Skip to content

Commit e351c6b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-q4hc-vp2m-fr47 GHSA-25xg-52c8-p9q8 GHSA-27g8-mxrv-gmvr GHSA-34rr-qp2j-p4q7 GHSA-72f8-jfg6-jwc2 GHSA-7q4c-5c93-23rx GHSA-c27m-9j97-3ghp GHSA-f4gc-mwrg-q36r GHSA-h6cx-fqvj-hw7c
1 parent 3aba3d5 commit e351c6b

9 files changed

Lines changed: 314 additions & 14 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-q4hc-vp2m-fr47/GHSA-q4hc-vp2m-fr47.json‎

Lines changed: 22 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-q4hc-vp2m-fr47",
4-
"modified": "2026-03-24T03:31:19Z",
4+
"modified": "2026-03-24T09:30:30Z",
55
"published": "2026-02-23T18:32:02Z",
66
"aliases": [
77
"CVE-2025-14905"
@@ -21,59 +21,67 @@
2121
},
2222
{
2323
"type": "WEB",
24-
"url": "https://access.redhat.com/errata/RHSA-2026:3189"
24+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423624"
2525
},
2626
{
2727
"type": "WEB",
28-
"url": "https://access.redhat.com/errata/RHSA-2026:3208"
28+
"url": "https://access.redhat.com/security/cve/CVE-2025-14905"
2929
},
3030
{
3131
"type": "WEB",
32-
"url": "https://access.redhat.com/errata/RHSA-2026:3379"
32+
"url": "https://access.redhat.com/errata/RHSA-2026:5569"
3333
},
3434
{
3535
"type": "WEB",
36-
"url": "https://access.redhat.com/errata/RHSA-2026:3504"
36+
"url": "https://access.redhat.com/errata/RHSA-2026:5568"
3737
},
3838
{
3939
"type": "WEB",
40-
"url": "https://access.redhat.com/errata/RHSA-2026:4207"
40+
"url": "https://access.redhat.com/errata/RHSA-2026:5514"
4141
},
4242
{
4343
"type": "WEB",
44-
"url": "https://access.redhat.com/errata/RHSA-2026:4661"
44+
"url": "https://access.redhat.com/errata/RHSA-2026:5513"
4545
},
4646
{
4747
"type": "WEB",
48-
"url": "https://access.redhat.com/errata/RHSA-2026:4720"
48+
"url": "https://access.redhat.com/errata/RHSA-2026:5512"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://access.redhat.com/errata/RHSA-2026:5511"
4953
},
5054
{
5155
"type": "WEB",
5256
"url": "https://access.redhat.com/errata/RHSA-2026:5196"
5357
},
5458
{
5559
"type": "WEB",
56-
"url": "https://access.redhat.com/errata/RHSA-2026:5511"
60+
"url": "https://access.redhat.com/errata/RHSA-2026:4720"
5761
},
5862
{
5963
"type": "WEB",
60-
"url": "https://access.redhat.com/errata/RHSA-2026:5512"
64+
"url": "https://access.redhat.com/errata/RHSA-2026:4661"
6165
},
6266
{
6367
"type": "WEB",
64-
"url": "https://access.redhat.com/errata/RHSA-2026:5513"
68+
"url": "https://access.redhat.com/errata/RHSA-2026:4207"
6569
},
6670
{
6771
"type": "WEB",
68-
"url": "https://access.redhat.com/errata/RHSA-2026:5514"
72+
"url": "https://access.redhat.com/errata/RHSA-2026:3504"
6973
},
7074
{
7175
"type": "WEB",
72-
"url": "https://access.redhat.com/security/cve/CVE-2025-14905"
76+
"url": "https://access.redhat.com/errata/RHSA-2026:3379"
7377
},
7478
{
7579
"type": "WEB",
76-
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423624"
80+
"url": "https://access.redhat.com/errata/RHSA-2026:3208"
81+
},
82+
{
83+
"type": "WEB",
84+
"url": "https://access.redhat.com/errata/RHSA-2026:3189"
7785
}
7886
],
7987
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-25xg-52c8-p9q8/GHSA-25xg-52c8-p9q8.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-25xg-52c8-p9q8",
4+
"modified": "2026-03-24T09:30:31Z",
5+
"published": "2026-03-24T09:30:31Z",
6+
"aliases": [
7+
"CVE-2025-41660"
8+
],
9+
"details": "A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41660"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://certvde.com/de/advisories/VDE-2026-011"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-669"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-24T08:16:00Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-27g8-mxrv-gmvr/GHSA-27g8-mxrv-gmvr.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-27g8-mxrv-gmvr",
4+
"modified": "2026-03-24T09:30:30Z",
5+
"published": "2026-03-24T09:30:30Z",
6+
"aliases": [
7+
"CVE-2026-4756"
8+
],
9+
"details": "Out-of-bounds Write vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4756"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/MolotovCherry/Android-ImageMagick7/pull/194"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-787"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-24T07:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-34rr-qp2j-p4q7/GHSA-34rr-qp2j-p4q7.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-34rr-qp2j-p4q7",
4+
"modified": "2026-03-24T09:30:31Z",
5+
"published": "2026-03-24T09:30:31Z",
6+
"aliases": [
7+
"CVE-2026-3509"
8+
],
9+
