Skip to content

Commit 782a2cb

Browse files
aboutcode-automationaboutcode-automation
committed
Sync EUVD catalog: Wed Jul 1 00:57:37 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent af3b35b commit 782a2cb

1,225 files changed

Lines changed: 33733 additions & 2255 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/2026/04/EUVD-2025-209594.json‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,34 +2,43 @@
22
"id": "EUVD-2025-209594",
33
"enisaUuid": "a570ea44-7ec4-377f-a9ca-8e2b0f8f810c",
44
"description": "Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.",
5-
"datePublished": "Apr 30, 2026, 3:30:39 PM",
6-
"dateUpdated": "May 5, 2026, 3:31:40 AM",
5+
"datePublished": "Apr 30, 2026, 12:39:40 PM",
6+
"dateUpdated": "Jun 30, 2026, 2:46:38 AM",
77
"baseScore": 7.4,
88
"baseScoreVersion": "4.0",
99
"baseScoreVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U",
10-
"references": "https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-14576\n",
10+
"references": "https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273\n",
1111
"aliases": "CVE-2025-14576\nGHSA-4hpm-v49g-rq7q\n",
1212
"assigner": "TQtC",
13-
"epss": 0.01,
13+
"epss": 0.22,
1414
"enisaIdProduct": [
1515
{
1616
"id": "7034ca9e-d14f-3c28-8939-12c74fd0f0e8",
1717
"product": {
18-
"name": "Qt"
18+
"name": "Qt",
19+
"vendor": {
20+
"name": "The Qt Company"
21+
}
1922
},
2023
"product_version": "6.10.0 \u22646.10.1"
2124
},
2225
{
2326
"id": "a80b943c-9f7a-331b-a5e3-8484f3301b83",
2427
"product": {
25-
"name": "Qt"
28+
"name": "Qt",
29+
"vendor": {
30+
"name": "The Qt Company"
31+
}
2632
},
2733
"product_version": "6.9.0 \u22646.10.1"
2834
},
2935
{
3036
"id": "fb07f66a-2f39-3a51-89f5-da7b0b6ad501",
3137
"product": {
32-
"name": "Qt"
38+
"name": "Qt",
39+
"vendor": {
40+
"name": "The Qt Company"
41+
}
3342
},
3443
"product_version": "6.8.0 \u22646.8.6"
3544
}

‎advisories/2026/04/EUVD-2026-26318.json‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,22 @@
33
"enisaUuid": "288e390a-d519-39f7-be6d-d970a5b389ed",
44
"description": "TLS protocol dissector heap overflow in Wireshark 4.6.0 to 4.6.4 allows denial of service and possible code execution",
55
"datePublished": "Apr 30, 2026, 5:39:14 AM",
6-
"dateUpdated": "Apr 30, 2026, 12:53:42 PM",
6+
"dateUpdated": "Jun 30, 2026, 2:44:16 AM",
77
"baseScore": 8.8,
88
"baseScoreVersion": "3.1",
99
"baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
1010
"references": "https://www.wireshark.org/security/wnpa-sec-2026-14.html\nhttps://gitlab.com/wireshark/wireshark/-/issues/21090\n",
11-
"aliases": "CVE-2026-5402\n",
11+
"aliases": "CVE-2026-5402\nGHSA-f6fp-9f7c-rfwv\n",
1212
"assigner": "GitLab",
13-
"epss": 0.05,
13+
"epss": 0.34,
1414
"enisaIdProduct": [
1515
{
1616
"id": "fb535276-f853-3e3e-be96-0a4869c61acb",
1717
"product": {
18-
"name": "Wireshark"
18+
"name": "Wireshark",
19+
"vendor": {
20+
"name": "Wireshark Foundation"
21+
}
1922
},
2023
"product_version": "4.6.0 <4.6.5"
2124
}

