Skip to content

Commit cc995fc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-29qh-jw3j-7gwj GHSA-q8x7-j9x6-2fpc GHSA-24p2-2h4q-gmhf GHSA-2rg7-jp97-9whm GHSA-4fwv-vp29-wx8m GHSA-cvwg-67gg-j4gg GHSA-jm9p-6v87-5wr3 GHSA-m9qp-xh66-cmcx GHSA-p32r-2rg5-6gc2 GHSA-prg7-cj54-c2q4 GHSA-q3hg-jp42-4pfq GHSA-w5f8-qggr-8844 GHSA-xfqh-9ppr-q5mc
1 parent 9aa4983 commit cc995fc

File tree

13 files changed

+430
-2
lines changed

13 files changed

+430
-2
lines changed

‎advisories/unreviewed/2026/03/GHSA-29qh-jw3j-7gwj/GHSA-29qh-jw3j-7gwj.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-29qh-jw3j-7gwj",
4-
"modified": "2026-03-05T21:30:43Z",
4+
"modified": "2026-04-01T12:31:27Z",
55
"published": "2026-03-05T06:30:28Z",
66
"aliases": [
77
"CVE-2026-28038"

‎advisories/unreviewed/2026/03/GHSA-q8x7-j9x6-2fpc/GHSA-q8x7-j9x6-2fpc.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-q8x7-j9x6-2fpc",
4-
"modified": "2026-03-25T06:30:28Z",
4+
"modified": "2026-04-01T12:31:27Z",
55
"published": "2026-03-04T18:31:52Z",
66
"aliases": [
77
"CVE-2025-12801"
@@ -47,6 +47,14 @@
4747
"type": "WEB",
4848
"url": "https://access.redhat.com/errata/RHSA-2026:5606"
4949
},
50+
{
51+
"type": "WEB",
52+
"url": "https://access.redhat.com/errata/RHSA-2026:5867"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://access.redhat.com/errata/RHSA-2026:5877"
57+
},
5058
{
5159
"type": "WEB",
5260
"url": "https://access.redhat.com/security/cve/CVE-2025-12801"

‎advisories/unreviewed/2026/04/GHSA-24p2-2h4q-gmhf/GHSA-24p2-2h4q-gmhf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-24p2-2h4q-gmhf",
4+
"modified": "2026-04-01T12:31:28Z",
5+
"published": "2026-04-01T12:31:28Z",
6+
"aliases": [
7+
"CVE-2026-21631"
8+
],
9+
"details": "Lack of output escaping leads to a XSS vector in the multilingual associations component.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21631"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://developer.joomla.org/security-centre/1029-20260303-core-xss-vector-in-com-associations-comparison-view.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-01T10:16:16Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-2rg7-jp97-9whm/GHSA-2rg7-jp97-9whm.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2rg7-jp97-9whm",
4+
"modified": "2026-04-01T12:31:28Z",
5+
"published": "2026-04-01T12:31:28Z",
6+
"aliases": [
7+
"CVE-2026-23899"
8+
],
9+
"details": "An improper access check allows unauthorized access to webservice endpoints.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23899"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://developer.joomla.org/security-centre/1032-20260306-core-improper-access-check-in-webservice-endpoints.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-284"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-01T10:16:16Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-4fwv-vp29-wx8m/GHSA-4fwv-vp29-wx8m.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4fwv-vp29-wx8m",
4+
"modified": "2026-04-01T12:31:28Z",
5+
"published": "2026-04-01T12:31:28Z",
6+
"aliases": [
7+
"CVE-2026-24096"
8+
],
9+
"details": "Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 allows low-privileged users to perform unauthorized actions or obtain sensitive information",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24096"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://checkmk.com/werk/18989"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-280"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-01T11:15:58Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-cvwg-67gg-j4gg/GHSA-cvwg-67gg-j4gg.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cvwg-67gg-j4gg",
4+
"modified": "2026-04-01T12:31:28Z",
5+
"published": "2026-04-01T12:31:27Z",
6+
"aliases": [
7+
"CVE-2026-21629"
8+
],
9+
"details": "The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21629"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://developer.joomla.org/security-centre/1027-20260301-core-acl-hardening-in-com-ajax.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-284"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-01T10:16:15Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-jm9p-6v87-5wr3/GHSA-jm9p-6v87-5wr3.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jm9p-6v87-5wr3",
4+
"modified": "2026-04-01T12:31:28Z",
5+
"published": "2026-04-01T12:31:28Z",
6+
"aliases": [
7+
"CVE-2026-0932"
8+
],
9+
"details": "Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0932"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://empower.m-files.com/security-advisories/CVE-2026-0932"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://product.m-files.com/security-advisories/cve-2026-0932"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-918"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-01T11:15:58Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-m9qp-xh66-cmcx/GHSA-m9qp-xh66-cmcx.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m9qp-xh66-cmcx",
4+
"modified": "2026-04-01T12:31:28Z",
5+
"published": "2026-04-01T12:31:28Z",
6+
"aliases": [
7+
"CVE-2026-23898"
8+
],
9+
"details": "Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23898"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://developer.joomla.org/security-centre/1031-20260305-core-arbitrary-file-deletion-in-com-joomlaupdate.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-73"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-01T10:16:16Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-p32r-2rg5-6gc2/GHSA-p32r-2rg5-6gc2.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p32r-2rg5-6gc2",
4+
"modified": "2026-04-01T12:31:28Z",
5+
"published": "2026-04-01T12:31:28Z",
6+
"aliases": [
7+
"CVE-2026-25601"
8+
],
9+
"details": "A vulnerability was identified in MEPIS RM, an industrial\nsoftware product developed by Metronik. The application contained a hardcoded\ncryptographic key within the Mx.Web.ComponentModel.dll component. When the\noption to store domain passwords was enabled, this key was used to encrypt user\npasswords before storing them in the application’s database. An attacker with\nsufficient privileges to access the database could extract the encrypted\npasswords, decrypt them using the embedded key, and gain unauthorized access to\nthe associated ICS/OT environment.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25601"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cert.si/en/cve-2026-25601"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-798"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-01T12:16:02Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-prg7-cj54-c2q4/GHSA-prg7-cj54-c2q4.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-prg7-cj54-c2q4",
4+
"modified": "2026-04-01T12:31:28Z",
5+
"published": "2026-04-01T12:31:28Z",
6+
"aliases": [
7+
"CVE-2026-21630"
8+
],
9+
"details": "Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21630"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://developer.joomla.org/security-centre/1028-20260302-core-sql-injection-in-com-content-articles-webservice-endpoint.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-01T10:16:15Z"
35+
}
36+
}

0 commit comments

Comments
 (0)