[Git][security-tracker-team/security-tracker][helmutg/type-improvements] 93 commits: pypy3/LTS
Helmut Grohne (@helmutg)
helmutg at debian.org
Fri Aug 7 07:42:00 BST 2026
Helmut Grohne pushed to branch helmutg/type-improvements at Debian Security Tracker / security-tracker
Commits:
01e114e1 by Bastien Roucariès at 2026-08-06T10:09:34+02:00
pypy3/LTS
- - - - -
1161736b by Bastien Roucariès at 2026-08-06T10:16:52+02:00
Add node-re2 to dla-needed
- - - - -
2232e1d6 by Bastien Roucariès at 2026-08-06T10:25:17+02:00
nodejs triagging
- - - - -
1bb5bfd6 by Salvatore Bonaccorso at 2026-08-06T10:37:07+02:00
Process some NFUs
- - - - -
aab97c25 by Salvatore Bonaccorso at 2026-08-06T10:37:43+02:00
Add new open62541 issues
- - - - -
bd6d251a by Salvatore Bonaccorso at 2026-08-06T11:00:05+02:00
Add CVE-2026-34966/gitea
- - - - -
3d141b58 by Salvatore Bonaccorso at 2026-08-06T11:02:25+02:00
Add new batch of hdf5 issues
- - - - -
21ec91eb by Salvatore Bonaccorso at 2026-08-06T11:04:43+02:00
Add CVE-2026-18967/Keycloak
- - - - -
df79ef55 by Salvatore Bonaccorso at 2026-08-06T11:05:33+02:00
Process some NFUs
- - - - -
1fd648b3 by Aron Xu at 2026-08-06T17:28:47+08:00
Reserve DSA for libde265
- - - - -
f651ceee by Bastien Roucariès at 2026-08-06T12:49:49+02:00
Add qpid-proton to dla-needed
- - - - -
83c9a465 by Aron Xu at 2026-08-06T19:40:35+08:00
Triage libheif CVEs
- - - - -
ac0638cc by Aron Xu at 2026-08-06T19:41:17+08:00
Take libheif
- - - - -
7d8767bf by Emmanuel Arias at 2026-08-06T08:55:32-03:00
CVE-2026-13321: Add NOTE for bookworm version
- - - - -
9c238f00 by Salvatore Bonaccorso at 2026-08-06T13:57:06+02:00
Update status for CVE-2026-47251
- - - - -
a4aef467 by Emmanuel Arias at 2026-08-06T08:59:41-03:00
CVE-2026-13204: Add NOTE for bookworm version
- - - - -
827aeadf by Emmanuel Arias at 2026-08-06T09:07:26-03:00
CVE-2026-11721: Add NOTE for bullseyes and bookworm version
- - - - -
3ba1cbda by Emmanuel Arias at 2026-08-06T09:10:40-03:00
CVE-2026-11622: Add NOTE for bullseyes and bookworm version
- - - - -
675105e9 by Salvatore Bonaccorso at 2026-08-06T14:23:19+02:00
Add Debian bug reference for CVE-2026-71201/ironic
- - - - -
ee44ce89 by Salvatore Bonaccorso at 2026-08-06T14:24:56+02:00
Track fixed version for CVE-2026-71201/ironic via unstable
- - - - -
5bfa2d78 by Alberto Garcia at 2026-08-06T15:00:23+02:00
Add udisks2 CVE-2026-7867
- - - - -
78fc5056 by Bastien Roucariès at 2026-08-06T15:20:34+02:00
Proton CVE look mistriaged wait for dla-needed
- - - - -
2d0d9611 by Bastien Roucariès at 2026-08-06T16:30:56+02:00
CVE-2026-35563/LTS
- - - - -
a1b42629 by Salvatore Bonaccorso at 2026-08-06T17:03:23+02:00
Track fixed version for CVE-2026-41579 via unstable
- - - - -
c883516c by Salvatore Bonaccorso at 2026-08-06T17:04:39+02:00
Mark CVE-2026-14957 as no-dsa for trixie
- - - - -
818d2759 by Salvatore Bonaccorso at 2026-08-06T17:09:53+02:00
Revert triage of qpid-proton assigned issues
All issues are in Apache Qpid ProtonJ2 which is a distinct source and
not packaged in Debian.
- - - - -
edbbd3f2 by Salvatore Bonaccorso at 2026-08-06T17:10:58+02:00
auto-nfu: Add another covered product for the Apache CNA rule
- - - - -
3046c92f by Salvatore Bonaccorso at 2026-08-06T17:14:34+02:00
Process some NFUs
- - - - -
215124a2 by Salvatore Bonaccorso at 2026-08-06T17:37:27+02:00
Add reference for CVE-2026-64564
- - - - -
dc4975af by Chris Lamb at 2026-08-06T08:52:00-07:00
Reserve DLA-4721-1 for async-http-client
- - - - -
8442b454 by Alberto Garcia at 2026-08-06T18:08:08+02:00
udisks2 DSA-6414-1
- - - - -
a3e6de6f by Salvatore Bonaccorso at 2026-08-06T18:12:03+02:00
Add reference for CVE-2026-64561
- - - - -
4ef7958d by Helmut Grohne at 2026-08-06T18:35:56+02:00
security_db.py: track source_package_status.vulnerable as an enum
The vulnerable column of source_package_status can take three possible
values:
* 0 (fixed)
* 1 (affected)
* 2 (undetermined)
We can encapsulate this as an IntEnum on the Python side. Then we can
use those names in place of magic numbers. Additionally, we may add a
constraint to the database column. Since the old schema is compatible,
we do not incur a new schema version.
Reported-by: Emilio Pozuelo Monfort <pochu at debian.org>
- - - - -
07664783 by Alberto Garcia at 2026-08-06T18:38:54+02:00
CVE-2026-7867: mark as fixed in udisks2 2.11.2-1
- - - - -
46fb69af by Salvatore Bonaccorso at 2026-08-06T19:37:23+02:00
Add back reference for CVE-2026-7867
- - - - -
bc1bda9b by Salvatore Bonaccorso at 2026-08-06T19:40:14+02:00
Reserve DSA number for linux update
- - - - -
9e414281 by Salvatore Bonaccorso at 2026-08-06T19:48:12+02:00
Add references for udisks2 issue
- - - - -
56780e02 by Salvatore Bonaccorso at 2026-08-06T19:54:10+02:00
Add new PowerDNS issues (pdns, pdns-recursor, dnsdist)
- - - - -
df1aa3a8 by Salvatore Bonaccorso at 2026-08-06T20:09:26+02:00
Add CVE-2026-68480/linux
- - - - -
18943ca6 by security tracker role at 2026-08-06T19:13:34+00:00
automatic update
- - - - -
71501bad by security tracker role at 2026-08-06T19:14:27+00:00
automatic NOT-FOR-US entries update
- - - - -
7ad1e24a by Salvatore Bonaccorso at 2026-08-06T21:26:06+02:00
Add reference for CVE-2026-68480
- - - - -
ba179060 by Bastien Roucariès at 2026-08-06T21:28:12+02:00
docker-registry/LTS
- - - - -
8b0fb265 by Bastien Roucariès at 2026-08-06T21:30:14+02:00
docker-registry/bullseye
- - - - -
c8bef499 by Bastien Roucariès at 2026-08-06T21:31:38+02:00
Add libgd-securityimage-perl
- - - - -
8eaee7ae by Salvatore Bonaccorso at 2026-08-06T21:33:29+02:00
Remove notes from CVE-2026-51992
- - - - -
ead69fd5 by Bastien Roucariès at 2026-08-06T21:44:03+02:00
Add python-asyncssh
- - - - -
c433e104 by Salvatore Bonaccorso at 2026-08-06T21:56:51+02:00
Add CVE-2026-61477/libvirt
- - - - -
ad845536 by Bastien Roucariès at 2026-08-06T22:01:08+02:00
node-tar/LTS
- - - - -
1e850af3 by Salvatore Bonaccorso at 2026-08-06T22:03:07+02:00
Process some NFUs
- - - - -
bf21c3ce by Bastien Roucariès at 2026-08-06T22:07:16+02:00
node-ua-parser-js/LTS
- - - - -
eb0f2c8b by Bastien Roucariès at 2026-08-06T22:09:09+02:00
CVE-2026-69185/LTS
- - - - -
72640d07 by Salvatore Bonaccorso at 2026-08-06T22:26:17+02:00
Add CVE-2026-43622/llama.cpp
- - - - -
ce7104ed by Salvatore Bonaccorso at 2026-08-06T22:29:43+02:00
Process some NFUs
- - - - -
fa94027e by Salvatore Bonaccorso at 2026-08-06T22:31:38+02:00
Add CVE-2026-18839/popt
- - - - -
53399357 by Salvatore Bonaccorso at 2026-08-06T22:49:56+02:00
Update status for libsynctex2
emacs-pdf-tools contained the patch to use the system provided library
form tine initial upload 0.70-1 already. Drop it.
- - - - -
9d2bf7d9 by Salvatore Bonaccorso at 2026-08-06T22:53:32+02:00
Drop entry completely as we track already bit before:
texlive-bin
- texstudio 2.8.0+debian-1 (embed; bug #753806)
NOTE: embeds synctex parser
- texmaker 4.2-2 (embed; bug #753812)
NOTE: embeds synctex parser
- texworks 0.5~svn1363-5 (embed; bug #753818)
NOTE: embeds synctex parser
- gummi <unfixed> (embed; bug #753827)
NOTE: embeds synctex parser
- evince <unfixed> (embed; bug #754136)
NOTE: embeds synctex parser
- okular <unfixed> (embed; bug #754137)
NOTE: embeds synctex parser
- qpdfview <unfixed> (embed; bug #754138)
NOTE: embeds synctex parser
- - - - -
1a5e7b32 by Salvatore Bonaccorso at 2026-08-06T22:56:30+02:00
Demote now CVE-2026-66011 to unimportant
- - - - -
05c1543a by Chris Lamb at 2026-08-06T14:36:14-07:00
Reserve DLA-4722-1 for redis
- - - - -
e9427f95 by Salvatore Bonaccorso at 2026-08-06T23:40:29+02:00
Add new set of apr-util issues
- - - - -
1e700f1c by Emilio Pozuelo Monfort at 2026-08-06T21:41:08+00:00
Merge branch 'helmutg/vulnerable-enum' into 'master'
security_db.py: track source_package_status.vulnerable as an enum
See merge request security-tracker-team/security-tracker!318
- - - - -
98c1ccf5 by Emmanuel Arias at 2026-08-06T18:49:18-03:00
CVE-2026-13321: Fix commits links
- - - - -
0b649152 by Emmanuel Arias at 2026-08-06T22:09:53-03:00
CVE-2026-13204: Fix commits links
- - - - -
01c7ee94 by Emmanuel Arias at 2026-08-06T22:15:14-03:00
CVE-2026-12617: fix commit link and add new one
- - - - -
4b721b61 by Emmanuel Arias at 2026-08-06T22:19:05-03:00
CVE-2026-11721: fix commits links
- - - - -
363088e9 by Emmanuel Arias at 2026-08-06T22:20:54-03:00
CVE-2026-11622: fix commits links
- - - - -
0d796885 by Emmanuel Arias at 2026-08-06T22:26:42-03:00
CVE-2026-11331: add commits link
- - - - -
a0136d39 by Emmanuel Arias at 2026-08-06T22:30:59-03:00
CVE-2026-10822: not-affected in bullseye, add commits links for bookworm
- - - - -
db8187a5 by Aron Xu at 2026-08-07T09:49:11+08:00
DSA for jq
- - - - -
385fe377 by Emmanuel Arias at 2026-08-06T23:18:56-03:00
CVE-2026-10723: add commits link
- - - - -
d009f471 by Emmanuel Arias at 2026-08-06T23:18:57-03:00
CVE-2026-5950: Add commit link
- - - - -
5741c1c7 by Emmanuel Arias at 2026-08-06T23:18:58-03:00
CVE-2026-5946: add commits link
- - - - -
91d98830 by Emmanuel Arias at 2026-08-06T23:21:10-03:00
CVE-2026-3592: Add commits links
- - - - -
86ffb990 by Emmanuel Arias at 2026-08-06T23:22:49-03:00
CVE-2026-3039: add commits links
- - - - -
d341dbb4 by Salvatore Bonaccorso at 2026-08-07T05:59:46+02:00
Track some fixes for rust-coreutils via unstable
At least one CVE is possibly not yet fixed, left untouched and asked
back to the maintainer.
- - - - -
f6233b14 by Salvatore Bonaccorso at 2026-08-07T06:02:29+02:00
Track fixed version for CVE-2026-1836 via unstable
- - - - -
3e49c316 by Salvatore Bonaccorso at 2026-08-07T06:06:40+02:00
Update status for CVE-2026-18401
- - - - -
8bcac43b by Salvatore Bonaccorso at 2026-08-07T06:28:29+02:00
Add Debian bug reference for two tar issues
- - - - -
79d7023c by Salvatore Bonaccorso at 2026-08-07T06:41:18+02:00
Add Debian bug reference for apr-util issues
- - - - -
a859d4db by Salvatore Bonaccorso at 2026-08-07T06:49:19+02:00
Merge Linux CVEs from kernel-sec
- - - - -
5b4be9f8 by Salvatore Bonaccorso at 2026-08-07T06:51:23+02:00
Track fixes via unstable for PowerDNS issue (CVE-2026-52682)
- - - - -
468b948b by Salvatore Bonaccorso at 2026-08-07T06:59:06+02:00
Add new chromium issues
- - - - -
da6ede3f by Salvatore Bonaccorso at 2026-08-07T06:59:47+02:00
Add chromium to dsa-needed list
- - - - -
832e5521 by Helmut Grohne at 2026-08-07T08:39:32+02:00
lib: change internUrgency not to return None
A number of callers of internUrgency are not prepared to handle its None
return value. Rather than fix all the callers, make it raise an
exception and adapt the one place that wants to handle it.
- - - - -
299395b2 by Helmut Grohne at 2026-08-07T08:39:32+02:00
lib: change internRelease not to return None
A number of callers of internRelease are not prepared to handle its None
return value. Rather than fix all the callers, make it raise an
exception.
- - - - -
5fc88e8e by Helmut Grohne at 2026-08-07T08:39:32+02:00
web tracker: delete method pre_dispatch
None of the implementations is non-trivial, but the more striking issue
is that their argument count varies. Rather than figure out, what is
right, dispose this unused mechanism.
- - - - -
c33e857c by Helmut Grohne at 2026-08-07T08:39:32+02:00
delete test of isKernOnly
Fixes: efd6f70f4aca ("Remove unused methods")
- - - - -
611a6f09 by Helmut Grohne at 2026-08-07T08:40:13+02:00
security_db.py: use sets
Some of this code predates the introduction of the set type to Python
and uses dicts with True values instead. We can now convert this to
proper sets. More importantly, this helps avoid variable type changes.
The list conversion can be deferred.
- - - - -
0b09d8e2 by Helmut Grohne at 2026-08-07T08:40:15+02:00
security_db.py: rewrite mergeLists using sets
Aside from being faster, this avoids changing the type of the result
variable.
- - - - -
e9c773c7 by Helmut Grohne at 2026-08-07T08:40:15+02:00
python: avoid more variable type changes
If we ever want to head into type checking, the type of value stored in
a variable should not change. Thus rename affected assignments or elide
them entirely.
- - - - -
6e5b6e82 by Helmut Grohne at 2026-08-07T08:40:15+02:00
tracker_service.py: narrow implied type of filters attribute
The lookup in params may return None in principle. This influences type
deduction and filters is assumed to be able to hold None, but the next
line changes that. In combining them, the deduced type of filters
becomes narrower.
- - - - -
77f14a6d by Helmut Grohne at 2026-08-07T08:40:15+02:00
tracker_service.py: don't pass None via body_attribs
While a None value might be acceptable there, it is discarded anyway.
Rather than supporting that use case, simply avoid passing it.
- - - - -
53e84bf6 by Helmut Grohne at 2026-08-07T08:40:15+02:00
tracker_service.py: explicitly cast hide_check to bool
When we pass it to getTODOs a real bool is expected, so convert the
thing that might be a list early.
- - - - -
12 changed files:
- bin/tracker_service.py
- data/CVE/list
- data/DLA/list
- data/DSA/list
- data/dla-needed.txt
- data/dsa-needed.txt
- data/embedded-code-copies
- data/packages/nfu.yaml
- lib/python/bugs.py
- lib/python/debian_support.py
- lib/python/security_db.py
- lib/python/web_support.py
Changes:
=====================================
bin/tracker_service.py
=====================================
@@ -45,9 +45,9 @@ class BugFilter:
self.params = {}
for (prop, desc, field) in self.action_list:
self.params[prop] = int(params.get(prop, (0,))[0])
- self.filters=params.get('filter')
- if not self.filters:
- self.filters=['high_urgency', 'medium_urgency', 'low_urgency', 'unassigned_urgency']
+ self.filters = (
+ params.get('filter') or ['high_urgency', 'medium_urgency', 'low_urgency', 'unassigned_urgency']
+ )
def actions(self, url):
"""Returns a HTML snippet which can be used to change the filter."""
@@ -73,7 +73,7 @@ class BugFilter:
urg in ('medium', 'medium**')
filterhigh = not self.params['high_urgency'] and \
urg in ('high', 'high**')
- filterund = not self.params['undetermined_issues'] and vuln == 2
+ filterund = not self.params['undetermined_issues'] and vuln == security_db.Vulnerable.UNDETERMINED
filteruni = not self.params['unimportant_urgency'] \
and urg == 'unimportant'
filteruna = not self.params['unassigned_urgency'] \
@@ -424,10 +424,10 @@ data source.""")],
package = compose(
self.make_source_package_ref(url, package),
" (", self.make_pts_ref(url, package, 'PTS'), ")")
- if vulnerable == 1:
+ if vulnerable == security_db.Vulnerable.AFFECTED:
vuln = self.make_red('vulnerable')
version = self.make_red(version)
- elif vulnerable == 2:
+ elif vulnerable == security_db.Vulnerable.UNDETERMINED:
vuln = self.make_purple('undetermined')
version = self.make_purple(version)
else:
@@ -598,7 +598,7 @@ to improve our documentation and procedures, so feedback is welcome.""")])])
def format_summary_entry(per_release):
if per_release is None:
return self.make_purple('unknown')
- if per_release.vulnerable == 1:
+ if per_release.vulnerable == security_db.Vulnerable.AFFECTED:
if per_release.state == 'no-dsa':
if per_release.reason:
text = 'vulnerable (no DSA, %s)' % per_release.reason
@@ -609,9 +609,9 @@ to improve our documentation and procedures, so feedback is welcome.""")])])
text=hint)
else:
return self.make_red('vulnerable')
- if per_release.vulnerable == 2:
+ if per_release.vulnerable == security_db.Vulnerable.UNDETERMINED:
return self.make_purple('undetermined')
- assert per_release.vulnerable == 0
+ assert per_release.vulnerable == security_db.Vulnerable.FIXED
return self.make_green('fixed')
def gen_summary(bugs):
@@ -704,7 +704,7 @@ to improve our documentation and procedures, so feedback is welcome.""")])])
if urgency.startswith('high'):
urgency = self.make_red(urgency)
- elif vulnerable == 2:
+ elif vulnerable == security_db.Vulnerable.UNDETERMINED:
urgency = self.make_purple(urgency)
else:
if no_dsa:
@@ -765,7 +765,7 @@ to improve our documentation and procedures, so feedback is welcome.""")])])
if urgency.startswith('high'):
urgency = self.make_red(urgency)
- elif vulnerable == 2:
+ elif vulnerable == security_db.Vulnerable.UNDETERMINED:
urgency = self.make_purple(urgency)
yield (self.make_source_package_ref(url, pkg_name, title), self.make_xref(url, bug_name),
@@ -792,9 +792,10 @@ to improve our documentation and procedures, so feedback is welcome.""")])])
