Skip to content

Commit 6b7d0c7

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent e860566 commit 6b7d0c7

59 files changed

Lines changed: 2413 additions & 5 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/github-reviewed/2024/07/GHSA-g92j-qhmh-64v2/GHSA-g92j-qhmh-64v2.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-g92j-qhmh-64v2",
4-
"modified": "2025-06-06T22:27:43Z",
4+
"modified": "2026-06-01T09:31:10Z",
55
"published": "2024-07-18T17:18:46Z",
66
"aliases": [
77
"CVE-2024-40647"
@@ -98,6 +98,10 @@
9898
{
9999
"type": "WEB",
100100
"url": "https://github.com/getsentry/sentry-python/releases/tag/2.8.0"
101+
},
102+
{
103+
"type": "WEB",
104+
"url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00001.html"
101105
}
102106
],
103107
"database_specific": {

‎advisories/unreviewed/2023/07/GHSA-vf9w-8jq5-g3f2/GHSA-vf9w-8jq5-g3f2.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vf9w-8jq5-g3f2",
4-
"modified": "2024-04-04T05:43:10Z",
4+
"modified": "2026-06-01T09:31:10Z",
55
"published": "2023-07-06T21:14:57Z",
66
"aliases": [
77
"CVE-2023-31408"
88
],
9-
"details": "\nCleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with\nPartnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote\nattacker to potentially steal user credentials that are stored in the user’s browsers local storage via\ncross-site-scripting attacks.\n\n",
9+
"details": "Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with\nPartnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote\nattacker to potentially steal user credentials that are stored in the user’s browsers local storage via\ncross-site-scripting attacks.",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",

‎advisories/unreviewed/2026/05/GHSA-89hg-mhjp-f99q/GHSA-89hg-mhjp-f99q.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-89hg-mhjp-f99q",
4-
"modified": "2026-05-31T03:30:58Z",
4+
"modified": "2026-06-01T09:31:10Z",
55
"published": "2026-05-31T03:30:58Z",
66
"aliases": [
77
"CVE-2026-10157"
@@ -39,6 +39,10 @@
3939
"type": "WEB",
4040
"url": "https://github.com/open5gs/open5gs"
4141
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/cve/CVE-2026-10157"
45+
},
4246
{
4347
"type": "WEB",
4448
"url": "https://vuldb.com/submit/818939"

‎advisories/unreviewed/2026/05/GHSA-xhpj-269v-vq2q/GHSA-xhpj-269v-vq2q.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xhpj-269v-vq2q",
4-
"modified": "2026-05-31T21:30:21Z",
4+
"modified": "2026-06-01T09:31:10Z",
55
"published": "2026-05-31T21:30:21Z",
66
"aliases": [
77
"CVE-2026-8796"
@@ -21,6 +21,10 @@
2121
{
2222
"type": "WEB",
2323
"url": "https://metacpan.org/release/YVES/Sereal-Decoder-5.005/changes"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "http://www.openwall.com/lists/oss-security/2026/06/01/1"
2428
}
2529
],
2630
"database_specific": {

‎advisories/unreviewed/2026/06/GHSA-275h-jpxv-7884/GHSA-275h-jpxv-7884.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-275h-jpxv-7884",
4+
"modified": "2026-06-01T09:31:15Z",
5+
"published": "2026-06-01T09:31:15Z",
6+
"aliases": [
7+
"CVE-2026-9024"
8+
],
9+
"details": "A Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary script code in user's browser session.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9024"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2026-9024"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-06-01T09:16:21Z"
35+
}
36+
}

‎advisories/unreviewed/2026/06/GHSA-2883-wwh7-x57v/GHSA-2883-wwh7-x57v.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2883-wwh7-x57v",
4+
"modified": "2026-06-01T09:31:12Z",
5+
"published": "2026-06-01T09:31:12Z",
6+
"aliases": [
7+
"CVE-2026-45192"
8+
],
9+
"details": "A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob under field names not present in the redaction allowlist (`DEFAULT_SENSITIVE_FIELDS`) — for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection `extra` blobs and grant Connection-read access to multiple users. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can store sensitive credential values in a secret-backend rather than inlined into the Connection's `extra` field.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45192"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/apache/airflow/pull/66673"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://lists.apache.org/thread/r2q93dg2wp5h9sd9vh6y4y5ljqd9crdd"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "http://www.openwall.com/lists/oss-security/2026/06/01/3"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [
32+
"CWE-200"
33+
],
34+
"severity": null,
35+
"github_reviewed": false,
36+
"github_reviewed_at": null,
37+
"nvd_published_at": "2026-06-01T08:16:20Z"
38+
}
39+
}

