[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sun Jul 12 20:13:23 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ead37b18 by security tracker role at 2026-07-12T19:13:17+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,81 @@
+CVE-2026-61876 (LuCI versions fail to properly encode DHCPv6 lease hostnames before re ...)
+ TODO: check
+CVE-2026-61875 (luci-app-upnp contains a stored cross-site scripting vulnerability tha ...)
+ TODO: check
+CVE-2026-61874 (filebrowser versions before 2.63.17 fail to normalize paths before que ...)
+ TODO: check
+CVE-2026-59260 (OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/s ...)
+ TODO: check
+CVE-2026-58596 (Untrusted pointer dereference in Microsoft Edge (Chromium-based) allow ...)
+ TODO: check
+CVE-2026-56336 (Capgo before 12.128.2 contains an information disclosure vulnerability ...)
+ TODO: check
+CVE-2026-56313 (Capgo before 12.128.2 contains a cross-organization account disruption ...)
+ TODO: check
+CVE-2026-56308 (Capgo before 12.128.2 allows email address changes without requiring c ...)
+ TODO: check
+CVE-2026-56281 (Capgo before 12.128.2 contains a sql injection vulnerability in the PO ...)
+ TODO: check
+CVE-2026-56271 (Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak ...)
+ TODO: check
+CVE-2026-56260 (Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability i ...)
+ TODO: check
+CVE-2026-56259 (Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities ...)
+ TODO: check
+CVE-2026-56252 (Capgo before 12.128.2 contains a scope isolation vulnerability in the ...)
+ TODO: check
+CVE-2026-56241 (Capgo before 12.128.2 contains a privilege escalation vulnerability wh ...)
+ TODO: check
+CVE-2026-56238 (Capgo before 12.128.2 contains an information disclosure vulnerability ...)
+ TODO: check
+CVE-2026-15502 (A vulnerability was detected in AojiaoZero Antaris 1.0. This affects t ...)
+ TODO: check
+CVE-2026-15501 (A security vulnerability has been detected in AstrBotDevs AstrBot up t ...)
+ TODO: check
+CVE-2026-15500 (A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Af ...)
+ TODO: check
+CVE-2026-15499 (A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25. ...)
+ TODO: check
+CVE-2026-15498 (A vulnerability was identified in sergomanov SmartHomeAdatum up to cf4 ...)
+ TODO: check
+CVE-2026-15497 (A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7. ...)
+ TODO: check
+CVE-2026-15496 (A vulnerability was found in SonicCloudOrg sonic-agent up to 2.7.2. Th ...)
+ TODO: check
+CVE-2026-15495 (A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7. ...)
+ TODO: check
+CVE-2026-15494 (A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Im ...)
+ TODO: check
+CVE-2026-15493 (A vulnerability was detected in Akpali9 Attendance-Management-System u ...)
+ TODO: check
+CVE-2026-15492 (A security vulnerability has been detected in igweze wizgrade up to b1 ...)
+ TODO: check
+CVE-2026-15491 (A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1 ...)
+ TODO: check
+CVE-2026-15490 (A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ...)
+ TODO: check
+CVE-2026-15489 (A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1 ...)
+ TODO: check
+CVE-2026-15488 (A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Af ...)
+ TODO: check
+CVE-2026-15487 (A vulnerability was found in TRENDnet TEW-821DAP 1.11B03. This impacts ...)
+ TODO: check
+CVE-2026-15486 (A vulnerability has been found in TRENDnet TEW-821DAP 1.11B03. This af ...)
+ TODO: check
+CVE-2026-15485 (A flaw has been found in TRENDnet TEW-821DAP 1.11B03. The impacted ele ...)
+ TODO: check
+CVE-2026-10668 (The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/u ...)
+ TODO: check
+CVE-2026-10667 (Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, ...)
+ TODO: check
+CVE-2026-10666 (parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() ...)
+ TODO: check
+CVE-2026-10665 (In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process ...)
+ TODO: check
+CVE-2026-10664 (The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_ ...)
+ TODO: check
+CVE-2026-10663 (In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_ ...)
