[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Aug 20 20:52:39 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ddad2f59 by security tracker role at 2026-08-20T19:14:18+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,577 @@
+CVE-2026-9033 (An unauthenticated attacker with network access to the captive portal ...)
+ TODO: check
+CVE-2026-8717
+ REJECTED
+CVE-2026-7485 (Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, ...)
+ TODO: check
+CVE-2026-77176 (A flaw was found in Kata Containers. In configurations utilizing genpo ...)
+ TODO: check
+CVE-2026-77148 (A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the ...)
+ TODO: check
+CVE-2026-77118 (A heap out-of-bounds write exists in the Photo CD (PCD) decoder of Gra ...)
+ TODO: check
+CVE-2026-77085 (n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection ...)
+ TODO: check
+CVE-2026-77084 (n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code e ...)
+ TODO: check
+CVE-2026-77083 (n8n is a workflow automation platform. In versions prior to 1.123.69, ...)
+ TODO: check
+CVE-2026-77082 (n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 conta ...)
+ TODO: check
+CVE-2026-77081 (n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain ...)
+ TODO: check
+CVE-2026-77080 (n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 conta ...)
+ TODO: check
+CVE-2026-77079 (n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the c ...)
+ TODO: check
+CVE-2026-77077 (n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript ...)
+ TODO: check
+CVE-2026-77076 (n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an informatio ...)
+ TODO: check
+CVE-2026-77075 (n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 conta ...)
+ TODO: check
+CVE-2026-77074 (n8n versions before 1.123.69 contain a server-side request forgery vul ...)
+ TODO: check
+CVE-2026-77073 (n8n versions before 2.34.1 contain a credential validation bypass in t ...)
+ TODO: check
+CVE-2026-77072 (n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site s ...)
+ TODO: check
+CVE-2026-77071 (n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter in ...)
+ TODO: check
+CVE-2026-77070 (n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vul ...)
+ TODO: check
+CVE-2026-77069 (n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection by ...)
+ TODO: check
+CVE-2026-77068 (n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execu ...)
+ TODO: check
+CVE-2026-77067 (The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts ...)
+ TODO: check
+CVE-2026-77066 (The scanFeedsResolver in packages/api/src/resolvers/subscriptions/inde ...)
+ TODO: check
+CVE-2026-77036 (A vulnerability was found in elunez eladmin up to 2.7. The impacted el ...)
+ TODO: check
+CVE-2026-77031 (A vulnerability has been found in Tenda CH22 1.0.0.1. The affected ele ...)
+ TODO: check
+CVE-2026-77026 (Joomla Extension - tassos.gr - Client-controlled validation bypass in ...)
+ TODO: check
+CVE-2026-77025 (A weakness has been identified in itsourcecode Hospital Management Sys ...)
+ TODO: check
+CVE-2026-77022 (A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affect ...)
+ TODO: check
+CVE-2026-77020 (A vulnerability was identified in CodeAstro Apartment Visitor Manageme ...)
+ TODO: check
+CVE-2026-77019 (A vulnerability was determined in CodeAstro Apartment Visitor Manageme ...)
+ TODO: check
+CVE-2026-77014 (A flaw was found in libsoup's SoupServer HTTP Range header processing. ...)
+ TODO: check
+CVE-2026-77004 (A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the fun ...)
+ TODO: check
+CVE-2026-76999 (A vulnerability was detected in SourceCodester CET Automated Grading S ...)
+ TODO: check
+CVE-2026-76998 (A security vulnerability has been detected in SourceCodester Simple On ...)
+ TODO: check
+CVE-2026-76997 (A weakness has been identified in SourceCodester Simple Online Food Or ...)
+ TODO: check
+CVE-2026-76996 (A security flaw has been discovered in SourceCodester Simple Online Fo ...)
+ TODO: check
+CVE-2026-76995 (A vulnerability was identified in SourceCodester Simple Online Food Or ...)
+ TODO: check
+CVE-2026-76993 (A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This ...)
+ TODO: check
+CVE-2026-76991 (A vulnerability was found in itsourcecode Hospital Management System 1 ...)
+ TODO: check
+CVE-2026-76990 (A vulnerability has been found in code-projects Simple Inventory Syste ...)
+ TODO: check
+CVE-2026-76989 (A security vulnerability has been detected in liftoff-sr CIPster 18025 ...)
+ TODO: check
+CVE-2026-76988 (A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19 ...)
+ TODO: check
+CVE-2026-76987 (A security flaw has been discovered in liftoff-sr CIPster 1802525be27d ...)