‎advisories/unreviewed/2026/06/GHSA-2r5m-76wx-56gx/GHSA-2r5m-76wx-56gx.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2r5m-76wx-56gx",
4+
"modified": "2026-06-01T09:31:14Z",
5+
"published": "2026-06-01T09:31:14Z",
6+
"aliases": [
7+
"CVE-2026-45360"
8+
],
9+
"details": "Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom `DeadlineReference` whose serialized form named an attacker-controlled module path, causing the scheduler to `import_string(...)` and instantiate that class with a live SQLAlchemy session attached. Affects deployments where DAG-author code is less trusted than the scheduler process. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45360"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/apache/airflow/pull/66737"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://lists.apache.org/thread/q227dghjwgfz8xsxrf2pwpz4wk43zm83"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-502"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-06-01T09:16:19Z"
34+
}
35+
}

‎advisories/unreviewed/2026/06/GHSA-33g2-gx67-c2h3/GHSA-33g2-gx67-c2h3.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-33g2-gx67-c2h3",
4+
"modified": "2026-06-01T09:31:14Z",
5+
"published": "2026-06-01T09:31:14Z",
6+
"aliases": [
7+
"CVE-2026-42358"
8+
],
9+
"details": "A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names like `password`, `token`, `secret`, `api_key`) to be bypassed when the JSON value's nesting depth exceeded the shared secrets masker's recursion limit: the masker returned the original nested item before checking the sensitive key name. An authenticated UI/API user with Variable read permission could harvest plaintext secret values stored under sensitive keys nested deep enough to exceed the masker's depth cap. Affects deployments that store sensitive values inside deeply-nested JSON Variables. This is a residual gap in the fix for CVE-2026-32690 (which covered shallower nesting via `max_depth=1`); the depth-limit boundary itself was not raised, so the same key-name bypass pattern reappears beyond the recursion cap. Users who already upgraded for CVE-2026-32690 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the deep-nesting path.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42358"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/apache/airflow/pull/65912"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://lists.apache.org/thread/33635mv3zjb75wn5453c5yf9trs8x2om"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-200"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-06-01T09:16:18Z"
34+
}
35+
}

‎advisories/unreviewed/2026/06/GHSA-34v4-r8c4-vxxc/GHSA-34v4-r8c4-vxxc.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-34v4-r8c4-vxxc",
4+
"modified": "2026-06-01T09:31:12Z",
5+
"published": "2026-06-01T09:31:12Z",
6+
"aliases": [
7+
"CVE-2026-10236"
8+
],
9+
"details": "A vulnerability has been found in SourceCodester Water Billing Management System 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=save of the component User Management Endpoint. Such manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10236"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/renzortega1337/Security-Research-/blob/main/Unauthenticated%20Admin%20Creation%20in%20PHP%20System.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/cve/CVE-2026-10236"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/823134"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/367515"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/367515/cti"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.sourcecodester.com"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-266"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-06-01T09:16:15Z"
59+
}
60+
}

‎advisories/unreviewed/2026/06/GHSA-3m2m-6phq-rxrq/GHSA-3m2m-6phq-rxrq.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3m2m-6phq-rxrq",
4+
"modified": "2026-06-01T09:31:12Z",
5+
"published": "2026-06-01T09:31:12Z",
6+
"aliases": [
7+
"CVE-2026-10241"
8+
],
9+
"details": "A security flaw has been discovered in jeecgboot The server processes these URLs up to 3.9.1. This affects the function FileDownloadUtils.download2DiskFromNet of the file /airag/app/debug of the component Cloud Instance Metadata Endpoint. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.9.2 mitigates this issue. It is suggested to upgrade the affected component.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10241"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jeecgboot/JeecgBoot/issues/9611"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.2"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/cve/CVE-2026-10241"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/submit/823268"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/367519"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/367519/cti"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-918"
54+
],
55+
"severity": "LOW",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-06-01T09:16:15Z"
59+
}
60+
}

0 commit comments

Comments
 (0)