Skip to content

Commit 879832e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-j5fg-gwpm-pjw5 GHSA-5r99-pj6c-hg6v GHSA-5vxp-pqjj-287g GHSA-239h-g863-fm9x GHSA-69rr-jvgq-g678 GHSA-7vfw-f3r2-9m2j GHSA-7w6x-34cj-2vph GHSA-8q8m-rvgf-6qvc GHSA-96h6-qp9f-fc25 GHSA-9cfw-4wfr-8gwf GHSA-fxg7-rh9m-q77p GHSA-g982-ffmg-jq3g GHSA-j47q-h9j2-79x8 GHSA-mmr3-c33j-h2f2 GHSA-pq33-qwwq-ggx5 GHSA-prmx-7v35-7q82 GHSA-pwm7-wr54-2jxv GHSA-q7v7-25qx-fcxf GHSA-v5jf-vjfx-frfr GHSA-vc5m-vgvg-698r GHSA-vvrm-pcwj-56vf GHSA-whc5-mvj9-gjqw GHSA-wjf6-53j2-2f8c GHSA-wph3-c8fm-q2v8
1 parent aaa45cf commit 879832e

24 files changed

Lines changed: 879 additions & 9 deletions

File tree

‎advisories/unreviewed/2025/12/GHSA-j5fg-gwpm-pjw5/GHSA-j5fg-gwpm-pjw5.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j5fg-gwpm-pjw5",
4-
"modified": "2026-01-11T18:30:28Z",
4+
"modified": "2026-04-02T09:30:24Z",
55
"published": "2025-12-16T15:30:47Z",
66
"aliases": [
77
"CVE-2025-68263"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: ipc: fix use-after-free in ipc_msg_send_request\n\nipc_msg_send_request() waits for a generic netlink reply using an\nipc_msg_table_entry on the stack. The generic netlink handler\n(handle_generic_event()/handle_response()) fills entry->response under\nipc_msg_table_lock, but ipc_msg_send_request() used to validate and free\nentry->response without holding the same lock.\n\nUnder high concurrency this allows a race where handle_response() is\ncopying data into entry->response while ipc_msg_send_request() has just\nfreed it, leading to a slab-use-after-free reported by KASAN in\nhandle_generic_event():\n\n BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd]\n Write of size 12 at addr ffff888198ee6e20 by task pool/109349\n ...\n Freed by task:\n kvfree\n ipc_msg_send_request [ksmbd]\n ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd]\n\nFix by:\n- Taking ipc_msg_table_lock in ipc_msg_send_request() while validating\n entry->response, freeing it when invalid, and removing the entry from\n ipc_msg_table.\n- Returning the final entry->response pointer to the caller only after\n the hash entry is removed under the lock.\n- Returning NULL in the error path, preserving the original API\n semantics.\n\nThis makes all accesses to entry->response consistent with\nhandle_response(), which already updates and fills the response buffer\nunder ipc_msg_table_lock, and closes the race that allowed the UAF.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -41,7 +46,7 @@
4146
],
4247
"database_specific": {
4348
"cwe_ids": [],
44-
"severity": null,
49+
"severity": "CRITICAL",
4550
"github_reviewed": false,
4651
"github_reviewed_at": null,
4752
"nvd_published_at": "2025-12-16T15:15:55Z"

‎advisories/unreviewed/2026/03/GHSA-5r99-pj6c-hg6v/GHSA-5r99-pj6c-hg6v.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5r99-pj6c-hg6v",
4-
"modified": "2026-03-25T12:30:24Z",
4+
"modified": "2026-04-02T09:30:24Z",
55
"published": "2026-03-25T12:30:24Z",
66
"aliases": [
77
"CVE-2026-23395"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ\n\nCurrently the code attempts to accept requests regardless of the\ncommand identifier which may cause multiple requests to be marked\nas pending (FLAG_DEFER_SETUP) which can cause more than\nL2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer\ncausing an overflow.\n\nThe spec is quite clear that the same identifier shall not be used on\nsubsequent requests:\n\n'Within each signaling channel a different Identifier shall be used\nfor each successive request or indication.'\nhttps://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d\n\nSo this attempts to check if there are any channels pending with the\nsame identifier and rejects if any are found.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -41,7 +46,7 @@
4146
],
4247
"database_specific": {
4348
"cwe_ids": [],
44-
"severity": null,
49+
"severity": "HIGH",
4550
"github_reviewed": false,
4651
"github_reviewed_at": null,
4752
"nvd_published_at": "2026-03-25T11:16:40Z"