(SELECT range_remote FROM nvd_data
WHERE cve_name = st.bug_name)
FROM source_package_status AS st, source_packages AS sp
- WHERE st.vulnerable AND sp.rowid = st.package
+ WHERE st.vulnerable != ? AND sp.rowid = st.package
AND sp.release = ? AND sp.subrelease = ''
- ORDER BY sp.name, st.bug_name COLLATE version""", (rel,)):
+ ORDER BY sp.name, st.bug_name COLLATE version""",
+ (security_db.Vulnerable.FIXED, rel,)):
if bf.urgencyFiltered(urgency, vulnerable):
continue
if bf.remoteFiltered(remote):
@@ -818,7 +819,7 @@ to improve our documentation and procedures, so feedback is welcome.""")])])
if urgency.startswith('high'):
urgency = self.make_red(urgency)
- elif vulnerable == 2:
+ elif vulnerable == security_db.Vulnerable.UNDETERMINED:
urgency = self.make_purple(urgency)
yield self.make_source_package_ref(url, pkg_name, title), self.make_xref(url, bug_name), urgency, remote
@@ -900,7 +901,7 @@ to improve our documentation and procedures, so feedback is welcome.""")])])
if urgency.startswith('high'):
urgency = self.make_red(urgency)
- elif vulnerable == 2:
+ elif vulnerable == security_db.Vulnerable.UNDETERMINED:
urgency = self.make_purple(urgency)
if stable_later:
@@ -925,7 +926,7 @@ checker to find out why they have not entered testing yet."""),
"Remote", ""))])
def page_status_todo(self, path, params, url):
- hide_check = params.get('hide_check', False)
+ hide_check = bool(params.get('hide_check', False))
if hide_check:
flags = A(url.updateParamsDict({'hide_check' : None}),
'Show "check" TODOs')
@@ -952,10 +953,11 @@ checker to find out why they have not entered testing yet."""),
"""SELECT DISTINCT sp.name, st.bug_name, sp.release,
bugs.description
FROM source_package_status AS st, source_packages AS sp, bugs
- WHERE st.vulnerable == 2 AND sp.rowid = st.package
+ WHERE st.vulnerable == ? AND sp.rowid = st.package
AND sp.release IN (""" + ",".join("?" * len(releases)) + """)
AND sp.subrelease = '' AND st.bug_name == bugs.name
- ORDER BY sp.name, st.bug_name COLLATE version""", releases):
+ ORDER BY sp.name, st.bug_name COLLATE version""",
+ (security_db.Vulnerable.UNDETERMINED, *releases)):
if old_bug == '':
old_bug = bug_name
@@ -996,11 +998,12 @@ checker to find out why they have not entered testing yet."""),
"""SELECT DISTINCT sp.name, st.bug_name, sp.release,
bugs.description
FROM source_package_status AS st, source_packages AS sp, bugs
- WHERE st.vulnerable > 0 AND sp.rowid = st.package
+ WHERE st.vulnerable != ? AND sp.rowid = st.package
AND sp.release IN (""" + ",".join("?" * len(releases)) + """)
AND st.urgency == 'unimportant'
AND sp.subrelease = '' AND st.bug_name == bugs.name
- ORDER BY sp.name, st.bug_name COLLATE version""", releases):
+ ORDER BY sp.name, st.bug_name COLLATE version""",
+ (security_db.Vulnerable.FIXED, *releases)):
if old_bug == '':
old_bug = bug_name
@@ -1177,13 +1180,9 @@ not unimportant."""),
def gen():
for (rel, subrel, archive, sources, archs) \
in self.db.availableReleases():
- if sources:
- sources = 'yes'
- else:
- sources = 'no'
if 'source' in archs:
archs.remove('source')
- yield rel, subrel, archive, sources, make_list(archs)
+ yield rel, subrel, archive, "yes" if sources else "no" , make_list(archs)
return self.create_page(
url, "Available releases",
[P("""The security issue database is checked against
@@ -1237,8 +1236,8 @@ issue (or a bug has been created and is not recorded in this database).
In the second kind of names, there is a Debian bug for the issue, and the "''',
CODE("000000"), '''"part of the name is replaced with the
Debian bug number.'''),
- make_table(gen(1),title=H2('With unfixed issues'), caption=("Bug", "Description")),
- make_table(gen(0),title=H2('The rest'), caption=("Bug", "Description")),
+ make_table(gen(security_db.Vulnerable.AFFECTED),title=H2('With unfixed issues'), caption=("Bug", "Description")),
+ make_table(gen(security_db.Vulnerable.FIXED),title=H2('The rest'), caption=("Bug", "Description")),
])
def page_data_pts(self, path, params, url):
@@ -1248,10 +1247,10 @@ Debian bug number.'''),
(SELECT package, bug, urgency FROM stable_status
UNION ALL SELECT DISTINCT sp.name, st.bug_name, st.urgency
FROM source_package_status AS st, source_packages AS sp
- WHERE st.vulnerable AND st.urgency <> 'unimportant'
+ WHERE st.vulnerable != ? AND st.urgency <> 'unimportant'
AND sp.rowid = st.package AND sp.release = 'sid'
AND sp.subrelease = '') x WHERE urgency <> 'unimportant'
- GROUP BY package ORDER BY package"""):
+ GROUP BY package ORDER BY package""", (security_db.Vulnerable.FIXED,)):
data.append(pkg)
data.append(':')
data.append(str(bugs))
@@ -1289,17 +1288,16 @@ Debian bug number.'''),
"Source"),
" ", A(url.absolute("https://salsa.debian.org/security-tracker-team/security-tracker"), "(Git)"),
)))
+ body_attribs = {}
if search_in_page:
- on_load = "selectSearch()"
- else:
- on_load = None
+ body_attribs["onload"] = "selectSearch()"
head_contents = compose(
LINK(' ', href=url.scriptRelative("style.css")),
SCRIPT(' ', src=url.scriptRelative("script.js")),
).toHTML()
return HTMLResult(self.add_title(title, body,
head_contents=head_contents,
- body_attribs={'onload': on_load}),
+ body_attribs=body_attribs),
doctype=self.html_dtd(),
status=status)
@@ -1527,8 +1525,5 @@ Debian bug number.'''),
def make_dangerous(self, contents):
return SPAN(contents, _class="dangerous")
- def pre_dispatch(self):
- pass
-
if __name__ == "__main__":
TrackerService(socket_name, db_name).run()
=====================================
data/CVE/list
=====================================
@@ -1,115 +1,663 @@
-CVE-2026-64604 [KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode]
+CVE-2026-19137
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19149
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19154
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19157
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19170
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19172
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19169
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19168
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19138
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19139
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19140
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19141
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19142
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19143
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19144
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19145
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19146
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19147
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19148
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19150
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19151
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19152
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19153
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19155
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19156
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19158
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19159
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19160
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19161
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19162
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19163
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19164
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19165
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19166
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19167
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19171
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19173
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19174
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19175
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19176
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-19177
+ - chromium <unfixed>
+ [bullseye] - chromium <end-of-life> (see #1061268)
+CVE-2026-61477
+ - libvirt <unfixed>
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2512068
+ TODO: wait and update entry once RH has updated records, reference upstream issue
+CVE-2026-8166 (Improper neutralization of input during web page generation ('cross-si ...)
+ NOT-FOR-US: e-Logo Purchasing Portal
+CVE-2026-70646 (aiosend is a synchronous and asynchronous Crypto Pay API client. Pror ...)
+ NOT-FOR-US: aiosend
+CVE-2026-70637 (LightFTP through 2.4 contains multiple data race vulnerabilities in ft ...)
+ NOT-FOR-US: LightFTP
+CVE-2026-70556 (Hubzilla 11.2.1 contains a cross-site request forgery vulnerability in ...)
+ NOT-FOR-US: Hubzilla
+CVE-2026-68750 (Inefficient Algorithmic Complexity vulnerability in the traversal engi ...)
+ NOT-FOR-US: rrrene html_sanitize_ex
+CVE-2026-68749 (Inefficient Regular Expression Complexity vulnerability in the CSS scr ...)
+ NOT-FOR-US: rrrene html_sanitize_ex
+CVE-2026-68747 (Improper Neutralization of Special Elements in Output Used by a Downst ...)
+ NOT-FOR-US: rrrene html_sanitize_ex
+CVE-2026-68481 (In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tok ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-68079 (In Apache CXF's DefaultEncryptingCodeDataProvider,a captured authoriza ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-67261 (Dell Virtual Storage Integrator for VMware vSphere Client, versions pr ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-66909 (Apache CXF's JMS transport deserializes the body of any inbound JMS Ob ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-66843 (Inclusion of Functionality from Untrusted Control Sphere vulnerability ...)
+ NOT-FOR-US: rrrene html_sanitize_ex
+CVE-2026-66829 (URL Redirection to Untrusted Site ('Open Redirect') vulnerability in t ...)
+ NOT-FOR-US: rrrene html_sanitize_ex
+CVE-2026-66733 (Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allo ...)
+ NOT-FOR-US: Sonic 3 A.I.R.
+CVE-2026-66732 (Sonic 3 A.I.R. before commit 2492d18 contains a missing source address ...)
+ NOT-FOR-US: Sonic 3 A.I.R.
+CVE-2026-66712 (Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 ve ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66711 (Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Mu ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66710 (Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66709 (Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 version ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66708 (Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versio ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66707 (Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66706 (Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 ve ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66705 (Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress < ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66703 (Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versio ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66702 (Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274 ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66701 (Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 ver ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66699 (Custom role Broken Access Control in Dokan <= 5.0.10 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66696 (Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blo ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66695 (Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66694 (Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9 ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66692 (Customer Insecure Direct Object References (IDOR) in Colissimo Officie ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66690 (Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 version ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66688 (Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elemento ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66686 (Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage C ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66685 (Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3. ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66684 (Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9. ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66683 (Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript < ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66681 (Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66678 (Contributor Broken Access Control in Advanced Custom Fields: Font Awes ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66665 (Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66664 (Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly S ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66663 (Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66662 (Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps < ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66470 (Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3. ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66457 (Unauthenticated Cross Site Scripting (XSS) in Events Manager <= 7.4.1 ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66452 (Unauthenticated Broken Access Control in Legal Text Connector of the I ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66451 (Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 ve ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66447 (Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versio ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66440 (Unauthenticated Cross Site Scripting (XSS) in WPIDE \u2013 File Manage ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66439 (Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Fi ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66425 (Unauthenticated Broken Authentication in Gutena Forms \u2013 Contact F ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-66370 (URL Redirection to Untrusted Site ('Open Redirect') vulnerability in t ...)
+ NOT-FOR-US: rrrene html_sanitize_ex
+CVE-2026-65583 (Apache CXF\u2019s OIDC relying-party token validation could accept sel ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-65581 (Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65579 (Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65578 (Unauthenticated PHP Object Injection in Agora <= 1.9 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65577 (Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65576 (Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65575 (Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65574 (Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65573 (Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65572 (Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65571 (Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versio ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65570 (Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8 ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65569 (Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65565 (Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65560 (Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65559 (Shop manager Privilege Escalation in Order Delivery Date for WooCommer ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65556 (Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Sp ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65554 (Subscriber Broken Access Control in AnsPress \u2013 Question and answe ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65553 (Unauthenticated Remote Code Execution (RCE) in Spider Analyser – ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65552 (Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65551 (Missing Authorization vulnerability in Soflyy Breakdance allows Exploi ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65549 (Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 version ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65548 (Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65547 (Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65546 (Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65545 (Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versi ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65544 (Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14 ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65543 (Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65542 (Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 ve ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65541 (Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versi ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65523 (Unauthenticated Insecure Direct Object References (IDOR) in Formidable ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65520 (Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65517 (Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Butt ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65515 (Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 ve ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65513 (Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointm ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65509 (Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 ve ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65508 (Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.1 ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65507 (Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65504 (Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3 ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65502 (Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-65432 (Apache CXF reads a top-level WSDL through its hardened StaxUtilspath, ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-64993 (Dell RVTools versions prior to 4.8.1, contains an improper certificate ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-64958 (An incomplete fix forCVE-2026-50645 means that it is still possible to ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-64640 (Apache Polaris did not consistently validate storage locations supplie ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-63687 (Apache CXF's JwtRequestCodeFilter copies all claims from a signed requ ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-61982 (Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1 ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-61964 (Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 ve ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-61963 (Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-61961 (Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 vers ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-61959 (Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-61466 (In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the autho ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-5430 (The JWT authentication mechanism accepts tokens signed with algorithms ...)
+ NOT-FOR-US: WSO2
+CVE-2026-5423 (@neo4j/graphqllibrary versions prior to 7.5.6 fail to verify the authe ...)
+ NOT-FOR-US: neo4j/graphql
+CVE-2026-5391 (The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2026-5158 (The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u20 ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2026-5134 (Improper neutralization of special elements used in an SQL command ('S ...)
+ NOT-FOR-US: Loca Software Informatics Technology Ltd. Co. CMS
+CVE-2026-57819 (Apache CXF allows to set a limit on the number of form parameters in a ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-57818 (A race condition in JCacheCodeDataProvider allows an attacker to redee ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-57817 (The OpenID Connect Core 1.0 specification mandates that the RP MUST va ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-55980 (A denial-of-service vulnerability inCatchPulsecould allow an attacker ...)
+ NOT-FOR-US: CatchPulse
+CVE-2026-55979 (An improper access control check inCatchPulse'snamed pipe communicatio ...)
+ NOT-FOR-US: CatchPulse
+CVE-2026-55978 (An improper access control vulnerability inCatchPulsecould allow a non ...)
+ NOT-FOR-US: CatchPulse
+CVE-2026-54489 (Dell Virtual Storage Integrator for VMware vSphere Client, versions pr ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-54225 (Apache CXF allows to control the maximum attachment size via the"attac ...)
+ NOT-FOR-US: Apache software not packaged in Debian
+CVE-2026-53985 (Ground Station prior to 0.6.0contains an unauthenticated denial-of-ser ...)
+ NOT-FOR-US: Ground Station
+CVE-2026-53977 (OpenChamber 1.11.7 contains an authentication bypass vulnerability tha ...)
+ NOT-FOR-US: OpenChamber
+CVE-2026-53976 (OpenChamber 1.11.7 contains a path traversal vulnerability in the file ...)
+ NOT-FOR-US: OpenChamber
+CVE-2026-53975 (OpenChamber 1.11.7 contains an unauthenticated remote code execution v ...)
+ NOT-FOR-US: OpenChamber
+CVE-2026-43622 (llama.cpp builds b1886 through b7445 contain a double free vulnerabili ...)
+ - llama.cpp 7593+dfsg-1
+CVE-2026-3430 (The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not saniti ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2026-34502 (Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Ut ...)
+ - apr-util <unfixed> (bug #1143837)
+ NOTE: https://lists.apache.org/thread/spk5643m4vq0mb8h5b9hz9gkp57ombl8
+CVE-2026-34501 (Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Ut ...)
+ - apr-util <unfixed> (bug #1143837)
+ NOTE: https://lists.apache.org/thread/o8h6c7cq86fplxlnry6c3rn9x0ovq8mv
+CVE-2026-34191 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ - apr-util <unfixed> (bug #1143837)
+ NOTE: https://lists.apache.org/thread/8xch90zogywwpo5wnsf4o088mkxy4qtf
+CVE-2026-32548 (Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-32469 (Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-32327 (A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion ...)
+ - apr-util <unfixed> (bug #1143837)
+ NOTE: https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1
+CVE-2026-28183 (Editor Privilege Escalation in PublishPress Capabilities <= 2.45.0 ver ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28180 (Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pa ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28179 (Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versio ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28178 (Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28177 (Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 ve ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28172 (Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Man ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28169 (Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magni ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28146 (Contributor Arbitrary File Download in Unlimited Elements For Elemento ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28143 (Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 ver ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28141 (Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28140 (Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 ver ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28139 (Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 ver ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28111 (Contributor Privilege Escalation in Forminator <= 1.56.0 versions.)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28082 (Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 ve ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-28005 (Unauthenticated Privilege Escalation in Kadence WooCommerce Email Desi ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-25403 (Unauthenticated Broken Access Control in Ultimate Store Kit Elementor ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-1728 (Tokens issued to a low-privileged user are not sufficiently restricted ...)
+ NOT-FOR-US: WSO2
+CVE-2026-19047 (A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. T ...)
+ NOT-FOR-US: NocteDefensor LudusMCP
+CVE-2026-19046 (A security vulnerability has been detected in NocteDefensor LudusMCP u ...)
+ NOT-FOR-US: NocteDefensor LudusMCP
+CVE-2026-19045 (A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. ...)
+ NOT-FOR-US: NocteDefensor LudusMCP
+CVE-2026-19044 (A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this ...)
+ NOT-FOR-US: LeeSinLiang godot-mcp
+CVE-2026-19041 (A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. T ...)
+ NOT-FOR-US: MissionSquad mcp-api
+CVE-2026-19040 (A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affect ...)
+ NOT-FOR-US: MissionSquad mcp-api
+CVE-2026-19039 (A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8 ...)
+ NOT-FOR-US: Kino-Kafkaesque ssh-mcp-server
+CVE-2026-19038 (A security vulnerability has been detected in MonomythDevelopment la-f ...)
+ NOT-FOR-US: MonomythDevelopmentla-forge-mcp
+CVE-2026-19037 (A weakness has been identified in WonderTrader up to 0.9.9. This vulne ...)
+ NOT-FOR-US: WonderTrader
+CVE-2026-19036 (A security flaw has been discovered in Shibby Tomato 1.28.0000. This a ...)
+ NOT-FOR-US: Shibby Tomato
+CVE-2026-19035 (A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by ...)
+ NOT-FOR-US: Shibby Tomato
+CVE-2026-19034 (A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by ...)
+ NOT-FOR-US: Shibby Tomato
+CVE-2026-19022 (A vulnerability was determined in OpenHands up to 0.62.0. The affected ...)
+ NOT-FOR-US: OpenHands
+CVE-2026-19021 (A security vulnerability has been detected in SourceCodester Computer ...)
+ NOT-FOR-US: SourceCodester
+CVE-2026-19020 (A weakness has been identified in itsourcecode Hospital Management Sys ...)
+ NOT-FOR-US: itsourcecode System
+CVE-2026-19019 (A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. ...)
+ NOT-FOR-US: poco-ai poco-agent
+CVE-2026-19011 (A vulnerability was detected in TinyAGI 0.0.20. The affected element i ...)
+ NOT-FOR-US: TinyAGI
+CVE-2026-19010 (A security vulnerability has been detected in TinyAGI 0.0.20. Impacted ...)