+ TODO: check
+CVE-2026-76833 (@cgauge/yaml npm package contains an arbitrary code execution vulnerab ...)
+ TODO: check
+CVE-2026-76641 (Expat through 2.8.3 contains an out-of-bounds read vulnerability that ...)
+ TODO: check
+CVE-2026-76635 (baserCMS before 5.3.0 contains a SQL injection vulnerability in BcData ...)
+ TODO: check
+CVE-2026-76634 (WeGIA before 3.9.2 contains an insecure direct object reference vulner ...)
+ TODO: check
+CVE-2026-76633 (WeGIA before 3.9.2 contains an authorization bypass vulnerability in t ...)
+ TODO: check
+CVE-2026-76632
+ REJECTED
+CVE-2026-76610 (Joomla Extension - yootheme.com - Unauthenticated tag modifications in ...)
+ TODO: check
+CVE-2026-76569 (Joomla Extension - phoca.cz - Reflected XSS via the search GET paramet ...)
+ TODO: check
+CVE-2026-76565 (Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to ...)
+ TODO: check
+CVE-2026-76564 (Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Adm ...)
+ TODO: check
+CVE-2026-75948 (Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagend ...)
+ TODO: check
+CVE-2026-75526 (django CMS is an easy-to-use and developer-friendly enterprise content ...)
+ TODO: check
+CVE-2026-75514 (BunkerWeb is an open-source, next-generation Web Application Firewall. ...)
+ TODO: check
+CVE-2026-75140 (jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolle ...)
+ TODO: check
+CVE-2026-74021 (Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.)
+ TODO: check
+CVE-2026-74020 (Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.)
+ TODO: check
+CVE-2026-74019 (Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 ...)
+ TODO: check
+CVE-2026-74018 (Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.)
+ TODO: check
+CVE-2026-74016 (Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.)
+ TODO: check
+CVE-2026-74014 (Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.)
+ TODO: check
+CVE-2026-74013 (Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.)
+ TODO: check
+CVE-2026-74011 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-74001 (Unauthenticated Broken Authentication in User Registration & Membershi ...)
+ TODO: check
+CVE-2026-73998 (Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.)
+ TODO: check
+CVE-2026-73993 (Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.)
+ TODO: check
+CVE-2026-73992 (Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 ver ...)
+ TODO: check
+CVE-2026-73402 (Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 vers ...)
+ TODO: check
+CVE-2026-73259 (Mongoose is an embedded web server and network library. Prior to 7.22, ...)
+ TODO: check
+CVE-2026-73258 (Mongoose is an embedded web server and network library. Prior to 7.22, ...)
+ TODO: check
+CVE-2026-73257 (Mongoose is an embedded web server and network library. Priro to versi ...)
+ TODO: check
+CVE-2026-73256 (Mongoose is an embedded web server and network library. Prior to 7.22, ...)
+ TODO: check
+CVE-2026-73255 (Mongoose is an embedded web server and network library. Prior to 7.22, ...)
+ TODO: check
+CVE-2026-73254 (Mongoose is an embedded web server and network library. Prior to 7.22, ...)
+ TODO: check
+CVE-2026-73253 (Mongoose is an embedded web server and network library. Prior to versi ...)
+ TODO: check
+CVE-2026-73220 (CVAT is an open source interactive video and image annotation tool for ...)
+ TODO: check
+CVE-2026-73199 (A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authen ...)
+ TODO: check
+CVE-2026-73198 (A flaw was found in FreeIPA. A remote, unauthenticated attacker can ex ...)
+ TODO: check
+CVE-2026-73197 (A flaw was found in FreeIPA. A remote, unauthenticated attacker can ex ...)
+ TODO: check
+CVE-2026-73196 (A flaw was found in FreeIPA. A low-privilege authenticated user can ex ...)
+ TODO: check
+CVE-2026-72854 (msgpack_unpacker_expand_buffer in src/unpack.c, reached through the pu ...)
+ TODO: check
+CVE-2026-72852 (hank-ai/darknet sizes a convolutional layer's weight and output heap b ...)
+ TODO: check
+CVE-2026-72847 (broot renders each file and directory name in its interactive tree vie ...)
+ TODO: check
+CVE-2026-72845
+ REJECTED
+CVE-2026-72844 (The Lean 4 kernel does not verify that the structure named in a projec ...)
+ TODO: check
+CVE-2026-71492 (Banks generates meaningful LLM prompts using a simple template languag ...)
+ TODO: check
+CVE-2026-71428 (The unstructured library provides open-source components for ingesting ...)
