Skip to content

Commit 2b57769

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-27h3-crw2-q36w GHSA-phv5-vq5p-qhp7 GHSA-q2hg-643c-gw8h GHSA-xrxf-jgv3-qmrm
1 parent 389034b commit 2b57769

File tree

4 files changed

+131
-18
lines changed

4 files changed

+131
-18
lines changed

advisories/unreviewed/2026/04/GHSA-27h3-crw2-q36w/GHSA-27h3-crw2-q36w.json renamed to advisories/github-reviewed/2026/04/GHSA-27h3-crw2-q36w/GHSA-27h3-crw2-q36w.json

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,53 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-27h3-crw2-q36w",
4-
"modified": "2026-04-16T15:31:31Z",
4+
"modified": "2026-04-16T22:57:31Z",
55
"published": "2026-04-16T15:31:31Z",
66
"aliases": [
77
"CVE-2026-30778"
88
],
9+
"summary": "SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information",
910
"details": "The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.\n\nThis issue affects Apache SkyWalking: from 9.7.0 through 10.3.0.\n\nUsers are recommended to upgrade to version 10.4.0, which fixes the issue.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.skywalking:server-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.7.0"
29+
},
30+
{
31+
"fixed": "10.4.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30778"
2142
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/apache/skywalking/commit/5a3f6260e4dd681a9132204e5299064bef079886"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/apache/skywalking"
50+
},
2251
{
2352
"type": "WEB",
2453
"url": "https://lists.apache.org/thread/pvf35o3tp1rqhmrhzj6fg31gvqrqcvn3"
@@ -33,8 +62,8 @@
3362
"CWE-202"
3463
],
3564
"severity": "HIGH",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-04-16T22:57:31Z",
3867
"nvd_published_at": "2026-04-15T11:16:33Z"
3968
}
4069
}

advisories/unreviewed/2026/04/GHSA-phv5-vq5p-qhp7/GHSA-phv5-vq5p-qhp7.json renamed to advisories/github-reviewed/2026/04/GHSA-phv5-vq5p-qhp7/GHSA-phv5-vq5p-qhp7.json

Lines changed: 40 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-phv5-vq5p-qhp7",
4-
"modified": "2026-04-16T15:31:32Z",
4+
"modified": "2026-04-16T22:57:42Z",
55
"published": "2026-04-16T15:31:32Z",
66
"aliases": [
77
"CVE-2026-31987"
88
],
9+
"summary": "Apache Airflow: JWT token appearing in logs",
910
"details": "JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. \nUsers are advised to upgrade to Airflow version that contains fix.\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue.",
10-
"severity": [],
11-
"affected": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "apache-airflow"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "3.0.0"
29+
},
30+
{
31+
"fixed": "3.2.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1238
"references": [
1339
{
1440
"type": "ADVISORY",
@@ -26,18 +52,26 @@
2652
"type": "WEB",
2753
"url": "https://github.com/apache/airflow/pull/62964"
2854
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/apache/airflow"
58+
},
2959
{
3060
"type": "WEB",
3161
"url": "https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "http://www.openwall.com/lists/oss-security/2026/04/16/7"
3266
}
3367
],
3468
"database_specific": {
3569
"cwe_ids": [
3670
"CWE-532"
3771
],
38-
"severity": null,
39-
"github_reviewed": false,
40-
"github_reviewed_at": null,
72+
"severity": "MODERATE",
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-04-16T22:57:42Z",
4175
"nvd_published_at": "2026-04-16T14:16:13Z"
4276
}
4377
}

advisories/unreviewed/2026/04/GHSA-q2hg-643c-gw8h/GHSA-q2hg-643c-gw8h.json renamed to advisories/github-reviewed/2026/04/GHSA-q2hg-643c-gw8h/GHSA-q2hg-643c-gw8h.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-q2hg-643c-gw8h",
4-
"modified": "2026-04-16T15:31:31Z",
4+
"modified": "2026-04-16T22:57:15Z",
55
"published": "2026-04-16T15:31:31Z",
66
"aliases": [
77
"CVE-2025-54550"
88
],
9+
"summary": "Apache Airflow: RCE by race condition in example_xcom dag",
910
"details": "The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value\nfrom xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary\nexecution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability.\n\nIt does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however\nusers following the example could replicate the bad pattern. Documentation of Airflow 3.2.0 contains version of\nthe example with improved resiliance for that case.\n\nUsers who followed that pattern are advised to adjust their implementations accordingly.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "apache-airflow"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.2.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,10 @@
2344
"type": "WEB",
2445
"url": "https://github.com/apache/airflow/pull/63200"
2546
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/apache/airflow"
50+
},
2651
{
2752
"type": "WEB",
2853
"url": "https://lists.apache.org/thread/3mf4cfx070ofsnf9qy0s2v5gqb5sc2g1"
@@ -37,8 +62,8 @@
3762
"CWE-94"
3863
],
3964
"severity": "HIGH",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-04-16T22:57:15Z",
4267
"nvd_published_at": "2026-04-15T04:17:32Z"
4368
}
4469
}

advisories/unreviewed/2026/04/GHSA-xrxf-jgv3-qmrm/GHSA-xrxf-jgv3-qmrm.json renamed to advisories/github-reviewed/2026/04/GHSA-xrxf-jgv3-qmrm/GHSA-xrxf-jgv3-qmrm.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xrxf-jgv3-qmrm",
4-
"modified": "2026-04-16T15:31:30Z",
4+
"modified": "2026-04-16T22:56:42Z",
55
"published": "2026-04-14T15:30:34Z",
66
"aliases": [
77
"CVE-2025-61260"
88
],
9+
"summary": "OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files",
910
"details": "A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "@openai/codex"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.23.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61260"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/openai/codex"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability"
@@ -33,8 +58,8 @@
3358
"CWE-94"
3459
],
3560
"severity": "CRITICAL",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-04-16T22:56:42Z",
3863
"nvd_published_at": "2026-04-14T15:16:24Z"
3964
}
4065
}

0 commit comments

Comments
 (0)