+ NOT-FOR-US: TinyAGI
+CVE-2026-19009 (A weakness has been identified in TinyAGI 0.0.20. This issue affects t ...)
+ NOT-FOR-US: TinyAGI
+CVE-2026-19008 (A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. Thi ...)
+ NOT-FOR-US: mf-yang openclaw-cn
+CVE-2026-18915 (Invocation of process using visible sensitive information vulnerabilit ...)
+ NOT-FOR-US: eta-otp-lock
+CVE-2026-18649 (A flaw was found in the GStreamer gst-plugins-good package. The rtph26 ...)
+ TODO: check
+CVE-2026-18597 (The PDF creation feature of Foxit PDF Services API supports referencin ...)
+ NOT-FOR-US: Foxit
+CVE-2026-18501 (The UsersWP \u2013 Front-end login form, User Registration, User Profi ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2026-18427 (@fastify/static before version 10.1.3 contains an incomplete fix for a ...)
+ NOT-FOR-US: fastify/static
+CVE-2026-18359 (Server-side request forgery in the METS and IIIF import URI handling i ...)
+ NOT-FOR-US: Scripta eScriptorium
+CVE-2026-18277 (Missing authorization in the OcrModelRight create and delete views in ...)
+ NOT-FOR-US: Scripta eScriptorium
+CVE-2026-18276 (Missing authorization in the websocket consumer in Scripta eScriptoriu ...)
+ NOT-FOR-US: Scripta eScriptorium
+CVE-2026-18275 (Authorization bypass in the process and annotation taxonomy serializer ...)
+ NOT-FOR-US: Scripta eScriptorium
+CVE-2026-18258 (Authorization bypass in the Line, LineTranscription, VirtualCollection ...)
+ NOT-FOR-US: Scripta eScriptorium
+CVE-2026-16731 (OMICRON StationScout before version 3.05 contains a cryptographic timi ...)
+ NOT-FOR-US: OMICRON
+CVE-2026-16316 (OMICRON StationGuard 4.00 contains an improper input validation vulner ...)
+ NOT-FOR-US: OMICRON
+CVE-2026-16315 (OMICRON StationGuard before version 4.10 contains a cryptographic timi ...)
+ NOT-FOR-US: OMICRON
+CVE-2026-15599 (Unverified ownership vulnerability in T\xdcB\u0130TAK B\u0130LGEM Soft ...)
+ NOT-FOR-US: pardus-domain-joiner
+CVE-2026-15246 (The RealHomes Memberships WordPress plugin before 3.1.0 does not verif ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2026-12605 (In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in Downl ...)
+ NOT-FOR-US: Eclipse
+CVE-2026-11983 (The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for WordPress i ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2026-0673 (The Element Pack Addons for Elementor plugin for WordPress is vulnerab ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2026-0637 (When an Event Publisher output adapter is configured with irrelevant p ...)
+ NOT-FOR-US: WSO2
+CVE-2025-9266 (The Accelerate theme for WordPress is vulnerable to unauthorized modif ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2025-49506 (APR-util versions 1.6.3 (and earlier) function apr_password_validate() ...)
+ - apr-util <unfixed> (bug #1143837)
+ NOTE: https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5
+CVE-2025-15039 (The Conditional Authentication (Adaptive Authentication) script does n ...)
+ NOT-FOR-US: WSO2
+CVE-2025-15028 (The FormGent \u2013 Next-Gen AI Form Builder for WordPress with Multi- ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2025-14779 (The Secret Type Management REST API does not correctly isolate access ...)
+ NOT-FOR-US: WSO2
+CVE-2025-13909 (The system accepts authentication requests without sufficient validati ...)
+ NOT-FOR-US: WSO2
+CVE-2025-13736 (When Multi-Attribute Login is enabled, the login interface fails to co ...)
+ NOT-FOR-US: WSO2
+CVE-2025-13394 (The Ajax processor within the Carbon console fails to adequately prote ...)
+ NOT-FOR-US: WSO2
+CVE-2025-12627 (The user impersonation flow in WSO2 Identity Server fails to properly ...)
+ NOT-FOR-US: WSO2
+CVE-2025-11850 (When secondary user stores are configured, the implicit-association re ...)
+ NOT-FOR-US: WSO2
+CVE-2024-8995 (Unused authorization codes issued to deleted users are not being prope ...)
+ NOT-FOR-US: WSO2
+CVE-2024-6832 (The account locking mechanism fails to trigger when secondary user sto ...)
+ NOT-FOR-US: WSO2
+CVE-2024-10302 (The user self-signup flow in multiple WSO2 products fails to adequatel ...)
+ NOT-FOR-US: WSO2
+CVE-2023-7355
+ REJECTED
+CVE-2023-7354
+ REJECTED
+CVE-2023-7353
+ REJECTED
+CVE-2026-68480 [x86/bugs: Make Safe-RET robust against interrupt injection]
+ - linux 7.1.7-1
+ NOTE: https://people.csail.mit.edu/mengjia/data/2026.USENIX.TONTOU.pdf
+CVE-2026-52682 [A crafted DNS packet can cause increased memory and CPU consumption]
+ - pdns 5.1.4-1
+ [bookworm] - pdns <end-of-life> (See #1119290)
+ [bullseye] - pdns <end-of-life> (see DLA 4471)
+ - pdns-recursor 5.4.5-1
+ [bookworm] - pdns-recursor <end-of-life> (see DSA 6045)
+ [bullseye] - pdns-recursor <end-of-life> (see DSA 6045)
+ - dnsdist 2.1.1-1
+ [bookworm] - dnsdist <end-of-life> (See #1119290)
+ [bullseye] - dnsdist <end-of-life> (see #1119290)
+ NOTE: https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-11.html
+CVE-2026-64604 (In the Linux kernel, the following vulnerability has been resolved: K ...)
- linux 7.1.4-1
[trixie] - linux 6.12.96-1
[bookworm] - linux 6.1.180-1
[bullseye] - linux 5.10.262-1
NOTE: https://git.kernel.org/linus/7ef78d71ca713d8c00f7c34ddcf276c808143f77 (7.2-rc1)
-CVE-2026-64603 [platform/x86: intel-hid: Protect ACPI notify handler against recursion]
+CVE-2026-64603 (In the Linux kernel, the following vulnerability has been resolved: p ...)
- linux 7.1.4-1
[trixie] - linux 6.12.96-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/c085d82613d5618814b84406c8b2d64f1bc305e7 (7.2-rc1)
-CVE-2026-64602 [iio: adc: spear: Initialize completion before requesting IRQ]
+CVE-2026-64602 (In the Linux kernel, the following vulnerability has been resolved: i ...)
- linux 7.1.4-1
[trixie] - linux 6.12.96-1
[bookworm] - linux 6.1.180-1
[bullseye] - linux 5.10.262-1
NOTE: https://git.kernel.org/linus/3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0 (7.2-rc3)
-CVE-2026-64601 [ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission]
+CVE-2026-64601 (In the Linux kernel, the following vulnerability has been resolved: A ...)
- linux 7.1.4-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/5cff1529a2f9b3461a7f5a6e36a86682fc290534 (7.2-rc2)
-CVE-2026-64599 [crypto: amlogic - avoid double cleanup in meson_crypto_probe()]
+CVE-2026-64599 (In the Linux kernel, the following vulnerability has been resolved: c ...)
- linux 7.1.4-1
[trixie] - linux 6.12.96-1
[bookworm] - linux 6.1.180-1
[bullseye] - linux 5.10.262-1
NOTE: https://git.kernel.org/linus/6d827ade51a24e18d81afb9f32756d339520a14c (7.2-rc1)
-CVE-2026-64598 [smb/client: Fix error code in smb2_aead_req_alloc()]
+CVE-2026-64598 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.1.4-1
[trixie] - linux 6.12.96-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/61f28012e5650c619223decdb7970e0d3162e949 (7.2-rc1)
-CVE-2026-64597 [smb: client: fix double-free in SMB2_close() replay]
+CVE-2026-64597 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.1.4-1
[trixie] - linux 6.12.96-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/f96e1cdcb63ed3321142ff2fcdf784e32cda8fee (7.2-rc1)
-CVE-2026-64596 [libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()]
+CVE-2026-64596 (In the Linux kernel, the following vulnerability has been resolved: l ...)
- linux 7.1.4-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/6de2aeffabaafaeda819e60ec8d04f199711e11a (7.2-rc1)
-CVE-2026-64595 [HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()]
+CVE-2026-64595 (In the Linux kernel, the following vulnerability has been resolved: H ...)
- linux 7.1.4-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/73fde0cbff7d9d618591774a12c23434232752c1 (7.2-rc1)
-CVE-2026-64594 [usb: gadget: f_fs: initialize reset_work at allocation time]
+CVE-2026-64594 (In the Linux kernel, the following vulnerability has been resolved: u ...)
- linux 7.1.4-1
[trixie] - linux 6.12.100-1
[bookworm] - linux 6.1.180-1
[bullseye] - linux 5.10.262-1
NOTE: https://git.kernel.org/linus/3137b243c93982fe3460335e12f9247739766e10 (7.2-rc3)
-CVE-2026-64593 [btrfs: do not trim a device which is not writeable]
+CVE-2026-64593 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 7.1.4-1
[trixie] - linux 6.12.96-1
[bookworm] - linux 6.1.180-1
[bullseye] - linux 5.10.262-1
NOTE: https://git.kernel.org/linus/1b1937eb08f51319bf71575484cde2b8c517aedc (7.2-rc1)
-CVE-2026-64592 [riscv: mm: Unconditionally sfence.vma for spurious fault]
+CVE-2026-64592 (In the Linux kernel, the following vulnerability has been resolved: r ...)
- linux 7.1.4-1
[trixie] - linux 6.12.96-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/1b2c6b56a9fa0dcbef461039937de22b1cbecc7d (7.2-rc1)
-CVE-2026-64591 [iommu/vt-d: Avoid WARNING in sva unbind path]
+CVE-2026-64591 (In the Linux kernel, the following vulnerability has been resolved: i ...)
- linux 7.1.4-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/534b5f98ab7319d8004bbc7dab6481462243e883 (7.2-rc1)
-CVE-2026-64589 [i2c: core: fix NULL-deref on adapter registration failure]
+CVE-2026-64589 (In the Linux kernel, the following vulnerability has been resolved: i ...)
- linux 7.1.4-1
[trixie] - linux 6.12.96-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/2295d2bb101faa663fbc45fadbb3fec45f107441 (7.2-rc1)
-CVE-2026-64588 [fuse-uring: fix data races on ring->ready]
+CVE-2026-64588 (In the Linux kernel, the following vulnerability has been resolved: f ...)
- linux 7.1.4-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/46725a0056c884cf58a6897f222892807327d82d (7.2-rc1)
-CVE-2026-64590 [dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning]
+CVE-2026-64590 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.1.4-1
[trixie] - linux 6.12.96-1
NOTE: https://git.kernel.org/linus/504e2b4ab97a51d56d966cd36d0997ad30b65b2d (7.2-rc1)
-CVE-2026-64587 [net: ethernet: arc: emac: quiesce interrupts before requesting IRQ]
+CVE-2026-64587 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 6.19.10-1
[trixie] - linux 6.12.85-1
[bookworm] - linux 6.1.170-1
[bullseye] - linux 5.10.257-1
NOTE: https://git.kernel.org/linus/2503d08f8a2de618e5c3a8183b250ff4a2e2d52c (7.0-rc4)
-CVE-2026-64586 [wifi: brcmfmac: drain bus_reset work on device removal]
+CVE-2026-64586 (In the Linux kernel, the following vulnerability has been resolved: w ...)
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/43b25879f004c98defa2776bedc6ca4763c51945 (7.2-rc5)
-CVE-2026-64585 [can: esd_usb: kill anchored URBs before freeing netdevs]
+CVE-2026-64585 (In the Linux kernel, the following vulnerability has been resolved: c ...)
- linux 7.1.5-1
[trixie] - linux 6.12.100-1
[bookworm] - linux 6.1.180-1
NOTE: https://git.kernel.org/linus/c43122fef328a70045fe7621c06de6b2b8e19264 (7.2-rc4)
-CVE-2026-64584 [usb: gadget: f_midi: cancel pending IN work before freeing the midi object]
+CVE-2026-64584 (In the Linux kernel, the following vulnerability has been resolved: u ...)
+ {DSA-6415-1}
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/5650c18d93a1db7e27cb5a40b394747eb4686d5b (7.2-rc5)
-CVE-2026-64583 [usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown]
+CVE-2026-64583 (In the Linux kernel, the following vulnerability has been resolved: u ...)
+ {DSA-6415-1}
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb (7.2-rc5)
CVE-2026-71321 (Nuxt is an open-source web development framework for Vue.js. From 3.1. ...)
@@ -147,127 +695,150 @@ CVE-2026-71309 (rclone is a command-line program to sync files and directories t
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh
NOTE: Fixed by: https://github.com/rclone/rclone/commit/cc5a189f00efe68ed0ddb32d3237b42549a9f264 (v1.75.0)
CVE-2026-70618 (Spacebar Server before commit 51da17c contains a missing authorization ...)
- TODO: check
+ NOT-FOR-US: Spacebar Server
CVE-2026-70617 (Spacebar Server before commit dcfd910 contains a missing authorization ...)
- TODO: check
+ NOT-FOR-US: Spacebar Server
CVE-2026-70616 (boringproxy through 0.10.0 contains a resource exhaustion vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: boringproxy
CVE-2026-70615 (boringproxy through 0.10.0 contains a newline injection vulnerability ...)
- TODO: check
+ NOT-FOR-US: boringproxy
CVE-2026-69111 (Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of ...)
- TODO: check
+ NOT-FOR-US: Milvus
CVE-2026-68746 (Not Failing Securely ('Failing Open') vulnerability in livebook-dev li ...)
- TODO: check
+ NOT-FOR-US: livebook-dev livebook
CVE-2026-67873 (A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server- ...)
- TODO: check
+ NOT-FOR-US: mz-automation lib60870
CVE-2026-67872 (An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a d ...)
- TODO: check
+ NOT-FOR-US: Systerel S2OPC
CVE-2026-67871 (Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote ...)
- TODO: check
+ NOT-FOR-US: Systerel S2OPC
CVE-2026-67870 (In open62541 v1.5.5, the server-side AddReferences implementation cont ...)
- TODO: check
+ - open62541 <unfixed>
+ NOTE: https://github.com/open62541/open62541/issues/8172
CVE-2026-67869 (Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote atta ...)
- TODO: check
+ - open62541 <unfixed>
+ NOTE: https://github.com/open62541/open62541/issues/8171
CVE-2026-67867 (Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote ...)
- TODO: check
+ NOT-FOR-US: Systerel S2OPC
CVE-2026-67866 (Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote ...)
- TODO: check
+ NOT-FOR-US: Systerel S2OPC
CVE-2026-67865 (S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handli ...)
- TODO: check
+ NOT-FOR-US: Systerel S2OPC
CVE-2026-67864 (An issue in open62541 v.1.5.5 and before allows a remote attacker to c ...)
- TODO: check
+ - open62541 <unfixed>
+ NOTE: https://github.com/open62541/open62541/issues/8133
CVE-2026-67863 (In open62541 1.5.5, a server-side use-after-free exists in the local M ...)
- TODO: check
+ - open62541 <unfixed>
+ NOTE: https://github.com/open62541/open62541/issues/8131
CVE-2026-67531 (FrontMCP is a TypeScript-first framework for the Model Context Protoco ...)
- TODO: check
+ NOT-FOR-US: FrontMCP
CVE-2026-66885 (Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebo ...)
- TODO: check
+ NOT-FOR-US: livebook-dev livebook
CVE-2026-66881 (Relative Path Traversal vulnerability in livebook-dev livebook allows ...)
- TODO: check
+ NOT-FOR-US: livebook-dev livebook
CVE-2026-66298 (Origin Validation Error vulnerability in livebook-dev livebook allows ...)
- TODO: check
+ NOT-FOR-US: livebook-dev livebook
CVE-2026-66297 (Improper Neutralization of Special Elements used in an OS Command (OS ...)
- TODO: check
+ NOT-FOR-US: livebook-dev livebook
CVE-2026-55524 (PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-55523 (PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1 ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-55522 (PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4. ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-52466 (Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toIno ...)
- TODO: check
+ NOT-FOR-US: Open Library Foundation VuFind
CVE-2026-34966 (Gitea prior to 1.27.0 contains a server-side request forgery vulnerabi ...)
- TODO: check
+ - gitea <removed>
CVE-2026-21766 (The default login portlet in HCL Digital Experience and Digital Experi ...)
NOT-FOR-US: HCL
CVE-2026-19028 (H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 comput ...)
- TODO: check
+ - hdf5 <unfixed> (unimportant)
+ NOTE: https://github.com/HDFGroup/hdf5/pull/6497
+ NOTE: https://github.com/HDFGroup/hdf5/issues/6488
+ NOTE: https://github.com/HDFGroup/hdf5/issues/6490
+ NOTE: HDF not covered by security support, see https://bugs.debian.org/1117722
CVE-2026-19027 (The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, ...)
- TODO: check
+ - hdf5 <unfixed> (unimportant)
+ NOTE: https://github.com/HDFGroup/hdf5/pull/6497
+ NOTE: https://github.com/HDFGroup/hdf5/issues/6489
+ NOTE: https://github.com/HDFGroup/hdf5/issues/6492
+ NOTE: HDF not covered by security support, see https://bugs.debian.org/1117722
CVE-2026-19026 (H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_va ...)
- TODO: check
+ - hdf5 <unfixed> (unimportant)
+ NOTE: https://github.com/HDFGroup/hdf5/pull/6497
+ NOTE: https://github.com/HDFGroup/hdf5/issues/6489
+ NOTE: https://github.com/HDFGroup/hdf5/issues/6492
+ NOTE: HDF not covered by security support, see https://bugs.debian.org/1117722
CVE-2026-19025 (H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not valid ...)
- TODO: check
+ - hdf5 <unfixed> (unimportant)
+ NOTE: https://github.com/HDFGroup/hdf5/issues/6491
+ NOTE: HDF not covered by security support, see https://bugs.debian.org/1117722
CVE-2026-19024 (NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.1.1 all ...)
- TODO: check
+ - hdf5 <unfixed> (unimportant)
+ NOTE: https://github.com/HDFGroup/hdf5/issues/6487
+ NOTE: HDF not covered by security support, see https://bugs.debian.org/1117722
CVE-2026-19023 (Untrusted pointer dereference in the render_bin_output function in the ...)
- TODO: check
+ - hdf5 <unfixed> (unimportant)
+ NOTE: https://github.com/HDFGroup/hdf5/issues/6486
+ NOTE: HDF not covered by security support, see https://bugs.debian.org/1117722
CVE-2026-19007 (A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. Thi ...)
- TODO: check
+ NOT-FOR-US: mf-yang openclaw-cn
CVE-2026-19006 (A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affect ...)
- TODO: check
+ NOT-FOR-US: mf-yang openclaw-cn
CVE-2026-19005 (A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affect ...)
