[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Aug 25 08:12:50 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
1f6f2ba0 by security tracker role at 2026-08-25T07:12:35+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,273 @@
+CVE-2026-7455 (A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, ...)
+ TODO: check
+CVE-2026-78685 (Medical Practice Management System developed by Le-yan has a Remote Co ...)
+ TODO: check
+CVE-2026-78683 (NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pick ...)
+ TODO: check
+CVE-2026-78682 (NLTK before 3.10.3 contains a server-side request forgery vulnerabilit ...)
+ TODO: check
+CVE-2026-78681 (NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in ...)
+ TODO: check
+CVE-2026-78680 (NLTK versions before 3.10.3 fail to use validated absolute paths when ...)
+ TODO: check
+CVE-2026-78679 (GitPython before 3.1.59 contains an arbitrary file read vulnerability ...)
+ TODO: check
+CVE-2026-78678 (GitPython versions before 3.1.59 contain an incomplete denylist in the ...)
+ TODO: check
+CVE-2026-78677 (GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone ...)
+ TODO: check
+CVE-2026-78676 (GitPython before 3.1.59 fails to safely re-serialize multi-line git-co ...)
+ TODO: check
+CVE-2026-78675 (GitPython before 3.1.59 fails to disable merge_includes when parsing . ...)
+ TODO: check
+CVE-2026-78656 (A vulnerability was found in itsourcecode Sales and Inventory System 1 ...)
+ TODO: check
+CVE-2026-78654 (A vulnerability has been found in cleverbrush framework and deep up to ...)
+ TODO: check
+CVE-2026-78638 (A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2. ...)
+ TODO: check
+CVE-2026-78637 (A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1 ...)
+ TODO: check
+CVE-2026-78555 (RansomLook exposed complete API keys in the HTML source of the authent ...)
+ TODO: check
+CVE-2026-78553 (RansomLook created its Flask session-signing key without explicitly re ...)
+ TODO: check
+CVE-2026-78551 (RansomLook contains multiple weaknesses in its authentication endpoint ...)
+ TODO: check
+CVE-2026-78478 (The Mane theme for WordPress is vulnerable to Local File Inclusion in ...)
+ TODO: check
+CVE-2026-78477 (The Jawn theme for WordPress is vulnerable to Privilege Escalation in ...)
+ TODO: check
+CVE-2026-78470 (The WP Project Manager Pro plugin for WordPress is vulnerable to SQL I ...)
+ TODO: check
+CVE-2026-78467 (The Fluent Support Pro plugin for WordPress is vulnerable to unauthori ...)
+ TODO: check
+CVE-2026-78466 (The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure D ...)
+ TODO: check
+CVE-2026-78435 (A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected ...)
+ TODO: check
+CVE-2026-78434 (A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the ...)
+ TODO: check
+CVE-2026-78430 (A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1 ...)
+ TODO: check
+CVE-2026-78284 (Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 v ...)
+ TODO: check
+CVE-2026-78282 (Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 ...)
+ TODO: check
+CVE-2026-78268 (Unauthenticated Sensitive Data Exposure in Lead Generation Contact Wid ...)
+ TODO: check
+CVE-2026-78267 (Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versio ...)
+ TODO: check
+CVE-2026-78266 (Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.)
+ TODO: check
+CVE-2026-78265 (Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 ...)
+ TODO: check
+CVE-2026-78264 (Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 ...)
+ TODO: check
+CVE-2026-78263 (Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2. ...)
+ TODO: check
+CVE-2026-78262 (Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 ve ...)
+ TODO: check
+CVE-2026-78259 (Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 version ...)
+ TODO: check
+CVE-2026-77923 (Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnera ...)
+ TODO: check
+CVE-2026-77635 (CakePHP is a rapid development framework for PHP. Prior to versions 5. ...)
+ TODO: check
+CVE-2026-77634 (CakePHP is a rapid development framework for PHP. Prior to versions 4. ...)
+ TODO: check
+CVE-2026-77567 (Filament is a collection of full-stack components for accelerated Lara ...)
+ TODO: check
+CVE-2026-77384 (libp2p is a JavaScript implementation of the libp2p networking stack. ...)
