Skip to content

Commit 8d4f5e9

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-42x2-wfr5-pcgx GHSA-559w-6g2v-jh67 GHSA-5qhg-xgvp-wq2g GHSA-c8r3-7jgc-cm9w GHSA-j2xg-7hvh-hxm5 GHSA-q3rp-qmhw-57f7 GHSA-qgc5-8q25-ffxc GHSA-rp88-35f4-4f9f GHSA-rqjf-4x9c-c8v8 GHSA-vx3q-gcj3-hmg7 GHSA-xr64-qq65-vf4r
1 parent ce1bfd4 commit 8d4f5e9

11 files changed

Lines changed: 344 additions & 2 deletions

File tree

‎advisories/unreviewed/2026/09/GHSA-42x2-wfr5-pcgx/GHSA-42x2-wfr5-pcgx.json‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-42x2-wfr5-pcgx",
4+
"modified": "2026-09-25T00:33:04Z",
5+
"published": "2026-09-25T00:33:04Z",
6+
"aliases": [
7+
"CVE-2026-97636"
8+
],
9+
"details": "Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because after the team-scoped lookup misses the backend falls back to a team-agnostic path concatenated from the unvalidated key. The Execution API Variables route accepts a path-shaped key, so this is reachable from ordinary Dag code.\n\nAffects multi-team deployments using the HashiCorp Vault secrets backend. Single-team deployments are not affected, as there is no cross-team boundary to cross. This is the same class as CVE-2026-86465, CVE-2026-68870, CVE-2026-68871 and CVE-2026-68872 in the Akeyless, Azure Key Vault, Yandex Lockbox and Amazon secrets backends.\n\nUsers of apache-airflow-providers-hashicorp are recommended to upgrade to version 4.8.0 or later, which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97636"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/apache/airflow/pull/70006"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://lists.apache.org/thread/l0fogo9dh5v07vnsxnhoh3c74othkr51"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68870"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68871"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68872"
36+
},
37+
{
38+
"type": "WEB",
39+
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86465"
40+
}
41+
],
42+
"database_specific": {
43+
"cwe_ids": [
44+
"CWE-639"
45+
],
46+
"severity": null,
47+
"github_reviewed": false,
48+
"github_reviewed_at": null,
49+
"nvd_published_at": "2026-09-24T22:17:02Z"
50+
}
51+
}

‎advisories/unreviewed/2026/09/GHSA-559w-6g2v-jh67/GHSA-559w-6g2v-jh67.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-559w-6g2v-jh67",
4+
"modified": "2026-09-25T00:33:06Z",
5+
"published": "2026-09-25T00:33:06Z",
6+
"aliases": [
7+
"CVE-2026-97230"
8+
],
9+
"details": "IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.\n\nThe generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly.\n\nThe impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host.\n\nThe releases have no test scripts nor build hooks. The intention may have been to trigger the payload after installation.\n\nThe dropper script is in lib/Crypt/SelfCertificate/sample/cert.pem.\n\nThis is similar to CVE-2026-95831 for the module Crypt::SelfCertificate.\n\nThe SHA-256 digests of the files are\n\n ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0 IO-Socket-SSL-SelfCertificate-1.00.tar.gz\n 821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac IO-Socket-SSL-SelfCertificate-1.00/lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem\n\n d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5 IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97230"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://www.cve.org/CVERecord?id=CVE-2026-95831"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://www.nntp.perl.org/group/perl.cpan.testers.discuss/2026/09/msg4756.html"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-506"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-09-24T23:19:22Z"
34+
}
35+
}

‎advisories/unreviewed/2026/09/GHSA-5qhg-xgvp-wq2g/GHSA-5qhg-xgvp-wq2g.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5qhg-xgvp-wq2g",
4+
"modified": "2026-09-25T00:33:04Z",
5+
"published": "2026-09-25T00:33:04Z",
6+
"aliases": [
7+
"CVE-2026-85491"
8+
],
9+
"details": "Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone.\n\nCatalyst::Seal replaces the dispatcher's prepare_action with a version that memoises how a path resolved: which dispatch type matched, at which level, and what was left over as arguments. The key is the request path and nothing else. Action roles that match on the method, content type, scheme or query make that resolution depend on state the key does not carry, so the memo answers for a request it was not built from.\n\nA path that resolves to no action is memoised as well, and replaying that entry returns without consulting any dispatch type, so no action is set and the request fails. A GET of a path whose action is declared POST-only therefore disables that path for every later request, the correct POST included. An entry that did resolve replays the level the earlier descent reached. Where a POST-only action sits below a shallower action on the same path, a GET memoises the shallow route, and a later POST is dispatched there with an auto() guarding the deeper controller never running.\n\nThe memo is cleared only when an action is registered, which happens at setup, so an entry lasts for the life of the process, and its cap of 2048 entries bounds how many paths one caller can disable. In the configuration measured, the misroute lands on the less privileged action, so it is an authorization check not running rather than a privilege gain.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85491"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://metacpan.org/release/LNATION/Catalyst-Seal-0.02/source/lib/Catalyst/Seal/Dispatch.pm#L237-280"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://metacpan.org/release/LNATION/Catalyst-Seal-0.03/changes"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-706"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-09-24T22:17:02Z"
34+
}
35+
}