- TODO: check
+ NOT-FOR-US: nanocoai NanoClaw
CVE-2026-19000 (A vulnerability was identified in JeecgBoot up to 3.9.2. The affected ...)
- TODO: check
+ NOT-FOR-US: JeecgBoot
CVE-2026-18998 (A vulnerability was determined in cosmicstack-labs mercury-agent up to ...)
- TODO: check
+ NOT-FOR-US: cosmicstack-labs mercury-agent
CVE-2026-18997 (A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1. ...)
- TODO: check
+ NOT-FOR-US: cosmicstack-labs mercury-agent
CVE-2026-18996 (A vulnerability has been found in cosmicstack-labs mercury-agent up to ...)
- TODO: check
+ NOT-FOR-US: cosmicstack-labs mercury-agent
CVE-2026-18995 (A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affe ...)
- TODO: check
+ NOT-FOR-US: netease-youdao LobsterAI
CVE-2026-18993 (A vulnerability was detected in NousResearch hermes-agent up to 0.16.0 ...)
- TODO: check
+ NOT-FOR-US: NousResearch
CVE-2026-18992 (A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vu ...)
- TODO: check
+ NOT-FOR-US: zhayujie CowAgent
CVE-2026-18991 (A security vulnerability has been detected in nanocoai NanoClaw up to ...)
- TODO: check
+ NOT-FOR-US: nanocoai NanoClaw
CVE-2026-18990 (A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is a ...)
- TODO: check
+ NOT-FOR-US: letta-ai LettaBot
CVE-2026-18980 (A vulnerability was identified in nearai ironclaw up to 0.29.1. Affect ...)
- TODO: check
+ NOT-FOR-US: nearai ironclaw
CVE-2026-18976 (A vulnerability was determined in NousResearch hermes-agent up to 0.16 ...)
- TODO: check
+ NOT-FOR-US: NousResearch
CVE-2026-18974 (A vulnerability was found in heshengtao super-agent-party up to 0.4.1. ...)
- TODO: check
+ NOT-FOR-US: heshengtao super-agent-party
CVE-2026-18973 (A vulnerability has been found in heshengtao super-agent-party up to 0 ...)
- TODO: check
+ NOT-FOR-US: heshengtao super-agent-party
CVE-2026-18970 (A flaw has been found in Rongzhitong Visual Integrated Command and Dis ...)
- TODO: check
+ NOT-FOR-US: Rongzhitong Visual Integrated Command and Dispatch Platform
CVE-2026-18969 (A vulnerability was detected in Rongzhitong Visual Integrated Command ...)
- TODO: check
+ NOT-FOR-US: Rongzhitong Visual Integrated Command and Dispatch Platform
CVE-2026-18968 (A security vulnerability has been detected in ttttonyhe OBlog up to 3c ...)
- TODO: check
+ NOT-FOR-US: ttttonyhe OBlog
CVE-2026-18967 (A flaw was found in the SAML broker component of Keycloak, an identity ...)
- TODO: check
+ - keycloak <itp> (bug #1088287)
CVE-2026-18959 (A flaw has been found in yushine InnoShop up to 0.8.2. Affected by thi ...)
- TODO: check
+ NOT-FOR-US: yushine InnoShop
CVE-2026-18958 (A vulnerability was detected in imranrisal-dev Student-Management-Syst ...)
- TODO: check
+ NOT-FOR-US: imranrisal-dev Student-Management-System
CVE-2026-18954 (Incorrect authorization in the aggregation pipeline tool in Amazon AWS ...)
NOT-FOR-US: Amazon
CVE-2026-18953 (Improper limitation of a pathname to a restricted directory in the get ...)
NOT-FOR-US: Amazon
CVE-2026-18909 (A stack-based buffer overflow vulnerability exists in ELAN Microelectr ...)
- TODO: check
+ NOT-FOR-US: ELAN Microelectronics Corp. ELAN Smart-Pad on Windows
CVE-2026-18839 (An integer underflow was found in the popt library when formatting hel ...)
- TODO: check
+ - popt <unfixed>
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2511010
CVE-2026-18510 (The TranslatePress \u2013 Translate Multilingual sites with AI Transla ...)
NOT-FOR-US: WordPress plugin
CVE-2026-18411 (The KARR Security System and SWDS dealer-installed automotive anti-the ...)
- TODO: check
+ NOT-FOR-US: KARR Security System and SWDS dealer-installed automotive anti-theft systems
CVE-2026-18400 (The Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, V ...)
NOT-FOR-US: WordPress plugin
CVE-2026-18395 (The Child Pages Card WordPress plugin before 1.09 does not sanitise an ...)
@@ -277,7 +848,7 @@ CVE-2026-18325 (The Forminator Forms \u2013 Contact Form, Payment Form & Custom
CVE-2026-18050 (The Events Manager WordPress plugin before 7.4 does not perform any a ...)
NOT-FOR-US: WordPress plugin
CVE-2026-17583 (The affected Thermo Fisher Applied Biosystems Genetic Analyzers arevu ...)
- TODO: check
+ NOT-FOR-US: Thermo Fisher
CVE-2026-17556 (A path traversal vulnerability was identified in GitHub Enterprise Ser ...)
NOT-FOR-US: Github Enterprise Server
CVE-2026-16954 (The AI Engine WordPress plugin before 3.6.4 does not redact secret co ...)
@@ -325,9 +896,9 @@ CVE-2026-12713 (The WPCargo Track & Trace WordPress plugin before 8.0.4 does not
CVE-2026-11588 (The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform an ...)
NOT-FOR-US: WordPress plugin
CVE-2025-63823 (My Safetipin Android Application 5.2.1 contains Hardcoded credentials ...)
- TODO: check
+ NOT-FOR-US: My Safetipin Android Application
CVE-2025-63822 (SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access ...)
- TODO: check
+ NOT-FOR-US: SirenGPS Android Application
CVE-2025-15678 (The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize upl ...)
NOT-FOR-US: WordPress plugin
CVE-2023-54389
@@ -400,6 +971,19 @@ CVE-2026-8029 (The ZTE Smart Life app contains an SQL injection vulnerability th
NOT-FOR-US: ZTE
CVE-2026-7869 (IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal ...)
NOT-FOR-US: IBM
+CVE-2026-7867 [Local privilege escalation via as-user mount spoofing]
+ {DSA-6414-1}
+ - udisks2 2.11.2-1
+ [bookworm] - udisks2 <not-affected> (udisks2 versions < 2.10.x are not affected)
+ [bullseye] - udisks2 <not-affected> (udisks2 versions < 2.10.x are not affected)
+ NOTE: https://github.com/azqzazq1/CVE-2026-7867-disk2root
+ NOTE: https://github.com/storaged-project/udisks/security/advisories/GHSA-j42g-v9jw-6ph3
+ NOTE: https://github.com/storaged-project/udisks/commit/397eea88d58f77f6e02d537c4c961201b9245943
+ NOTE: https://github.com/storaged-project/udisks/commit/0050f51d40e468f6a3197ccdc77b5bd59c923a37
+ NOTE: https://github.com/storaged-project/udisks/commit/98e5a76c155640d155280cdb642791f00def736a
+ NOTE: https://github.com/storaged-project/udisks/commit/681d58a76f6aaa5045eb43e665c65f497d35b810
+ NOTE: https://github.com/storaged-project/udisks/commit/36231768dde088c8b4d4796ff2d311d089d84052
+ NOTE: Backport for 2.10.y: https://github.com/storaged-project/udisks/pull/1530
CVE-2026-7726 (The Layouts for WPBakery plugin for WordPress is vulnerable to unautho ...)
NOT-FOR-US: WordPress plugin
CVE-2026-7693 (The Backup Migration plugin for WordPress is vulnerable to OS Command ...)
@@ -942,52 +1526,65 @@ CVE-2026-64581 (In the Linux kernel, the following vulnerability has been resolv
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/c283e9ada7fcb7dd4b10592623086b2e6d2f9925 (7.2-rc4)
CVE-2026-64580 (In the Linux kernel, the following vulnerability has been resolved: x ...)
+ {DSA-6415-1}
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/136992de9bb91871084ae52d172610541c76e4d2 (7.2-rc4)
CVE-2026-64579 (In the Linux kernel, the following vulnerability has been resolved: x ...)
+ {DSA-6415-1}
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/f38f8cce2f7e79775b3db7e8a5eacda04ac908e4 (7.2-rc4)
CVE-2026-64578 (In the Linux kernel, the following vulnerability has been resolved: k ...)
+ {DSA-6415-1}
- linux 7.1.6-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/15b38176fd1530372905c602fde51fe89ec8c877 (7.2-rc4)
CVE-2026-64577 (In the Linux kernel, the following vulnerability has been resolved: g ...)
+ {DSA-6415-1}
- linux 7.1.6-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/cd170f051dba9ac146fabcd1b91726487c0cb9fa (7.2-rc5)
CVE-2026-64576 (In the Linux kernel, the following vulnerability has been resolved: n ...)
+ {DSA-6415-1}
- linux 7.1.6-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/6347c5314cee49f364aaf2e40ff15415a57a116e (7.2-rc5)
CVE-2026-64574 (In the Linux kernel, the following vulnerability has been resolved: w ...)
+ {DSA-6415-1}
- linux 7.1.6-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/952c02b33f56207a160421bcd61e7ac53c9c59ae (7.2-rc5)
CVE-2026-64573 (In the Linux kernel, the following vulnerability has been resolved: B ...)
+ {DSA-6415-1}
- linux 7.1.6-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/c90164ca0f7036942ba088eb7ea8d3f6c2352020 (7.2-rc4)
CVE-2026-64572 (In the Linux kernel, the following vulnerability has been resolved: i ...)
+ {DSA-6415-1}
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/f2f152e94a67bc746afaf05a1b2702c195553112 (7.2-rc4)
CVE-2026-64571 (In the Linux kernel, the following vulnerability has been resolved: w ...)
+ {DSA-6415-1}
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/ebd6d37fa94bee929e0b4c9ca19fdf9b1dcf6cea (7.2-rc4)
CVE-2026-64570 (In the Linux kernel, the following vulnerability has been resolved: w ...)
+ {DSA-6415-1}
- linux 7.1.6-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/286e52a799fa158bdbd77da1426c4d93f9a6e7ad (7.2-rc4)
CVE-2026-64569 (In the Linux kernel, the following vulnerability has been resolved: m ...)
+ {DSA-6415-1}
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/56d96fededd61192cd7cc8d2b0f36adfd59036c3 (7.2-rc4)
CVE-2026-64568 (In the Linux kernel, the following vulnerability has been resolved: w ...)
+ {DSA-6415-1}
- linux 7.1.6-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/1d067abcd37062426c59ec73dbc4e87a63f33fea (7.2-rc4)
CVE-2026-64567 (In the Linux kernel, the following vulnerability has been resolved: b ...)
+ {DSA-6415-1}
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/a2d8d5647ed854e38f941741aea45b9eb15a6350 (7.2-rc4)
CVE-2026-9273 (The Membership Plugin \u2013 Kadence Memberships plugin for WordPress ...)
@@ -999,7 +1596,7 @@ CVE-2026-8761 (The Dokan plugin for WordPress is vulnerable to Privilege Escalat
CVE-2026-7753 (The Cost Calculator Builder plugin for WordPress is vulnerable to unau ...)
NOT-FOR-US: WordPress plugin
CVE-2026-71201 (In OpenStack Ironic through 38.0.0, a project reader that makes a craf ...)
- - ironic <unfixed>
+ - ironic 1:35.0.1-9 (bug #1143790)
NOTE: https://bugs.launchpad.net/ironic/+bug/2162715
CVE-2026-70620 (Odysseus before commit 87babb5 contains a server-side request forgery ...)
NOT-FOR-US: Odysseus
@@ -1110,20 +1707,15 @@ CVE-2026-67855 (open62541 contains a heap use-after-free in the GDS PushManageme
- open62541 <unfixed>
NOTE: https://github.com/open62541/open62541/issues/8093
CVE-2026-67592 (It was not possible to govern the maximum number of transfer frames pe ...)
- - qpid-proton <unfixed>
- NOTE: https://lists.apache.org/thread/b4pv9hfdk7ox78pss77sb4nzwjrvqhhz
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-67591 (An authenticated attacker could exceed the session flow control incomi ...)
- - qpid-proton <unfixed>
- NOTE: https://lists.apache.org/thread/rwmggh2bkm6qotxpdfcplht3jgw5n036
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-67590 (A pre-authentication attacker could leverage type nesting to cause a S ...)
- - qpid-proton <unfixed>
- NOTE: https://lists.apache.org/thread/kmov6k7f3moqy01m1s370fl61vgos3ly
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-67589 (A pre-authentication attacker could leverage type size/count handling ...)
- - qpid-proton <unfixed>
- NOTE: https://lists.apache.org/thread/bs24x4778dh72xtfs299cy8krvdlo47q
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-67588 (A pre-authentication attacker could leverage unbounded symbol value ca ...)
- - qpid-proton <unfixed>
- NOTE: https://lists.apache.org/thread/vk4j02dzggfdrdkwvzmqo4jro2tgj0jt
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-67555 (It was not possible to govern the maximum number of transfer frames pe ...)
NOT-FOR-US: Apache Qpid Proton-Dotnet
CVE-2026-67554 (An authenticated attacker can craft a disposition frame with large or ...)
@@ -1571,7 +2163,7 @@ CVE-2026-18753 (The product firmware contains an embedded, static RSA private ke
CVE-2026-18650 (Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows ...)
NOT-FOR-US: Liman MYS
CVE-2026-18401 (The non-blocking (asynchronous) JSON parser in jackson-core does not e ...)
- - jackson-core <unfixed>
+ - jackson-core <not-affected> (Vulnerable code introduced later)
NOTE: https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq
NOTE: https://github.com/FasterXML/jackson-core/pull/1555
NOTE: Fixed by: https://github.com/FasterXML/jackson-core/commit/b0c428e6f993e1b5ece5c1c3cb2523e887cd52cf (jackson-core-2.18.6)
@@ -1701,6 +2293,8 @@ CVE-2026-69192 (ip-address is a library for parsing and manipulating IPv4 and IP
NOTE: Fixed by: https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e (v10.3.1)
CVE-2026-69185 (Socket.IO enables bidirectional and low-latency communication for ever ...)
- node-socket.io-parser <unfixed> (bug #1143598)
+ [bookworm] - node-socket.io-parser <postponed> (minor issue; DoS)
+ [bullseye] - node-socket.io-parser <postponed> (minor issue; DoS)
NOTE: https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr
NOTE: Fixed by: https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4 (socket.io-parser at 4.2.7)
NOTE: Fixed by: https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291 (socket.io-parser at 3.4.5)
@@ -1777,20 +2371,27 @@ CVE-2026-65804 (Improper control of generation of code ('code injection') in Mic
CVE-2026-65802 (External control of file name or path in Microsoft Edge for Android al ...)
NOT-FOR-US: Microsoft
CVE-2026-64565 (In the Linux kernel, the following vulnerability has been resolved: I ...)
+ {DSA-6415-1}
- linux 7.1.3-1
NOTE: https://git.kernel.org/linus/875115b82c295277b81b6dfee7debc725f44e854 (7.1-rc1)
CVE-2026-64564 (In the Linux kernel, the following vulnerability has been resolved: s ...)
+ {DSA-6415-1}
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/9b2854f86f0b56e9027d68e7a3fc909d1a9b566f (7.2-rc5)
+ NOTE: https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564
CVE-2026-64563 (In the Linux kernel, the following vulnerability has been resolved: r ...)
+ {DSA-6415-1}
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456 (7.2-rc5)
CVE-2026-64562 (In the Linux kernel, the following vulnerability has been resolved: K ...)
+ {DSA-6415-1}
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/622ebfac01ba4f9c0060cebd41257fe46fc4a0b3 (7.2-rc5)
CVE-2026-64561 (In the Linux kernel, the following vulnerability has been resolved: K ...)
+ {DSA-6415-1}
- linux 7.1.6-1
NOTE: https://git.kernel.org/linus/2abd5287f08319fa35764566b15c6e22cb1068db (7.2-rc5)
+ NOTE: https://github.com/V4bel/Zapscape
CVE-2026-62870 (Use after free in Microsoft Office Excel allows an unauthorized attack ...)
NOT-FOR-US: Microsoft
CVE-2026-62354 (Authorization handling for Parameter Context validation requests in Ap ...)
@@ -2167,13 +2768,11 @@ CVE-2026-18590 (A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7
CVE-2026-18574 (An authentication bypass vulnerability in Check Point Security Managem ...)
NOT-FOR-US: Check Point Security Management Server
CVE-2026-18508 (A flaw was found in GNU tar. When extracting an archive with the --one ...)
- - tar <unfixed>
+ - tar <unfixed> (bug #1143836)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2509843
- TODO: check upstream status, Red Hat Bugzilla entry got restricted
CVE-2026-18477 (A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's increm ...)
- - tar <unfixed>
+ - tar <unfixed> (bug #1143836)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2509735
- TODO: check upstream
CVE-2026-18248 (@fastify/aws-lambda version 6.4.0 decorates each Fastify request with ...)
NOT-FOR-US: fastify/aws-lambda
CVE-2026-18243 (Certain HP DesignJet products may be potentially vulnerable to cross-s ...)
@@ -4113,6 +4712,8 @@ CVE-2026-58044 (A flaw in Node.js HTTP client can cause a request desynchronizat
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http-parser-header-truncation-can-enable-request-smuggling-cve-2026-58044---low
CVE-2026-58039 (A flaw in Node.js Permission Model enforcement allows process.report w ...)
- nodejs <unfixed>
+ [bookworm] - nodejs <not-affected> (Permission Model is a Node 20+ feature)
+ [bullseye] - nodejs <not-affected> (Permission Model is a Node 20+ feature)
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#permission-model-allows-process-reports-to-write-outside-the-allowlist-cve-2026-58039---low
CVE-2026-58045 (A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigge ...)
- nodejs <unfixed>
@@ -4233,6 +4834,8 @@ CVE-2026-58046 (Improper neutralization in the Plesk XML-RPC API allows a remote
NOT-FOR-US: Plesk
CVE-2026-58043 (A flaw in Node.js Permission Model enforcement can over-grant filesyst ...)
- nodejs <unfixed>
+ [bookworm] - nodejs <not-affected> (Permission Model is a Node 20+ feature)
+ [bullseye] - nodejs <not-affected> (Permission Model is a Node 20+ feature)
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#permission-model-path-matching-can-over-grant-filesystem-access-cve-2026-58043---high
CVE-2026-58040 (An incomplete fix has been identified in Node.js: HTTPS Agent TLS sess ...)
- nodejs <unfixed>
@@ -4242,6 +4845,8 @@ CVE-2026-56850 (A flaw in Node.js HTTPS Agent connection reuse can cause PFX obj
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#https-agent-can-reuse-mtls-identities-across-pfx-certificates-cve-2026-56850---medium
CVE-2026-56847 (A flaw in Node.js Permission Model enforcement allows `trace_events.cr ...)
