[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Jul 8 20:16:11 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
97c6fb84 by security tracker role at 2026-07-08T19:15:59+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,333 @@
+CVE-2026-9074 (IBM API Connect 10.0.8.0 through 10.0.8.9 and12.1.0.0 through 12.1.0.3 ...)
+ TODO: check
+CVE-2026-8315 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-8310 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-8307 (Improper neutralization of special elements used in an SQL command ('S ...)
+ TODO: check
+CVE-2026-6854 (The My Calendar \u2013 Accessible Event Manager plugin for WordPress i ...)
+ TODO: check
+CVE-2026-6820 (The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vuln ...)
+ TODO: check
+CVE-2026-6818 (The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vuln ...)
+ TODO: check
+CVE-2026-6742 (The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross ...)
+ TODO: check
+CVE-2026-6740 (The Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website B ...)
+ TODO: check
+CVE-2026-6459 (The Essential Addons for Elementor \u2013 Popular Elementor Templates ...)
+ TODO: check
+CVE-2026-6371 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-6280 (Exposure of sensitive information due to incompatible policies vulnera ...)
+ TODO: check
+CVE-2026-6230 (The Tainacan plugin for WordPress is vulnerable to time-based blind SQ ...)
+ TODO: check
+CVE-2026-60125 (MISP\u2019s importModule() path used getEnabledModule() to resolve a s ...)
+ TODO: check
+CVE-2026-60124 (An authorization bypass in MISP\u2019s EventsController::importModule( ...)
+ TODO: check
+CVE-2026-60102 (Horde Virtual File System (VFS) API before 3.0.1 contains an OS comman ...)
+ TODO: check
+CVE-2026-60092 (AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc02 ...)
+ TODO: check
+CVE-2026-5459 (The User Frontend: AI Powered Frontend Posting, User Directory, Profil ...)
+ TODO: check
+CVE-2026-5356 (The LatePoint \u2013 Calendar Booking Plugin for Appointments and Even ...)
+ TODO: check
+CVE-2026-59938 (pypdf is a free and open-source pure-python PDF library. Prior to 6.14 ...)
+ TODO: check
+CVE-2026-59937 (pypdf is a free and open-source pure-python PDF library. Prior to 6.14 ...)
+ TODO: check
+CVE-2026-59930 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
+ TODO: check
+CVE-2026-59929 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
+ TODO: check
+CVE-2026-59928 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
+ TODO: check
+CVE-2026-59927 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
+ TODO: check
+CVE-2026-59926 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
+ TODO: check
+CVE-2026-59925 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
+ TODO: check
+CVE-2026-59924 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
+ TODO: check
+CVE-2026-59923 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
+ TODO: check
+CVE-2026-59922 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
+ TODO: check
+CVE-2026-59897 (Hono is a Web application framework that provides support for any Java ...)
+ TODO: check
+CVE-2026-59896 (Hono is a Web application framework that provides support for any Java ...)
+ TODO: check
+CVE-2026-59895 (Hono is a Web application framework that provides support for any Java ...)
+ TODO: check
+CVE-2026-59892 (OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior ...)
+ TODO: check
+CVE-2026-59890 (setuptools is a package that allows users to download, build, install, ...)
+ TODO: check
+CVE-2026-59887 (linkify-it is a links recognition library with full Unicode support. P ...)
+ TODO: check
+CVE-2026-59883 (Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar di ...)
+ TODO: check
+CVE-2026-59882 (guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. ...)
+ TODO: check
+CVE-2026-59880 (Immutable.js provides many Persistent Immutable data structures. Prior ...)
+ TODO: check
+CVE-2026-59879 (Immutable.js provides many Persistent Immutable data structures. Prior ...)
+ TODO: check
+CVE-2026-59877 (protobufjs compiles protobuf definitions into JavaScript (JS) function ...)
+ TODO: check
+CVE-2026-59876 (protobufjs compiles protobuf definitions into JavaScript (JS) function ...)