+ TODO: check
+CVE-2026-77337 (CakePHP Authentication is an authentication plugin for CakePHP that ca ...)
+ TODO: check
+CVE-2026-77310 (jackson-databind contains the general-purpose data-binding functionali ...)
+ TODO: check
+CVE-2026-76846 (Grav before 2.0.16 contains an incomplete default denylist in the Twig ...)
+ TODO: check
+CVE-2026-76839 (Grav before 2.0.16 allows sandboxed Twig templates to access sensitive ...)
+ TODO: check
+CVE-2026-76816 (Netty is an asynchronous, event-driven network application framework. ...)
+ TODO: check
+CVE-2026-76098 (Mistune is a Python Markdown parser with renderers and plugins. Versio ...)
+ TODO: check
+CVE-2026-76063 (The FundEngine \u2013 Donation and Crowdfunding Platform plugin for Wo ...)
+ TODO: check
+CVE-2026-75982 (The LearnPress plugin for WordPress is vulnerable to unauthorized modi ...)
+ TODO: check
+CVE-2026-75930 (The FundEngine \u2013 Donation and Crowdfunding Platform plugin for Wo ...)
+ TODO: check
+CVE-2026-75575 (Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without ...)
+ TODO: check
+CVE-2026-75574 (The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders ...)
+ TODO: check
+CVE-2026-75554 (Insufficient Session Expiration vulnerability in the OAuth token refre ...)
+ TODO: check
+CVE-2026-75542 (Incorrect Authorization vulnerability in the OAuth token endpoint in h ...)
+ TODO: check
+CVE-2026-75509 (joserfc is a Python library that provides an implementation of several ...)
+ TODO: check
+CVE-2026-75464 (OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnera ...)
+ TODO: check
+CVE-2026-75369 (An out-of-bounds read vulnerability in the CAN::Application::parsePerf ...)
+ TODO: check
+CVE-2026-75368 (A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC ...)
+ TODO: check
+CVE-2026-75019 (The Cozy Blocks \u2013 Page Builder for Gutenberg Editor & FSE with 70 ...)
+ TODO: check
+CVE-2026-72714 (Rocq Prover does not restore the universe graph's copy of the universe ...)
+ TODO: check
+CVE-2026-72711 (The Lean 4 kernel does not check that the body of an opaque declaratio ...)
+ TODO: check
+CVE-2026-72705 (The guard checker in Rocq Prover does not follow recursive calls made ...)
+ TODO: check
+CVE-2026-72704 (The guard checker in Rocq Prover does not recheck the recursive tree r ...)
+ TODO: check
+CVE-2026-72703 (The guard checker in Rocq Prover treats a parameter of a nested mutual ...)
+ TODO: check
+CVE-2026-72702 (Grav CMS before 2.0.16 contains an origin validation bypass in the Uri ...)
+ TODO: check
+CVE-2026-72701 (Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verif ...)
+ TODO: check
+CVE-2026-72700 (The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Gr ...)
+ TODO: check
+CVE-2026-72699 (The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vuln ...)
+ TODO: check
+CVE-2026-72698 (Grav CMS before 2.0.16 fails to filter system, site, and theme configu ...)
+ TODO: check
+CVE-2026-72697 (Grav CMS before 2.0.16 contains a path traversal vulnerability in the ...)
+ TODO: check
+CVE-2026-72696 (Grav CMS before 2.0.16 contains a symlink following vulnerability in S ...)
+ TODO: check
+CVE-2026-72695 (Grav before 2.0.16 contains a path traversal vulnerability in MediaUpl ...)
+ TODO: check
+CVE-2026-71511 (Dolibarr before 24.0.0 contains a sensitive data exposure vulnerabilit ...)
+ TODO: check
+CVE-2026-71510 (Dolibarr before 24.0.0 contains a SQL injection vulnerability in the u ...)
+ TODO: check
+CVE-2026-69665 (SKYSEA Client View and SKYMEC IT Manager contain an issue with incorre ...)
+ TODO: check
+CVE-2026-68960 (A stack-based buffer overflow vulnerability exists in SKYSEA Client Vi ...)
