Publish Advisories

GHSA-46pv-mj2g-93gh
GHSA-vxg2-hhgr-37fx

Author: advisory-database[bot]

…-46pv-mj2g-93gh/GHSA-46pv-mj2g-93gh.json …-46pv-mj2g-93gh/GHSA-46pv-mj2g-93gh.jsonadvisories/unreviewed/2026/04/GHSA-46pv-mj2g-93gh/GHSA-46pv-mj2g-93gh.json renamed to advisories/github-reviewed/2026/04/GHSA-46pv-mj2g-93gh/GHSA-46pv-mj2g-93gh.json advisories/unreviewed/2026/04/GHSA-46pv-mj2g-93gh/GHSA-46pv-mj2g-93gh.json renamed to advisories/github-reviewed/2026/04/GHSA-46pv-mj2g-93gh/GHSA-46pv-mj2g-93gh.json

@@ -1,19 +1,40 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-46pv-mj2g-93gh",
-  "modified": "2026-04-03T06:31:32Z",
+  "modified": "2026-04-04T06:54:24Z",
   "published": "2026-04-03T06:31:32Z",
   "aliases": [
     "CVE-2026-35541"
   ],
+  "summary": "Roundcube Webmail: Incorrect password comparison in the password plugin",
   "details": "An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "roundcube/roundcubemail"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.7-beta"
+            },
+            {
+              "fixed": "1.7-rc5"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -31,6 +52,10 @@
       "type": "WEB",
       "url": "https://github.com/roundcube/roundcubemail/commit/6fa2bddc59b9c9fd31cad4a9e2954a208d793dce"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/roundcube/roundcubemail"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.14"
@@ -53,8 +78,8 @@
       "CWE-843"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-04-04T06:54:24Z",
     "nvd_published_at": "2026-04-03T05:16:22Z"
   }
 }

…-vxg2-hhgr-37fx/GHSA-vxg2-hhgr-37fx.json …-vxg2-hhgr-37fx/GHSA-vxg2-hhgr-37fx.jsonadvisories/unreviewed/2026/04/GHSA-vxg2-hhgr-37fx/GHSA-vxg2-hhgr-37fx.json renamed to advisories/github-reviewed/2026/04/GHSA-vxg2-hhgr-37fx/GHSA-vxg2-hhgr-37fx.json advisories/unreviewed/2026/04/GHSA-vxg2-hhgr-37fx/GHSA-vxg2-hhgr-37fx.json renamed to advisories/github-reviewed/2026/04/GHSA-vxg2-hhgr-37fx/GHSA-vxg2-hhgr-37fx.json

@@ -1,19 +1,40 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vxg2-hhgr-37fx",
-  "modified": "2026-04-03T06:31:32Z",
+  "modified": "2026-04-04T06:53:55Z",
   "published": "2026-04-03T06:31:32Z",
   "aliases": [
     "CVE-2026-35540"
   ],
+  "summary": "Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages",
   "details": "An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "roundcube/roundcubemail"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.7-beta"
+            },
+            {
+              "fixed": "1.7-rc5"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -27,6 +48,10 @@
       "type": "WEB",
       "url": "https://github.com/roundcube/roundcubemail/commit/579b68eff90650a5c782e153debd66c765648942"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/roundcube/roundcubemail"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.14"
@@ -42,11 +67,12 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-669"
+      "CWE-669",
+      "CWE-918"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-04-04T06:53:55Z",
     "nvd_published_at": "2026-04-03T05:16:22Z"
   }
 }