Skip to content

Commit 1f2ea73

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-wp3j-xq48-xpjw GHSA-7376-x4rm-3v8x GHSA-83xx-9f6p-vwfj GHSA-qg4c-8pj4-qgw2 GHSA-49pm-cgmh-hw25 GHSA-4hfm-xmwc-7ffw GHSA-892r-x96w-jh76 GHSA-95fm-5hch-ccgx GHSA-c6m9-cmc6-g435 GHSA-h4r4-6hvf-34r8 GHSA-v3px-8gvp-39x8
1 parent 27a36a3 commit 1f2ea73

File tree

11 files changed

+297
-4
lines changed

11 files changed

+297
-4
lines changed

‎advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wp3j-xq48-xpjw",
4-
"modified": "2025-10-29T15:31:51Z",
4+
"modified": "2025-10-30T06:30:53Z",
55
"published": "2025-09-04T20:01:54Z",
66
"aliases": [
77
"CVE-2025-9566"
@@ -90,6 +90,10 @@
9090
"type": "WEB",
9191
"url": "https://access.redhat.com/errata/RHSA-2025:19046"
9292
},
93+
{
94+
"type": "WEB",
95+
"url": "https://access.redhat.com/errata/RHSA-2025:19041"
96+
},
9397
{
9498
"type": "WEB",
9599
"url": "https://access.redhat.com/errata/RHSA-2025:18240"

‎advisories/unreviewed/2025/06/GHSA-7376-x4rm-3v8x/GHSA-7376-x4rm-3v8x.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7376-x4rm-3v8x",
4-
"modified": "2025-10-29T15:31:51Z",
4+
"modified": "2025-10-30T06:30:53Z",
55
"published": "2025-06-09T21:30:52Z",
66
"aliases": [
77
"CVE-2025-5914"
@@ -39,6 +39,10 @@
3939
"type": "WEB",
4040
"url": "https://access.redhat.com/errata/RHSA-2025:19046"
4141
},
42+
{
43+
"type": "WEB",
44+
"url": "https://access.redhat.com/errata/RHSA-2025:19041"
45+
},
4246
{
4347
"type": "WEB",
4448
"url": "https://access.redhat.com/errata/RHSA-2025:18219"

‎advisories/unreviewed/2025/06/GHSA-83xx-9f6p-vwfj/GHSA-83xx-9f6p-vwfj.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-83xx-9f6p-vwfj",
4-
"modified": "2025-10-29T15:31:51Z",
4+
"modified": "2025-10-30T06:30:53Z",
55
"published": "2025-06-16T18:32:19Z",
66
"aliases": [
77
"CVE-2025-49796"
@@ -31,6 +31,10 @@
3131
"type": "WEB",
3232
"url": "https://access.redhat.com/errata/RHSA-2025:19046"
3333
},
34+
{
35+
"type": "WEB",
36+
"url": "https://access.redhat.com/errata/RHSA-2025:19041"
37+
},
3438
{
3539
"type": "WEB",
3640
"url": "https://access.redhat.com/errata/RHSA-2025:19020"

‎advisories/unreviewed/2025/06/GHSA-qg4c-8pj4-qgw2/GHSA-qg4c-8pj4-qgw2.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qg4c-8pj4-qgw2",
4-
"modified": "2025-10-29T15:31:51Z",
4+
"modified": "2025-10-30T06:30:53Z",
55
"published": "2025-06-16T18:32:19Z",
66
"aliases": [
77
"CVE-2025-49794"
@@ -31,6 +31,10 @@
3131
"type": "WEB",
3232
"url": "https://access.redhat.com/errata/RHSA-2025:19046"
3333
},
34+
{
35+
"type": "WEB",
36+
"url": "https://access.redhat.com/errata/RHSA-2025:19041"
37+
},
3438
{
3539
"type": "WEB",
3640
"url": "https://access.redhat.com/errata/RHSA-2025:19020"

‎advisories/unreviewed/2025/10/GHSA-49pm-cgmh-hw25/GHSA-49pm-cgmh-hw25.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-49pm-cgmh-hw25",
4+
"modified": "2025-10-30T06:30:54Z",
5+
"published": "2025-10-30T06:30:53Z",
6+
"aliases": [
7+
"CVE-2025-62229"
8+
],
9+
"details": "A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62229"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2025-62229"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402649"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-416"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-30T06:15:45Z"
39+
}
40+
}

‎advisories/unreviewed/2025/10/GHSA-4hfm-xmwc-7ffw/GHSA-4hfm-xmwc-7ffw.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4hfm-xmwc-7ffw",
4+
"modified": "2025-10-30T06:30:53Z",
5+
"published": "2025-10-30T06:30:53Z",
6+
"aliases": [
7+
"CVE-2025-10636"
8+
],
9+
"details": "The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10636"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/a1ab1d82-108e-4f66-9d06-5036cde9678a"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-10-30T06:15:43Z"
28+
}
29+
}

‎advisories/unreviewed/2025/10/GHSA-892r-x96w-jh76/GHSA-892r-x96w-jh76.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-892r-x96w-jh76",
4+
"modified": "2025-10-30T06:30:54Z",
5+
"published": "2025-10-30T06:30:54Z",
6+
"aliases": [
7+
"CVE-2025-62230"
8+
],
9+
"details": "A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62230"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2025-62230"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402653"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-416"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-30T06:15:45Z"
39+
}
40+
}

‎advisories/unreviewed/2025/10/GHSA-95fm-5hch-ccgx/GHSA-95fm-5hch-ccgx.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-95fm-5hch-ccgx",
4+
"modified": "2025-10-30T06:30:54Z",
5+
"published": "2025-10-30T06:30:53Z",
6+
"aliases": [
7+
"CVE-2025-11627"
8+
],
9+
"details": "The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to insert arbitrary content into log files, and potentially cause denial of service via disk space exhaustion.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/site-checkup/tags/1.47/includes/catch-errors/class_bill_catch_errors.php#L80"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset/3380169"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/50251b17-58d7-4870-b825-a194312fb3e7?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-117"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-10-30T06:15:43Z"
43+
}
44+
}

‎advisories/unreviewed/2025/10/GHSA-c6m9-cmc6-g435/GHSA-c6m9-cmc6-g435.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c6m9-cmc6-g435",
4+
"modified": "2025-10-30T06:30:53Z",
5+
"published": "2025-10-30T06:30:53Z",
6+
"aliases": [
7+
"CVE-2025-12475"
8+
],
9+
"details": "The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blocksy_newsletter_subscribe' shortcode in all versions up to, and including, 2.1.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12475"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3371878/blocksy-companion/trunk/framework/extensions/newsletter-subscribe/helpers.php"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd13eb67-3bd5-41c4-a47f-5f55656ea5b9?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-30T05:15:37Z"
39+
}
40+
}

‎advisories/unreviewed/2025/10/GHSA-h4r4-6hvf-34r8/GHSA-h4r4-6hvf-34r8.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h4r4-6hvf-34r8",
4+
"modified": "2025-10-30T06:30:53Z",
5+
"published": "2025-10-30T06:30:53Z",
6+
"aliases": [
7+
"CVE-2025-62231"
8+
],
9+
"details": "A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62231"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2025-62231"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402660"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-190"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-30T05:15:39Z"
39+
}
40+
}

0 commit comments

Comments
 (0)