+ TODO: check
+CVE-2026-70383 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
+ TODO: check
+CVE-2026-6822
+ REJECTED
+CVE-2026-6260
+ REJECTED
+CVE-2026-69183 (Monkeytype is a minimalistic and customizable typing test. In 26.26.0 ...)
+ TODO: check
+CVE-2026-68566 (Unauthenticated SQL Injection in BookingPress Appointment Booking Pro ...)
+ TODO: check
+CVE-2026-68564 (Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1 ...)
+ TODO: check
+CVE-2026-66788 (A flaw was found in Lighthouse. A remote attacker, by compromising a s ...)
+ TODO: check
+CVE-2026-66787 (A flaw was found in the lighthouse component of Red Hat Advanced Clust ...)
+ TODO: check
+CVE-2026-66785 (A flaw was found in Submariner. This vulnerability allows a malicious ...)
+ TODO: check
+CVE-2026-66682 (Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooComm ...)
+ TODO: check
+CVE-2026-66680 (Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 ve ...)
+ TODO: check
+CVE-2026-66677 (Subscriber Broken Authentication in Leyka <= 3.32.3 versions.)
+ TODO: check
+CVE-2026-66673 (Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 version ...)
+ TODO: check
+CVE-2026-66672 (Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.)
+ TODO: check
+CVE-2026-66649 (Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.)
+ TODO: check
+CVE-2026-66647 (Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.)
+ TODO: check
+CVE-2026-66616 (Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web <= 1 ...)
+ TODO: check
+CVE-2026-66615 (Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publishe ...)
+ TODO: check
+CVE-2026-66614 (Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly S ...)
+ TODO: check
+CVE-2026-66612 (Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.)
+ TODO: check
+CVE-2026-66611 (Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce < ...)
+ TODO: check
+CVE-2026-66609 (Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions ...)
+ TODO: check
+CVE-2026-66607 (Unauthenticated Cross Site Scripting (XSS) in Advance Product Search < ...)
+ TODO: check
+CVE-2026-66606 (Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versi ...)
+ TODO: check
+CVE-2026-66605 (Unauthenticated Cross Site Scripting (XSS) in Swatchly \u2013 WooComme ...)
+ TODO: check
+CVE-2026-66604 (Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 ...)
+ TODO: check
+CVE-2026-66601 (Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3. ...)
+ TODO: check
+CVE-2026-66600 (Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versio ...)
+ TODO: check
+CVE-2026-66598 (Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.0 ...)
+ TODO: check
+CVE-2026-66597 (Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 ...)
+ TODO: check
+CVE-2026-66595 (Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 vers ...)
+ TODO: check
+CVE-2026-66594 (Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versio ...)
+ TODO: check
+CVE-2026-66593 (Unauthenticated SQL Injection in Security & Malware scan by CleanTalk ...)
+ TODO: check
+CVE-2026-66592 (Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and ...)
+ TODO: check
+CVE-2026-66590 (Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions ...)
+ TODO: check
+CVE-2026-66586 (Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.)
+ TODO: check
+CVE-2026-66583 (Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.)
+ TODO: check
+CVE-2026-66582 (Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 ...)
+ TODO: check
+CVE-2026-66581 (Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 ve ...)
+ TODO: check
+CVE-2026-66002 (Frappe is a full-stack web application framework. Prior to 15.115.0 an ...)
+ TODO: check
+CVE-2026-66001 (Frappe is a full-stack web application framework. Prior to 15.114.0 an ...)
+ TODO: check
+CVE-2026-65842 (Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @p ...)
+ TODO: check
+CVE-2026-64972 (ATutor is vulnerable to Reflected XSS via popup parameter in preview.p ...)
+ TODO: check
+CVE-2026-64971 (ATutor is vulnerable to Reflected XSS in restore functionality. An att ...)
+ TODO: check
+CVE-2026-64970 (ATutor is vulnerable to Stored Cross Site Scripting in registration fu ...)
+ TODO: check
+CVE-2026-64969 (ATutor is vulnerable to InsecureDirect Object Reference (IDOR) attack ...)
+ TODO: check
+CVE-2026-64968 (ATutor is vulnerable toServer-Side request forgery in import functiona ...)
+ TODO: check
+CVE-2026-64967 (A path traversal vulnerability in ATutor's error log viewer allows an ...)
+ TODO: check
+CVE-2026-64966 (ATutor is vulnerable to a Path Traversal vulnerability in ZIP extracti ...)
+ TODO: check
+CVE-2026-64965 (ATutor is vulnerable to Missing Authorization Check on Test and Questi ...)
+ TODO: check
+CVE-2026-64964 (ATutor generates predictable email confirmation tokens due to the use ...)
