Publish Advisories

GHSA-44qx-v2f9-7rq9
GHSA-4q97-mrgv-92q2
GHSA-77wp-p4v3-xgj7
GHSA-84x2-p8rx-5q4g
GHSA-8849-3gmw-cqc7
GHSA-92ww-86qp-x82q
GHSA-92x5-3wh4-435c
GHSA-9fwx-p432-xmr2
GHSA-9r89-rh23-vf6r
GHSA-g8qx-492c-9982
GHSA-m66r-fg5x-99cr
GHSA-pw25-rj5h-xh7p
GHSA-qv5g-75w4-jq79
GHSA-x9c5-wggq-jw83
GHSA-xc75-cc6q-49fg
GHSA-xpp4-mh2g-6345

advisories/unreviewed/2025/05/GHSA-44qx-v2f9-7rq9/GHSA-44qx-v2f9-7rq9.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-44qx-v2f9-7rq9",
-  "modified": "2025-05-30T03:30:31Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T03:30:31Z",
   "aliases": [
     "CVE-2020-36846"
   ],
   "details": "A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -37,7 +42,7 @@
   ],
   "database_specific": {
     "cwe_ids": [],
-    "severity": null,
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-30T01:15:20Z"

advisories/unreviewed/2025/05/GHSA-4q97-mrgv-92q2/GHSA-4q97-mrgv-92q2.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4q97-mrgv-92q2",
-  "modified": "2025-05-30T06:30:24Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T06:30:24Z",
   "aliases": [
     "CVE-2025-44906"
   ],
   "details": "jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -20,8 +25,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-416"
+    ],
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-30T04:15:46Z"

advisories/unreviewed/2025/05/GHSA-77wp-p4v3-xgj7/GHSA-77wp-p4v3-xgj7.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-77wp-p4v3-xgj7",
-  "modified": "2025-05-30T06:30:24Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T06:30:24Z",
   "aliases": [
     "CVE-2025-44904"
   ],
   "details": "hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -20,8 +25,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-122"
+    ],
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-30T04:15:32Z"

advisories/unreviewed/2025/05/GHSA-84x2-p8rx-5q4g/GHSA-84x2-p8rx-5q4g.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-84x2-p8rx-5q4g",
-  "modified": "2025-05-30T03:30:32Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T03:30:32Z",
   "aliases": [
     "CVE-2025-44619"
   ],
   "details": "Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the network without authentication.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -24,8 +29,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-30T03:15:20Z"

advisories/unreviewed/2025/05/GHSA-8849-3gmw-cqc7/GHSA-8849-3gmw-cqc7.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8849-3gmw-cqc7",
-  "modified": "2025-05-30T00:31:14Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T00:31:14Z",
   "aliases": [
     "CVE-2025-31263"
   ],
   "details": "The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to corrupt coprocessor memory.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -20,8 +25,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-119"
+    ],
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-29T22:15:22Z"

advisories/unreviewed/2025/05/GHSA-92ww-86qp-x82q/GHSA-92ww-86qp-x82q.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-92ww-86qp-x82q",
-  "modified": "2025-05-30T03:30:31Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T03:30:31Z",
   "aliases": [
     "CVE-2025-44614"
   ],
   "details": "Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -20,8 +25,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-312"
+    ],
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-30T03:15:20Z"

advisories/unreviewed/2025/05/GHSA-92x5-3wh4-435c/GHSA-92x5-3wh4-435c.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-92x5-3wh4-435c",
-  "modified": "2025-05-30T00:31:14Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T00:31:14Z",
   "aliases": [
     "CVE-2025-31264"
   ],
   "details": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An attacker with physical access to a locked device may be able to view sensitive user information.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-287"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-29T22:15:22Z"

advisories/unreviewed/2025/05/GHSA-9fwx-p432-xmr2/GHSA-9fwx-p432-xmr2.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9fwx-p432-xmr2",
-  "modified": "2025-05-30T00:31:13Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T00:31:13Z",
   "aliases": [
     "CVE-2025-31199"
   ],
   "details": "A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, visionOS 2.4, macOS Sequoia 15.4. An app may be able to access sensitive user data.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-532"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-29T22:15:21Z"