+ TODO: check
+CVE-2026-68959 (SKYSEA Client View and SKYMEC IT Manager contain a path traversal vuln ...)
+ TODO: check
+CVE-2026-68516 (OpenEXR is the reference implementation and specification for the EXR ...)
+ TODO: check
+CVE-2026-68062 (SKYSEA Client View and SKYMEC IT Manager contain a path traversal vuln ...)
+ TODO: check
+CVE-2026-66766 (SAP S/4HANA (Private Cloud) uses a third-party component that contains ...)
+ TODO: check
+CVE-2026-66109 (A missing authorization vulnerability exists in SKYSEA Client View and ...)
+ TODO: check
+CVE-2026-63693 (Dell Client BIOS contains an Improper Link Resolution Before File Acce ...)
+ TODO: check
+CVE-2026-61419 (Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Ac ...)
+ TODO: check
+CVE-2026-5006 (A vulnerability was identified in HashiCorp Vault and Vault Enterprise ...)
+ TODO: check
+CVE-2026-59183 (OpenEXR is the reference implementation and specification for the EXR ...)
+ TODO: check
+CVE-2026-56710 (Grav Login plugin versions before 1.0.16 fail to validate the target a ...)
+ TODO: check
+CVE-2026-56709 (Grav before 3.9.2 fails to validate untrusted Host headers in the send ...)
+ TODO: check
+CVE-2026-56708 (Grav API plugin before 1.0.16 contains a server-side request forgery v ...)
+ TODO: check
+CVE-2026-56707 (Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an autho ...)
+ TODO: check
+CVE-2026-56706 (Adminer before 5.4.3 uses a CSRF token scheme that transmits both the ...)
+ TODO: check
+CVE-2026-56705 (Adminer before 5.4.3 fails to sanitize the server field before constru ...)
+ TODO: check
+CVE-2026-56704 (Adminer before 5.4.3 inserts unsanitized database server version strin ...)
+ TODO: check
+CVE-2026-56703 (Adminer before 5.4.3 contains a remote code execution vulnerability in ...)
+ TODO: check
+CVE-2026-56702 (Adminer versions before 5.4.3 contain an unrestricted file upload vuln ...)
+ TODO: check
+CVE-2026-55468 (Wagtail is an open source content management system built on Django. P ...)
+ TODO: check
+CVE-2026-55373 (OpenEXR is the reference implementation and specification for the EXR ...)
+ TODO: check
+CVE-2026-55371 (OpenEXR is the reference implementation and specification for the EXR ...)
+ TODO: check
+CVE-2026-55059 (OpenEXR is the reference implementation and specification for the EXR ...)
+ TODO: check
+CVE-2026-54920 (OpenEXR is the reference implementation and specification for the EXR ...)
+ TODO: check
+CVE-2026-53532 (OpenEXR is the reference implementation and specification for the EXR ...)
+ TODO: check
+CVE-2026-52492 (An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() fun ...)
+ TODO: check
+CVE-2026-52490 (An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an ...)
+ TODO: check
+CVE-2026-45404 (OpenTelemetry-Go is the Go implementation of OpenTelemetry. From versi ...)
+ TODO: check
+CVE-2026-34968 (Adminer before 5.4.3 contains an arbitrary file deletion vulnerability ...)
+ TODO: check
+CVE-2026-34967 (Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled c ...)
+ TODO: check
+CVE-2026-34964 (Adminer before 5.5.0 contains a server-side request forgery vulnerabil ...)
+ TODO: check
+CVE-2026-34959 (Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Pr ...)
+ TODO: check
+CVE-2026-32563 (Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plug ...)
+ TODO: check
+CVE-2026-32561 (Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.)
+ TODO: check
+CVE-2026-32560 (Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Im ...)
+ TODO: check
+CVE-2026-32559 (Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions.)
+ TODO: check
+CVE-2026-32556 (Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.)
+ TODO: check
+CVE-2026-32555 (Unauthenticated SQL Injection in Boost <= 2.0.4 versions.)
+ TODO: check
+CVE-2026-32554 (Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 ...)
+ TODO: check
+CVE-2026-27364 (Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.)