+ TODO: check
+CVE-2026-64963 (A path traversal vulnerability in ATutor allows an authenticated user ...)
+ TODO: check
+CVE-2026-64962 (ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile u ...)
+ TODO: check
+CVE-2026-64961 (ATutor is vulnerable to authentication bypass .Although a token valida ...)
+ TODO: check
+CVE-2026-64960 (ATutor Gameme module allows users to upload files of any type and exte ...)
+ TODO: check
+CVE-2026-64846 (Nix is a package manager for Linux and other Unix systems. Prior to 2. ...)
+ TODO: check
+CVE-2026-64777 (A malicious builder peer may be able to request an in-context file by ...)
+ TODO: check
+CVE-2026-63654 (Frappe is a full-stack web application framework. In version 16.31.0 a ...)
+ TODO: check
+CVE-2026-63495 (Libevent is an event notification library. From 2.2.0-alpha-dev until ...)
+ TODO: check
+CVE-2026-63490 (Handlebars.java provides logic-less and semantic Mustache templates wi ...)
+ TODO: check
+CVE-2026-63481 (Hurl is a command line tool that runs and tests HTTP requests defined ...)
+ TODO: check
+CVE-2026-63388 (Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-a ...)
+ TODO: check
+CVE-2026-63387 (Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-a ...)
+ TODO: check
+CVE-2026-63385 (Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-a ...)
+ TODO: check
+CVE-2026-63384 (Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-a ...)
+ TODO: check
+CVE-2026-63383 (Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-a ...)
+ TODO: check
+CVE-2026-63382 (Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-a ...)
+ TODO: check
+CVE-2026-63381 (Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-a ...)
+ TODO: check
+CVE-2026-63380 (Libevent is an event notification library. Prior to 2.2.2-alpha, libev ...)
+ TODO: check
+CVE-2026-63379 (Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-a ...)
+ TODO: check
+CVE-2026-63044 (Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.Any ...)
+ TODO: check
+CVE-2026-63043 (Relative Path Traversal vulnerability in Apache InLong.Arbitrary file ...)
+ TODO: check
+CVE-2026-63042 (Files or Directories Accessible to External Parties vulnerability in A ...)
+ TODO: check
+CVE-2026-63040 (Files or Directories Accessible to External Parties vulnerability in A ...)
+ TODO: check
+CVE-2026-63039 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-63038 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-63037 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-63016 (Uncontrolled Resource Consumption vulnerability in Apache InLong. User ...)
+ TODO: check
+CVE-2026-63015 (Uncontrolled Resource Consumption vulnerability in Apache InLong.Non-t ...)
+ TODO: check
+CVE-2026-63003 (django CMS is an easy-to-use and developer-friendly enterprise content ...)
+ TODO: check
+CVE-2026-62315 (Frappe is a full-stack web application framework. In version 16.31.0 a ...)
+ TODO: check
+CVE-2026-61704 (Link Preview JS extracts web links information. Prior to 4.0.4, the re ...)
+ TODO: check
+CVE-2026-61663 (django CMS is an easy-to-use and developer-friendly enterprise content ...)
+ TODO: check
+CVE-2026-61625 (VictoriaMetrics is a scalable solution for monitoring and managing tim ...)
+ TODO: check
+CVE-2026-55642 (dbx is a cross-platform database client for databases. Prior to 0.5.51 ...)
+ TODO: check
+CVE-2026-55586 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ...)
+ TODO: check
+CVE-2026-55558 (aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior ...)
+ TODO: check
+CVE-2026-55095 (OpenProject is open-source, web-based project management software. In ...)
+ TODO: check
+CVE-2026-54770 (WebOb provides objects for HTTP requests and responses. Prior to 1.8.1 ...)
+ TODO: check
+CVE-2026-54625 (django CMS is a content management system powered by Django. Prior to ...)
+ TODO: check
+CVE-2026-54624 (django CMS is an easy-to-use and developer-friendly enterprise content ...)
+ TODO: check
+CVE-2026-54623 (django CMS is an easy-to-use and developer-friendly enterprise content ...)
+ TODO: check
+CVE-2026-54622 (django CMS is an easy-to-use and developer-friendly enterprise content ...)
+ TODO: check
+CVE-2026-54616 (NanaZip is the 7-Zip derivative intended for the modern Windows experi ...)
+ TODO: check
+CVE-2026-54449 (LangBot is a global IM bot platform designed for LLMs. In version 4.10 ...)
+ TODO: check
+CVE-2026-54136 (Windmill is an open-source developer platform for internal code: APIs, ...)
