c.json

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-935g-9rq5-q95c",
4-
"modified": "2026-05-08T00:31:35Z",
4+
"modified": "2026-05-13T01:37:38Z",
55
"published": "2026-05-08T00:31:35Z",
66
"aliases": [
77
"CVE-2026-8115"
88
],
9+
"summary": "short-video-maker has a path traversal vulnerability",
910
"details": "A security flaw has been discovered in gyoridavid short-video-maker up to 1.3.4. This affects an unknown part of the file src/server/routers/rest.ts of the component REST API. The manipulation of the argument req.params.tmpFile results in path traversal. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "npm",
25+
"name": "short-video-maker"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"last_affected": "1.3.4"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -28,7 +49,7 @@
2849
"url": "https://github.com/gyoridavid/short-video-maker/issues/73"
2950
},
3051
{
31-
"type": "WEB",
52+
"type": "PACKAGE",
3253
"url": "https://github.com/gyoridavid/short-video-maker"
3354
},
3455
{
@@ -49,8 +70,8 @@
4970
"CWE-22"
5071
],
5172
"severity": "MODERATE",
52-
"github_reviewed": false,
53-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-05-13T01:37:38Z",
5475
"nvd_published_at": "2026-05-07T23:16:33Z"
5576
}
5677
}

advisories/unreviewed/2026/05/GHSA-mm7j-mhhj-hj36/GHSA-mm7j-mhhj-hj36.json renamed to advisories/github-reviewed/2026/05/GHSA-mm7j-mhhj-hj36/GHSA-mm7j-mhhj-hj36.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mm7j-mhhj-hj36",
4-
"modified": "2026-05-08T18:31:28Z",
4+
"modified": "2026-05-13T01:37:14Z",
55
"published": "2026-05-08T00:31:33Z",
66
"aliases": [
77
"CVE-2026-40213"
88
],
9+
"summary": "OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints",
910
"details": "OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "openstack-cyborg"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "16.0.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,10 @@
2344
"type": "WEB",
2445
"url": "https://bugs.launchpad.net/openstack-cyborg/+bug/2143263"
2546
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/openstack/cyborg"
50+
},
2651
{
2752
"type": "WEB",
2853
"url": "https://security.openstack.org/ossa/OSSA-2026-011.html"
@@ -37,8 +62,8 @@
3762
"CWE-863"
3863
],
3964
"severity": "HIGH",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-05-13T01:37:14Z",
4267
"nvd_published_at": "2026-05-07T22:16:34Z"
4368
}
4469
}

advisories/unreviewed/2026/05/GHSA-mmpc-xjxr-5hf8/GHSA-mmpc-xjxr-5hf8.json renamed to advisories/github-reviewed/2026/05/GHSA-mmpc-xjxr-5hf8/GHSA-mmpc-xjxr-5hf8.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mmpc-xjxr-5hf8",
4-
"modified": "2026-05-08T18:31:28Z",
4+
"modified": "2026-05-13T01:37:26Z",
55
"published": "2026-05-08T00:31:34Z",
66
"aliases": [
77
"CVE-2026-40214"
88
],
9+
"summary": "OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer",
910
"details": "In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "openstack-cyborg"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "16.0.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,10 @@
2344
"type": "WEB",
2445
"url": "https://bugs.launchpad.net/openstack-cyborg/+bug/2144056"
2546
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/openstack/cyborg"
50+
},
2651
{
2752
"type": "WEB",
2853
"url": "https://security.openstack.org/ossa/OSSA-2026-011.html"
@@ -37,8 +62,8 @@
3762
"CWE-282"
3863
],
3964
"severity": "MODERATE",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-05-13T01:37:26Z",
4267
"nvd_published_at": "2026-05-07T22:16:35Z"
4368
}
4469
}

0 commit comments

Comments
 (0)