"details": "An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3509"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://certvde.com/de/advisories/VDE-2026-018"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-134"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-24T08:16:01Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-72f8-jfg6-jwc2/GHSA-72f8-jfg6-jwc2.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-72f8-jfg6-jwc2",
4+
"modified": "2026-03-24T09:30:30Z",
5+
"published": "2026-03-24T09:30:30Z",
6+
"aliases": [
7+
"CVE-2026-33852"
8+
],
9+
"details": "Missing Release of Memory after Effective Lifetime vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33852"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/MolotovCherry/Android-ImageMagick7/pull/191"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-401"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-24T07:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-7q4c-5c93-23rx/GHSA-7q4c-5c93-23rx.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7q4c-5c93-23rx",
4+
"modified": "2026-03-24T09:30:30Z",
5+
"published": "2026-03-24T09:30:30Z",
6+
"aliases": [
7+
"CVE-2026-4754"
8+
],
9+
"details": "CWE-79 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4754"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/MolotovCherry/Android-ImageMagick7/pull/192"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-24T07:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-c27m-9j97-3ghp/GHSA-c27m-9j97-3ghp.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c27m-9j97-3ghp",
4+
"modified": "2026-03-24T09:30:31Z",
5+
"published": "2026-03-24T09:30:31Z",
6+
"aliases": [
7+
"CVE-2026-4649"
8+
],
9+
"details": "Apache Artemis before version 2.52.0 is affected by an authentication bypass flaw which allows reading all messages exchanged via the broker and injection of new message ( CVE-2026-27446 https://www.cve.org/CVERecord ). Since KNIME Business Hub uses Apache Artemis it is also affected by the issue. However, since Apache Artemis is not exposed to the outside it requires at least normal user privileges and the ability to execute workflows in an executor. Such a user can install and register a federated mirror without authentication to the original Apache Artemis instance and thereby read all internal messages and inject new messages.\n\nThe issue affects all versions of KNIME Business Hub. A fixed version of Apache Artemis is shipped with versions 1.18.0, 1.17.4, and 1.16.3.\n\nWe recommend updating to a fixed version as soon as possible since no workaround is known.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4649"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.knime.com/security/advisories#CVE-2026-4649"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-306"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-24T09:16:39Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-f4gc-mwrg-q36r/GHSA-f4gc-mwrg-q36r.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f4gc-mwrg-q36r",
4+
"modified": "2026-03-24T09:30:31Z",
5+
"published": "2026-03-24T09:30:31Z",
6+
"aliases": [
7+
"CVE-2026-32642"
8+
],
9+
"details": "Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the \"createDurableQueue\" permission but does not have the \"createAddress\" permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed.\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0.\n\nUsers are recommended to upgrade to version 2.53.0, which fixes the issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32642"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://lists.apache.org/thread/4wlrp31ngq2yb54sf4kjb3bl41t4xgtp"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "http://www.openwall.com/lists/oss-security/2026/03/20/2"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-863"
34+
],
35+
"severity": "LOW",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-24T08:16:01Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-h6cx-fqvj-hw7c/GHSA-h6cx-fqvj-hw7c.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h6cx-fqvj-hw7c",
4+
"modified": "2026-03-24T09:30:30Z",
5+
"published": "2026-03-24T09:30:30Z",
6+
"aliases": [
7+
"CVE-2026-4755"
8+
],
9+
"details": "CWE-20 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4755"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/MolotovCherry/Android-ImageMagick7/pull/193"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-20"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-24T07:16:07Z"
35+
}
36+
}

0 commit comments

Comments
 (0)