+ TODO: check
+CVE-2026-53993
+ REJECTED
+CVE-2026-53569 (Frappe is a full-stack web application framework. In version 16.31.0 a ...)
+ TODO: check
+CVE-2026-53425 (Insufficient Verification of Data Authenticity vulnerability in dropbo ...)
+ TODO: check
+CVE-2026-53424 (Authentication Bypass by Capture-replay vulnerability in dropbox samly ...)
+ TODO: check
+CVE-2026-49996 (SecureDrop Client is a desktop app for journalists to securely communi ...)
+ TODO: check
+CVE-2026-49825 (lxml is a library for processing XML and HTML in the Python language. ...)
+ TODO: check
+CVE-2026-46537
+ REJECTED
+CVE-2026-46536
+ REJECTED
+CVE-2026-46535
+ REJECTED
+CVE-2026-46534
+ REJECTED
+CVE-2026-46533
+ REJECTED
+CVE-2026-44725 (EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and con ...)
+ TODO: check
+CVE-2026-43678 (An unauthenticated remote peer can crash any NIOWebSocket-based server ...)
+ TODO: check
+CVE-2026-40345 (deepmerge-ts is a typescript library providing functionality to deep m ...)
+ TODO: check
+CVE-2026-2334 (An issue was discovered in vsDesk v14.0101. An authenticated attacker ...)
+ TODO: check
+CVE-2026-28164 (Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Ele ...)
+ TODO: check
+CVE-2026-28163 (Missing Authorization vulnerability in myCred New User Approve allows ...)
+ TODO: check
+CVE-2026-28150 (Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 version ...)
+ TODO: check
+CVE-2026-21784 (HCL IntelliOps Event Management (IEM) is affected by missing or insecu ...)
+ TODO: check
+CVE-2026-19683 (A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-L ...)
+ TODO: check
+CVE-2026-19611 (A flaw was found in WildFly Elytron. Password hashing and verification ...)
+ TODO: check
+CVE-2026-19586 (A pre-authentication OS command injection vulnerability has been ident ...)
+ TODO: check
+CVE-2026-18917 (A flaw was found in libvirt. An unprivileged local user could exploit ...)
+ TODO: check
+CVE-2026-18482 (Neo.mjs contains a command injection vulnerability within the FileSyst ...)
+ TODO: check
+CVE-2026-18309 (GIMP APNG File Parsing Integer Overflow Remote Code Execution Vulnerab ...)
+ TODO: check
+CVE-2026-18308 (GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerabi ...)
+ TODO: check
+CVE-2026-18307 (GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution ...)
+ TODO: check
+CVE-2026-18306 (GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerabi ...)
+ TODO: check
+CVE-2026-18305 (GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerabi ...)
+ TODO: check
+CVE-2026-18304 (GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerabi ...)
+ TODO: check
+CVE-2026-18303 (GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Executio ...)
+ TODO: check
+CVE-2026-18302 (GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution ...)
+ TODO: check
+CVE-2026-18301 (GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerabi ...)
+ TODO: check
+CVE-2026-18300 (GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerabi ...)
+ TODO: check
+CVE-2026-18299 (GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerabili ...)
+ TODO: check
+CVE-2026-18298 (GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Exec ...)
+ TODO: check
+CVE-2026-18297 (GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Exe ...)
+ TODO: check
+CVE-2026-18296 (GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Exec ...)
+ TODO: check
+CVE-2026-18295 (GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution V ...)
+ TODO: check
+CVE-2026-18294 (OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code ...)
+ TODO: check
+CVE-2026-18293 (OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Co ...)
+ TODO: check
+CVE-2026-18292 (OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Exe ...)
+ TODO: check
+CVE-2026-18291 (OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Exe ...)
+ TODO: check
+CVE-2026-18290 (OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code E ...)
+ TODO: check
+CVE-2026-18289 (OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code E ...)
+ TODO: check
+CVE-2026-18288 (OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code ...)
+ TODO: check
+CVE-2026-18287 (Aeon load_time_series_segmentation_benchmark Code Injection Remote Cod ...)
+ TODO: check
+CVE-2026-18286 (Aeon load_human_activity_segmentation_datasets Code Injection Remote C ...)
+ TODO: check
+CVE-2026-18285 (Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote ...)
+ TODO: check
+CVE-2026-18284 (Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege E ...)
+ TODO: check
+CVE-2026-18283 (Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. Thi ...)
+ TODO: check
+CVE-2026-18282 (Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Re ...)
+ TODO: check
+CVE-2026-18281 (Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Co ...)
