Skip to content

Commit ffc1600

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-65cr-c32f-9764 GHSA-84m6-p53c-x4wp GHSA-6qx4-cmrg-x79q GHSA-7549-ggpq-22w8 GHSA-f2hp-qw27-8wfq GHSA-jf89-3q6q-vcgr GHSA-jw3m-5wwm-qcph GHSA-jx24-j485-cqwm GHSA-rp7w-624x-95qv
1 parent 493883d commit ffc1600

9 files changed

Lines changed: 223 additions & 4 deletions

File tree

‎advisories/unreviewed/2026/01/GHSA-65cr-c32f-9764/GHSA-65cr-c32f-9764.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-65cr-c32f-9764",
4-
"modified": "2026-04-01T18:36:31Z",
4+
"modified": "2026-04-13T12:31:15Z",
55
"published": "2026-01-08T18:30:50Z",
66
"aliases": [
77
"CVE-2026-22486"

‎advisories/unreviewed/2026/03/GHSA-84m6-p53c-x4wp/GHSA-84m6-p53c-x4wp.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-84m6-p53c-x4wp",
4-
"modified": "2026-03-25T15:31:29Z",
4+
"modified": "2026-04-13T12:31:15Z",
55
"published": "2026-03-25T15:31:29Z",
66
"aliases": [
77
"CVE-2026-1519"
@@ -34,6 +34,10 @@
3434
{
3535
"type": "WEB",
3636
"url": "https://kb.isc.org/docs/cve-2026-1519"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00008.html"
3741
}
3842
],
3943
"database_specific": {

‎advisories/unreviewed/2026/04/GHSA-6qx4-cmrg-x79q/GHSA-6qx4-cmrg-x79q.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@
3030
],
3131
"database_specific": {
3232
"cwe_ids": [
33-
"CWE-120"
33+
"CWE-120",
34+
"CWE-787"
3435
],
3536
"severity": "HIGH",
3637
"github_reviewed": false,

‎advisories/unreviewed/2026/04/GHSA-7549-ggpq-22w8/GHSA-7549-ggpq-22w8.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7549-ggpq-22w8",
4+
"modified": "2026-04-13T12:31:15Z",
5+
"published": "2026-04-13T12:31:15Z",
6+
"aliases": [
7+
"CVE-2026-6204"
8+
],
9+
"details": "LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "WEB",
20+
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-pr3g-phhr-h8fh"
21+
},
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6204"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#binary-path-rce-poc"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-78"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-13T11:16:06Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-f2hp-qw27-8wfq/GHSA-f2hp-qw27-8wfq.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f2hp-qw27-8wfq",
4+
"modified": "2026-04-13T12:31:15Z",
5+
"published": "2026-04-13T12:31:15Z",
6+
"aliases": [
7+
"CVE-2026-35565"
8+
],
9+
"details": "Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI\n\n\nVersions Affected: before 2.8.6\n\n\nDescription: The Storm UI visualization component interpolates topology metadata including component IDs, stream names, and grouping values directly into HTML via innerHTML in parseNode() and parseEdge() without sanitization at any layer. An authenticated user with topology submission rights could craft a topology containing malicious HTML/JavaScript in component identifiers (e.g., a bolt ID containing an onerror event handler). This payload flows through Nimbus → Thrift → the Visualization API → vis.js tooltip rendering, resulting in stored cross-site scripting. \n\nIn multi-tenant deployments where topology submission is available to less-trusted users but the UI is accessed by operators or administrators, this enables privilege escalation through script execution in an admin's browser session.\n\n\nMitigation: 2.x users should upgrade to 2.8.6. Users who cannot upgrade immediately should monkey-patch the parseNode() and parseEdge() functions in the visualization JavaScript file to HTML-escape all API-supplied values including nodeId, :capacity, :latency, :component, :stream, and :grouping before interpolation into tooltip HTML strings, and should additionally restrict topology submission to trusted users via Nimbus ACLs as a defense-in-depth measure. A guide on how to do this is available in the release notes of 2.8.6.\n\nCredit: This issue was discovered while investigating another report by K.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35565"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://storm.apache.org/2026/04/12/storm286-released.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://www.openwall.com/lists/oss-security/2026/04/12/7"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-79"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-04-13T10:16:11Z"
34+
}
35+
}

‎advisories/unreviewed/2026/04/GHSA-jf89-3q6q-vcgr/GHSA-jf89-3q6q-vcgr.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jf89-3q6q-vcgr",
4+
"modified": "2026-04-13T12:31:15Z",
5+
"published": "2026-04-13T12:31:15Z",
6+
"aliases": [
7+
"CVE-2026-35337"
8+
],
9+
"details": "Deserialization of Untrusted Data vulnerability in Apache Storm.\n\nVersions Affected:\nbefore 2.8.6.\n\n\nDescription:\nWhen processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the \"TGT\" credential field, leading to remote code execution in both the Nimbus and Worker JVMs.\n\n\nMitigation:\n2.x users should upgrade to 2.8.6.\n\n\nUsers who cannot upgrade immediately should monkey-patch an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket() restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies. A guide on how to do this is available in the release notes of 2.8.6.\n\nCredit: This issue was discovered by K.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35337"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://storm.apache.org/2026/04/12/storm286-released.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://www.openwall.com/lists/oss-security/2026/04/12/6"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-502"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-04-13T10:16:11Z"
34+
}
35+
}

‎advisories/unreviewed/2026/04/GHSA-jw3m-5wwm-qcph/GHSA-jw3m-5wwm-qcph.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jw3m-5wwm-qcph",
4-
"modified": "2026-04-08T15:31:44Z",
4+
"modified": "2026-04-13T12:31:15Z",
55
"published": "2026-04-08T15:31:43Z",
66
"aliases": [
77
"CVE-2026-27102"

‎advisories/unreviewed/2026/04/GHSA-jx24-j485-cqwm/GHSA-jx24-j485-cqwm.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jx24-j485-cqwm",
4+
"modified": "2026-04-13T12:31:15Z",
5+
"published": "2026-04-13T12:31:15Z",
6+
"aliases": [
7+
"CVE-2025-15632"
8+
],
9+
"details": "A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component MdPreview. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.5.0 is recommended to address this issue. The name of the patch is 7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15632"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/AnalogyC0de/public_exp/issues/28"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/1Panel-dev/MaxKB/pull/4578"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/1Panel-dev/MaxKB/commit/7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/1Panel-dev/MaxKB"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.5.0"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/submit/782265"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/356967"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/vuln/356967/cti"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-79"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": false,
65+
"github_reviewed_at": null,
66+
"nvd_published_at": "2026-04-13T10:16:10Z"
67+
}
68+
}

‎advisories/unreviewed/2026/04/GHSA-rp7w-624x-95qv/GHSA-rp7w-624x-95qv.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rp7w-624x-95qv",
4+
"modified": "2026-04-13T12:31:15Z",
5+
"published": "2026-04-13T12:31:15Z",
6+
"aliases": [
7+
"CVE-2026-2728"
8+
],
9+
"details": "LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2728"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#xss-on-showconfig-page-2630"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-13T11:16:05Z"
35+
}
36+
}

0 commit comments

Comments
 (0)