+ TODO: check
+CVE-2026-59875 (node-tar is a tar archive manipulation library for Node.js. Prior to 7 ...)
+ TODO: check
+CVE-2026-59874 (node-tar is a tar archive manipulation library for Node.js. Prior to 7 ...)
+ TODO: check
+CVE-2026-59873 (node-tar is a tar archive manipulation library for Node.js. Prior to 7 ...)
+ TODO: check
+CVE-2026-59871 (node-tar is a tar archive manipulation library for Node.js. Prior to 7 ...)
+ TODO: check
+CVE-2026-59870 (js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2. ...)
+ TODO: check
+CVE-2026-59869 (js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15 ...)
+ TODO: check
+CVE-2026-59868 (js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2. ...)
+ TODO: check
+CVE-2026-59731 (Astro is a web framework for content-driven websites. Version 6.4.7 pe ...)
+ TODO: check
+CVE-2026-59725 (Socket.IO enables bidirectional and low-latency communication for ever ...)
+ TODO: check
+CVE-2026-59724 (Socket.IO enables bidirectional and low-latency communication for ever ...)
+ TODO: check
+CVE-2026-59703 (repomix contains a local file inclusion vulnerability in the git clone ...)
+ TODO: check
+CVE-2026-59702 (repomix contains a server-side request forgery vulnerability in the PO ...)
+ TODO: check
+CVE-2026-59262 (AFFiNE's histories GraphQL field fails to validate Doc.Read permission ...)
+ TODO: check
+CVE-2026-59261 (OpenClaw before 2026.5.28 contains a credential exposure vulnerability ...)
+ TODO: check
+CVE-2026-59257 (n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 conta ...)
+ TODO: check
+CVE-2026-59253 (n8n before 2.28.0 contains an improper authorization vulnerability all ...)
+ TODO: check
+CVE-2026-58657 (Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) con ...)
+ TODO: check
+CVE-2026-58656 (Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= ...)
+ TODO: check
+CVE-2026-58654 (The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrest ...)
+ TODO: check
+CVE-2026-58480 (Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an u ...)
+ TODO: check
+CVE-2026-57439 (CyberChef is a web app for encryption, encoding, compression, and data ...)
+ TODO: check
+CVE-2026-57260 (The application opened a PDF file containing an abnormal Unity 3D obje ...)
+ TODO: check
+CVE-2026-57259 (The input file does not need to be strictly in a structurally valid PD ...)
+ TODO: check
+CVE-2026-57258 (The PRC file header parsing logic trusts the constructed file structur ...)
+ TODO: check
+CVE-2026-57257 (During the PRC parsing stage, there is a lack of boundary verification ...)
+ TODO: check
+CVE-2026-57256 (When the application opens a PDF and executes JavaScript, it performs ...)
+ TODO: check
+CVE-2026-57255 (The application opens a PDF containing an abnormal color space whose a ...)
+ TODO: check
+CVE-2026-57254 (There is an abnormal annotation within the PDF that is referenced by o ...)
+ TODO: check
+CVE-2026-57253 (An abnormal image object causes the renderer to enter the wrong proces ...)
+ TODO: check
+CVE-2026-57252 (When the application opens a PDF file, during the process of JavaScrip ...)
+ TODO: check
+CVE-2026-57251 (The application opens a PDF, but the cloud-like appearance of the cons ...)
+ TODO: check
+CVE-2026-57250 (When the application opens a PDF and JavaScript resets the form fields ...)
+ TODO: check
+CVE-2026-57249 (After the application opened the PDF file, the script first reset the ...)
+ TODO: check
+CVE-2026-57248 (When the application opens a PDF file and JavaScript writes annotation ...)
+ TODO: check
+CVE-2026-57247 (The application re-enters the document structure via field processing ...)
+ TODO: check
+CVE-2026-57246 (When dealing with abnormally constructed objects, there is a lack of a ...)
+ TODO: check
+CVE-2026-57245 (When the application opens a PDF, traverses and builds the annotation ...)
+ TODO: check
+CVE-2026-57244 (After JavaScript resetting the form, the synchronization process lacks ...)