+ TODO: check
+CVE-2026-18280 (Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerab ...)
+ TODO: check
+CVE-2026-18279 (Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulne ...)
+ TODO: check
+CVE-2026-18278 (Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Di ...)
+ TODO: check
+CVE-2026-18274 (Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code ...)
+ TODO: check
+CVE-2026-18273 (Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Es ...)
+ TODO: check
+CVE-2026-18272 (Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability. ...)
+ TODO: check
+CVE-2026-18271 (Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Executio ...)
+ TODO: check
+CVE-2026-18270 (Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privile ...)
+ TODO: check
+CVE-2026-18269 (Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execu ...)
+ TODO: check
+CVE-2026-18268 (Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escal ...)
+ TODO: check
+CVE-2026-18267 (Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulner ...)
+ TODO: check
+CVE-2026-18265 (OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulner ...)
+ TODO: check
+CVE-2026-18264 (NoMachine getstat Command Injection Remote Code Execution Vulnerabilit ...)
+ TODO: check
+CVE-2026-18263 (Parallels RAS Client RDP Backend Service Exposed Dangerous Function Lo ...)
+ TODO: check
+CVE-2026-18262 (Parallels RAS Client RDP Backend Service Exposed Dangerous Function Lo ...)
+ TODO: check
+CVE-2026-16932 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local atta ...)
+ TODO: check
+CVE-2026-16928 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote att ...)
+ TODO: check
+CVE-2026-16927 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local atta ...)
+ TODO: check
+CVE-2026-16926 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote att ...)
+ TODO: check
+CVE-2026-16925 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local atta ...)
+ TODO: check
+CVE-2026-16924 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote att ...)
+ TODO: check
+CVE-2026-16923 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local atta ...)
+ TODO: check
+CVE-2026-16922 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local atta ...)
+ TODO: check
+CVE-2026-15743 (Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark r ...)
+ TODO: check
+CVE-2026-15706 (Missing authentication for critical function vulnerability in Baylan M ...)
+ TODO: check
+CVE-2026-15686 (Adminer multi_query Incorrect Check of Function Return Value Remote Co ...)
+ TODO: check
+CVE-2026-15679 (Hugging Face PyTorch Image Models checkpoint Deserialization of Untrus ...)
+ TODO: check
+CVE-2026-14953 (A low-privileged remote attacker can enumerate all configured users an ...)
+ TODO: check
+CVE-2026-14952 (An unauthenticated remote attacker can retrieve sensible files from th ...)
+ TODO: check
+CVE-2026-14951 (An low privileged remote attacker can cause authenticated users to per ...)
+ TODO: check
+CVE-2026-14950 (An unauthenticated remote attacker in possession of a valid session id ...)
+ TODO: check
+CVE-2026-14949 (A low privileged remote attacker with a valid session can submit a req ...)
+ TODO: check
+CVE-2026-14948 (A low privileged remote attacker can hijack an active administrative s ...)
+ TODO: check
+CVE-2026-14947 (A high-privileged remote attacker can upload malicious ZIP archive con ...)
+ TODO: check
+CVE-2026-14946 (A high privileged remote attacker can upload a .php file and then requ ...)
+ TODO: check
+CVE-2026-13121 (Parallels RAS Client RDP Backend Service Exposed Dangerous Function Lo ...)
+ TODO: check
+CVE-2026-13097 (A privilege escalation flaw was found in FreeIPA. The uniqueness const ...)
+ TODO: check
+CVE-2026-11861 (A flaw was found in FreeIPA. When a trust relationship is configured b ...)
+ TODO: check
+CVE-2025-62307 (HCL IntelliOps Event Management (IEM) is affected by insufficient logg ...)
+ TODO: check
+CVE-2025-62306 (HCL IntelliOps Event Management (IEM) is affected by information omiss ...)
+ TODO: check
+CVE-2025-62300 (HCL IntelliOps Event Management (IEM) is affected by a race condition. ...)
+ TODO: check
+CVE-2025-62299 (HCL IntelliOps Event Management (IEM) is affected by a least privilege ...)
+ TODO: check
+CVE-2025-53999 (Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.)
+ TODO: check
+CVE-2025-15689 (Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.)
+ TODO: check
+CVE-2025-15688 (Unauthenticated SQL Injection in Capella <= 2.5.5 versions.)
+ TODO: check
+CVE-2025-15637 (Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.)
+ TODO: check
+CVE-2025-14601 (An OS command injection vulnerability in vsDesk allows an authenticate ...)
