Skip to content

Commit 89a1ac0

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-9782-qgv6-6p8g GHSA-jfxq-p7rj-52hh GHSA-p2wp-hfcj-f5jm GHSA-rgfh-mp7v-25f9 GHSA-vqmj-h423-xx64
1 parent cf6d960 commit 89a1ac0

File tree

5 files changed

+260
-0
lines changed

5 files changed

+260
-0
lines changed

‎advisories/unreviewed/2026/04/GHSA-9782-qgv6-6p8g/GHSA-9782-qgv6-6p8g.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9782-qgv6-6p8g",
4+
"modified": "2026-04-19T12:31:16Z",
5+
"published": "2026-04-19T12:31:16Z",
6+
"aliases": [
7+
"CVE-2026-6569"
8+
],
9+
"details": "A vulnerability was identified in kodcloud KodExplorer up to 4.52. This impacts the function fileGet of the file /app/controller/share.class.php of the component fileGet Endpoint. Such manipulation of the argument fileUrl leads to improper authentication. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6569"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/submit/789982"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/vuln/358203"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/358203/cti"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vulnplus-note.wetolink.com/share/wgfZR6kXRApl"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-287"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-04-19T11:16:14Z"
51+
}
52+
}

‎advisories/unreviewed/2026/04/GHSA-jfxq-p7rj-52hh/GHSA-jfxq-p7rj-52hh.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jfxq-p7rj-52hh",
4+
"modified": "2026-04-19T12:31:16Z",
5+
"published": "2026-04-19T12:31:16Z",
6+
"aliases": [
7+
"CVE-2026-6570"
8+
],
9+
"details": "A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php. Performing a manipulation of the argument path results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6570"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/submit/789983"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/vuln/358204"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/358204/cti"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vulnplus-note.wetolink.com/share/byd7AQVs42VY"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-285"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-04-19T12:16:32Z"
51+
}
52+
}

‎advisories/unreviewed/2026/04/GHSA-p2wp-hfcj-f5jm/GHSA-p2wp-hfcj-f5jm.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p2wp-hfcj-f5jm",
4+
"modified": "2026-04-19T12:31:16Z",
5+
"published": "2026-04-19T12:31:16Z",
6+
"aliases": [
7+
"CVE-2026-6571"
8+
],
9+
"details": "A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGroupAction of the file /app/controller/systemRole.class.php. Executing a manipulation of the argument group_role can lead to authorization bypass. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6571"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/submit/789987"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/vuln/358205"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/358205/cti"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vulnplus-note.wetolink.com/share/atu3UbqnfAgs"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-285"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-04-19T12:16:33Z"
51+
}
52+
}

‎advisories/unreviewed/2026/04/GHSA-rgfh-mp7v-25f9/GHSA-rgfh-mp7v-25f9.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rgfh-mp7v-25f9",
4+
"modified": "2026-04-19T12:31:15Z",
5+
"published": "2026-04-19T12:31:15Z",
6+
"aliases": [
7+
"CVE-2026-6568"
8+
],
9+
"details": "A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/controller/share.class.php of the component Public Share Handler. This manipulation of the argument path causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6568"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/submit/789981"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/vuln/358202"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/358202/cti"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vulnplus-note.wetolink.com/share/JyHBnRUaoOY2"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-22"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-04-19T10:16:09Z"
51+
}
52+
}

‎advisories/unreviewed/2026/04/GHSA-vqmj-h423-xx64/GHSA-vqmj-h423-xx64.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vqmj-h423-xx64",
4+
"modified": "2026-04-19T12:31:15Z",
5+
"published": "2026-04-19T12:31:15Z",
6+
"aliases": [
7+
"CVE-2026-6564"
8+
],
9+
"details": "A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the component Session Handling. The manipulation results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6564"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cailiujia/CVE"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/789924"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/358201"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/358201/cti"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-266"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-04-19T10:16:08Z"
51+
}
52+
}

0 commit comments

Comments
 (0)