+ TODO: check
+CVE-2026-57243 (During the process of page opening and form formatting, a JavaScript r ...)
+ TODO: check
+CVE-2026-57242 (The application opens the PDF, and JavaScript modifies the form. Howev ...)
+ TODO: check
+CVE-2026-57241 (The application opens the PDF, and JavaScript performs operations on t ...)
+ TODO: check
+CVE-2026-57240 (When the application opens a PDF file and JavaScript deletes the PDF f ...)
+ TODO: check
+CVE-2026-57239 (The user-controllable executable files will be directly executed by hi ...)
+ TODO: check
+CVE-2026-57238 (After the application opened the PDF, JavaScript deleted the form fiel ...)
+ TODO: check
+CVE-2026-57237 (When the application opens a PDF and JavaScript modifies the propertie ...)
+ TODO: check
+CVE-2026-56778 (n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization b ...)
+ TODO: check
+CVE-2026-56776 (n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypa ...)
+ TODO: check
+CVE-2026-56775 (n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vuln ...)
+ TODO: check
+CVE-2026-56401 (Wazuh wazuh-modulesd before 5.0.0-beta3 contains a null pointer derefe ...)
+ TODO: check
+CVE-2026-56374 (ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerabil ...)
+ TODO: check
+CVE-2026-56362 (ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulne ...)
+ TODO: check
+CVE-2026-56360 (n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 sig ...)
+ TODO: check
+CVE-2026-56359 (n8n before 2.8.0 contains a cross-site scripting vulnerability in the ...)
+ TODO: check
+CVE-2026-56298 (Capgo before 12.128.2 fails to strip EXIF metadata from images uploade ...)
+ TODO: check
+CVE-2026-56297 (FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcma ...)
+ TODO: check
+CVE-2026-56293 (Capgo before 12.128.2 contains an authorization flaw in transfer_app() ...)
+ TODO: check
+CVE-2026-56284 (Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosur ...)
+ TODO: check
+CVE-2026-56283 (Capgo before 12.128.2 contains an html injection vulnerability in the ...)
+ TODO: check
+CVE-2026-56273 (Flowise before 3.1.0 contains a path traversal vulnerability in Faiss ...)
+ TODO: check
+CVE-2026-56250 (Capgo before 12.128.2 allows upload-scoped API keys to modify the muta ...)
+ TODO: check
+CVE-2026-56246 (Capgo before 12.128.2 contains a broken access control vulnerability i ...)
+ TODO: check
+CVE-2026-56226 (Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RP ...)
+ TODO: check
+CVE-2026-56220 (Capgo before 12.128.2 contains an authorization bypass vulnerability i ...)
+ TODO: check
+CVE-2026-56217 (Capgo before 12.128.2 contains a policy bypass vulnerability in app_ve ...)
+ TODO: check
+CVE-2026-56086 (Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 r ...)
+ TODO: check
+CVE-2026-55874 (SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API g ...)
+ TODO: check
+CVE-2026-55873 (SeaweedFS is a distributed storage system. In versions 4.08 through 4. ...)
+ TODO: check
+CVE-2026-55761 (Portainer Community Edition is a lightweight service delivery platform ...)
+ TODO: check
+CVE-2026-55668 (File Browser provides a web file managing interface. Prior to 2.63.16, ...)
+ TODO: check
+CVE-2026-54652 (Frigate is an open source network video recorder. In version 0.17.1, t ...)
+ TODO: check
+CVE-2026-54344 (ToolJet is an open-source low-code platform for building internal tool ...)
+ TODO: check
+CVE-2026-54061 (Dgraph is an open source distributed GraphQL database. Prior to versio ...)
+ TODO: check
+CVE-2026-53951 (Copier is a library and CLI app for rendering project templates. In ve ...)
+ TODO: check
+CVE-2026-53482 (Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 r ...)
+ TODO: check
+CVE-2026-53480 (Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 r ...)
+ TODO: check
+CVE-2026-50813 (An issue in SQLite before Fossil check-in 869a51ae84df allows a local ...)
