Skip to content

Commit f2e5a9c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2jp3-2923-9h52 GHSA-72mv-wwvm-vgp5 GHSA-f786-9c63-8xr8 GHSA-mr6m-xj7v-3cv3 GHSA-r3x8-5j74-9fg2 GHSA-rv45-r523-m576 GHSA-w3w2-mpp5-92gm
1 parent 109002a commit f2e5a9c

7 files changed

Lines changed: 251 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/04/GHSA-2jp3-2923-9h52/GHSA-2jp3-2923-9h52.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2jp3-2923-9h52",
4+
"modified": "2026-04-24T12:30:27Z",
5+
"published": "2026-04-24T12:30:27Z",
6+
"aliases": [
7+
"CVE-2026-41043"
8+
],
9+
"details": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.\n\nAn authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.\n\nThis issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.\n\nUsers are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41043"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://activemq.apache.org/security-advisories.data/CVE-2026-41043-announcement.txt"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://www.openwall.com/lists/oss-security/2026/04/23/5"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-79"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-04-24T11:16:22Z"
34+
}
35+
}

‎advisories/unreviewed/2026/04/GHSA-72mv-wwvm-vgp5/GHSA-72mv-wwvm-vgp5.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-72mv-wwvm-vgp5",
4+
"modified": "2026-04-24T12:30:27Z",
5+
"published": "2026-04-24T12:30:27Z",
6+
"aliases": [
7+
"CVE-2026-23902"
8+
],
9+
"details": "Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.\n\nThis issue affects Apache DolphinScheduler versions prior to 3.4.1. \n\nUsers are recommended to upgrade to version 3.4.1, which fixes this issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23902"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://www.openwall.com/lists/oss-security/2026/04/24/1"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-863"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-04-24T12:17:06Z"
34+
}
35+
}

‎advisories/unreviewed/2026/04/GHSA-f786-9c63-8xr8/GHSA-f786-9c63-8xr8.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f786-9c63-8xr8",
4+
"modified": "2026-04-24T12:30:27Z",
5+
"published": "2026-04-24T12:30:27Z",
6+
"aliases": [
7+
"CVE-2025-62233"
8+
],
9+
"details": "Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module.\n\nThis issue affects Apache DolphinScheduler: \n\nVersion >= 3.2.0 and < 3.3.1.\n\nAttackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes.\nUsers are recommended to upgrade to version [3.3.1], which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62233"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://lists.apache.org/thread/79s80h51r4z5d4l2xs5xy364rmmo1bw0"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://www.openwall.com/lists/oss-security/2026/04/24/2"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-502"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-04-24T11:16:21Z"
34+
}
35+
}

‎advisories/unreviewed/2026/04/GHSA-mr6m-xj7v-3cv3/GHSA-mr6m-xj7v-3cv3.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mr6m-xj7v-3cv3",
4+
"modified": "2026-04-24T12:30:27Z",
5+
"published": "2026-04-24T12:30:27Z",
6+
"aliases": [
7+
"CVE-2026-41044"
8+
],
9+
"details": "Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All.\n\nAn authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation to include an xbean binding that can be later used by a VM transport to load a remote Spring XML application.\nThe attacker can then use the DestinationView mbean to send a message to trigger a VM transport creation that will reference this malicious broker name which can lead to loading the malicious Spring XML context file.\n\n\nBecause Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().\n\nThis issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5.\n\nUsers are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41044"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://activemq.apache.org/security-advisories.data/CVE-2026-41044-announcement.txt"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://www.openwall.com/lists/oss-security/2026/04/23/6"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-20"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-04-24T11:16:22Z"
34+
}
35+
}

‎advisories/unreviewed/2026/04/GHSA-r3x8-5j74-9fg2/GHSA-r3x8-5j74-9fg2.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r3x8-5j74-9fg2",
4+
"modified": "2026-04-24T12:30:27Z",
5+
"published": "2026-04-24T12:30:27Z",
6+
"aliases": [
7+
"CVE-2026-4313"
8+
],
9+
"details": "AdaptiveGRC is vulnerable to Stored XSS via text type fields across the forms. Authenticated attacker can replace the value of the text field in the HTTP POST request. Improper parameter validation by the server results in arbitrary JavaScript execution in the victim's browser.\nCritically, this may allow the attacker to obtain the administrator authentication token and perform arbitrary actions with administrative privileges, which could lead to further compromise.\n\nThis issue occurs in versions released before December 2025.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4313"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://adaptivegrc.com/pl/wszystkie-procesy-grc-w-jednym-narzedziu"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://cert.pl/posts/2026/04/CVE-2026-4313"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "LOW",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-24T12:17:07Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-rv45-r523-m576/GHSA-rv45-r523-m576.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rv45-r523-m576",
4+
"modified": "2026-04-24T12:30:27Z",
5+
"published": "2026-04-24T12:30:27Z",
6+
"aliases": [
7+
"CVE-2026-6043"
8+
],
9+
"details": "P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password set, and access depot contents via the built-in 'remote' user. These default settings, taken together, can lead to unauthorized access to source code repositories and other managed assets. The 2026.1 release, expected in May 2026, enforces secure-by-default configurations on upgrade and new installations",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6043"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://help.perforce.com/helix-core/server-apps/p4sag/current/Content/P4SAG/security-configurables.html"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://portal.perforce.com/s/cve/a91Qi000002wRUvIAM/insecure-default-configuration-in-p4-server"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-1188"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-24T12:17:07Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-w3w2-mpp5-92gm/GHSA-w3w2-mpp5-92gm.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w3w2-mpp5-92gm",
4+
"modified": "2026-04-24T12:30:27Z",
5+
"published": "2026-04-24T12:30:27Z",
6+
"aliases": [
7+
"CVE-2026-40466"
8+
],
9+
"details": "Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.\n\n\n\nAn authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.\nA malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.\nBecause Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().\n\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5.\n\nUsers are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40466"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-20"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-24T11:16:22Z"
30+
}
31+
}

0 commit comments

Comments
 (0)