Skip to content

Commit 8798509

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5hf6-crg4-fg59 GHSA-j2g6-8rvg-7mf6 GHSA-w846-74jr-76cv GHSA-xpqh-grpw-4xmg
1 parent d64c7e7 commit 8798509

File tree

4 files changed

+116
-16
lines changed

4 files changed

+116
-16
lines changed

advisories/unreviewed/2026/04/GHSA-5hf6-crg4-fg59/GHSA-5hf6-crg4-fg59.json renamed to advisories/github-reviewed/2026/04/GHSA-5hf6-crg4-fg59/GHSA-5hf6-crg4-fg59.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5hf6-crg4-fg59",
4-
"modified": "2026-04-03T06:31:32Z",
4+
"modified": "2026-04-04T06:55:40Z",
55
"published": "2026-04-03T06:31:32Z",
66
"aliases": [
77
"CVE-2026-35542"
88
],
9+
"summary": "Roundcube: Bypass of remote image blocking via crafted BODY background attribute",
910
"details": "An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "roundcube/roundcubemail"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.7-beta"
29+
},
30+
{
31+
"fixed": "1.7-rc5"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -31,6 +52,10 @@
3152
"type": "WEB",
3253
"url": "https://github.com/roundcube/roundcubemail/commit/fde14d01adc9f37893cd82b635883e516ed453f8"
3354
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/roundcube/roundcubemail"
58+
},
3459
{
3560
"type": "WEB",
3661
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.14"
@@ -53,8 +78,8 @@
5378
"CWE-669"
5479
],
5580
"severity": "MODERATE",
56-
"github_reviewed": false,
57-
"github_reviewed_at": null,
81+
"github_reviewed": true,
82+
"github_reviewed_at": "2026-04-04T06:55:40Z",
5883
"nvd_published_at": "2026-04-03T05:16:22Z"
5984
}
6085
}

advisories/unreviewed/2026/04/GHSA-j2g6-8rvg-7mf6/GHSA-j2g6-8rvg-7mf6.json renamed to advisories/github-reviewed/2026/04/GHSA-j2g6-8rvg-7mf6/GHSA-j2g6-8rvg-7mf6.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j2g6-8rvg-7mf6",
4-
"modified": "2026-04-03T06:31:33Z",
4+
"modified": "2026-04-04T06:56:48Z",
55
"published": "2026-04-03T06:31:32Z",
66
"aliases": [
77
"CVE-2026-35543"
88
],
9+
"summary": "Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message",
910
"details": "An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "roundcube/roundcubemail"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.7-beta"
29+
},
30+
{
31+
"fixed": "1.7-rc5"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -31,6 +52,10 @@
3152
"type": "WEB",
3253
"url": "https://github.com/roundcube/roundcubemail/commit/82ab5eca7b332fce7a174b2b987f0957a66377cd"
3354
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/roundcube/roundcubemail"
58+
},
3459
{
3560
"type": "WEB",
3661
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.14"
@@ -53,8 +78,8 @@
5378
"CWE-669"
5479
],
5580
"severity": "MODERATE",
56-
"github_reviewed": false,
57-
"github_reviewed_at": null,
81+
"github_reviewed": true,
82+
"github_reviewed_at": "2026-04-04T06:56:48Z",
5883
"nvd_published_at": "2026-04-03T05:16:22Z"
5984
}
6085
}

advisories/unreviewed/2026/04/GHSA-w846-74jr-76cv/GHSA-w846-74jr-76cv.json renamed to advisories/github-reviewed/2026/04/GHSA-w846-74jr-76cv/GHSA-w846-74jr-76cv.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-w846-74jr-76cv",
4-
"modified": "2026-04-03T06:31:33Z",
4+
"modified": "2026-04-04T06:58:03Z",
55
"published": "2026-04-03T06:31:32Z",
66
"aliases": [
77
"CVE-2026-35545"
88
],
9+
"summary": "Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message",
910
"details": "An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "roundcube/roundcubemail"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.7-beta"
29+
},
30+
{
31+
"fixed": "1.7-rc5"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -31,6 +52,10 @@
3152
"type": "WEB",
3253
"url": "https://github.com/roundcube/roundcubemail/commit/fe1320b199d3a2f58351bb699c9ed4316e73221b"
3354
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/roundcube/roundcubemail"
58+
},
3459
{
3560
"type": "WEB",
3661
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.15"
@@ -53,8 +78,8 @@
5378
"CWE-669"
5479
],
5580
"severity": "MODERATE",
56-
"github_reviewed": false,
57-
"github_reviewed_at": null,
81+
"github_reviewed": true,
82+
"github_reviewed_at": "2026-04-04T06:58:03Z",
5883
"nvd_published_at": "2026-04-03T05:16:22Z"
5984
}
6085
}

advisories/unreviewed/2026/04/GHSA-xpqh-grpw-4xmg/GHSA-xpqh-grpw-4xmg.json renamed to advisories/github-reviewed/2026/04/GHSA-xpqh-grpw-4xmg/GHSA-xpqh-grpw-4xmg.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xpqh-grpw-4xmg",
4-
"modified": "2026-04-03T06:31:33Z",
4+
"modified": "2026-04-04T06:57:38Z",
55
"published": "2026-04-03T06:31:32Z",
66
"aliases": [
77
"CVE-2026-35544"
88
],
9+
"summary": "Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages",
910
"details": "An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "roundcube/roundcubemail"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.7-beta"
29+
},
30+
{
31+
"fixed": "1.7-rc5"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -31,6 +52,10 @@
3152
"type": "WEB",
3253
"url": "https://github.com/roundcube/roundcubemail/commit/57dec0c127b98e0c8e3b9c26c80049b9c4bcaea7"
3354
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/roundcube/roundcubemail"
58+
},
3459
{
3560
"type": "WEB",
3661
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.14"
@@ -53,8 +78,8 @@
5378
"CWE-669"
5479
],
5580
"severity": "MODERATE",
56-
"github_reviewed": false,
57-
"github_reviewed_at": null,
81+
"github_reviewed": true,
82+
"github_reviewed_at": "2026-04-04T06:57:38Z",
5883
"nvd_published_at": "2026-04-03T05:16:22Z"
5984
}
6085
}

0 commit comments

Comments
 (0)