+ TODO: check
+CVE-2026-50812 (A NULL pointer dereference in the SQLite Session Extension in SQLite 3 ...)
+ TODO: check
+CVE-2026-49946
+ REJECTED
+CVE-2026-49945
+ REJECTED
+CVE-2026-49944
+ REJECTED
+CVE-2026-49147 (App::Ack versions through 3.10.0 for Perl print unsanitised terminal e ...)
+ TODO: check
+CVE-2026-49146 (App::Ack versions before 3.10.0 for Perl allow memory exhaustion via a ...)
+ TODO: check
+CVE-2026-49145 (App::Ack versions through 3.10.0 for Perl read arbitrary files via --f ...)
+ TODO: check
+CVE-2026-44840 (Dgraph is an open source distributed GraphQL database. Prior to versio ...)
+ TODO: check
+CVE-2026-41122 (Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 r ...)
+ TODO: check
+CVE-2026-41042 (Unauthenticated callers can supply a malicious H2 JDBC URL through the ...)
+ TODO: check
+CVE-2026-3688 (The WCFM Membership \u2013 WooCommerce Memberships for Multivendor Mar ...)
+ TODO: check
+CVE-2026-3144 (IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials whi ...)
+ TODO: check
+CVE-2026-29009 (U-Boot through 2026.04-rc3 contains a buffer overflow vulnerability in ...)
+ TODO: check
+CVE-2026-29008 (U-Boot through 2026.04-rc3 contains an integer underflow vulnerability ...)
+ TODO: check
+CVE-2026-29007 (U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerabilit ...)
+ TODO: check
+CVE-2026-24700 (An OS command injection vulnerability exists in the start_lltd() funct ...)
+ TODO: check
+CVE-2026-24699 (An OS command injection vulnerability exists in the sub_34984() functi ...)
+ TODO: check
+CVE-2026-24698 (An OS command injection vulnerability exists in the save_syslog_to_fil ...)
+ TODO: check
+CVE-2026-24697 (An OS command injection vulnerability exists in the start_bonjour() fu ...)
+ TODO: check
+CVE-2026-22927 (Omnissa Workspace ONE\xae Tunnel for Windows addresses a Local Privi ...)
+ TODO: check
+CVE-2026-15067 (Snowflake Terraform Provider versions prior to 2.18.0 contain several ...)
+ TODO: check
+CVE-2026-15063 (A flaw was found in the gorch service template, which is part of the t ...)
+ TODO: check
+CVE-2026-15062 (SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (sn ...)
+ TODO: check
+CVE-2026-15053 (Tanium addressed a denial of service vulnerability in Tanium Server.)
+ TODO: check
+CVE-2026-15044 (A flaw was found in the TrustyAI Service Operator. When deploying serv ...)
+ TODO: check
+CVE-2026-15041 (A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password v ...)
+ TODO: check
+CVE-2026-15036 (A vulnerability was determined in Harness up to 2.28.2. This vulnerabi ...)
+ TODO: check
+CVE-2026-15035 (A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the ...)
+ TODO: check
+CVE-2026-15034 (A vulnerability has been found in flask-dashboard Flask-MonitoringDash ...)
+ TODO: check
+CVE-2026-15033 (A flaw has been found in christopherthielen check-peer-dependencies up ...)
+ TODO: check
+CVE-2026-14967 (BBOT's `github_workflows` module could be induced to write a downloade ...)
+ TODO: check
+CVE-2026-14966 (BBOT's unarchive module rejects archives containing symlink entries be ...)
+ TODO: check
+CVE-2026-14362 (HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of ...)
+ TODO: check
+CVE-2026-14250 (The Themehunk Login Registration plugin for WordPress is vulnerable to ...)
+ TODO: check
+CVE-2026-13129 (When the application opens a PDF file, JavaScript uses the damaged fie ...)
+ TODO: check
+CVE-2026-13128 (Embedding JavaScript within a PDF file will cause the page to be delet ...)