- nodejs <unfixed>
+ [bookworm] - nodejs <not-affected> (Permission Model is a Node 20+ feature)
+ [bullseye] - nodejs <not-affected> (Permission Model is a Node 20+ feature)
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#permission-model-allows-trace-events-to-write-outside-the-allowlist-cve-2026-56847---low
CVE-2026-54249 (Pydantic AI is a Python agent framework for building Generative AI app ...)
NOT-FOR-US: Pydantic AI
@@ -6238,8 +6843,8 @@ CVE-2026-52791 (fuse-overlayfs is an implementation of overlayfs in FUSE for roo
- fuse-overlayfs <unfixed> (bug #1143058)
NOTE: https://github.com/containers/fuse-overlayfs/security/advisories/GHSA-2cc4-p72c-v85h
NOTE: Fixed by: https://github.com/containers/fuse-overlayfs/commit/97e0d968a782fc259ebde112db1e9b9ff1ad724f (v1.17)
-CVE-2026-51992 (SQL Injection vulnerability in ClickHouse Server Versions <= 26.3.9.8 ...)
- NOT-FOR-US: ClickHouse Server
+CVE-2026-51992
+ REJECTED
CVE-2026-50642 (diff\u2011so\u2011fancy does not properly sanitize non\u2011SGR termin ...)
NOT-FOR-US: diff-so-fancy
CVE-2026-50641 (Streamsoft Business Intelligence (BI) stores users' passwords in plain ...)
@@ -6652,6 +7257,8 @@ CVE-2026-6879 (`Element.findall()` and fully-consumed `Element.iterfind()` exhib
- python2.7 <removed>
[bullseye] - python2.7 <end-of-life> (EOL in bullseye LTS)
- pypy3 <unfixed>
+ [bookworm] - pypy3 <postponed> (Minor issue)
+ [bullseye] - pypy3 <postponed> (Minor issue)
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/
NOTE: https://github.com/python/cpython/issues/152674
NOTE: https://github.com/python/cpython/pull/152676
@@ -8192,6 +8799,7 @@ CVE-2026-16566
TODO: check upstream report and status on fix
CVE-2026-14957
- libreswan <unfixed> (bug #1143067)
+ [trixie] - libreswan <no-dsa> (Minor issue; can be fixed via point release)
[bullseye] - libreswan <end-of-life> (EOL in bullseye LTS)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2501764
NOTE: https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt
@@ -8277,12 +8885,10 @@ CVE-2026-66013 (OpenRemote before 1.26.2 contains an authentication bypass vulne
CVE-2026-66012 (SiYuan before v3.7.2 contains a missing authorization vulnerability in ...)
NOT-FOR-US: SiYuan
CVE-2026-66011 (ImageMagick before 7.1.2-27 contains a memory leak vulnerability in th ...)
- - imagemagick 8:7.1.2.27+dfsg1-1
- [bookworm] - imagemagick <ignored> (minor issue; leak will be cleaned at process exit)
- [bullseye] - imagemagick <ignored> (minor issue; leak will be cleaned at process exit)
+ - imagemagick 8:7.1.2.27+dfsg1-1 (unimportant)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cvhv-g4rq-3hmw
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/e3e69118c29064e2716ca89aab635ea95a15dd49 (7.1.2-27)
- NOTE: Leak concern command line tools. By definition leak is cleaned at end of command.
+ NOTE: Memory leak in CLI tool; By definition leak is cleaned at end of command.
CVE-2026-16766 (Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell ...)
NOT-FOR-US: Catalyst::View::Wkhtmltopdf Perl module
CVE-2026-15425 (The Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in ...)
@@ -9683,6 +10289,7 @@ CVE-2026-64294 (In the Linux kernel, the following vulnerability has been resolv
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/e187bc02f8fa4226d62814592cf064ee4557c470 (7.2-rc3)
CVE-2026-64290 (In the Linux kernel, the following vulnerability has been resolved: i ...)
+ {DSA-6415-1}
- linux 7.1.4-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
@@ -9705,6 +10312,7 @@ CVE-2026-64283 (In the Linux kernel, the following vulnerability has been resolv
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/eba85fee7fc6cf28fec38a5bf3c378bef9a79ca6 (7.2-rc1)
CVE-2026-64280 (In the Linux kernel, the following vulnerability has been resolved: f ...)
+ {DSA-6415-1}
- linux 7.1.4-1
NOTE: https://git.kernel.org/linus/fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27 (7.2-rc1)
CVE-2026-64279 (In the Linux kernel, the following vulnerability has been resolved: i ...)
@@ -10870,7 +11478,7 @@ CVE-2026-65461 (Administrator Arbitrary File Upload in Really Simple CSV Importe
NOT-FOR-US: WordPress plugin or theme
CVE-2026-65460 (Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-65458 (Contributor Sensitive Data Exposure in Polylang <= 3.8.5 versions.)
+CVE-2026-65458 (Exposure of Sensitive System Information to an Unauthorized Control Sp ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-65457 (Subscriber Broken Access Control in \u042eKassa \u0434\u043b\u044f Woo ...)
NOT-FOR-US: WordPress plugin or theme
@@ -11147,7 +11755,7 @@ CVE-2026-24639 (Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.
NOT-FOR-US: WordPress plugin or theme
CVE-2026-24628 (Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-24552 (Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions.)
+CVE-2026-24552 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-24537 (Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility ...)
NOT-FOR-US: WordPress plugin or theme
@@ -11738,14 +12346,31 @@ CVE-2026-10723 (BIND may accept incorrect child-zone NSEC3 records as valid, whi
{DSA-6395-1}
- bind9 1:9.20.26-1
NOTE: https://kb.isc.org/docs/cve-2026-10723
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/238ec379e9bed56383ba2333e711e554b139ac13 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/dc3f52388427f4f94087d984d5a2088b925810e2 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/c9cb6a5e24e43489cf3fd4d4cc2193b6a74499cb (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/35e3d49d2222c13786a06021c7ed583d2a656e51 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/833dd3b230b92596074e8da15b12298f46c939f2 (9.18-branch)
CVE-2026-10822 (If BIND encounters a particular invalid data structure in a DNS record ...)
{DSA-6395-1}
- bind9 1:9.20.26-1
+ [bullseye] - bind9 <not-affected> (Vulnerable code not present)
NOTE: https://kb.isc.org/docs/cve-2026-10822
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/d413c9ac2e29a728531354a69c8c8234c01b7d1e (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/a5f1a9d0d2ec021618924b14202ac96ead8299c1 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/e73b70a64453e7d97a11cb5f0afe8bb02d34aaf8 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/19ac8b8e46aeb0a15e217bc7bdf485b31b87d9b4 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/8e066d3fc369e3346f22bb5cfb67a7ab08a74034 (9.18-branch)
CVE-2026-11331 (An attacker who knows (or guesses) that a resolver uses RPZ with wildc ...)
{DSA-6395-1}
- bind9 1:9.20.26-1
NOTE: https://kb.isc.org/docs/cve-2026-11331
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/e1c83d27984f10ff929bc54d6ed84b5152be96d5 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/25b572a6d00f717d7992f154f28b43d2b2ffd0b3 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/ee2ac186bc5f75f7f3f7049f1a21e9a2014cee59 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/adc8285d23e2eac6ec463f5dbc5a9596fdd36c60 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/095b11f20f911f5b8059bdc349b256d6c64ece30 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/dc328a199f96222e0c30cc20b7b795bfc2c9b2e4 (9.18-branch)
CVE-2026-11605 (The issue is a resource exhaustion vulnerability associated with DNSSE ...)
{DSA-6395-1}
- bind9 1:9.20.26-1
@@ -11754,26 +12379,41 @@ CVE-2026-11622 (A DNSSEC validating resolver that is under a random subdomain at
{DSA-6395-1}
- bind9 1:9.20.26-1
NOTE: https://kb.isc.org/docs/cve-2026-11622
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/c57695da31a338092528283fde4f8ed9048b2087 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/231b1ca3edfb26389e1af39181aa6b4413e87ec4 (9.18-branch)
CVE-2026-11721 (It is possible for an attacker's zone to respond to a query with an RR ...)
{DSA-6395-1}
- bind9 1:9.20.26-1
NOTE: https://kb.isc.org/docs/cve-2026-11721
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/5f1d1f35d8ea137ee3afefbe50d76a9fb1199ab7 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/71dadba745c5d2ca7e1d4788fccab3a7d6a929f2 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/ebf391bdb8ea196dab43d0a1e1f639458cb15126 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/1a4986e2533f87e80eb21da3f06708d335aff1e2 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/15089066b15f826d7487c3d160b5872820f84b83 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/19e496ca260b6a756ae1378e8ebcbdb666b7d9ed (9.18-branch)
CVE-2026-12617 (The issue is unexpected program termination based on ordering and/or s ...)
{DSA-6395-1}
- bind9 1:9.20.26-1
[bullseye] - bind9 <not-affected> (Vulnerable code not present)
NOTE: https://kb.isc.org/docs/cve-2026-12617
- NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/773d46d58c693047a5945c8fe40512edd0ac214e (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/c740c37689f234e21a9b0ef760471ef2cf1133f5 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/bb92832fb6ae899bee7206c2d8966258461c2f71 (9.18-branch)
CVE-2026-13204 (If a provably insecure domain is covered by both an NSEC and NSEC3 rec ...)
{DSA-6395-1}
- bind9 1:9.20.26-1
NOTE: https://kb.isc.org/docs/cve-2026-13204
- NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/57cba571ee31311e54d8a11cb38094d439f04e09 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/1b90fbb4f9d3d923516ff7841171269b993cfd6f (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/0cf010c153518f1f9831e201891ecba8d8ba65e1 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/6c0e599ea85c0c53a4af09742e64e193da089bb4 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/48f5aa5fb3746d6194edcc57e8792a8b3cc3b454 (9.18-branch)
CVE-2026-13321 (The BIND resolver accepts validly-signed NSEC records where the "Next ...)
{DSA-6395-1}
- bind9 1:9.20.26-1
NOTE: https://kb.isc.org/docs/cve-2026-13321
- NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/4065512d25b71605b9502bb69dfb903776d35aa9 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/af84538a2ce6722b89b8ef7f2a233a5c10d0207d (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/c969ad2c17b43dd999e358bfeb280d3df6fab822 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/058023c66f11d78590d4aa8c4f98946c4c965e21 (9.18-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/f751e19a30d107f04c2f644aff9f8dab8fed03ab (9.18-branch)
CVE-2026-52688 (RRSIGs with too few labels can lead to bypass of DNSSEC wildcard valid ...)
{DSA-6397-1}
- pdns-recursor 5.4.4-1
@@ -15780,6 +16420,7 @@ CVE-2026-64206 (In the Linux kernel, the following vulnerability has been resolv
- linux 7.1.4-1
NOTE: https://git.kernel.org/linus/2641a9e0a1dd4af2e21995470a21d55dd35e5203 (7.2-rc3)
CVE-2026-64205 (In the Linux kernel, the following vulnerability has been resolved: i ...)
+ {DSA-6415-1}
- linux 7.1.4-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
@@ -22101,6 +22742,8 @@ CVE-2026-48252 (Adobe Experience Manager is affected by a Missing Authentication
NOT-FOR-US: Adobe
CVE-2026-48125 (UAParser.js is a JavaScript library to detect browsers, operating syst ...)
- node-ua-parser-js <unfixed>
+ [bookworm] - node-ua-parser-js <postponed> (minor issue)
+ [bullseye] - node-ua-parser-js <postponed> (minor issue)
NOTE: https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-9h5v-pfqq-x599
NOTE: Fixed by: https://github.com/faisalman/ua-parser-js/commit/90354d3458495628b1d3ba68a9d76673e6d14fc5 (2.0.10)
CVE-2026-48069 (@grpc/grps-js implements the core functionality of gRPC purely in Java ...)
@@ -25775,21 +26418,29 @@ CVE-2026-59876 (protobufjs compiles protobuf definitions into JavaScript (JS) fu
CVE-2026-59875 (node-tar is a tar archive manipulation library for Node.js. Prior to 7 ...)
- node-tar 7.5.19+~4.0.1-1 (bug #1141767)
[trixie] - node-tar <no-dsa> (Minor issue)
+ [bookworm] - node-tar <postponed> (Minor issue)
+ [bullseye] - node-tar <postponed> (Minor issue)
NOTE: https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j
NOTE: Fixed by: https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3 (v7.5.17)
CVE-2026-59874 (node-tar is a tar archive manipulation library for Node.js. Prior to 7 ...)
- node-tar 7.5.19+~4.0.1-1 (bug #1141767)
[trixie] - node-tar <no-dsa> (Minor issue)
+ [bookworm] - node-tar <postponed> (Minor issue)
+ [bullseye] - node-tar <postponed> (Minor issue)
NOTE: https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w
NOTE: Fixed by: https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5 (v7.5.18)
CVE-2026-59873 (node-tar is a tar archive manipulation library for Node.js. Prior to 7 ...)
- node-tar 7.5.19+~4.0.1-1 (bug #1141767)
[trixie] - node-tar <no-dsa> (Minor issue)
+ [bookworm] - node-tar <postponed> (Minor issue)
+ [bullseye] - node-tar <postponed> (Minor issue)
NOTE: https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw
NOTE: Fixed by: https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3 (v7.5.19)
CVE-2026-59871 (node-tar is a tar archive manipulation library for Node.js. Prior to 7 ...)
- node-tar 7.5.19+~4.0.1-1 (bug #1141767)
[trixie] - node-tar <no-dsa> (Minor issue)
+ [bookworm] - node-tar <postponed> (Minor issue)
+ [bullseye] - node-tar <postponed> (Minor issue)
NOTE: https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp
NOTE: Fixed by: https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b (v7.5.18)
CVE-2026-59870 (js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2. ...)
@@ -28964,6 +29615,7 @@ CVE-2026-55791 (Craft CMS is a content management system (CMS). Versions 4.0.0-R
CVE-2026-55790 (Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 ...)
NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-55688 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ {DLA-4721-1}
- async-http-client <unfixed> (bug #1141445)
NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-m452-q8c9-rg2f
NOTE: https://github.com/AsyncHttpClient/async-http-client/pull/2196
@@ -29900,17 +30552,21 @@ CVE-2026-53327 (In the Linux kernel, the following vulnerability has been resolv
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/5f41161059fd0f1bbf18c90f3180e38cc45a14eb (7.1-rc5)
CVE-2026-45382 (libde265 is an open source implementation of the h.265 video codec. Pr ...)
+ {DSA-6413-1}
- libde265 1.1.1-1
NOTE: https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9
NOTE: https://github.com/strukturag/libde265/commit/c33b4f63ae9056b00f34a31874fed55cd0aa29c9 (v1.0.19)
CVE-2026-45383 (libde265 is an open source implementation of the h.265 video codec. Ve ...)
+ {DSA-6413-1}
- libde265 1.1.1-1
NOTE: https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38
CVE-2026-54241
+ {DSA-6413-1}
- libde265 1.1.1-1
NOTE: https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr
NOTE: https://github.com/strukturag/libde265/commit/bdca87569b9c63c2a7054d90ae4462dbb78d159a (v1.1.1)
CVE-2026-54240
+ {DSA-6413-1}
- libde265 1.1.1-1
NOTE: https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3
NOTE: https://github.com/strukturag/libde265/commit/bdca87569b9c63c2a7054d90ae4462dbb78d159a (v1.1.1)
@@ -37285,6 +37941,7 @@ CVE-2026-53091 (In the Linux kernel, the following vulnerability has been resolv
- linux 7.0.10-1
NOTE: https://git.kernel.org/linus/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 (7.1-rc1)
CVE-2026-53090 (In the Linux kernel, the following vulnerability has been resolved: b ...)
+ {DSA-6415-1}
- linux 7.0.10-1
NOTE: https://git.kernel.org/linus/ee861486e377edc55361c08dcbceab3f6b6577bd (7.1-rc1)
CVE-2026-53089 (In the Linux kernel, the following vulnerability has been resolved: b ...)
@@ -37315,6 +37972,7 @@ CVE-2026-53080 (In the Linux kernel, the following vulnerability has been resolv
[trixie] - linux 6.12.94-1
NOTE: https://git.kernel.org/linus/65782b2db7321d5f97c16718c4c7f6c7205a56be (7.1-rc1)
CVE-2026-53078 (In the Linux kernel, the following vulnerability has been resolved: b ...)
+ {DSA-6415-1}
- linux 7.0.10-1
NOTE: https://git.kernel.org/linus/10f86a2a5c91fc4c4d001960f1c21abe52545ef6 (7.1-rc1)
CVE-2026-53077 (In the Linux kernel, the following vulnerability has been resolved: n ...)
@@ -39389,6 +40047,8 @@ CVE-2026-53655 (node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, ta
[experimental] - node-tar 7.5.16+~4.0.1-1
- node-tar 7.5.16+~4.0.1-2
[trixie] - node-tar <no-dsa> (Minor issue)
+ [bookworm] - node-tar <postponed> (Minor issue)
+ [bullseye] - node-tar <postponed> (Minor issue)
NOTE: https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh
CVE-2026-53632 (launch-editor allows users to open files with line numbers in editor f ...)
NOT-FOR-US: Node launch-editor
@@ -39944,6 +40604,7 @@ CVE-2026-50559 (Quarkus is a Java framework for building cloud-native applicatio
CVE-2026-50519 (Initialization of a resource with an insecure default in GitHub Copilo ...)
NOT-FOR-US: Microsoft
CVE-2026-49346 (libde265 is an open source implementation of the h.265 video codec. Pr ...)
+ {DSA-6413-1}
- libde265 1.1.1-1 (bug #1140431)
NOTE: https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86
NOTE: Fixed by: https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8 (v1.1.0)
@@ -39963,10 +40624,12 @@ CVE-2026-49340 (gonic is a music streaming server / free-software subsonic serve
CVE-2026-49338 (gonic is a music streaming server / free-software subsonic server API ...)
NOT-FOR-US: gonic music streaming server
CVE-2026-49337 (libde265 is an open source implementation of the h.265 video codec. Pr ...)
+ {DSA-6413-1}
- libde265 1.1.1-1 (bug #1140431)
NOTE: https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm
NOTE: Fixed by: https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9 (v1.1.0)
CVE-2026-49295 (libde265 is an open source implementation of the h.265 video codec. Pr ...)
+ {DSA-6413-1}
- libde265 1.1.1-1 (bug #1140431)
NOTE: https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594
NOTE: Fixed by: https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652 (v1.1.0)
@@ -40529,9 +41192,13 @@ CVE-2026-48931 (A flaw in Node.js HTTP Agent can cause a client to accept as val
NOTE: https://github.com/nodejs/node/commit/0a22d40180cb796e0d68e94c1a7a8a05a8f47c10 (v22.23.0)
CVE-2026-48936 (A flaw in Node.js Permission API can cause a local server to be starte ...)
- nodejs <not-affected> (Only affects Node.js v26)
+ [bookworm] - nodejs <not-affected> (Permission Model is a Node 20+ feature)
+ [bullseye] - nodejs <not-affected> (Permission Model is a Node 20+ feature)
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#unix-domain-socket-server-bypasses---permission-network-restrictions-incomplete-cve-2026-21636-fix-cve-2026-48936---low
CVE-2026-48935 (A flaw in Node.js Permission API can cause a file metadata to be modif ...)