+ TODO: check
CVE-2026-XXXX [OSSN-0103]
- manila 1:22.0.0-4 (bug #1143804)
[trixie] - manila <no-dsa> (Minor issue)
@@ -4100,7 +4674,7 @@ CVE-2026-74038 (Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerabilit
NOT-FOR-US: Wazuh
CVE-2026-74015 (Unauthenticated SQL Injection in Readabler < 2.0.18 versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-74012 (Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.)
+CVE-2026-74012 (Deserialization of Untrusted Data vulnerability in TaxoPress allows Ob ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-74009 (Unauthenticated Insecure Direct Object References (IDOR) in Razorpay f ...)
NOT-FOR-US: WordPress plugin or theme
@@ -4943,6 +5517,7 @@ CVE-2026-64849 (MLflow is an open source AI engineering platform for agents, lar
CVE-2026-64788 (The issue was addressed with improved memory handling. This issue is f ...)
NOT-FOR-US: Apple
CVE-2026-64787 (A use-after-free issue was addressed with improved memory management. ...)
+ {DSA-6398-1}
- webkit2gtk 2.52.5-1
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -5049,6 +5624,7 @@ CVE-2026-34398 (FreeCAD is a free and open-source multiplatform 3D parametric mo
NOTE: https://github.com/FreeCAD/FreeCAD/pull/28610
NOTE: Fixed by: https://github.com/FreeCAD/FreeCAD/commit/9ed351cc4700db0a94c46f020c34c58bbf1bdaba (1.1.1)
CVE-2026-28984 (The issue was addressed with improved memory handling. This issue is f ...)
+ {DSA-6398-1}
- webkit2gtk 2.52.4-1
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -11333,7 +11909,7 @@ CVE-2026-63626 [Built-in TCP/IP PPP IPV6CP option parsing bounds check]
- mongoose 7.23+ds-1
CVE-2026-73252 [Built-in TLS short-record handling]
- mongoose 7.23+ds-1
-CVE-2026-73251 [Built-in TLS certificate-chain verification with CA bundles]
+CVE-2026-73251 (Mongoose is an embedded web server and network library. Prior to 7.23, ...)
- mongoose 7.23+ds-1
CVE-2026-56865 (A malicious GOPROXY was previously capable of forging up to two sumdb ...)
- golang-1.27 1.27~rc3-1 (bug #1144340)
@@ -13615,6 +14191,7 @@ CVE-2026-63134 (Malcolm is a network traffic analysis tool suite. Prior to versi
CVE-2026-63133 (Malcolm is a network traffic analysis tool suite. Prior to version 26. ...)
NOT-FOR-US: Malcolm
CVE-2026-5917 (libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH bac ...)
+ {DSA-6453-1}
- libgit2 1.9.7+ds-1 (bug #1144465)
NOTE: Fixed by: https://github.com/libgit2/libgit2/commit/b2105b8e60798cb28086d4c648b1cb4854eadccb (v1.9.7)
CVE-2026-55676 (Malcolm is a network traffic analysis tool suite. The file-upload comp ...)
@@ -14292,7 +14869,7 @@ CVE-2026-71383 (is affected by an Incorrect Authorization vulnerability that cou
NOT-FOR-US: Adobe
CVE-2026-71362 (Adobe Commerce is affected by an Incorrect Authorization vulnerability ...)
NOT-FOR-US: Adobe
-CVE-2026-71331 (Integer overflow or wraparound in Microsoft Azure Attestation service ...)
+CVE-2026-71331 (Integer overflow or wraparound in Windows Device Health Attestation (D ...)
NOT-FOR-US: Microsoft
CVE-2026-71218 (A flaw was found in iperf3. A remote unauthenticated attacker can expl ...)
- iperf3 3.18-1
@@ -18711,10 +19288,10 @@ CVE-2026-68083 (In the Linux kernel, the following vulnerability has been resolv
[trixie] - linux 6.12.100-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/1c8951963d8ed357f70f59e0ad4ddce2199d2016 (7.2-rc1)
-CVE-2026-61897
+CVE-2026-61897 (An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 on ...)
- accountsservice <not-affected> (Ubuntu-specific changes)
NOTE: https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985
-CVE-2026-61898
+CVE-2026-61898 (The Ubuntu-specific language helper scripts (save-to-pam-env, update-l ...)
- accountsservice <not-affected> (Ubuntu-specific changes)
NOTE: https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985
CVE-2026-XXXX [Neutron sub-resource APIs do not verify parent ownership]
@@ -24959,23 +25536,28 @@ CVE-2026-60074 (Date::Manip versions through 6.99 for Perl return corrupted date
[bullseye] - libdate-manip-perl <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/42266594/
NOTE: https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60074-r1.patch
-CVE-2026-53587
+CVE-2026-53587 (libgit2 is a portable C implementation of the Git core methods provide ...)