+ TODO: check
+CVE-2026-13127 (The application opens the PDF file. JavaScript then rewrites the docum ...)
+ TODO: check
+CVE-2026-13126 (The embedded JavaScript in the PDF deleted the pages, making the objec ...)
+ TODO: check
+CVE-2026-12936 (The Recurio \u2013 Ultimate Subscription for WooCommerce plugin for Wo ...)
+ TODO: check
+CVE-2026-12002 (The Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin pl ...)
+ TODO: check
+CVE-2026-11903 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-10708 (This vulnerability enables large\u2011scale data harvesting without re ...)
+ TODO: check
+CVE-2026-10706 (In Adalo\u2019s no-code app builder, (Versions 1 and 2) the attackers ...)
+ TODO: check
+CVE-2026-10699 (Missing release of memory after effective lifetime vulnerability in Pr ...)
+ TODO: check
+CVE-2026-10698 (Improper Neutralization of Special Elements in Data Query Logic vulner ...)
+ TODO: check
+CVE-2025-3110 (OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed seque ...)
+ TODO: check
+CVE-2025-14785 (The Website Builder by SeedProd - Theme Builder, Landing Page Builder, ...)
+ TODO: check
CVE-2026-58382
- gimp <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2497384
@@ -28,7 +358,7 @@ CVE-2026-58388
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2497435
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/commit/c1263f39
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16231
-CVE-2026-14454
+CVE-2026-14454 (Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry co ...)
- libimager-perl <unfixed>
[trixie] - libimager-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41637674/
@@ -367,26 +697,26 @@ CVE-2026-10570 (The Sympl Repeater for ACF and Elementor plugin for WordPress is
NOT-FOR-US: WordPress plugin
CVE-2025-12799 (A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripti ...)
NOT-FOR-US: Jastow
-CVE-2026-56003 [computeProps Property Buffer Heap Buffer Overflow]
+CVE-2026-56003 (A heap buffer overflow due to missing size checking in the property bu ...)
- libxfont <unfixed>
NOTE: https://www.openwall.com/lists/oss-security/2026/07/08/1
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/dff957a5158da038a282a59a31fe736702732939 (libXfont2-2.0.8)
-CVE-2026-56002 [PCF Font Parsing Heap Buffer Overflow]
+CVE-2026-56002 (A heap bufferflow in pcfReadFont() due to missing glyph bounds checkin ...)
- libxfont <unfixed>
NOTE: https://www.openwall.com/lists/oss-security/2026/07/08/1
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/b4389e0b1d84a690b819bb27b1439968811a3674 (libXfont2-2.0.8)
-CVE-2026-56001 [BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow]
+CVE-2026-56001 (A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 ...)
- libxfont <unfixed>
NOTE: https://www.openwall.com/lists/oss-security/2026/07/08/1
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/be0b08e2d354138d3222b4490e2a77c6ee42f778 (libXfont2-2.0.8)
-CVE-2026-56000 [GLX contextTags Use-After-Free in CommonMakeCurrent()]
+CVE-2026-56000 (Local attackers with a X connection able to provide GLX commit to the ...)
- xorg-server <unfixed>
- xwayland <unfixed>
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
NOTE: https://www.openwall.com/lists/oss-security/2026/07/08/2
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043
-CVE-2026-55999 [glamor Font Atlas Heap Buffer Overflow]
+CVE-2026-55999 (Local attackers with a X connection able to provide PCX fonts to the X ...)
- xorg-server <unfixed>
- xwayland <unfixed>
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
@@ -412,7 +742,7 @@ CVE-2026-14740 (DBI versions before 1.650 for Perl read one byte out-of-bounds i
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41625532/
NOTE: https://github.com/perl5-dbi/dbi/security/advisories/GHSA-35f4-f8m9-w8xg
NOTE: Fixed by: https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01 (1.650)
-CVE-2026-39822
+CVE-2026-39822 (On Unix systems, opening a file in an os.Root improperly follows symli ...)