+ TODO: check
+CVE-2026-19943 (The Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor plu ...)
+ TODO: check
+CVE-2026-19892 (The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Esc ...)
+ TODO: check
+CVE-2026-19801 (The BetterLinks \u2013 Link Shortener, Link Cloaking, Redirects, Affil ...)
+ TODO: check
+CVE-2026-19568 (A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, ...)
+ TODO: check
+CVE-2026-17113 (A flaw was found in CRI-O's container-creation environment-variable ha ...)
+ TODO: check
+CVE-2026-17089 (The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugi ...)
+ TODO: check
+CVE-2026-16783 (A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, ...)
+ TODO: check
+CVE-2026-16782 (A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, ...)
+ TODO: check
+CVE-2026-16781 (A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, ...)
+ TODO: check
+CVE-2026-16434 (Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fi ...)
+ TODO: check
+CVE-2026-15023 (The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugi ...)
+ TODO: check
+CVE-2026-14280 (The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugi ...)
+ TODO: check
+CVE-2026-13215 (The Zephyr ext2 filesystem driver fails to validate the s_log_block_si ...)
+ TODO: check
+CVE-2026-13214 (The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack b ...)
+ TODO: check
+CVE-2026-12561 (The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross ...)
+ TODO: check
+CVE-2026-10630 (The WP Courses LMS \u2013 Online Courses Builder, eLearning Courses, C ...)
+ TODO: check
+CVE-2026-10627 (The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugi ...)
+ TODO: check
+CVE-2025-9878 (The PPWP \u2013 Password Protect WordPress | #1 Most-Reviewed Password ...)
+ TODO: check
+CVE-2025-41741
+ REJECTED
+CVE-2020-37268 (Print Assumptions does not report that a definition was produced while ...)
+ TODO: check
CVE-2026-9728 (The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-9254 (An unauthenticated OS command injection vulnerability exists in the pa ...)
@@ -16221,7 +16491,7 @@ CVE-2026-73374 (A stored cross-site scripting (XSS) vulnerability existed in Vul
NOT-FOR-US: vulnerability-lookup
CVE-2026-73327
REJECTED
-CVE-2026-73325 (Fujitsu Research's OneCompression library 1.2.0 contains an unsafe des ...)
+CVE-2026-73325 (Fujitsu Research's OneCompression library before 1.2.1 contains an uns ...)
NOT-FOR-US: Fujitsu Research's OneCompression library
CVE-2026-73301 (Budibase is an open-source low-code platform. Prior to 3.39.25, the GE ...)
NOT-FOR-US: Budibase
@@ -32167,6 +32437,7 @@ CVE-2026-59528 (Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipp
CVE-2026-59527 (Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-59251 (Allocation of resources without limits in Erlang/OTP public_key certif ...)
+ {DSA-6464-1}
- erlang 1:29.0.4+dfsg-1 (bug #1142985)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352
NOTE: https://cna.erlef.org/cves/CVE-2026-59251.html
@@ -32175,6 +32446,7 @@ CVE-2026-59251 (Allocation of resources without limits in Erlang/OTP public_key
NOTE: Fixed by: https://github.com/erlang/otp/commit/f04c6bba38de1cf1b1836a7d9a9fbe239bd939e8 (OTP-27.3.4.15)
NOTE: Fixed by: https://github.com/erlang/otp/commit/f8580fc117098c08165f46c26fd0750c5cfb2a90 (OTP-29.0.4, OTP-28.5.0.4)
CVE-2026-59250 (Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver ...)
+ {DSA-6464-1}
- erlang 1:29.0.4+dfsg-1 (bug #1142985)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7
NOTE: https://cna.erlef.org/cves/CVE-2026-59250.html
@@ -32194,6 +32466,7 @@ CVE-2026-58389 (Allocation of Resources Without Limits or Throttling vulnerabili
NOTE: https://lists.apache.org/thread/ht2mjt8m3vz9v0h5pqzvc4r4nzfxwtrw
NOTE: rust bindings not built in Debian package
CVE-2026-58227 (The Erlang/OTP ssl application does not detect cycles when reconstruct ...)