- nodejs 24.17.0+dfsg+~cs24.13.2-1
+ [bookworm] - nodejs <not-affected> (Permission Model is a Node 20+ feature)
+ [bullseye] - nodejs <not-affected> (Permission Model is a Node 20+ feature)
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#permission-model-bypass-via-filehandleutimes-in-the-promises-api-cve-2026-48935---low
NOTE: https://github.com/nodejs/node/commit/28dcd388644c676b5b8149abfe18ec32cd010781 (v22.23.0)
CVE-2026-48934 (A flaw in Node.js TLS host verification can cause an attacker to bypas ...)
@@ -40552,6 +41219,9 @@ CVE-2026-48619 (A flaw in Node.js HTTP/2 client allows a server to send an unlim
NOTE: https://github.com/nodejs/node/commit/c79968e108002c2394bdb9e9cefb2c8c8cc202f8 (v22.23.0)
CVE-2026-48615 (A flaw in Node.js proxy tunnel error handling could expose proxy crede ...)
- nodejs 24.17.0+dfsg+~cs24.13.2-1
+ [trixie] - nodejs <not-affected> (ERR_PROXY_TUNNEL built-in proxy client is a Node 22+ feature; not present)
+ [bookworm] - nodejs <not-affected> (ERR_PROXY_TUNNEL built-in proxy client is a Node 22+ feature; not present)
+ [bullseye] - nodejs <not-affected> (ERR_PROXY_TUNNEL built-in proxy client is a Node 22+ feature; not present)
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#proxy-credentials-leaked-in-err_proxy_tunnel-error-message-cve-2026-48615---medium
NOTE: https://github.com/nodejs/node/commit/9b6af26132f6e87659ce360e6a59f42a03ff1701 (v22.23.0)
CVE-2026-48618 (A flaw in Node.js TLS hostname handling can cause Node.js unicode dot ...)
@@ -40560,6 +41230,7 @@ CVE-2026-48618 (A flaw in Node.js TLS hostname handling can cause Node.js unicod
NOTE: https://github.com/nodejs/node/commit/2197a47144f3356ab451c5dcd858a49eb5957a70 (v22.23.0)
CVE-2026-48933 (A flaw in Node.js WebCrypto implementation can crash the process if th ...)
- nodejs 24.17.0+dfsg+~cs24.13.2-1
+ [bullseye] - nodejs <not-affected> (WebCrypto (SubtleCrypto) introduced in Node 15; not present)
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#nodejs-webcrypto-aes-integer-overflow-leads-to-remote-process-abort-dos-cve-2026-48933---high
NOTE: https://github.com/nodejs/node/commit/38b4c5ed51b2ec81c28fbd379fea72e22fa12a15 (v22.23.0)
CVE-2026-9815 (The MagicForm WordPress plugin through 0.1.3 does not properly validat ...)
@@ -40668,6 +41339,8 @@ CVE-2026-48937 (A flaw in Node.js HTTP/2 server API can cause servers to keep ac
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#http2-sessions-never-clean-up-after-goaway-on-invalid-protocol-errors-cve-2026-48937---medium
CVE-2026-48617 (A flaw in Node.js Permission Model enforcement allows Bypass via `proc ...)
- nodejs 24.17.0+dfsg+~cs24.13.2-1
+ [bookworm] - nodejs <not-affected> ((Permission Model is a Node 20+ feature)
+ [bullseye] - nodejs <not-affected> ((Permission Model is a Node 20+ feature)
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#permission-model-bypass-via-processreportwritereport-path-misvalidation-cve-2026-48617---low
NOTE: https://github.com/nodejs/node/commit/2f62693801a12bc8a485b3b7da3239ac522f607d (v22.23.0)
CVE-2026-47833 (setupBpmLogs follows symlink for bpm.log open and chown \u2014 contain ...)
@@ -44750,7 +45423,7 @@ CVE-2026-3433 (Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <
CVE-2026-28742 (Naxclow devices use a uniform request-signing scheme based on a hard-c ...)
NOT-FOR-US: Naxclow
CVE-2026-1836 (The system stores the username and password from the login form after ...)
- - redmine <unfixed> (bug #1140483)
+ - redmine 6.1.3+ds-1 (bug #1140483)
[trixie] - redmine <no-dsa> (Minor issue)
[bookworm] - redmine <postponed> (Minor issue; credential-bearing responses lack Cache-Control: no-store, exposure limited to local access to the victim's browser cache)
NOTE: https://www.incibe.es/en/incibe-cert/notices/aviso/stored-credentials-redmine
@@ -53617,6 +54290,7 @@ CVE-2026-41440
CVE-2026-35563 (It was identified that the LDAP client implementation in version 2.1.7 ...)
- apache-directory-api <unfixed> (bug #1139171)
[trixie] - apache-directory-api <no-dsa> (Minor issue)
+ [bookworm] - apache-directory-api <postponed> (Minor issue)
[bullseye] - apache-directory-api <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/06/01/2
CVE-2026-48827 (Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack ...)
@@ -57485,7 +58159,7 @@ CVE-2026-47770 (jq is a command-line JSON processor. Prior to 1.8.2, comparing t
NOTE: https://github.com/jqlang/jq/commit/7122866869960b55cea3646bc91334ef55787831
NOTE: https://github.com/jqlang/jq/pull/3539
CVE-2026-41579 (runc is a CLI tool for spawning and running containers according to th ...)
- - runc <unfixed> (bug #1140000)
+ - runc 1.3.6+ds1-1 (bug #1140000)
NOTE: https://www.openwall.com/lists/oss-security/2026/06/13/2
NOTE: https://github.com/opencontainers/runc/security/advisories/GHSA-xjvp-4fhw-gc47
NOTE: Fixed by: https://github.com/opencontainers/runc/commit/864db8042dbb191028676f80addf8c35f348aee2
@@ -58754,6 +59428,7 @@ CVE-2026-45904 (In the Linux kernel, the following vulnerability has been resolv
[bookworm] - linux 6.1.170-1
NOTE: https://git.kernel.org/linus/815a8d2feb5615ae7f0b5befd206af0b0160614c (7.0-rc1)
CVE-2026-45901 (In the Linux kernel, the following vulnerability has been resolved: n ...)
+ {DSA-6415-1}
- linux 6.19.6-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc (7.0-rc1)
@@ -58763,6 +59438,7 @@ CVE-2026-45899 (In the Linux kernel, the following vulnerability has been resolv
[trixie] - linux 6.12.85-1
NOTE: https://git.kernel.org/linus/79b592e8f1b435796cbc2722190368e3e8ffd7a1 (7.0-rc1)
CVE-2026-45897 (In the Linux kernel, the following vulnerability has been resolved: n ...)
+ {DSA-6415-1}
- linux 6.19.6-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/779c60a5190c42689534172f4b49e927c9959e4e (7.0-rc1)
@@ -60630,10 +61306,12 @@ CVE-2026-41074 (RT is an open source, enterprise-grade issue and ticket tracking
NOTE: https://github.com/bestpractical/rt/security/advisories/GHSA-265j-qx4w-256j
CVE-2026-41071 (libheif is a HEIF and AVIF file format decoder and encoder. In version ...)
- libheif 1.23.1-1 (bug #1137524)
+ [trixie] - libheif <not-affected> (Vulnerable code introduced in 1.20.0)
NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-xj92-xjff-h8w3
NOTE: Fixed by: https://github.com/strukturag/libheif/commit/f20c81745e917b4c496615140385c86d7a2fa58d (v1.22.0)
CVE-2026-41069 (libheif is a HEIF and AVIF file format decoder and encoder. In version ...)
- libheif 1.23.1-1 (bug #1137524)
+ [trixie] - libheif <not-affected> (Vulnerable code introduced in 1.20.0)
NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-p82x-fpmv-576r
CVE-2026-40864 (JupyterHub is software that allows users to create a multi-user server ...)
- jupyterhub <unfixed> (bug #1143060)
@@ -62100,25 +62778,32 @@ CVE-2026-3592 (BIND resolvers are vulnerable to an amplified resource consumptio
- bind9 1:9.20.23-1
NOTE: https://kb.isc.org/docs/cve-2026-3592
NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/06a0738b2bd48c0da847a55791d10dc0a8f32c93 (v9.20.23)
- NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/42fb4c1b7d7381ec8019f9f668d8ee2157b408a3 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/20d79632c20ba81e66dec9a9e158ac17909ede1a (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/5d7f468c7784d8806e230b784f5e63cb4c6c76ce (9.16-branch)
CVE-2026-3039 (BIND servers that are configured to use TKEY-based authentication via ...)
{DSA-6285-1}
- bind9 1:9.20.23-1
NOTE: https://kb.isc.org/docs/cve-2026-3039
NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/83ff826b22e181a8f73431193a9b4ace530a0299 (v9.20.23)
- NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/7f04d7104304fdc6b858c41bb44ad151b2c3e1b7 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/58c646c4b95efcda759cf194a534290eef38135e (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/7eef47ce676672f65b4988b1b5c086c4f30a9b70 (9.16-branch)
CVE-2026-5946 (Multiple flaws have been identified in `named` related to the handling ...)
{DSA-6285-1}
- bind9 1:9.20.23-1
NOTE: https://kb.isc.org/docs/cve-2026-5946
NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/4c1547e4b5afabdea3c3fe4ce81eb85acc990c9a (v9.20.23)
- NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/ec2c98181115bd5f6c7087fcc74d816490d4312e (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/e577560f65dbc6109fca8a597d16568a1cd8987c (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/bec30ad70d17e36241df9da259bb2ac85b3c3435 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/986533b5ae8e855e23430bd7f6af7552d82e0ece (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/e7468f6be6dc98f86508627f4f333b6d09d2ac31 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/e60ee54f7d650783d3b6dd7fdd749c64c6593353 (9.16-branch)
CVE-2026-5950 (An unbounded resend loop vulnerability exists in the BIND 9 resolver s ...)
{DSA-6285-1}
- bind9 1:9.20.23-1
NOTE: https://kb.isc.org/docs/cve-2026-5950
NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/1c390aacaedaf788a04ba053758c1b7f53673f0b (v9.20.23)
- NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/379ca10cf34759d0c007cebcd9280911161bca1a (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/c78042a013c04bd5db894543a6a02a7ed59e44c4 (9.16-branch)
+ NOTE: https://gitlab.isc.org/isc-projects/bind9/-/commit/eb73df0cebc8909a030a0db66d4366e2181bd3f5 (9.16-branch)
CVE-2026-5947 (Undefined behavior may result due to a race condition leading to a use ...)
- bind9 1:9.20.23-1
[trixie] - bind9 1:9.20.23-1~deb13u1
@@ -62506,6 +63191,7 @@ CVE-2026-33633 (Kitty is a cross-platform GPU based terminal. Versions 0.46.2 an
NOTE: Fixed by: https://github.com/kovidgoyal/kitty/commit/48ab623f594d60dbbfb1e767d9686d380ce547fb (v0.47.0)
CVE-2026-50142
- libheif 1.23.1-1
+ [trixie] - libheif <not-affected> (Vulnerable code introduced in 1.20.0)
NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-jvmp-j3cw-84mh
CVE-2026-48029 (libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ...)
- libheif 1.23.1-1
@@ -62517,10 +63203,13 @@ CVE-2026-47247 (libheif is a HEIF and AVIF file format decoder and encoder. Prio
- libheif 1.23.1-1
NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-2vh6-whr3-cmq3
CVE-2026-47251 (libheif is a HEIF and AVIF file format decoder and encoder. The fix fo ...)
- - libheif 1.23.1-1
+ - libheif <not-affected> (Incomplete patch for CVE-2026-3949 not applied standalone in Debian released version)
+ NOTE: Flaw in the bounds check added by the fix for CVE-2026-3949 (b97c8b5f, v1.22.0)
+ NOTE: The 'vvdec' backend is not built for the Debian binary packages
NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-p6q9-fhf2-vj9v
CVE-2026-47254 (libheif is a HEIF and AVIF file format decoder and encoder. Prior to v ...)
- libheif 1.23.1-1
+ [trixie] - libheif <not-affected> (Vulnerable code introduced in 1.20.0)
NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-wqjg-4x9g-6cvg
CVE-2026-47714 (libheif is a HEIF and AVIF file format decoder and encoder. In version ...)
- libheif 1.23.1-1
@@ -62530,6 +63219,9 @@ CVE-2026-32882 (libheif is a HEIF and AVIF file format decoder and encoder. Vers
NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-hg7q-rjr2-8x46
CVE-2026-32814 (libheif is a HEIF and AVIF file format decoder and encoder. In version ...)
- libheif 1.23.1-1 (bug #1137524)
+ [trixie] - libheif <not-affected> (Vulnerable code introduced in 1.21.0)
+ NOTE: Needs the strict_decoding leniency in ImageItem_Grid::decode_and_paste_tile_image()
+ NOTE: added by 0f17e1cd (v1.21.0); in 1.19.8 a tile decode error aborts the grid decode
NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-4m8r-34pg-rvwc
NOTE: https://github.com/strukturag/libheif/commit/724ad42638c025993a0de8b53b180e465397c500 (v1.22.0)
CVE-2026-32741 (libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ...)
@@ -62542,10 +63234,12 @@ CVE-2026-32740 (libheif is a HEIF and AVIF file format decoder and encoder. Vers
NOTE: https://github.com/strukturag/libheif/commit/6721f307ad684804b735e917dde7d372c5faae31 (v1.22.0)
CVE-2026-32739 (libheif is a HEIF and AVIF file format decoder and encoder. In version ...)
- libheif 1.23.1-1 (bug #1137524)
+ [trixie] - libheif <not-affected> (Vulnerable code introduced in 1.20.0)
NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-j9g7-q9hv-gq8c
NOTE: https://github.com/strukturag/libheif/commit/723b58d6ca329b2743822951aeaf3299c7410448 (v1.22.0)
CVE-2026-32738 (libheif is a HEIF and AVIF file format decoder and encoder. In version ...)
- libheif 1.23.1-1 (bug #1137524)
+ [trixie] - libheif <not-affected> (Vulnerable code introduced in 1.20.0)
NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww
NOTE: https://github.com/strukturag/libheif/commit/bdaa37728442800497ea224bd232ca25e2f9bdff (v1.22.0)
CVE-2026-32134 (NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. ...)
@@ -67762,7 +68456,6 @@ CVE-2026-44991 (OpenClaw before 2026.4.21 contains an authorization bypass vulne
CVE-2026-44777 (jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordi ...)
{DLA-4662-1 DLA-4599-1}
- jq 1.8.1-6 (bug #1136445)
- [trixie] - jq <no-dsa> (Minor issue)
NOTE: https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9
CVE-2026-44738 (Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandb ...)
NOT-FOR-US: Grav CMS
@@ -67803,7 +68496,6 @@ CVE-2026-43968 (Improper Neutralization of CRLF Sequences ('CRLF Injection') vul
CVE-2026-43896 (jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded r ...)
{DLA-4662-1 DLA-4599-1}
- jq 1.8.1-6 (bug #1136445)
- [trixie] - jq <no-dsa> (Minor issue)
NOTE: https://github.com/jqlang/jq/security/advisories/GHSA-mg96-6h3q-g846
CVE-2026-43895 (jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts ...)
{DLA-4662-1 DLA-4599-1}
@@ -67887,12 +68579,10 @@ CVE-2026-41431 (Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser sh
CVE-2026-41257 (jq is a command-line JSON processor. In 1.8.1 and earlier, the jq byte ...)
{DLA-4662-1 DLA-4599-1}
- jq 1.8.1-6 (bug #1136445)
- [trixie] - jq <no-dsa> (Minor issue)
NOTE: https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539
CVE-2026-41256 (jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level j ...)
{DLA-4662-1 DLA-4599-1}
- jq 1.8.1-6 (bug #1136445)
- [trixie] - jq <no-dsa> (Minor issue)
NOTE: https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fg
CVE-2026-41250 (Taiga is a project management platform for startups and agile develope ...)
NOT-FOR-US: Taiga
@@ -79815,15 +80505,18 @@ CVE-2026-35378 (A logic error in the expr utility of uutils coreutils causes the
NOTE: https://github.com/uutils/coreutils/pull/11395
NOTE: Fixed by: https://github.com/uutils/coreutils/commit/76b2f7877f558f3bfa78e3d4f49f022460f509b7 (0.8.0)
CVE-2026-35377 (A logic error in the env utility of uutils coreutils causes a failure ...)
- - rust-coreutils <unfixed> (bug #1136207)
+ - rust-coreutils 0.10.0-1 (bug #1136207)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/pull/11512
+ NOTE: https://github.com/uutils/coreutils/pull/12657
CVE-2026-35376 (A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the ch ...)
- - rust-coreutils <unfixed> (bug #1136203)
+ - rust-coreutils 0.10.0-1 (bug #1136203)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/pull/11402
+ NOTE: https://github.com/uutils/coreutils/pull/12566
+ NOTE: Fixed by: https://github.com/uutils/coreutils/commit/7cfc74e47ffab452663be6842d788a5164d9688b (0.10.0)
CVE-2026-35375 (A logic error in the split utility of uutils coreutils causes the corr ...)
- rust-coreutils 0.8.0-1 (bug #1134876)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
@@ -79831,15 +80524,18 @@ CVE-2026-35375 (A logic error in the split utility of uutils coreutils causes th
NOTE: https://github.com/uutils/coreutils/pull/11397
NOTE: Fixed by: https://github.com/uutils/coreutils/commit/d2b9550fe821a9a10bf0cec057509211357363f1 (0.8.0)
CVE-2026-35374 (A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the sp ...)
- - rust-coreutils <unfixed> (bug #1136202)
+ - rust-coreutils 0.10.0-1 (bug #1136202)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/pull/11401
+ NOTE: https://github.com/uutils/coreutils/pull/12565
+ NOTE: Fixed by: https://github.com/uutils/coreutils/commit/58040feb5c66fce588a7ffac299b3a23bd55cd81 (0.10.0)
CVE-2026-35373 (A logic error in the ln utility of uutils coreutils causes the program ...)
- - rust-coreutils <unfixed> (bug #1136201)
+ - rust-coreutils 0.10.0-1 (bug #1136201)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/pull/11403
+ NOTE: Fixed by: https://github.com/uutils/coreutils/commit/48d030dfb2ca7659ee2735f09cda706c8245a3fc (0.10.0)
CVE-2026-35372 (A logic error in the ln utility of uutils coreutils allows the utility ...)
- rust-coreutils 0.8.0-1 (bug #1134876)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
@@ -79915,10 +80611,11 @@ CVE-2026-35361 (The mknod utility in uutils coreutils fails to handle security l
NOTE: https://github.com/uutils/coreutils/pull/10582
NOTE: Fixed by: https://github.com/uutils/coreutils/commit/42b2ad83cdcf6e959ecb378c5040c60d9c64becf (0.6.0)
CVE-2026-35360 (The touch utility in uutils coreutils is vulnerable to a Time-of-Check ...)