advisories/unreviewed/2025/05/GHSA-9r89-rh23-vf6r/GHSA-9r89-rh23-vf6r.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9r89-rh23-vf6r",
-  "modified": "2025-05-30T06:30:24Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T06:30:24Z",
   "aliases": [
     "CVE-2025-44905"
   ],
   "details": "hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -20,8 +25,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-122"
+    ],
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-30T04:15:46Z"

advisories/unreviewed/2025/05/GHSA-g8qx-492c-9982/GHSA-g8qx-492c-9982.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-g8qx-492c-9982",
-  "modified": "2025-05-30T00:31:13Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T00:31:13Z",
   "aliases": [
     "CVE-2025-31189"
   ],
   "details": "A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to break out of its sandbox.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-693"
+    ],
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-29T22:15:21Z"

advisories/unreviewed/2025/05/GHSA-m66r-fg5x-99cr/GHSA-m66r-fg5x-99cr.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m66r-fg5x-99cr",
-  "modified": "2025-05-30T00:31:13Z",
+  "modified": "2025-05-31T00:30:27Z",
   "published": "2025-05-30T00:31:13Z",
   "aliases": [
     "CVE-2025-30466"
   ],
   "details": "This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, visionOS 2.4, macOS Sequoia 15.4. A website may be able to bypass Same Origin Policy.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -32,8 +37,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-346"
+    ],
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-29T22:15:21Z"

advisories/unreviewed/2025/05/GHSA-pw25-rj5h-xh7p/GHSA-pw25-rj5h-xh7p.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-pw25-rj5h-xh7p",
-  "modified": "2025-05-30T03:30:31Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T03:30:31Z",
   "aliases": [
     "CVE-2025-44612"
   ],
   "details": "Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device credentials, allowing attackers to possibly intercept and access sensitive information via a man-in-the-middle attack.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -20,8 +25,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-319"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-30T03:15:20Z"

advisories/unreviewed/2025/05/GHSA-qv5g-75w4-jq79/GHSA-qv5g-75w4-jq79.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-qv5g-75w4-jq79",
-  "modified": "2025-05-30T00:31:13Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T00:31:13Z",
   "aliases": [
     "CVE-2025-31231"
   ],
   "details": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to read sensitive location information.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -20,8 +25,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-29T22:15:22Z"

advisories/unreviewed/2025/05/GHSA-x9c5-wggq-jw83/GHSA-x9c5-wggq-jw83.json

@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x9c5-wggq-jw83",
+  "modified": "2025-05-31T00:30:29Z",
+  "published": "2025-05-31T00:30:28Z",
+  "aliases": [
+    "CVE-2025-5364"
+  ],
+  "details": "A vulnerability was found in Campcodes Online Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /doctor/add-patient.php. The manipulation of the argument patname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5364"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/yuanchaoxxxxx/CVE/issues/2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.310658"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.310658"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.586699"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.campcodes.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-30T22:15:24Z"
+  }
+}

advisories/unreviewed/2025/05/GHSA-xc75-cc6q-49fg/GHSA-xc75-cc6q-49fg.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xc75-cc6q-49fg",
-  "modified": "2025-05-30T00:31:13Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T00:31:13Z",
   "aliases": [
     "CVE-2025-31198"
   ],
   "details": "This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A path handling issue was addressed with improved validation.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-59"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-29T22:15:21Z"

advisories/unreviewed/2025/05/GHSA-xpp4-mh2g-6345/GHSA-xpp4-mh2g-6345.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xpp4-mh2g-6345",
-  "modified": "2025-05-30T00:31:14Z",
+  "modified": "2025-05-31T00:30:28Z",
   "published": "2025-05-30T00:31:14Z",
   "aliases": [
     "CVE-2025-31261"
   ],
   "details": "A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access protected user data.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-276"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-29T22:15:22Z"