+ {DSA-6464-1}
- erlang 1:29.0.4+dfsg-1 (bug #1142985)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw
NOTE: https://cna.erlef.org/cves/CVE-2026-58227.html
@@ -32235,6 +32508,7 @@ CVE-2026-55968 (Inefficient Algorithmic Complexity, Allocation of Resources With
NOTE: https://lists.apache.org/thread/gxhhfyr6flr5vzr4qnxm13p6fc41qstp
NOTE: nodejs bindings not built in Debian package
CVE-2026-55953 (The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not veri ...)
+ {DSA-6464-1}
- erlang 1:29.0.4+dfsg-1 (bug #1142985)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882
NOTE: https://cna.erlef.org/cves/CVE-2026-55953.html
@@ -32244,6 +32518,7 @@ CVE-2026-55953 (The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does no
NOTE: Fixed by: https://github.com/erlang/otp/commit/0a82596d425abe43dc2e0b3d74aa1557ef74051c (OTP-28.5.0.4)
NOTE: Fixed by: https://github.com/erlang/otp/commit/064e236414614f9085cbbbd6eacf0e43c02d1b4b (OTP-29.0.4)
CVE-2026-55737 (Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerabil ...)
+ {DSA-6464-1}
- erlang 1:29.0.4+dfsg-1 (bug #1142985)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-446w-268v-9462
NOTE: https://cna.erlef.org/cves/CVE-2026-55737.html
@@ -32255,6 +32530,7 @@ CVE-2026-55579 (Pheditor is a single-file editor and file manager written in PHP
CVE-2026-55578 (Pheditor is a single-file editor and file manager written in PHP. From ...)
NOT-FOR-US: Pheditor
CVE-2026-54890 (Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erl ...)
+ {DSA-6464-1}
- erlang 1:29.0.4+dfsg-1 (bug #1142985)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86
NOTE: https://cna.erlef.org/cves/CVE-2026-54890.html
@@ -32316,6 +32592,7 @@ CVE-2026-48051 (Papra is a minimalistic document management and archiving platfo
CVE-2026-48030 (Pheditor is a single-file editor and file manager written in PHP. From ...)
NOT-FOR-US: Pheditor
CVE-2026-47078 (Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module ...)
+ {DSA-6464-1}
- erlang 1:29.0.4+dfsg-1 (bug #1142985)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-rf72-wp7h-jg3x
NOTE: https://cna.erlef.org/cves/CVE-2026-47078.html
@@ -32341,6 +32618,7 @@ CVE-2026-43871 (Loop with Unreachable Exit Condition ('Infinite Loop') vulnerabi
[trixie] - thrift <no-dsa> (Minor issue)
NOTE: https://lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qby
CVE-2026-42792 (Improper Handling of Exceptional Conditions vulnerability in Erlang OT ...)
+ {DSA-6464-1}
- erlang 1:29.0.4+dfsg-1 (bug #1142985)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-h6f3-hx58-xhj6
NOTE: https://cna.erlef.org/cves/CVE-2026-42792.html
@@ -45156,13 +45434,13 @@ CVE-2026-10673 (The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (dri
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2025-32781 (Apollo is a reliable configuration management system suitable for micr ...)
NOT-FOR-US: Apollo
-CVE-2026-56136
+CVE-2026-56136 (In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_ ...)
{DSA-6389-1}
[experimental] - ntfs-3g 1:2026.7.7-1
- ntfs-3g 1:2026.7.7-2 (bug #1142144)
NOTE: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-r66g-c39x-cw95
NOTE: https://www.openwall.com/lists/oss-security/2026/07/15/6
-CVE-2026-56135
+CVE-2026-56135 (In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in t ...)
{DSA-6389-1}
[experimental] - ntfs-3g 1:2026.7.7-1
- ntfs-3g 1:2026.7.7-2 (bug #1142144)
@@ -53434,6 +53712,7 @@ CVE-2026-56037 (Deserialization of Untrusted Data vulnerability in Themify Themi
CVE-2026-56004 (A shellcode injection in the mercurial handler of the obs tar_scm sour ...)