‎advisories/unreviewed/2026/03/GHSA-5vxp-pqjj-287g/GHSA-5vxp-pqjj-287g.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5vxp-pqjj-287g",
4-
"modified": "2026-03-25T12:30:21Z",
4+
"modified": "2026-04-02T09:30:24Z",
55
"published": "2026-03-20T09:32:10Z",
66
"aliases": [
77
"CVE-2026-23278"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: always walk all pending catchall elements\n\nDuring transaction processing we might have more than one catchall element:\n1 live catchall element and 1 pending element that is coming as part of the\nnew batch.\n\nIf the map holding the catchall elements is also going away, its\nrequired to toggle all catchall elements and not just the first viable\ncandidate.\n\nOtherwise, we get:\n WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404\n RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]\n [..]\n __nft_set_elem_destroy+0x106/0x380 [nf_tables]\n nf_tables_abort_release+0x348/0x8d0 [nf_tables]\n nf_tables_abort+0xcf2/0x3ac0 [nf_tables]\n nfnetlink_rcv_batch+0x9c9/0x20e0 [..]",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -33,7 +38,7 @@
3338
],
3439
"database_specific": {
3540
"cwe_ids": [],
36-
"severity": null,
41+
"severity": "HIGH",
3742
"github_reviewed": false,
3843
"github_reviewed_at": null,
3944
"nvd_published_at": "2026-03-20T09:16:13Z"

‎advisories/unreviewed/2026/04/GHSA-239h-g863-fm9x/GHSA-239h-g863-fm9x.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-239h-g863-fm9x",
4+
"modified": "2026-04-02T09:30:25Z",
5+
"published": "2026-04-02T09:30:25Z",
6+
"aliases": [
7+
"CVE-2026-29141"
8+
],
9+
"details": "SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge tags such as [signed OK].",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29141"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-20"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-02T09:16:22Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-69rr-jvgq-g678/GHSA-69rr-jvgq-g678.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-69rr-jvgq-g678",
4+
"modified": "2026-04-02T09:30:25Z",
5+
"published": "2026-04-02T09:30:25Z",
6+
"aliases": [
7+
"CVE-2026-29131"
8+
],
9+
"details": "SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to read the contents of emails encrypted for other users.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29131"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-90"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-02T09:16:21Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-7vfw-f3r2-9m2j/GHSA-7vfw-f3r2-9m2j.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7vfw-f3r2-9m2j",
4+
"modified": "2026-04-02T09:30:25Z",
5+
"published": "2026-04-02T09:30:25Z",
6+
"aliases": [
7+
"CVE-2026-5244"
8+
],
9+
"details": "A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5244"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/cesanta/mongoose"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/cesanta/mongoose/releases/tag/7.21"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/submit/770063"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/354825"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/354825/cti"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-119"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-04-02T08:16:28Z"
59+
}
60+
}

‎advisories/unreviewed/2026/04/GHSA-7w6x-34cj-2vph/GHSA-7w6x-34cj-2vph.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7w6x-34cj-2vph",
4+
"modified": "2026-04-02T09:30:25Z",
5+
"published": "2026-04-02T09:30:24Z",
6+
"aliases": [
7+
"CVE-2026-29132"
8+
],
9+
"details": "SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker with access to a victim's GINA account to bypass a second-password check and read protected emails.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29132"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-306"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-02T09:16:21Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-8q8m-rvgf-6qvc/GHSA-8q8m-rvgf-6qvc.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8q8m-rvgf-6qvc",
4+
"modified": "2026-04-02T09:30:25Z",
5+
"published": "2026-04-02T09:30:25Z",
6+
"aliases": [
7+
"CVE-2026-29139"
8+
],
9+
"details": "SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29139"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-288"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-02T09:16:22Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-96h6-qp9f-fc25/GHSA-96h6-qp9f-fc25.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-96h6-qp9f-fc25",
4+
"modified": "2026-04-02T09:30:25Z",
5+
"published": "2026-04-02T09:30:25Z",
6+
"aliases": [
7+
"CVE-2026-29135"
8+
],
9+
"details": "SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to craft a password-tag that bypasses subject sanitization.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29135"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-20"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-02T09:16:21Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-9cfw-4wfr-8gwf/GHSA-9cfw-4wfr-8gwf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9cfw-4wfr-8gwf",
4+
"modified": "2026-04-02T09:30:25Z",
5+
"published": "2026-04-02T09:30:25Z",
6+
"aliases": [
7+
"CVE-2026-29136"
8+
],
9+
"details": "SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to inject HTML into notification emails about new CA certificates.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29136"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-02T09:16:21Z"
35+
}
36+
}

0 commit comments

Comments
 (0)