- golang-1.27 1.27~rc2-1
- golang-1.26 1.26.5-1
- golang-1.25 1.25.12-1
@@ -424,7 +754,7 @@ CVE-2026-39822
NOTE: https://github.com/golang/go/issues/79005
NOTE: Fixed by: https://github.com/golang/go/commit/f9ef7f55988f03afeb3b8354367d0fa8d053683d (go1.26.5)
NOTE: Fixed by: https://github.com/golang/go/commit/c94048f5638bbcaa22102bade5e9774e0d485315 (go1.25.12)
-CVE-2026-42505
+CVE-2026-42505 (Handshakes which used Encrypted Client Hello could be de-anonymized by ...)
- golang-1.27 1.27~rc2-1
- golang-1.26 1.26.5-1
- golang-1.25 1.25.12-1
@@ -888,9 +1218,9 @@ CVE-2026-33630
NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542
NOTE: Fixed by: https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc (main)
NOTE: Fixed by: https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a (v1.34.7)
-CVE-2026-9182 (ArcGIS Server contains an unrestricted file upload vulnerability. An u ...)
+CVE-2026-9182 (Esri ArcGIS Server contains an unrestricted file upload vulnerability. ...)
NOT-FOR-US: Esri
-CVE-2026-9181 (ArcGIS Server contains a directory traversal vulnerability. An unauth ...)
+CVE-2026-9181 (Esri ArcGIS Server contains a directory traversal vulnerability. ArcGI ...)
NOT-FOR-US: Esri
CVE-2026-9165 (A flaw was found in Red Hat Advanced Cluster Security for Kubernetes ( ...)
NOT-FOR-US: Red Hat Advanced Cluster Security for Kubernetes (RHACS)
@@ -2015,7 +2345,7 @@ CVE-2026-58579 (RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name w
NOT-FOR-US: RAGFlow
CVE-2026-58578 (LobeChat before version 2.2.10-canary.15 contains a regular expression ...)
NOT-FOR-US: LobeChat
-CVE-2026-58467 (Cockpit CMS before release 364 contains a path traversal and local fil ...)
+CVE-2026-58467 (Cockpit CMS through 2.14.0 contains a path traversal and local file in ...)
NOT-FOR-US: Cockpit CMS
CVE-2026-58466 (AutoBangumi before 3.2.8 contains a hard-coded default credentials vul ...)
NOT-FOR-US: AutoBangumi
@@ -3096,6 +3426,7 @@ CVE-2026-55597 (ImageMagick is free and open-source software used for editing an
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/277541927c2de8317d4167ee16d57375f24971d3 (7.1.2-26)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/d241c85d93e4684f84201bd08f4aad80eac44f4a (6.9.13-51)
CVE-2026-55595 (ImageMagick is free and open-source software used for editing and mani ...)
+ {DSA-6383-1}
- imagemagick 8:7.1.2.26+dfsg1-1
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qhmf-7fc4-8q3h
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/549fdf2195bbac1c93e736c04f416d4d9a5d05a8 (7.1.2-26)
@@ -224719,7 +225050,7 @@ CVE-2024-50563 (A weak authentication in Fortinet FortiManager Cloud, FortiAnaly
NOT-FOR-US: FortiGuard
CVE-2024-48885 (A improper limitation of a pathname to a restricted directory ('path t ...)
NOT-FOR-US: FortiGuard
-CVE-2024-45331 (A incorrect privilege assignment in Fortinet FortiAnalyzer versions 7. ...)
+CVE-2024-45331 (A incorrect privilege assignment vulnerability in Fortinet FortiAnalyz ...)
NOT-FOR-US: FortiGuard
CVE-2024-41746 (IBM CICS TX Advanced 10.1, 11.1, and Standard 11.1 is vulnerable to st ...)
NOT-FOR-US: IBM
@@ -226054,7 +226385,7 @@ CVE-2024-35278 (A improper neutralization of special elements used in an sql com
NOT-FOR-US: Wavlink
CVE-2024-35277 (A missing authentication for critical function in Fortinet FortiPortal ...)