NOT-FOR-US: obs-service-tar_scm
CVE-2026-55952 (The Erlang/OTP ssl application does not validate that the PSK identity ...)
+ {DSA-6464-1}
- erlang 1:29.0.3+dfsg-1 (bug #1141414)
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-55952
NOTE: https://cna.erlef.org/cves/CVE-2026-55952.html
@@ -53441,6 +53720,7 @@ CVE-2026-55952 (The Erlang/OTP ssl application does not validate that the PSK id
NOTE: https://github.com/erlang/otp/commit/2c3e599797644310e5d4aa39c7193420e59dadff (OTP-28.5.0.3)
NOTE: https://github.com/erlang/otp/commit/9b5437c72fa3403a75c1aba28e5c532bc191c662 (OTP-27.3.4.14)
CVE-2026-55950 (Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erl ...)
+ {DSA-6464-1}
- erlang 1:29.0.3+dfsg-1 (bug #1141414)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-hwfc-5hf4-gvr3
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-55950
@@ -53467,18 +53747,21 @@ CVE-2026-55111 (A malicious actor with access to the network could exploit a Pat
CVE-2026-55110 (A malicious actor who lures an authenticated user to a malicious page ...)
NOT-FOR-US: UniFi
CVE-2026-54891 (Improper Enforcement of Message Integrity During Transmission in a Com ...)
+ {DSA-6464-1}
- erlang 1:29.0.3+dfsg-1 (bug #1141414)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-gf6r-99xw-6qg6
NOTE: https://cna.erlef.org/cves/CVE-2026-54891.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-54891
NOTE: https://github.com/erlang/otp/commit/07d2d0e93f6aaf7652a81e8df075fc1728da5e96 (OTP-29.0.3, OTP-28.5.0.3, OTP-27.3.4.14)
CVE-2026-54887 (Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS ...)
+ {DSA-6464-1}
- erlang 1:29.0.3+dfsg-1 (bug #1141414)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-p2m2-3c2w-8jp8
NOTE: https://cna.erlef.org/cves/CVE-2026-54887.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-54887
NOTE: https://github.com/erlang/otp/commit/888e3bcd72d5406016b9e0de741026bc2a6f114d (OTP-29.0.3, OTP-28.5.0.3, OTP-27.3.4.14)
CVE-2026-54886 (Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability i ...)
+ {DSA-6464-1}
- erlang 1:29.0.3+dfsg-1 (bug #1141414)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-7wp4-pc27-2vj9
NOTE: https://cna.erlef.org/cves/CVE-2026-54886.html
@@ -53517,6 +53800,7 @@ CVE-2026-54401 (A malicious actor with access to the network and low privileges
CVE-2026-54400 (A malicious actor with access to the network and high privileges could ...)
NOT-FOR-US: UniFi
CVE-2026-53422 (Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_s ...)
+ {DSA-6464-1}
- erlang 1:29.0.3+dfsg-1 (bug #1141414)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976
NOTE: https://cna.erlef.org/cves/CVE-2026-53422.html
@@ -70528,11 +70812,13 @@ CVE-2026-49822 (Fission is an open-source, Kubernetes-native serverless framewor
CVE-2026-49821 (Fission is an open-source, Kubernetes-native serverless framework that ...)
NOT-FOR-US: Fission
CVE-2026-49760 (Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface ...)
+ {DSA-6464-1}
- erlang 1:29.0.2+dfsg-1 (bug #1139727)
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-49760
NOTE: https://cna.erlef.org/cves/CVE-2026-49760.html
NOTE: Fixed by: https://github.com/erlang/otp/commit/0bef277b2d39dc8babb9ceb4f5d0a456f3007111 (OTP-29.0.2, OTP-28.5.0.2, OTP-27.3.4.13)
CVE-2026-49759 (Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv ...)
+ {DSA-6464-1}
- erlang 1:29.0.2+dfsg-1 (bug #1139727)
NOTE: https://cna.erlef.org/cves/CVE-2026-49759.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-49759
@@ -70548,6 +70834,7 @@ CVE-2026-49495 (Ghidra 10.2 before 12.1 contains an uncontrolled resource consum
CVE-2026-49069 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-48860 (Reliance on IP Address for Authentication vulnerability in Erlang/OTP ...)