- - rust-coreutils <unfixed> (bug #1136044)
+ - rust-coreutils 0.10.0-1 (bug #1136044)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/issues/10019
+ NOTE: Fixed by: https://github.com/uutils/coreutils/commit/ca0c842e71a9f75b31c87f701952f9e174a320ce (0.10.0)
CVE-2026-35359 (A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utilit ...)
- rust-coreutils 0.8.0-1 (bug #1134876)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
@@ -79961,10 +80658,11 @@ CVE-2026-35353 (The mkdir utility in uutils coreutils incorrectly applies permis
NOTE: https://github.com/uutils/coreutils/pull/10036
NOTE: Fixed by: https://github.com/uutils/coreutils/commit/037b9583bc03d814e8516df54ebcda6f681fe1f8 (0.6.0)
CVE-2026-35352 (A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the m ...)
- - rust-coreutils <unfixed> (bug #1136042)
+ - rust-coreutils 0.10.0-1 (bug #1136042)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/issues/10020
+ NOTE: Fixed by: https://github.com/uutils/coreutils/commit/c004672c5eb2415b03f11f766583c4b967ba024f (0.10.0)
CVE-2026-35351 (The mv utility in uutils coreutils fails to preserve file ownership du ...)
- rust-coreutils 0.9.0-1 (bug #1136041)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
@@ -79984,10 +80682,11 @@ CVE-2026-35349 (A vulnerability in the rm utility of uutils coreutils allows a b
NOTE: https://github.com/uutils/coreutils/pull/9706
NOTE: Fixed by: https://github.com/uutils/coreutils/commit/5e5968cdbc6618acd6c2402a8a98b503f278835e (0.7.0)
CVE-2026-35348 (The sort utility in uutils coreutils is vulnerable to a process panic ...)
- - rust-coreutils <unfixed> (bug #1135996)
+ - rust-coreutils 0.10.0-1 (bug #1135996)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/issues/9696
+ NOTE: https://github.com/uutils/coreutils/pull/11593
CVE-2026-35347 (The comm utility in uutils coreutils incorrectly consumes data from no ...)
- rust-coreutils 0.6.0-1
[trixie] - rust-coreutils <no-dsa> (Minor issue)
@@ -80007,10 +80706,11 @@ CVE-2026-35345 (A vulnerability in the tail utility of uutils coreutils allows f
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/issues/10328
CVE-2026-35344 (The dd utility in uutils coreutils suppresses errors during file trunc ...)
- - rust-coreutils <unfixed> (bug #1135993)
+ - rust-coreutils 0.10.0-1 (bug #1135993)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/issues/9745
+ NOTE: Fixed by: https://github.com/uutils/coreutils/commit/0f538b942a5cdaba6e0960f6952429a1baaedf93 (0.10.0)
CVE-2026-35343 (The cut utility in uutils coreutils incorrectly handles the -s (only-d ...)
- rust-coreutils 0.7.0-1 (bug #1134876)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
@@ -89213,6 +89913,7 @@ CVE-2026-35172 (Distribution is a toolkit to pack, ship, store, and deliver cont
- docker-registry 2.8.3+ds1-3 (bug #1134567)
[trixie] - docker-registry <no-dsa> (Minor issue)
[bookworm] - docker-registry <no-dsa> (Minor issue)
+ [bullseye] - docker-registry <postponed> (Minor issue)
NOTE: https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc
CVE-2026-35170 (openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlie ...)
NOT-FOR-US: openFPGALoader
@@ -89527,6 +90228,8 @@ CVE-2026-33727 (Pi-hole is a Linux network-level advertisement and Internet trac
CVE-2026-33540 (Distribution is a toolkit to pack, ship, store, and deliver container ...)
- docker-registry 2.8.3+ds1-3 (bug #1134567)
[trixie] - docker-registry <no-dsa> (Minor issue)
+ [bookworm] - docker-registry <postponed> (Minor issue)
+ [bullseye] - docker-registry <postponed> (Minor issue)
NOTE: https://github.com/distribution/distribution/security/advisories/GHSA-3p65-76g6-3w7r
CVE-2026-33510 (Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross ...)
NOT-FOR-US: Homarr
@@ -111041,6 +111744,7 @@ CVE-2025-63946 (A privilege escalation (PE) vulnerability in the Tencent PC Mana
CVE-2025-63945 (A privilege escalation (PE) vulnerability in the Tencent iOA app thru ...)
NOT-FOR-US: Tencent iOA app
CVE-2025-61147 (strukturag libde265 commit d9fea9d wa discovered to contain a segmenta ...)
+ {DSA-6413-1}
- libde265 1.0.18-1 (bug #1129257; unimportant)
NOTE: https://github.com/strukturag/libde265/issues/484
NOTE: Fixed by: https://github.com/strukturag/libde265/commit/8b17e0930f77db07f55e0b89399a8f054ddbecf7
@@ -156465,6 +157169,7 @@ CVE-2025-40099 (In the Linux kernel, the following vulnerability has been resolv
[trixie] - linux 6.12.57-1
NOTE: https://git.kernel.org/linus/6447b0e355562a1ff748c4a2ffb89aae7e84d2c9 (6.18-rc2)
CVE-2025-40098 (In the Linux kernel, the following vulnerability has been resolved: A ...)
+ {DSA-6415-1}
- linux 6.17.6-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
@@ -164811,7 +165516,7 @@ CVE-2025-43824 (The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, an
NOT-FOR-US: Liferay
CVE-2025-34251 (Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contain ...)
NOT-FOR-US: Tesla
-CVE-2025-11362 (Versions of the package pdfmake before 0.3.0-beta.17 are vulnerable to ...)
+CVE-2025-11362 (Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-bet ...)
NOT-FOR-US: pdfmake
CVE-2025-11358 (A weakness has been identified in code-projects Simple Banking System ...)
NOT-FOR-US: code-projects
@@ -306945,15 +307650,15 @@ CVE-2024-39242 (A cross-site scripting (XSS) vulnerability in skycaiji v2.8 allo
CVE-2024-39241 (Cross Site Scripting (XSS) vulnerability in skycaiji 2.8 allows attack ...)
NOT-FOR-US: skycaiji
CVE-2024-38950 (Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attacker ...)
+ {DSA-6413-1}
- libde265 1.1.1-1 (bug #1074416)
- [trixie] - libde265 <postponed> (Minor issue, revisit when fixed upstream)
[bookworm] - libde265 <postponed> (Minor issue, revisit when fixed upstream)
[bullseye] - libde265 <no-dsa> (Minor issue)
NOTE: https://github.com/strukturag/libde265/issues/460
NOTE: https://github.com/strukturag/libde265/commit/4089de0845e0009e019be4ca5cbebaf2aee0a8ce (v1.0.19)
CVE-2024-38949 (Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attacker ...)
+ {DSA-6413-1}
- libde265 1.1.1-1 (bug #1074416)
- [trixie] - libde265 <postponed> (Minor issue, revisit when fixed upstream)
[bookworm] - libde265 <postponed> (Minor issue, revisit when fixed upstream)
[bullseye] - libde265 <no-dsa> (Minor issue)
NOTE: https://github.com/strukturag/libde265/issues/460
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,11 @@
+[06 Aug 2026] DLA-4722-1 redis - security update
+ {CVE-2026-66373}
+ [bullseye] - redis 5:6.0.16-1+deb11u9
+ [bookworm] - redis 5:7.0.15-1~deb12u9
+[06 Aug 2026] DLA-4721-1 async-http-client - security update
+ {CVE-2026-55688}
+ [bullseye] - async-http-client 2.12.2-1+deb11u1
+ [bookworm] - async-http-client 2.12.3-1+deb12u1
[05 Aug 2026] DLA-4720-1 linux - security update
{CVE-2024-36013 CVE-2025-40196 CVE-2026-31610 CVE-2026-43216 CVE-2026-46135 CVE-2026-53332 CVE-2026-53392 CVE-2026-53393 CVE-2026-53399 CVE-2026-53400 CVE-2026-53402 CVE-2026-63797 CVE-2026-63806 CVE-2026-63810 CVE-2026-63815 CVE-2026-63818 CVE-2026-63829 CVE-2026-64187 CVE-2026-64189 CVE-2026-64206 CVE-2026-64248 CVE-2026-64250 CVE-2026-64266 CVE-2026-64268 CVE-2026-64269 CVE-2026-64271 CVE-2026-64273 CVE-2026-64274 CVE-2026-64275 CVE-2026-64276 CVE-2026-64277 CVE-2026-64279 CVE-2026-64296 CVE-2026-64297 CVE-2026-64298 CVE-2026-64299 CVE-2026-64301 CVE-2026-64303 CVE-2026-64304 CVE-2026-64306 CVE-2026-64312 CVE-2026-64313 CVE-2026-64315 CVE-2026-64316 CVE-2026-64317 CVE-2026-64318 CVE-2026-64322 CVE-2026-64323 CVE-2026-64324 CVE-2026-64329 CVE-2026-64330 CVE-2026-64331 CVE-2026-64332 CVE-2026-64333 CVE-2026-64334 CVE-2026-64335 CVE-2026-64336 CVE-2026-64337 CVE-2026-64338 CVE-2026-64340 CVE-2026-64342 CVE-2026-64343 CVE-2026-64344 CVE-2026-64346 CVE-2026-64347 CVE-2026-64350 CVE-2026-64351 CVE-2026-64352 CVE-2026-64355 CVE-2026-64359 CVE-2026-64360 CVE-2026-64361 CVE-2026-64362 CVE-2026-64363 CVE-2026-64364 CVE-2026-64365 CVE-2026-64370 CVE-2026-64371 CVE-2026-64372 CVE-2026-64373 CVE-2026-64374 CVE-2026-64375 CVE-2026-64376 CVE-2026-64378 CVE-2026-64379 CVE-2026-64380 CVE-2026-64381 CVE-2026-64390 CVE-2026-64393 CVE-2026-64394 CVE-2026-64395 CVE-2026-64396 CVE-2026-64397 CVE-2026-64398 CVE-2026-64399 CVE-2026-64401 CVE-2026-64403 CVE-2026-64406 CVE-2026-64408 CVE-2026-64409 CVE-2026-64411 CVE-2026-64412 CVE-2026-64413 CVE-2026-64417 CVE-2026-64419 CVE-2026-64420 CVE-2026-64422 CVE-2026-64423 CVE-2026-64425 CVE-2026-64428 CVE-2026-64429 CVE-2026-64430 CVE-2026-64432 CVE-2026-64435 CVE-2026-64436 CVE-2026-64437 CVE-2026-64438 CVE-2026-64440 CVE-2026-64441 CVE-2026-64442 CVE-2026-64443 CVE-2026-64444 CVE-2026-64445 CVE-2026-64446 CVE-2026-64448 CVE-2026-64449 CVE-2026-64450 CVE-2026-64452 CVE-2026-64454 CVE-2026-64455 CVE-2026-64456 CVE-2026-64458 CVE-2026-64461 CVE-2026-64462 CVE-2026-64465 CVE-2026-64468 CVE-2026-64469 CVE-2026-64470 CVE-2026-64471 CVE-2026-64472 CVE-2026-64475 CVE-2026-64476 CVE-2026-64478 CVE-2026-64480 CVE-2026-64482 CVE-2026-64483 CVE-2026-64484 CVE-2026-64486 CVE-2026-64487 CVE-2026-64488 CVE-2026-64489 CVE-2026-64494 CVE-2026-64495 CVE-2026-64496 CVE-2026-64497 CVE-2026-64500 CVE-2026-64503 CVE-2026-64504 CVE-2026-64505 CVE-2026-64510 CVE-2026-64512 CVE-2026-64514 CVE-2026-64530 CVE-2026-64531 CVE-2026-64532 CVE-2026-64533 CVE-2026-64534 CVE-2026-64535 CVE-2026-64536 CVE-2026-64537 CVE-2026-64538 CVE-2026-64539 CVE-2026-64540 CVE-2026-64541 CVE-2026-64544 CVE-2026-64545 CVE-2026-64546 CVE-2026-64547 CVE-2026-64548 CVE-2026-64549 CVE-2026-64550 CVE-2026-64551 CVE-2026-64552 CVE-2026-64553 CVE-2026-64554 CVE-2026-64557 CVE-2026-64560 CVE-2026-64600}
[bookworm] - linux 6.1.180-1
=====================================
data/DSA/list
=====================================
@@ -1,3 +1,15 @@
+[07 Aug 2026] DSA-6416-1 jq - security update
+ {CVE-2024-53427 CVE-2026-32316 CVE-2026-40612 CVE-2026-41256 CVE-2026-41257 CVE-2026-43894 CVE-2026-43895 CVE-2026-43896 CVE-2026-44777 CVE-2026-47770 CVE-2026-49839 CVE-2026-54679}
+ [trixie] - jq 1.7.1-6+deb13u3
+[06 Aug 2026] DSA-6415-1 linux - security update
+ {CVE-2025-40098 CVE-2026-45897 CVE-2026-45901 CVE-2026-53078 CVE-2026-53090 CVE-2026-64205 CVE-2026-64280 CVE-2026-64290 CVE-2026-64561 CVE-2026-64562 CVE-2026-64563 CVE-2026-64564 CVE-2026-64565 CVE-2026-64567 CVE-2026-64568 CVE-2026-64569 CVE-2026-64570 CVE-2026-64571 CVE-2026-64572 CVE-2026-64573 CVE-2026-64574 CVE-2026-64576 CVE-2026-64577 CVE-2026-64578 CVE-2026-64579 CVE-2026-64580 CVE-2026-64583 CVE-2026-64584}
+ [trixie] - linux 6.12.101-1
+[06 Aug 2026] DSA-6414-1 udisks2 - security update
+ {CVE-2026-7867}
+ [trixie] - udisks2 2.10.1-12.1+deb13u2
+[06 Aug 2026] DSA-6413-1 libde265 - security update
+ {CVE-2024-38949 CVE-2024-38950 CVE-2025-61147 CVE-2026-45382 CVE-2026-45383 CVE-2026-49295 CVE-2026-49337 CVE-2026-49346 CVE-2026-54240 CVE-2026-54241}
+ [trixie] - libde265 1.0.15-1+deb13u1
[05 Aug 2026] DSA-6412-1 botan3 - security update
{CVE-2026-44378}
[trixie] - botan3 3.12.0+dfsg-2~deb13u1
=====================================
data/dla-needed.txt
=====================================
@@ -61,9 +61,6 @@ aom/bookworm
apache-log4j2/bullseye
NOTE: 20260413: Added by Front-Desk (rouca)
--
-async-http-client (Chris Lamb)
- NOTE: 20260610: Added by Front-Desk (rouca)
---
bind9 (eamanu)
NOTE: 20260520: Added by Front-Desk (Beuc)
NOTE: 20260520: 6 new CVEs including 1 memory corruption, upcoming DSA (Beuc/front-desk)
@@ -328,6 +325,9 @@ libde265
NOTE: 20260709: HEVC decoder overflow/UAF (CVE-2026-45382/45383/49295/49337/49346/54240/54241);
NOTE: 20260709: upstream fixes v1.0.19-v1.1.1 newer than Debian 1.0.11.
--
+libgd-securityimage-perl
+ NOTE: 20260806: Added by Front-Desk (rouca)
+--
libgd2 (guilhem)
NOTE: 20260731: Added by Front-Desk (ta)
--
@@ -533,6 +533,10 @@ node-lodash/bookworm (utkarsh)
NOTE: 20260703: Added by Front-Desk (dleidert)
NOTE: 20260703: Follow DLA 4663-1; assigned to Utkarsh to grab this (dleidert/front-desk)
--
+node-re2
+ NOTE: 20260806: Added by Front-Desk (rouca)
+ NOTE: 20260806: CVE-2026-68499 is worth fixing due to re2 used for fixing redos and other regex problem on backport (rouca)
+--
nodejs
NOTE: 20260622: Added by Front-Desk (lamby)
--
@@ -688,6 +692,9 @@ python-aiohttp (dleidert)
NOTE: 20260611: Added by Front-Desk (rouca)
NOTE: 20260602: Daniel Leidert is proposing to work on the update and provide debdiffs for bookworm and trixie (carnil)
--
+python-asyncssh
+ NOTE: 20260806: Added by Front-Desk (rouca)
+--
python-cryptography
NOTE: 20260805: Added by Front-Desk (rouca)
--
@@ -761,14 +768,6 @@ rabbitmq-server/bullseye
rails
NOTE: 20260805: Added by Front-Desk (rouca)
--
-redis (Chris Lamb)
- NOTE: 20260727: Added by Front-Desk (utkarsh)
- NOTE: 20260727: CVE-2026-66373: double free in the stream consumer PEL
- NOTE: 20260727: loader (rdbLoadObject), reachable via RESTORE. Fixed
- NOTE: 20260727: upstream in 6.2.23/7.2.15/8.6.5; bookworm ships
- NOTE: 20260727: 7.0.15-1~deb12u8 and bullseye 6.0.16-1+deb11u8, both
- NOTE: 20260727: still unguarded.
---
request-tracker4/bullseye (Andrew Ruthven)
NOTE: 20260529: Added by Front-Desk (dleidert)
NOTE: 20260529: Follow DSA in preparation by maintainer (dleidert/front-desk)
=====================================
data/dsa-needed.txt
=====================================
@@ -25,6 +25,8 @@ cacti
--
caddy
--
+chromium (dilinger)
+--
cockpit
--
containerd
@@ -52,9 +54,6 @@ jetty9
--
jetty12
--
-jq (aron)
- possibly move trixie to 1.8.2
---
jupyterlab
--
kamailio
@@ -62,10 +61,7 @@ kamailio
kitty
Maintainer proposed debdiff for review in https://bugs.debian.org/1139898#15
--
-libde265 (aron)
- possibly best to move to 1.1.1
---
-libheif
+libheif (aron)
possibly best to move to 1.23.0
--
librabbitmq
=====================================
data/embedded-code-copies
=====================================
@@ -3073,6 +3073,7 @@ texlive-bin
NOTE: embeds synctex parser
- qpdfview <unfixed> (embed; bug #754138)
NOTE: embeds synctex parser
+ NOTE: texlive-bin is considered under Debian main source for synctex parser
libmspack
- cabextract 1.4-5 (embed; bug #675560)
@@ -3975,11 +3976,3 @@ erlang-cowlib
node-systeminformation
- jupyterlab 4.0.11+ds5+~cs11.25.27-1 (embed)
NOTE: node-systeminformation split from jupyterlab
-
-libsynctex2 (embed in texlive-bin)
- - texlive-bin <unfixable> (embed)
- - texworks 0.5~svn1363-5 (embed but not compiled)
- - texstudio <unfixed> (embed)
- - emacs-pdf-tools 0.90-1 (embed)
- - okular <unfixed> (embed)
- NOTE: texlive-bin is considered under debian as main source
=====================================
data/packages/nfu.yaml
=====================================
@@ -382,6 +382,7 @@
- product: Apache OpenMeetings
- product: Apache OpenOffice
- product: Apache Polaris
+ - product: Apache Qpid ProtonJ2
- product: Apache Ranger
- product: Apache SIS
- product: Apache Seata (incubating)
=====================================
lib/python/bugs.py
=====================================
@@ -31,10 +31,10 @@ def listUrgencies():
Urgency.urgencies = urgencies
return urgencies
def internUrgency(name, urgencies=listUrgencies()):
- if name in urgencies:
+ try:
return urgencies[name]
- else:
- return None
+ except KeyError as err:
+ raise ValueError("invalid urgency") from err
del listUrgencies
def to_integer(expr):
@@ -63,13 +63,9 @@ class PackageNote:
else:
if isinstance(release, str):
release = debian_support.internRelease(release)
- if release is None:
- raise ValueError("invalid release")
self.release = release
if isinstance(urgency, str):
urgency = internUrgency(urgency)
- if urgency is None:
- raise ValueError("invalid urgency")
self.urgency = urgency
self.bugs = []
self.package_kind = "unknown"
@@ -144,10 +140,11 @@ class PackageNoteParsed(PackageNote):
urgency = 'not yet assigned'
if notes is not None:
for n in self.re_notes_split.split(notes):
- u = internUrgency(n)
- if u:
- urgency = u
+ try:
+ urgency = internUrgency(n)
continue
+ except ValueError:
+ pass
if n == 'bug filed':
continue
@@ -172,10 +169,7 @@ class PackageNoteNoDSA:
else:
assert isinstance(reason, str)
self.package = package
- release = debian_support.internRelease(release)
- if release is None:
- raise ValueError("invalid release")
- self.release = release
+ self.release = debian_support.internRelease(release)
self.comment = comment
self.reason = reason
=====================================
lib/python/debian_support.py
=====================================
@@ -218,10 +218,10 @@ def listReleases():
Release.releases = releases
return releases
def internRelease(name, releases=listReleases()):
- if name in releases:
+ try:
return releases[name]
- else:
- return None
+ except KeyError as err:
+ raise ValueError("invalid release") from err
del listReleases
def readLinesSHA1(lines):
=====================================
lib/python/security_db.py
=====================================
@@ -31,6 +31,7 @@ import apsw
import bugs
from collections import defaultdict, namedtuple
import email.utils
+import enum
import functools
import json
import pickle
@@ -61,6 +62,15 @@ class InsertError(Exception):
def __str__(self):
return self.errors[0] + ' [more...]'