+ {DSA-6453-1}
- libgit2 1.9.6+ds-1
NOTE: https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm
NOTE: Fixed by: https://github.com/libgit2/libgit2/commit/affda60c10fcef16723451c0d7dc71b71dc20ad3 (v1.9.5)
-CVE-2026-53586
+CVE-2026-53586 (libgit2 is a portable C implementation of the Git core methods provide ...)
+ {DSA-6453-1}
- libgit2 1.9.6+ds-1
NOTE: https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x
NOTE: Fixed by: https://github.com/libgit2/libgit2/commit/af2b29ad0a74d5bac9751376879ddaf848136d3b (v1.9.5)
-CVE-2026-53585
+CVE-2026-53585 (libgit2 is a portable C implementation of the Git core methods provide ...)
+ {DSA-6453-1}
- libgit2 1.9.6+ds-1
NOTE: https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j
NOTE: Fixed by: https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30 (v1.9.5)
-CVE-2026-53584
+CVE-2026-53584 (libgit2 is a portable C implementation of the Git core methods provide ...)
+ {DSA-6453-1}
- libgit2 1.9.6+ds-1
NOTE: https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm
NOTE: Fixed by: https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4 (v1.9.5)
-CVE-2026-53583
+CVE-2026-53583 (libgit2 is a portable C implementation of the Git core methods provide ...)
+ {DSA-6453-1}
- libgit2 1.9.6+ds-1
NOTE: https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp
NOTE: Fixed by: https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f (v1.9.5)
@@ -42576,9 +43158,9 @@ CVE-2026-54121 (Improper authorization in Active Directory Certificate Services
NOT-FOR-US: Microsoft
CVE-2026-54119 (Loop with unreachable exit condition ('infinite loop') in Windows Acti ...)
NOT-FOR-US: Microsoft
-CVE-2026-54118 (Deserialization of untrusted data in SQL Server allows an authorized a ...)
+CVE-2026-54118 (Deserialization of untrusted data in SQL Server allows an unauthorized ...)
NOT-FOR-US: Microsoft
-CVE-2026-54117 (Deserialization of untrusted data in SQL Server allows an authorized a ...)
+CVE-2026-54117 (Deserialization of untrusted data in SQL Server allows an unauthorized ...)
NOT-FOR-US: Microsoft
CVE-2026-54116 (Access of resource using incompatible type ('type confusion') in SQL S ...)
NOT-FOR-US: Microsoft
@@ -46558,7 +47140,7 @@ CVE-2026-59946 (Composer is a dependency Manager for the PHP language. Prior to
NOTE: Fixed by: https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0 (2.10.2)
NOTE: Fixed by: https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1 (2.2.29)
CVE-2026-59939 (httplib2 is a comprehensive HTTP client library for Python. Prior to 0 ...)
- {DSA-6441-1}
+ {DSA-6441-1 DLA-4748-1 DLA-4747-1}
- python-httplib2 0.32.0-1
NOTE: https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3
NOTE: Fixed by: https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427 (v0.32.0)
@@ -62229,7 +62811,7 @@ CVE-2026-XXXX [RUSTSEC-2026-0184]
[bullseye] - rust-git2 <postponed> (Minor issue)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0184.html
NOTE: https://github.com/rust-lang/git2-rs/pull/1254
-CVE-2026-50190
+CVE-2026-50190 (Shaarli is a personal bookmarking service. Versions prior to 0.16.3 ar ...)
- shaarli <unfixed> (bug #1140348)
[bookworm] - shaarli <postponed> (Minor issue, XSS)
NOTE: https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv
@@ -595968,6 +596550,7 @@ CVE-2021-21241 (The Python "Flask-Security-Too" package is used for adding secur
NOTE: https://github.com/Flask-Middleware/flask-security/commit/c05afe837e83f20f59c0fb409ce1240341d1ec41 (master)
NOTE: https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f (3.4.5)
CVE-2021-21240 (httplib2 is a comprehensive HTTP client library for Python. In httplib ...)
+ {DLA-4747-1}
- python-httplib2 0.20.2-1 (bug #982738)
[buster] - python-httplib2 <no-dsa> (Minor issue)
[stretch] - python-httplib2 <no-dsa> (Minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ddad2f5974692ea6009032142228b21b8e300c51
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ddad2f5974692ea6009032142228b21b8e300c51
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260820/c9d4256b/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list