+ TODO: check
CVE-2026-58281 (Deserialization of untrusted data in Microsoft Edge (Chromium-based) a ...)
NOT-FOR-US: Microsoft
CVE-2026-15484 (A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The affec ...)
@@ -1800,111 +1878,111 @@ CVE-2026-0288 (Multiple buffer overflow vulnerabilities in the User-ID Terminal
CVE-2025-12506 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15112 (Use after free in Ozone in Google Chrome prior to 150.0.7871.115 allow ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15129 (Use after free in Views in Google Chrome prior to 150.0.7871.115 allow ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15132 (Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allow ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15133 (Use after free in InterestGroups in Google Chrome prior to 150.0.7871. ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15108 (Integer overflow in Extensions API in Google Chrome prior to 150.0.787 ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15109 (Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.115 al ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15110 (Use after free in Extensions in Google Chrome prior to 150.0.7871.115 ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15111 (Use after free in Views in Google Chrome prior to 150.0.7871.115 allow ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15113 (Use after free in Autofill in Google Chrome on Android prior to 150.0. ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15114 (Out of bounds read and write in Codecs in Google Chrome prior to 150.0 ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15115 (Insufficient validation of untrusted input in WebAppInstalls in Google ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15116 (Use after free in Actor in Google Chrome prior to 150.0.7871.115 allow ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15117 (Use after free in Payments in Google Chrome prior to 150.0.7871.115 al ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15118 (Use after free in Input in Google Chrome prior to 150.0.7871.115 allow ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15119 (Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15120 (Use after free in Core in Google Chrome on Windows prior to 150.0.7871 ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15121 (Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allo ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15122 (Insufficient validation of untrusted input in Codecs in Google Chrome ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15123 (Inappropriate implementation in DOM in Google Chrome prior to 150.0.78 ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15124 (Insufficient policy enforcement in Passwords in Google Chrome prior to ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15125 (Inappropriate implementation in Forms in Google Chrome prior to 150.0. ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15126 (Use after free in Forms in Google Chrome prior to 150.0.7871.115 allow ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15127 (Inappropriate implementation in WebGL in Google Chrome prior to 150.0. ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15128 (Inappropriate implementation in Forms in Google Chrome prior to 150.0. ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15130 (Insufficient policy enforcement in Navigation in Google Chrome prior t ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15107 (Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 a ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15131 (Inappropriate implementation in Navigation in Google Chrome prior to 1 ...)
- {DSA-6387-1}
+ {DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9074 (IBM API Connect 10.0.8.0 through 10.0.8.9 and12.1.0.0 through 12.1.0.3 ...)
@@ -2730,14 +2808,17 @@ CVE-2026-10570 (The Sympl Repeater for ACF and Elementor plugin for WordPress is
CVE-2025-12799 (A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripti ...)
NOT-FOR-US: Jastow
CVE-2026-56003 (A heap buffer overflow due to missing size checking in the property bu ...)
+ {DLA-4678-1}
- libxfont 1:2.0.8-1 (bug #1141702)
NOTE: https://www.openwall.com/lists/oss-security/2026/07/08/1
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/dff957a5158da038a282a59a31fe736702732939 (libXfont2-2.0.8)
CVE-2026-56002 (A heap bufferflow in pcfReadFont() due to missing glyph bounds checkin ...)
+ {DLA-4678-1}
- libxfont 1:2.0.8-1 (bug #1141702)
NOTE: https://www.openwall.com/lists/oss-security/2026/07/08/1
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/b4389e0b1d84a690b819bb27b1439968811a3674 (libXfont2-2.0.8)
CVE-2026-56001 (A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 ...)
+ {DLA-4678-1}
- libxfont 1:2.0.8-1 (bug #1141702)
NOTE: https://www.openwall.com/lists/oss-security/2026/07/08/1
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/be0b08e2d354138d3222b4490e2a77c6ee42f778 (libXfont2-2.0.8)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ead37b18310869b4108ee2675cbc501338967a70
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ead37b18310869b4108ee2675cbc501338967a70
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260712/255a6650/attachment.htm>
More information about the debian-security-tracker-commits
mailing list