+
+class Vulnerable(enum.IntEnum):
+ """vulnerable column value for source_package_status table"""
+
+ FIXED = 0
+ AFFECTED = 1
+ UNDETERMINED = 2
+
+
def mergeLists(a, b):
"""Merges two lists."""
if isinstance(a, str):
@@ -73,14 +83,7 @@ def mergeLists(a, b):
b = []
else:
b = b.split(',')
- result = {}
- for x in a:
- result[x] = 1
- for x in b:
- result[x] = 1
- result = list(result.keys())
- result.sort()
- return result
+ return sorted(set(a).union(b))
class NVDEntry:
"""A class for an entry in the nvd_data table.
@@ -155,7 +158,7 @@ def getBugsForSourcePackage(cursor, pkg):
# Restrict to regular releases excluding e.g. backports.
release_names = tuple(debian_support.Release.releases)
- data = itertools.starmap(
+ data_iter = itertools.starmap(
BugsForSourcePackage_internal,
cursor.execute(
BugsForSourcePackage_query.replace(
@@ -168,7 +171,7 @@ def getBugsForSourcePackage(cursor, pkg):
all_bugs = []
version_key = functools.cmp_to_key(version_compare)
# Group by bug name.
- for bug_name, data in itertools.groupby(data,
+ for bug_name, data in itertools.groupby(data_iter,
lambda row: row.bug_name):
description = None
open_seen = False
@@ -190,7 +193,7 @@ def getBugsForSourcePackage(cursor, pkg):
# Compute state. Update state-seen flags for global state
# determination.
- if best_row.vulnerable:
+ if best_row.vulnerable != Vulnerable.FIXED:
if best_row.urgency == 'unimportant':
state = 'unimportant'
unimportant_seen = True
@@ -207,7 +210,7 @@ def getBugsForSourcePackage(cursor, pkg):
bug = BugForSourcePackageRelease(
best_row.release, best_row.subrelease, best_row.version,
- best_row.vulnerable, state, comment, reason)
+ Vulnerable(best_row.vulnerable), state, comment, reason)
releases[best_row.release] = bug
# Compute global_state.
@@ -442,7 +445,7 @@ class DB:
cursor.execute("""CREATE TABLE source_package_status
(bug_name TEXT NOT NULL,
package INTEGER NOT NULL REFERENCES source_packages(rowid),
- vulnerable INTEGER NOT NULL,
+ vulnerable INTEGER NOT NULL CHECK (vulnerable IN (0, 1, 2)),
urgency TEXT NOT NULL,
PRIMARY KEY (bug_name, package))""")
cursor.execute(
@@ -863,7 +866,7 @@ class DB:
# stores aggregated data, and there is no efficient way to
# handle updates of the records related to a single file.
- packages = {}
+ packages = defaultdict(set)
unchanged = True
for filename in filenames:
match = re_packages.match(filename)
@@ -884,10 +887,7 @@ class DB:
% (arch, name))
key = (name, release, subrelease, archive, version,
source, source_version)
- if key in packages:
- packages[key][arch] = 1
- else:
- packages[key] = {arch : 1}
+ packages[key].add(arch)
if unchanged:
if self.verbose:
@@ -899,18 +899,12 @@ class DB:
cursor.execute("DELETE FROM binary_packages")
self._clearVersions(cursor)
- l = list(packages.keys())
-
- if len(l) == 0:
+ if len(packages) == 0:
raise ValueError("no binary packages found")
- l.sort()
def gen():
- for key in l:
- archs = list(packages[key].keys())
- archs.sort()
- archs = ','.join(archs)
- yield key + (archs,)
+ for key, archs in sorted(packages.items()):
+ yield key + (",".join(sorted(archs)),)
if self.verbose:
print(" storing binary package data")
@@ -1432,12 +1426,12 @@ class DB:
ORDER BY sp.name""",
(bug_name,)):
have_something = True
- if vulnerable == 1:
+ if vulnerable == Vulnerable.AFFECTED:
if urgency == 'unimportant':
unimportant_packages.append( package )
else:
vulnerable_packages.append(package)
- elif vulnerable == 2:
+ elif vulnerable == Vulnerable.UNDETERMINED:
undetermined_packages.append(package)
if vulnerable_packages or undetermined_packages:
@@ -1485,7 +1479,7 @@ class DB:
# here.
status = {'' : {}, 'security' : {}, 'lts' : {}}
- for (package, note, subrelease, vulnerable, urgency) in cursor.execute(
+ for (package, note, subrelease, vulnerable_int, urgency) in cursor.execute(
"""SELECT DISTINCT sp.name, n.id, sp.subrelease,
st.vulnerable, n.urgency
FROM source_package_status AS st,
@@ -1495,33 +1489,26 @@ class DB:
AND n.bug_name = st.bug_name AND n.package = sp.name
ORDER BY sp.name""",
(bug_name, nickname)):
- status[subrelease][(package, note)] = (vulnerable,urgency)
+ status[subrelease][(package, note)] = (Vulnerable(vulnerable_int), urgency)
# Check if any packages in plain testing are vulnerable, and
# if all of those have been fixed in the security archive.
fixed_in_security = True
- unfixed_pkgs = {}
- undet_pkgs = {}
- unimp_pkgs = {}
+ unfixed_pkgs = set()
+ undet_pkgs = set()
+ unimp_pkgs = set()
for ((package, note), (vulnerable, urgency)) in status[''].items():
- if vulnerable == 1:
+ if vulnerable == Vulnerable.AFFECTED:
if urgency == 'unimportant':
- unimp_pkgs[package] = True
+ unimp_pkgs.add(package)
else:
- unfixed_pkgs[package] = True
+ unfixed_pkgs.add(package)
if status['security'].get((package, note), True):
fixed_in_security = False
elif status['lts'].get((package, note), True):
fixed_in_security = False
- elif vulnerable == 2:
- undet_pkgs[package] = True
-
- unfixed_pkgs = list(unfixed_pkgs.keys())
- unfixed_pkgs.sort()
- undet_pkgs = list(undet_pkgs.keys())
- undet_pkgs.sort()
- unimp_pkgs = list(unimp_pkgs.keys())
- unimp_pkgs.sort()
+ elif vulnerable == Vulnerable.UNDETERMINED:
+ undet_pkgs.add(package)
pkgs = ""
result = "undetermined"
@@ -1533,9 +1520,9 @@ class DB:
result = "fixed"
if len(unfixed_pkgs) > 0:
if len(unfixed_pkgs) == 1:
- pkgs += "package " + unfixed_pkgs[0] + " is "
+ pkgs += "package " + next(iter(unfixed_pkgs)) + " is "
else:
- pkgs += "packages " + ", ".join(unfixed_pkgs) + " are "
+ pkgs += "packages " + ", ".join(sorted(unfixed_pkgs)) + " are "
if fixed_in_security:
pkgs = "%sfixed in %s-security. " % (pkgs, suite)
if suite == "stable":
@@ -1547,15 +1534,15 @@ class DB:
result = "vulnerable"
if len(undet_pkgs) > 0:
if len(undet_pkgs) == 1:
- pkgs += "package " + undet_pkgs[0] + " may be vulnerable but needs to be checked."
+ pkgs += "package " + next(iter(undet_pkgs)) + " may be vulnerable but needs to be checked."
else:
- pkgs += "packages " + ", ".join(undet_pkgs) + " may be vulnerable but need to be checked."
+ pkgs += "packages " + ", ".join(sorted(undet_pkgs)) + " may be vulnerable but need to be checked."
if len(unimp_pkgs) > 0 and len(undet_pkgs) == 0 and len(unfixed_pkgs) == 0:
result = "fixed"
if len(unimp_pkgs) == 1:
- pkgs = "package %s is vulnerable; however, the security impact is unimportant." % unimp_pkgs[0]
+ pkgs = "package %s is vulnerable; however, the security impact is unimportant." % next(iter(unimp_pkgs))
else:
- pkgs = "packages %s are vulnerable; however, the security impact is unimportant." % (', '.join(unimp_pkgs))
+ pkgs = "packages %s are vulnerable; however, the security impact is unimportant." % (', '.join(sorted(unimp_pkgs)))
cursor.execute("""INSERT INTO bug_status
(bug_name, release, status, reason)
@@ -1641,8 +1628,7 @@ class DB:
if fix_available_sql:
for (v,) in c.execute(fix_available_sql,
(package, release, name)):
- assert v is not None
- if not v:
+ if Vulnerable(v) == Vulnerable.FIXED:
fix_available = 'F'
break
@@ -1665,9 +1651,9 @@ class DB:
kind, urgency_to_flag[urgency], remote,
fix_available,
package, fixed_version, description))
- result = zlib.compress(''.join(result).encode('utf-8'), 9)
+ compressed = zlib.compress(''.join(result).encode('utf-8'), 9)
- self.storeExport('debsecan/release/' + release, 'application/octet-stream', result)
+ self.storeExport('debsecan/release/' + release, 'application/octet-stream', compressed)
c.execute("DROP TABLE vulnlist")
@@ -1711,7 +1697,7 @@ class DB:
'not yet assigned' : ' '}
vuln_list = []
- source_packages = {}
+ source_packages = set()
def fill_vuln_list(source_packages=source_packages):
for (bug, package) in list(c.execute(
"""SELECT DISTINCT bug_name, package
@@ -1732,7 +1718,7 @@ class DB:
unstable_fixed = ''
total_urgency = ''
- other_versions = {}
+ other_versions = set()
is_binary = False
is_unknown = False
fixed_releases = {}
@@ -1755,7 +1741,7 @@ class DB:
if kind == 'binary':
is_binary = True
elif kind == 'source':
- source_packages[package] = True
+ source_packages.add(package)
else:
is_unknown = True
@@ -1784,7 +1770,7 @@ class DB:
if v is None:
continue
if debian_support.Version(v) >= v_ref:
- other_versions[v] = True
+ other_versions.add(v)
# The second part of this SELECT statement
# covers binary-only NMUs.
@@ -1796,7 +1782,7 @@ class DB:
AND release = ?2 AND subrelease IN ('', 'security', 'lts')""",
(package, release)):
if debian_support.Version(v) >= v_ref:
- other_versions[v] = True
+ other_versions.add(v)
if not total_urgency:
total_urgency = 'unknown'
@@ -1818,9 +1804,7 @@ class DB:
elif is_unknown:
bs_flag = ' '
- other_versions = list(other_versions.keys())
- other_versions.sort()
- other_versions = ' '.join(other_versions)
+ other_versions_str = ' '.join(sorted(other_versions))
vuln_list.append(("%s,%d,%c%c%c"
% (package, bug_to_index[bug],
@@ -1828,14 +1812,12 @@ class DB:
bug_to_remote_flag[bug]),
fixed_releases.keys(),
",%s,%s"
- % (unstable_fixed, other_versions)))
+ % (unstable_fixed, other_versions_str)))
fill_vuln_list()
- source_packages = list(source_packages.keys())
- source_packages.sort()
def store_value(name, value):
- value = zlib.compress(value.encode('utf-8'), 9)
- self.storeExport('debsecan/' + name, 'application/octet-stream', value)
+ compressed = zlib.compress(value.encode('utf-8'), 9)
+ self.storeExport('debsecan/' + name, 'application/octet-stream', compressed)
def gen_release(release):
result = result_start[:]
@@ -1848,7 +1830,7 @@ class DB:
result.append(prefix + fixed + suffix)
result.append('')
- for sp in source_packages:
+ for sp in sorted(source_packages):
bp_list = []
for (bp,) in c.execute("""SELECT name FROM binary_packages
WHERE source = ? AND release = ? AND subrelease = ''
@@ -1867,7 +1849,7 @@ class DB:
gen_release(release)
result = result_start
- for (prefix, release, suffix) in vuln_list:
+ for (prefix, releases, suffix) in vuln_list:
result.append(prefix + ' ' + suffix)
result.append('')
result.append('')
@@ -1907,7 +1889,7 @@ class DB:
nodsa_reason = defaultdict(lambda: defaultdict(dict))
next_point_update = defaultdict(lambda: defaultdict(set))
supported_releases = config.get_supported_releases()
- for (pkg, issue, desc, debianbug, release, subrelease, db_version, db_fixed_version, db_status, db_urgency, db_remote, db_nodsa, db_nodsa_reason, db_next_point_update) in self.cursor().execute(
+ for (pkg, issue, desc, debianbug, release, subrelease, db_version, db_fixed_version, db_vulnerable_int, db_urgency, db_remote, db_nodsa, db_nodsa_reason, db_next_point_update) in self.cursor().execute(
"""SELECT sp.name, st.bug_name,
(SELECT cve_desc FROM nvd_data
WHERE cve_name = st.bug_name),
@@ -1937,9 +1919,10 @@ class DB:
AND sp.release IN (""" + ",".join("?" * len(supported_releases)) + """)
ORDER BY sp.name, st.bug_name, sp.release, sp.subrelease""" , supported_releases):
+ db_vulnerable = Vulnerable(db_vulnerable_int)
### to ease debugging...:
#if issue in ('CVE-2012-6656','CVE-2014-8738','CVE-2013-6673') :
- # print pkg, issue, release, subrelease, db_version, db_fixed_version, db_status
+ # print pkg, issue, release, subrelease, db_version, db_fixed_version, db_vulnerable
if pkg not in packages:
packages.append(pkg)
if issue not in issues[pkg]:
@@ -1958,7 +1941,7 @@ class DB:
repositories[pkg][issue].append(repository)
version[pkg][issue][repository] = db_version
fixed_version[pkg][issue][repository] = db_fixed_version
- status[pkg][issue][repository] = db_status
+ status[pkg][issue][repository] = db_vulnerable
urgency[pkg][issue][repository] = db_urgency
if db_next_point_update:
next_point_update[pkg][issue].add(db_next_point_update)
@@ -2006,11 +1989,10 @@ class DB:
# keep looking for a real winner...
winner=suffix
repository=release+winner
- if status[pkg][issue][repository] == 0:
- # 1 = vulnerable, 2 = undetermined
+ if status[pkg][issue][repository] == Vulnerable.FIXED:
state = "resolved"
suite_fixed_version = fixed_version[pkg][issue][repository]
- elif status[pkg][issue][repository] == 2:
+ elif status[pkg][issue][repository] == Vulnerable.UNDETERMINED:
state = "undetermined"
else:
state = "open"
@@ -2127,21 +2109,21 @@ class DB:
RELEASE-LIST, VERSION, VULNERABLE-FLAG) of source packages
which are related to the given bug."""
- releases = config.get_supported_releases()
- values = [bug] + releases
+ supported_releases = config.get_supported_releases()
+ values = [bug] + supported_releases
- for (package, releases, version, vulnerable) in cursor.execute(
+ for (package, releases, version, vulnerable_int) in cursor.execute(
"""SELECT package, string_list(release), version, vulnerable
FROM (SELECT p.name AS package,
release_name(p.release, p.subrelease, p.archive) AS release,
p.version AS version, s.vulnerable AS vulnerable
FROM source_package_status AS s, source_packages AS p
WHERE s.bug_name = ? AND p.rowid = s.package
- AND release in (""" + ",".join("?" * len(releases)) + """))
+ AND release in (""" + ",".join("?" * len(supported_releases)) + """))
GROUP BY package, version, vulnerable
ORDER BY package, releasepart_to_number(release), subreleasepart_to_number(release), version COLLATE version""",
values):
- yield package, releases.split(', '), version, vulnerable
+ yield package, releases.split(', '), version, Vulnerable(vulnerable_int)
def getBugsFromDebianBug(self, cursor, number):
"""A generator which returns a list of tuples
@@ -2284,7 +2266,7 @@ class DB:
if old_package:
yield (old_package, bugs)
- def getFakeBugs(self, cursor=None, vulnerability=0):
+ def getFakeBugs(self, cursor=None, vulnerability=Vulnerable.FIXED):
"""Returns a list of pairs (BUG-NAME, DESCRIPTION)."""
if cursor is None:
@@ -2449,7 +2431,5 @@ def test():
else:
assert False
- assert bugs.BugFromDB(cursor, 'DSA-311').isKernelOnly()
-
if __name__ == "__main__":
test()
=====================================
lib/python/web_support.py
=====================================
@@ -612,10 +612,6 @@ class WebServiceBase:
return Tag('html',
(HEAD(head_list), Tag('body', body_list, **body_attribs)))
- def pre_dispatch(self, url):
- """Invoked by handle prior to calling the registered handler."""
- pass
-
class ThreadingHTTPServer(ThreadingMixIn, HTTPServer):
daemon_threads = True
@@ -644,7 +640,6 @@ class WebServiceHTTP(WebServiceBase):
service_self.lock.acquire()
try:
- service_self.pre_dispatch()
r = method(remaining, params, url)
assert isinstance(r, Result), repr(r)
result = r.flatten_later()
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/0d152b4570d769ef383cc21ea2c813b6fbd99e57...53e84bf6519801f8b3a304876ea9c84299772330
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/0d152b4570d769ef383cc21ea2c813b6fbd99e57...53e84bf6519801f8b3a304876ea9c84299772330
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260807/72fedfda/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list