NOT-FOR-US: Fortinet
-CVE-2024-35276 (A stack-based buffer overflow in Fortinet FortiAnalyzer versions 7.4.0 ...)
+CVE-2024-35276 (A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer ...)
NOT-FOR-US: Fortinet
CVE-2024-35275 (A improper neutralization of special elements used in an sql command ( ...)
NOT-FOR-US: Fortinet
@@ -226064,7 +226395,7 @@ CVE-2024-34544 (A command injection vulnerability exists in the wireless.cgi Add
NOT-FOR-US: Wavlink
CVE-2024-34166 (An os command injection vulnerability exists in the touchlist_sync.cgi ...)
NOT-FOR-US: Wavlink
-CVE-2024-33503 (A improper privilege management in Fortinet FortiManager version 7.4.0 ...)
+CVE-2024-33503 (A improper privilege management vulnerability in Fortinet FortiManager ...)
NOT-FOR-US: Fortinet
CVE-2024-33502 (An improper limitation of a pathname to a restricted directory ('path ...)
NOT-FOR-US: Fortinet
@@ -285712,7 +286043,7 @@ CVE-2024-28103 (Action Pack is a framework for handling and responding to web re
NOTE: https://github.com/rails/rails/security/advisories/GHSA-fwhr-88qx-h9g7
NOTE: https://github.com/rails/rails/commit/35858f1d9d57f6c4050a8d9ab754bd5d088b4523 (main)
NOTE: https://github.com/rails/rails/commit/b329b261dd32a61316f2831788d6078ca0563ab6 (v6.1.7.8)
-CVE-2024-23669 (An improper authorization in Fortinet FortiWebManager version 7.2.0 an ...)
+CVE-2024-23669 (An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebM ...)
NOT-FOR-US: Fortinet
CVE-2024-23326 (Envoy is a cloud-native, open source edge and service proxy. A theoret ...)
- envoyproxy <itp> (bug #987544)
@@ -286161,11 +286492,11 @@ CVE-2024-31684 (Incorrect access control in the fingerprint authentication mecha
NOT-FOR-US: Bitdefender Mobile Security
CVE-2024-31682 (Incorrect access control in the fingerprint authentication mechanism o ...)
NOT-FOR-US: phone-cleaner
-CVE-2024-23670 (An improper authorization in Fortinet FortiWebManager version 7.2.0 an ...)
+CVE-2024-23670 (An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebM ...)
NOT-FOR-US: FortiGuard
-CVE-2024-23668 (An improper authorization in Fortinet FortiWebManager version 7.2.0 an ...)
+CVE-2024-23668 (An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebM ...)
NOT-FOR-US: FortiGuard
-CVE-2024-23667 (An improper authorization in Fortinet FortiWebManager version 7.2.0 an ...)
+CVE-2024-23667 (An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebM ...)
NOT-FOR-US: FortiGuard
CVE-2024-23665 (Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb ...)
NOT-FOR-US: FortiGuard
@@ -315696,9 +316027,9 @@ CVE-2023-46717 (An improper authentication vulnerability [CWE-287] in FortiOS ve
NOT-FOR-US: FortiGuard
CVE-2023-45793 (A vulnerability has been identified in Siveillance Control (All versio ...)
NOT-FOR-US: Siemens
-CVE-2023-42790 (A stack-based buffer overflow in Fortinet FortiOS 7.4.0 through 7.4.1, ...)
+CVE-2023-42790 (A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 ...)
NOT-FOR-US: FortiGuard
-CVE-2023-42789 (A out-of-bounds write in Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 t ...)
+CVE-2023-42789 (A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through ...)
NOT-FOR-US: FortiGuard
CVE-2023-41842 (A use of externally-controlled format string vulnerability [CWE-134] v ...)
NOT-FOR-US: FortiGuard
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/97c6fb84cd8ce5ba75c01fc7a7c68e230811e696
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/97c6fb84cd8ce5ba75c01fc7a7c68e230811e696
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260708/0a159f62/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list