‎advisories/2026/04/EUVD-2026-26374.json‎

Lines changed: 43 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,47 +3,82 @@
33
"enisaUuid": "e4294cd8-5ca2-3427-b1a6-4b7fe82a1120",
44
"description": "A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub. \n\nThe credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials, which returns the kubeadmin password) and the kubeconfig download endpoint are operational in AUTH_TYPE=local mode, the only authentication mode available in on-premises ACM/MCE hub deployments. The local authenticator unconditionally grants full administrative access to any request bearing a valid JWT, with no per-endpoint restrictions. A valid local JWT is embedded as a plaintext query parameter in InfraEnvStatus.ISODownloadURL and is readable by any user who has get rights on an InfraEnv object in their own namespace.\n\nThe affected components ship as part of Multicluster Engine (MCE). The Red Hat Advanced Cluster Management (ACM) deployments that include MCE are equally affected.\nThis issue does not affect the hosted SaaS offering (console.redhat.com), which uses a different authentication mode.\n\nSuccessful exploitation gives the attacker the kubeadmin password and kubeconfig for any OpenShift cluster provisioned through the affected hub, granting unrestricted root-level administrative access to those spoke clusters.",
55
"datePublished": "Apr 30, 2026, 1:18:49 PM",
6-
"dateUpdated": "May 7, 2026, 6:28:07 AM",
6+
"dateUpdated": "Jun 30, 2026, 2:44:07 AM",
77
"baseScore": 6.1,
88
"baseScoreVersion": "3.1",
99
"baseScoreVector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
10-
"references": "https://access.redhat.com/errata/RHSA-2026:11511\nhttps://access.redhat.com/errata/RHSA-2026:11512\nhttps://access.redhat.com/errata/RHSA-2026:12116\nhttps://access.redhat.com/errata/RHSA-2026:12337\nhttps://access.redhat.com/security/cve/CVE-2026-7163\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2463152\n",
10+
"references": "https://access.redhat.com/errata/RHSA-2026:11511\nhttps://access.redhat.com/errata/RHSA-2026:11512\nhttps://access.redhat.com/errata/RHSA-2026:12116\nhttps://access.redhat.com/errata/RHSA-2026:12337\nhttps://access.redhat.com/errata/RHSA-2026:18584\nhttps://access.redhat.com/errata/RHSA-2026:18585\nhttps://access.redhat.com/security/cve/CVE-2026-7163\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2463152\n",
1111
"aliases": "CVE-2026-7163\nGHSA-62pm-2jjw-mqpx\n",
1212
"assigner": "redhat",
13-
"epss": 0.01,
13+
"epss": 0.16,
1414
"enisaIdProduct": [
1515
{
1616
"id": "42433514-446f-3cad-a90f-4684a3d8c394",
1717
"product": {
18-
"name": "multicluster engine for Kubernetes 2.10"
18+
"name": "multicluster engine for Kubernetes 2.10",
19+
"vendor": {
20+
"name": "Red Hat"
21+
}
1922
},
2023
"product_version": "patch: 1776983527"
2124
},
2225
{
2326
"id": "4e074586-43e4-3568-9f79-74710026fd2d",
2427
"product": {
25-
"name": "multicluster engine for Kubernetes 2.1"
28+
"name": "multicluster engine for Kubernetes 2.1",
29+
"vendor": {
30+
"name": "Red Hat"
31+
}
2632
},
2733
"product_version": "patch: 1776983527"
2834
},
2935
{
3036
"id": "8cb29a30-bc2c-3bb7-a043-66b80cad41b5",
3137
"product": {
32-
"name": "multicluster engine for Kubernetes 2.7"
38+
"name": "multicluster engine for Kubernetes 2.7",
39+
"vendor": {
40+
"name": "Red Hat"
41+
}
3342
},
3443
"product_version": "patch: 1777205772"
3544
},
45+
{
46+
"id": "dd56716d-fdc2-3a83-928a-f77b8cc012cf",
47+
"product": {
48+
"name": "multicluster engine for Kubernetes 2.9",
49+
"vendor": {
50+
"name": "Red Hat"
51+
}
52+
},
53+
"product_version": "patch: 1778464072"
54+
},
3655
{
3756
"id": "e2007ddf-e166-31be-9e4d-c0ecd6c26f21",
3857
"product": {
39-
"name": "multicluster engine for Kubernetes 2.11"
58+
"name": "multicluster engine for Kubernetes 2.11",
59+
"vendor": {
60+
"name": "Red Hat"
61+
}
4062
},
4163
"product_version": "patch: 1776987609"
4264
},
65+
{
66+
"id": "f2fd1153-a4d3-3c0a-8362-224bad739af3",
67+
"product": {
68+
"name": "multicluster engine for Kubernetes 2.9",
69+
"vendor": {
70+
"name": "Red Hat"
71+
}
72+
},
73+
"product_version": "patch: 1778464111"
74+
},
4375
{
4476
"id": "fa7bbefa-0481-310a-bc41-1a70ac040064",
4577
"product": {
46-
"name": "multicluster engine for Kubernetes 2.7"
78+
"name": "multicluster engine for Kubernetes 2.7",
79+
"vendor": {
80+
"name": "Red Hat"
81+
}
4782
},
4883
"product_version": "patch: 1777205801"
4984
}

‎advisories/2026/04/EUVD-2026-26375.json‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,22 @@
33
"enisaUuid": "2835944a-4df1-37b1-bc0c-aac451d92d23",
44
"description": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
55
"datePublished": "Apr 30, 2026, 1:16:44 PM",
6-
"dateUpdated": "Apr 30, 2026, 1:40:48 PM",
6+
"dateUpdated": "Jun 30, 2026, 2:46:21 AM",
77
"baseScore": 7.2,
88
"baseScoreVersion": "3.1",
99
"baseScoreVector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
1010
"references": "https://github.com/pallets/click/releases/tag/8.3.3\nhttps://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw\n",
1111
"aliases": "CVE-2026-7246\n",
1212
"assigner": "certcc",
13-
"epss": 0.0,
13+
"epss": 0.67,
1414
"enisaIdProduct": [
1515
{
1616
"id": "d059b9fe-7380-3127-a302-62efae29e7c1",
1717
"product": {
18-
"name": "Click"
18+
"name": "Click",
19+
"vendor": {
20+
"name": "Pallets Click"
21+
}
1922
},
2023
"product_version": "0 <8.3.3"
2124
}

0 commit comments

Comments
 (0)