Skip to content

Commit 966ca54

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3fjr-cx6c-863c GHSA-8pxf-65qh-4qrc GHSA-9f83-3gqq-cv2v GHSA-c3h3-5hxq-qpc7 GHSA-f87p-wjm9-4rp5 GHSA-g4hf-8p4f-p7g3 GHSA-h3xj-4mp2-qr5w GHSA-hwc8-vf72-jqqw GHSA-j3qx-c2ff-2p64 GHSA-jm26-2m6v-322r GHSA-q7v7-xg85-x35m GHSA-qx5q-4m37-mp7p GHSA-rw6m-2gvw-353g
1 parent f5fcf11 commit 966ca54

File tree

13 files changed

+412
-1
lines changed

13 files changed

+412
-1
lines changed

‎advisories/unreviewed/2025/11/GHSA-3fjr-cx6c-863c/GHSA-3fjr-cx6c-863c.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3fjr-cx6c-863c",
4+
"modified": "2025-11-14T03:30:53Z",
5+
"published": "2025-11-14T03:30:53Z",
6+
"aliases": [
7+
"CVE-2024-11919"
8+
],
9+
"details": "Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11919"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/352516283"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-11-14T03:15:54Z"
32+
}
33+
}

‎advisories/unreviewed/2025/11/GHSA-8pxf-65qh-4qrc/GHSA-8pxf-65qh-4qrc.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8pxf-65qh-4qrc",
4-
"modified": "2025-11-06T09:30:27Z",
4+
"modified": "2025-11-14T03:30:53Z",
55
"published": "2025-11-06T09:30:27Z",
66
"aliases": [
77
"CVE-2025-10259"
@@ -23,6 +23,10 @@
2323
"type": "WEB",
2424
"url": "https://jvn.jp/vu/JVNVU92088475"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-01"
29+
},
2630
{
2731
"type": "WEB",
2832
"url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-014_en.pdf"

‎advisories/unreviewed/2025/11/GHSA-9f83-3gqq-cv2v/GHSA-9f83-3gqq-cv2v.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9f83-3gqq-cv2v",
4+
"modified": "2025-11-14T03:30:54Z",
5+
"published": "2025-11-14T03:30:54Z",
6+
"aliases": [
7+
"CVE-2025-13097"
8+
],
9+
"details": "Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13097"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/402791076"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-11-14T03:15:56Z"
32+
}
33+
}

‎advisories/unreviewed/2025/11/GHSA-c3h3-5hxq-qpc7/GHSA-c3h3-5hxq-qpc7.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c3h3-5hxq-qpc7",
4+
"modified": "2025-11-14T03:30:54Z",
5+
"published": "2025-11-14T03:30:54Z",
6+
"aliases": [
7+
"CVE-2024-13983"
8+
],
9+
"details": "Inappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a remote attacker to perform UI spoofing via a crafted QR code. (Chromium security severity: Low)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13983"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/379818904"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-11-14T03:15:55Z"
32+
}
33+
}

‎advisories/unreviewed/2025/11/GHSA-f87p-wjm9-4rp5/GHSA-f87p-wjm9-4rp5.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f87p-wjm9-4rp5",
4+
"modified": "2025-11-14T03:30:54Z",
5+
"published": "2025-11-14T03:30:54Z",
6+
"aliases": [
7+
"CVE-2025-12904"
8+
],
9+
"details": "The SNORDIAN's H5PxAPIkatchu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'insert_data' AJAX endpoint in all versions up to, and including, 0.4.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12904"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3392176/h5pxapikatchu"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/90552d5a-6103-48c7-ad44-52ee8ecac114?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-14T03:15:56Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-g4hf-8p4f-p7g3/GHSA-g4hf-8p4f-p7g3.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g4hf-8p4f-p7g3",
4+
"modified": "2025-11-14T03:30:54Z",
5+
"published": "2025-11-14T03:30:54Z",
6+
"aliases": [
7+
"CVE-2024-7017"
8+
],
9+
"details": "Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7017"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/338248595"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-11-14T03:15:55Z"
32+
}
33+
}

‎advisories/unreviewed/2025/11/GHSA-h3xj-4mp2-qr5w/GHSA-h3xj-4mp2-qr5w.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h3xj-4mp2-qr5w",
4+
"modified": "2025-11-14T03:30:54Z",
5+
"published": "2025-11-14T03:30:54Z",
6+
"aliases": [
7+
"CVE-2025-13102"
8+
],
9+
"details": "Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13102"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/351564774"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-11-14T03:15:56Z"
32+
}
33+
}

‎advisories/unreviewed/2025/11/GHSA-hwc8-vf72-jqqw/GHSA-hwc8-vf72-jqqw.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hwc8-vf72-jqqw",
4+
"modified": "2025-11-14T03:30:54Z",
5+
"published": "2025-11-14T03:30:54Z",
6+
"aliases": [
7+
"CVE-2025-13107"
8+
],
9+
"details": "Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13107"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/429440615"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-11-14T03:15:56Z"
32+
}
33+
}

‎advisories/unreviewed/2025/11/GHSA-j3qx-c2ff-2p64/GHSA-j3qx-c2ff-2p64.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j3qx-c2ff-2p64",
4+
"modified": "2025-11-14T03:30:54Z",
5+
"published": "2025-11-14T03:30:54Z",
6+
"aliases": [
7+
"CVE-2024-7021"
8+
],
9+
"details": "Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7021"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/40064701"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-11-14T03:15:55Z"
32+
}
33+
}

‎advisories/unreviewed/2025/11/GHSA-jm26-2m6v-322r/GHSA-jm26-2m6v-322r.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jm26-2m6v-322r",
4+
"modified": "2025-11-14T03:30:53Z",
5+
"published": "2025-11-14T03:30:53Z",
6+
"aliases": [
7+
"CVE-2024-11920"
8+
],
9+
"details": "Inappropriate implementation in Dawn in Google Chrome on Mac prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11920"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/371840056"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-11-14T03:15:55Z"
32+
}
33+
}

0 commit comments

Comments
 (0)