‎advisories/unreviewed/2026/09/GHSA-c8r3-7jgc-cm9w/GHSA-c8r3-7jgc-cm9w.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c8r3-7jgc-cm9w",
4+
"modified": "2026-09-25T00:33:04Z",
5+
"published": "2026-09-25T00:33:04Z",
6+
"aliases": [
7+
"CVE-2026-87720"
8+
],
9+
"details": "Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user (or an unauthenticated user if the repository was previously public) to cause unauthorized disclosure of private repository content and durable restoration of revoked project-owner administrative privileges via crafted requests using repeated .git suffixes (such as project.git.git) across REST APIs, Gitiles, or SSH Git commands. Because Gerrit strips only a single terminal .git suffix when constructing the logical ProjectCache key while JGit (FileKey.lenient) resolves the suffixed alias to the same canonical bare repository on disk, revoking read access or removing owner rules on the canonical project name fails to evict the cached alias ProjectState during the cache validity window, enabling reads of newly created private commits or writes to refs/meta/config. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87720"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://issues.gerritcodereview.com/issues/538883789"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-613"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-09-24T22:17:02Z"
35+
}
36+
}

‎advisories/unreviewed/2026/09/GHSA-j2xg-7hvh-hxm5/GHSA-j2xg-7hvh-hxm5.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j2xg-7hvh-hxm5",
4-
"modified": "2026-09-16T00:31:32Z",
4+
"modified": "2026-09-25T00:33:03Z",
55
"published": "2026-09-16T00:31:31Z",
66
"aliases": [
77
"CVE-2026-81855"
@@ -31,6 +31,10 @@
3131
"type": "WEB",
3232
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-02"
3333
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wartsila.com/marine/products/data-service-downloads/fos-downloads"
37+
},
3438
{
3539
"type": "WEB",
3640
"url": "https://www.wartsila.com/services-catalogue/engine-services-4-stroke/wartsila-ics-patch-deployment#contact"

‎advisories/unreviewed/2026/09/GHSA-q3rp-qmhw-57f7/GHSA-q3rp-qmhw-57f7.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q3rp-qmhw-57f7",
4+
"modified": "2026-09-25T00:33:04Z",
5+
"published": "2026-09-25T00:33:04Z",
6+
"aliases": [
7+
"CVE-2026-87721"
8+
],
9+
"details": "Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a persistent denial of service (CPU exhaustion and HTTP worker thread pool starvation requiring a server restart) via crafted search queries containing deeply nested parentheses sent to query evaluation endpoints (/changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or SSH gerrit query). Because syntactic predicates in conditionOr and conditionAnd recurse via conditionBase without memoization prior to capability or visibility checks and worker threads do not abort when the client disconnects, a small number of requests (such as 25 requests matching default httpd.maxThreads) can permanently pin all HTTP worker threads. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87721"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://issues.gerritcodereview.com/issues/541287630"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-400"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-09-24T22:17:02Z"
35+
}
36+
}

‎advisories/unreviewed/2026/09/GHSA-qgc5-8q25-ffxc/GHSA-qgc5-8q25-ffxc.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qgc5-8q25-ffxc",
4+
"modified": "2026-09-25T00:33:04Z",
5+
"published": "2026-09-25T00:33:04Z",
6+
"aliases": [
7+
"CVE-2026-87722"
8+
],
9+
"details": "Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicates) and REST regex filter endpoints (RegexListSearcher /projects/?r= and RefFilter /projects/{project}/branches/?r=) in Gerrit Code Review versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a denial of service (CPU starvation and JVM heap exhaustion / OutOfMemoryError) via crafted search queries or REST API requests containing regular expressions with large counted repetitions or exponential DFA determinization patterns. Because the user-supplied regular expression is compiled into an unbounded dk.brics.automaton instance (new RegExp(re).toAutomaton()) on the request thread prior to index evaluation or access control visibility filtering, trivial queries can exhaust JVM heap or pin request threads regardless of heap size. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87722"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://issues.gerritcodereview.com/issues/540877705"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-400"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-09-24T22:17:02Z"
35+
}
36+
}

‎advisories/unreviewed/2026/09/GHSA-rp88-35f4-4f9f/GHSA-rp88-35f4-4f9f.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rp88-35f4-4f9f",
4+
"modified": "2026-09-25T00:33:06Z",
5+
"published": "2026-09-25T00:33:06Z",
6+
"aliases": [
7+
"CVE-2026-97387"
8+
],
9+
"details": "Rejected reason: This CVE is a duplicate of another CVE.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97387"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-09-24T23:19:23Z"
24+
}
25+
}

‎advisories/unreviewed/2026/09/GHSA-rqjf-4x9c-c8v8/GHSA-rqjf-4x9c-c8v8.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rqjf-4x9c-c8v8",
4+
"modified": "2026-09-25T00:33:06Z",
5+
"published": "2026-09-25T00:33:06Z",
6+
"aliases": [
7+
"CVE-2026-85082"
8+
],
9+
"details": "Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85082"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://fluidattacks.com/advisories/infant"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://play.google.com/store/apps/details?id=com.jrummyapps.rootbrowser.classic"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-78"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-09-25T00:16:57Z"
39+
}
40+
}

‎advisories/unreviewed/2026/09/GHSA-vx3q-gcj3-hmg7/GHSA-vx3q-gcj3-hmg7.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vx3q-gcj3-hmg7",
4+
"modified": "2026-09-25T00:33:06Z",
5+
"published": "2026-09-25T00:33:06Z",
6+
"aliases": [
7+
"CVE-2026-84283"
8+
],
9+
"details": "Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Folder.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84283"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://fluidattacks.com/advisories/sanguisugabogg"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://play.google.com/store/apps/details?id=com.securefolder.securevault"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-922"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-09-25T00:16:57Z"
39+
}
40+
}

0 commit comments

Comments
 (0)