+ {DSA-6464-1}
- erlang 1:29.0.2+dfsg-1 (bug #1139727)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv
NOTE: https://cna.erlef.org/cves/CVE-2026-48860.html
@@ -70560,6 +70847,7 @@ CVE-2026-48859 (Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (s
NOTE: Introduced with: https://github.com/erlang/otp/commit/032d1bc9491a3975c68faf9bc7776115d6ae3005 (OTP-29.0-rc2)
NOTE: Fixed by: https://github.com/erlang/otp/commit/c342092ef4b369bb409d5b71ac8fd83bab74aedf (OTP-29.0.2)
CVE-2026-48858 (Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ft ...)
+ {DSA-6464-1}
- erlang 1:29.0.2+dfsg-1 (bug #1139727)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-24cv-hwgr-37fq
NOTE: https://cna.erlef.org/cves/CVE-2026-48858.html
@@ -70567,12 +70855,14 @@ CVE-2026-48858 (Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP f
NOTE: Fixed by: https://github.com/erlang/otp/commit/2691a806231ffd0490a8a9e20500dec0c7e73727 (OTP-29.0.2, OTP-28.5.0.2)
NOTE: Fixed by: https://github.com/erlang/otp/commit/521bcfa24407ee8cb5614823cf905c37ea3aa605 (OTP-27.3.4.13)
CVE-2026-48856 (Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_respo ...)
+ {DSA-6464-1}
- erlang 1:29.0.2+dfsg-1 (bug #1139727)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-m75x-4vwg-ggjh
NOTE: https://cna.erlef.org/cves/CVE-2026-48856.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-48856
NOTE: Fixed by: https://github.com/erlang/otp/commit/688d748d6f7a6a06b13b662a1d3de8af97079612 (OTP-29.0.2, OTP-28.5.0.2, OTP-27.3.4.13)
CVE-2026-48855 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
+ {DSA-6464-1}
- erlang 1:29.0.2+dfsg-1 (bug #1139727)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-pv7g-pjrq-x2fh
NOTE: https://cna.erlef.org/cves/CVE-2026-48855.html
@@ -81899,6 +82189,7 @@ CVE-2026-42879 (FacturaScripts is an open source accounting and invoicing softwa
CVE-2026-42878 (FacturaScripts is an open source accounting and invoicing software. Pr ...)
NOT-FOR-US: FacturaScripts
CVE-2026-42791 (Improper Certificate Validation vulnerability in Erlang OTP public_key ...)
+ {DSA-6464-1}
- erlang 1:27.3.4.12+dfsg-1
[bookworm] - erlang <not-affected> (Vulnerable code not present)
[bullseye] - erlang <not-affected> (Vulnerable code not present)
@@ -81908,6 +82199,7 @@ CVE-2026-42791 (Improper Certificate Validation vulnerability in Erlang OTP publ
NOTE: https://github.com/erlang/otp/commit/7995f1fdaee3da569bb810358ce0f546471d169b (OTP-27.3.4.12)
NOTE: https://github.com/erlang/otp/commit/b3870e02405c709a872b01ba6086065620cdfe76 (OTP-29.0.1, OTP-28.5.0.1)
CVE-2026-42790 (Improper Certificate Validation vulnerability in Erlang OTP public_key ...)
+ {DSA-6464-1}
- erlang 1:27.3.4.12+dfsg-1
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-22cw-4ph4-6447
NOTE: https://cna.erlef.org/cves/CVE-2026-42790.html
@@ -81916,6 +82208,7 @@ CVE-2026-42790 (Improper Certificate Validation vulnerability in Erlang OTP publ
NOTE: https://github.com/erlang/otp/commit/fb67c6d1836f51105a96d8b769e71e4215a79457 (OTP-27.3.4.12)
NOTE: https://github.com/erlang/otp/commit/21abed64eb2026b5f82f432709e4e932f9be389a (OTP-29.0.1, OTP-28.5.0.1)
CVE-2026-42789 (Improper Following of a Certificate's Chain of Trust vulnerability in ...)
