Skip to content

Commit 2566750

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2h6j-mhcp-9j9h GHSA-49xc-52mp-cc9j GHSA-8647-755q-fw9p
1 parent 98db725 commit 2566750

3 files changed

Lines changed: 139 additions & 5 deletions

File tree

advisories/unreviewed/2026/04/GHSA-2h6j-mhcp-9j9h/GHSA-2h6j-mhcp-9j9h.json renamed to advisories/github-reviewed/2026/04/GHSA-2h6j-mhcp-9j9h/GHSA-2h6j-mhcp-9j9h.json

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,30 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2h6j-mhcp-9j9h",
4-
"modified": "2026-04-09T15:35:06Z",
4+
"modified": "2026-04-10T19:54:53Z",
55
"published": "2026-04-07T21:32:39Z",
66
"aliases": [
77
"CVE-2025-56015"
88
],
9+
"summary": "GenieACS has an unauthenticated access vulnerability via the NBI API endpoint",
910
"details": "In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "genieacs"
22+
},
23+
"versions": [
24+
"1.2.13"
25+
]
26+
}
27+
],
1728
"references": [
1829
{
1930
"type": "ADVISORY",
@@ -24,7 +35,7 @@
2435
"url": "https://github.com/e1st/CVE-2025-56015"
2536
},
2637
{
27-
"type": "WEB",
38+
"type": "PACKAGE",
2839
"url": "https://github.com/genieacs/genieacs"
2940
}
3041
],
@@ -33,8 +44,8 @@
3344
"CWE-284"
3445
],
3546
"severity": "HIGH",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
47+
"github_reviewed": true,
48+
"github_reviewed_at": "2026-04-10T19:54:53Z",
3849
"nvd_published_at": "2026-04-07T20:16:22Z"
3950
}
4051
}

‎advisories/github-reviewed/2026/04/GHSA-49xc-52mp-cc9j/GHSA-49xc-52mp-cc9j.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-49xc-52mp-cc9j",
4+
"modified": "2026-04-10T19:55:04Z",
5+
"published": "2026-04-10T19:55:04Z",
6+
"aliases": [
7+
"CVE-2026-40093"
8+
],
9+
"summary": "nimiq-blockchain is missing a wall-clock upper bound on block timestamps",
10+
"details": "### Impact\n\nBlock timestamp validation enforces that `timestamp >= parent.timestamp` for non-skip blocks and `timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT` for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via `Policy::supply_at()` and `batch_delay()` in `blockchain/src/reward.rs`, inflating the monetary supply beyond the intended emission schedule.\n\n### Patches\nTBD\n\n### Workarounds\nNo know workarounds.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "crates.io",
21+
"name": "nimiq-blockchain"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "1.3.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-49xc-52mp-cc9j"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40093"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/nimiq/core-rs-albatross"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-1284",
55+
"CWE-20"
56+
],
57+
"severity": "CRITICAL",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-04-10T19:55:04Z",
60+
"nvd_published_at": "2026-04-09T21:16:11Z"
61+
}
62+
}

‎advisories/github-reviewed/2026/04/GHSA-8647-755q-fw9p/GHSA-8647-755q-fw9p.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8647-755q-fw9p",
4+
"modified": "2026-04-10T19:54:41Z",
5+
"published": "2026-04-10T19:54:41Z",
6+
"aliases": [
7+
"CVE-2026-40178"
8+
],
9+
"summary": "ajenti.plugin.core has race conditions in 2FA",
10+
"details": "### Impact\n\nIf the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication.\n\n### Patches\n\nThis is fixed in the version 0.112. Users should upgrade to this version as soon as possible.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "ajenti.plugin.core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.112"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 0.111"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/ajenti/ajenti/security/advisories/GHSA-8647-755q-fw9p"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/ajenti/ajenti"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-287",
54+
"CWE-362"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-04-10T19:54:41Z",
59+
"nvd_published_at": null
60+
}
61+
}

0 commit comments

Comments
 (0)