Skip to content

Commit 533fe68

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-ffjr-v44f-52r7 GHSA-3xgj-m9hf-j98g GHSA-46pv-mj2g-93gh GHSA-5hf6-crg4-fg59 GHSA-8f3q-gr5f-wwhg GHSA-8jr8-v43g-5c57 GHSA-fqwm-6jpj-5wxc GHSA-j2g6-8rvg-7mf6 GHSA-mqg3-gfr2-qw8p GHSA-qpc3-8vqg-8g6w GHSA-rxj3-rrwm-pj4r GHSA-v55w-28r9-q537 GHSA-vxg2-hhgr-37fx GHSA-w846-74jr-76cv GHSA-wqc8-9v27-r965 GHSA-x4q5-8j5g-hpjc GHSA-xpqh-grpw-4xmg
1 parent 91424b9 commit 533fe68

17 files changed

Lines changed: 812 additions & 2 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-ffjr-v44f-52r7/GHSA-ffjr-v44f-52r7.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-ffjr-v44f-52r7",
4-
"modified": "2026-03-26T15:30:36Z",
4+
"modified": "2026-04-03T06:31:31Z",
55
"published": "2026-03-26T12:30:29Z",
66
"aliases": [
77
"CVE-2026-24068"
@@ -22,6 +22,10 @@
2222
{
2323
"type": "WEB",
2424
"url": "https://r.sec-consult.com/vsl"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "http://seclists.org/fulldisclosure/2026/Apr/3"
2529
}
2630
],
2731
"database_specific": {

‎advisories/unreviewed/2026/04/GHSA-3xgj-m9hf-j98g/GHSA-3xgj-m9hf-j98g.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3xgj-m9hf-j98g",
4+
"modified": "2026-04-03T06:31:33Z",
5+
"published": "2026-04-03T06:31:33Z",
6+
"aliases": [
7+
"CVE-2026-35549"
8+
],
9+
"details": "An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35549"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://jira.mariadb.org/browse/MDEV-38365"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-789"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-03T05:16:23Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-46pv-mj2g-93gh/GHSA-46pv-mj2g-93gh.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-46pv-mj2g-93gh",
4+
"modified": "2026-04-03T06:31:32Z",
5+
"published": "2026-04-03T06:31:32Z",
6+
"aliases": [
7+
"CVE-2026-35541"
8+
],
9+
"details": "An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35541"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/roundcube/roundcubemail/commit/2e6a99b2a38110907ea8d3be8e59ec3d5802c394"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/roundcube/roundcubemail/commit/6a275676a8043083c05c961914d830b79e2490d4"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/roundcube/roundcubemail/commit/6fa2bddc59b9c9fd31cad4a9e2954a208d793dce"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.14"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.14"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-843"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-04-03T05:16:22Z"
59+
}
60+
}

‎advisories/unreviewed/2026/04/GHSA-5hf6-crg4-fg59/GHSA-5hf6-crg4-fg59.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5hf6-crg4-fg59",
4+
"modified": "2026-04-03T06:31:32Z",
5+
"published": "2026-04-03T06:31:32Z",
6+
"aliases": [
7+
"CVE-2026-35542"
8+
],
9+
"details": "An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35542"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/roundcube/roundcubemail/commit/e052328e3dc75f13adc2e314eaa4096ac21084ad"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/roundcube/roundcubemail/commit/fd0e98178db5c73eaa93d005b561874923f9b0f0"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/roundcube/roundcubemail/commit/fde14d01adc9f37893cd82b635883e516ed453f8"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.14"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.14"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-669"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-04-03T05:16:22Z"
59+
}
60+
}

‎advisories/unreviewed/2026/04/GHSA-8f3q-gr5f-wwhg/GHSA-8f3q-gr5f-wwhg.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8f3q-gr5f-wwhg",
4+
"modified": "2026-04-03T06:31:33Z",
5+
"published": "2026-04-03T06:31:33Z",
6+
"aliases": [
7+
"CVE-2026-5453"
8+
],
9+
"details": "A vulnerability has been found in Rico só vantagem pra investir App up to 4.58.32.12421 on Android. This issue affects some unknown processing of the file br/com/rico/mobile/di/SegmentSettingsModule.java of the component br.com.rico.mobile. Such manipulation of the argument SEGMENT_WRITE_KEY leads to use of hard-coded cryptographic key\n . The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5453"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/submit/781758"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/vuln/355041"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/355041/cti"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-br-com-rico-mo-3262de3f97fb800a9bfef6e6fd7d7179?source=copy_link"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "LOW",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2026-04-03T05:16:23Z"
49+
}
50+
}

‎advisories/unreviewed/2026/04/GHSA-8jr8-v43g-5c57/GHSA-8jr8-v43g-5c57.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8jr8-v43g-5c57",
4+
"modified": "2026-04-03T06:31:32Z",
5+
"published": "2026-04-03T06:31:32Z",
6+
"aliases": [
7+
"CVE-2026-35538"
8+
],
9+
"details": "An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35538"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/roundcube/roundcubemail/commit/5fe8a69956a9683a4269f3ad2a68e18deebf8a15"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/roundcube/roundcubemail/commit/7daf5aa9c190ccc75bb31672d8fee9938877fd64"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/roundcube/roundcubemail/commit/b18a8fa8e81571914c0ff55d4e20edb459c6952c"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.14"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.14"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-88"
54+
],
55+
"severity": "LOW",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-04-03T05:16:21Z"
59+
}
60+
}

‎advisories/unreviewed/2026/04/GHSA-fqwm-6jpj-5wxc/GHSA-fqwm-6jpj-5wxc.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fqwm-6jpj-5wxc",
4+
"modified": "2026-04-03T06:31:32Z",
5+
"published": "2026-04-03T06:31:31Z",
6+
"aliases": [
7+
"CVE-2026-35536"
8+
],
9+
"details": "In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "WEB",
20+
"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7"
21+
},
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35536"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/tornadoweb/tornado/releases/tag/v6.5.5"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-159"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-03T04:16:53Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-j2g6-8rvg-7mf6/GHSA-j2g6-8rvg-7mf6.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j2g6-8rvg-7mf6",
4+
"modified": "2026-04-03T06:31:33Z",
5+
"published": "2026-04-03T06:31:32Z",
6+
"aliases": [
7+
"CVE-2026-35543"
8+
],
9+
"details": "An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35543"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/roundcube/roundcubemail/commit/1a63e01542bff42aaa71c00c4c279a09ef31f20c"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/roundcube/roundcubemail/commit/39471343ee081ce1d31696c456a2c163462daae3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/roundcube/roundcubemail/commit/82ab5eca7b332fce7a174b2b987f0957a66377cd"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.14"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.14"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-669"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-04-03T05:16:22Z"
59+
}
60+
}

0 commit comments

Comments
 (0)