+ {DSA-6464-1}
- erlang 1:27.3.4.12+dfsg-1
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq
NOTE: https://cna.erlef.org/cves/CVE-2026-42789.html
@@ -90309,7 +90602,7 @@ CVE-2026-39803 (Allocation of Resources Without Limits or Throttling vulnerabili
NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-39459 (A vulnerability exists in iControl REST and the TMOS Shell (tmsh) wher ...)
NOT-FOR-US: F5
-CVE-2026-39458 (When a BIG-IP DNS profile enabled with DNS cache is configured on a vi ...)
+CVE-2026-39458 (When a BIG-IP is configured with DNS caching (Such as a DNS profile w ...)
NOT-FOR-US: F5
CVE-2026-39455 (When the BIG-IP Configuration utility is configured to use Lightweight ...)
NOT-FOR-US: F5
@@ -106579,6 +106872,7 @@ CVE-2026-32604 (Spinnaker is an open source, multi-cloud continuous delivery pla
CVE-2026-32311 (Flowsint is an open-source OSINT graph exploration tool designed for c ...)
NOT-FOR-US: Flowsint
CVE-2026-32147 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
+ {DSA-6464-1}
- erlang 1:27.3.4.11+dfsg-1
[bookworm] - erlang <no-dsa> (Minor issue)
[bullseye] - erlang <postponed> (Minor issue, can be fixed with next update)
@@ -113725,6 +114019,7 @@ CVE-2026-33227 (Improper validation and restriction of a classpath path name vul
CVE-2026-32588 (Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows au ...)
- cassandra <itp> (bug #585905)
CVE-2026-32144 (Improper Certificate Validation vulnerability in Erlang OTP public_key ...)
+ {DSA-6464-1}
- erlang 1:27.3.4.10+dfsg-1
[bookworm] - erlang <not-affected> (Vulnerable code not present, only affects 27 and later)
[bullseye] - erlang <not-affected> (Vulnerable code not present, only affects 27 and later)
@@ -113749,6 +114044,7 @@ CVE-2026-30460 (Daylight Studio FuelCMS v1.5.2 was discovered to contain an auth
CVE-2026-30079 (In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorr ...)
NOT-FOR-US: OpenAirInterface
CVE-2026-28810 (Generation of Predictable Numbers or Identifiers vulnerability in Erla ...)
+ {DSA-6464-1}
- erlang 1:27.3.4.10+dfsg-1
[bookworm] - erlang <no-dsa> (Minor issue)
[bullseye] - erlang <postponed> (Minor issue, can be fixed with next update)
@@ -113757,6 +114053,7 @@ CVE-2026-28810 (Generation of Predictable Numbers or Identifiers vulnerability i
NOTE: Fixed by: https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8 (OTP-26.2.5.19, OTP-27.3.4.10, OTP-28.4.2)
NOTE: https://cna.erlef.org/cves/CVE-2026-28810.html
CVE-2026-28808 (Incorrect Authorization vulnerability in Erlang OTP (inets modules) al ...)
+ {DSA-6464-1}
- erlang 1:27.3.4.10+dfsg-1
[bookworm] - erlang <no-dsa> (Minor issue)
[bullseye] - erlang <postponed> (Minor issue, can be fixed with next update)
@@ -501019,8 +501316,8 @@ CVE-2022-30985
RESERVED
CVE-2022-30984 (A buffer overflow vulnerability in the Rubrik Backup Service (RBS) Age ...)
NOT-FOR-US: Rubrik CDM
-CVE-2022-30983
- RESERVED
+CVE-2022-30983 (A cross-site scripting (XSS) vulnerability in Support chatbot in Nopap ...)
+ TODO: check
CVE-2022-30982 (An issue was discovered in Gentics CMS before 5.43.1. There is stored ...)
NOT-FOR-US: Gentics CMS
CVE-2022-30981 (An issue was discovered in Gentics CMS before 5.43.1. By uploading a m ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1f6f2ba03f6c479e50772065895fbce3d58aea2e
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1f6f2ba03f6c479e50772065895fbce3d58aea2e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260825/2eba49df/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list