[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Jul 21 08:12:43 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
d918ae95 by security tracker role at 2026-07-21T07:12:37+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,16 +1,200 @@
-CVE-2026-58624
+CVE-2026-8082 (The bpost-shipping-platform WordPress plugin before 3.2.3 does not pro ...)
+ TODO: check
+CVE-2026-6952 (A post-authentication command injection vulnerability in the "LogServe ...)
+ TODO: check
+CVE-2026-64651 (The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode ...)
+ TODO: check
+CVE-2026-64650 (The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by ...)
+ TODO: check
+CVE-2026-64626 (AVideo versions from commit 0dbadbca through latest master contain a s ...)
+ TODO: check
+CVE-2026-64625 (AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where ...)
+ TODO: check
+CVE-2026-64624 (FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP ...)
+ TODO: check
+CVE-2026-64619 (FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in t ...)
+ TODO: check
+CVE-2026-63771 (Adminer before 5.4.3 contains a cookie injection vulnerability that al ...)
+ TODO: check
+CVE-2026-63770 (Glance through 0.8.5 contains an IP address spoofing vulnerability in ...)
+ TODO: check
+CVE-2026-63769 (Huginn through 2022.08.18 contains a server-side request forgery vulne ...)
+ TODO: check
+CVE-2026-63768 (cal.diy through 6.2.0 contains an open redirect vulnerability in the c ...)
+ TODO: check
+CVE-2026-63767 (ktransformers through 0.6.3, fixed in commit def0f93, contains an unau ...)
+ TODO: check
+CVE-2026-63766 (GPT-SoVITS through 20250606v2pro contains an OS command injection vuln ...)
+ TODO: check
+CVE-2026-63731 (HyperDX before 2.31.0 contains a server-side request forgery vulnerabi ...)
+ TODO: check
+CVE-2026-63730 (HyperDX before 2.31.0 contains a server-side request forgery vulnerabi ...)
+ TODO: check
+CVE-2026-63729 (The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedd ...)
+ TODO: check
+CVE-2026-63728 (Gitleaks prior to 8.30.1 contains a template injection vulnerability t ...)
+ TODO: check
+CVE-2026-62414 (The Joomla extension Page Builder CK does not properly apply access co ...)
+ TODO: check
+CVE-2026-61901 (The Joomla extension Hikashop is vulnerable to an open redirect.)
+ TODO: check
+CVE-2026-61900 (The Joomla extension JDownloads is vulnerable to an unauthenticated fi ...)
+ TODO: check
+CVE-2026-61425 (The Joomla extension Gridbox is vulnerable an authenticated bypass, po ...)
+ TODO: check
+CVE-2026-61424 (The Joomla extension DJ-Classifieds is vulnerable to an unauthenticate ...)
+ TODO: check
+CVE-2026-59776 (Missing Cryptographic Step (CWE-325) vulnerability exists in certain F ...)
+ TODO: check
+CVE-2026-57852 (Grav CMS scheduler-webhook plugin contains an authentication bypass vu ...)
+ TODO: check
+CVE-2026-57495 (AgenticMail gives AI agents real email addresses and phone numbers. In ...)
+ TODO: check
+CVE-2026-57494 (AgenticMail gives AI agents real email addresses and phone numbers. In ...)
+ TODO: check
+CVE-2026-55833 (Netty is a network application framework for development of protocol s ...)
+ TODO: check
+CVE-2026-55831 (Netty is a network application framework for development of protocol s ...)
+ TODO: check
+CVE-2026-55550 (NextCRM is open-source customer relationship management (CRM) software ...)
+ TODO: check
+CVE-2026-55544 (NextCRM is open-source customer relationship management (CRM) software ...)
+ TODO: check
+CVE-2026-55219 (Paymenter is a free and open-source webshop solution for management of ...)
+ TODO: check
+CVE-2026-53596 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
+ TODO: check
+CVE-2026-53595 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
+ TODO: check
+CVE-2026-53594 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
+ TODO: check
+CVE-2026-53593 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
+ TODO: check
+CVE-2026-53592 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
+ TODO: check
+CVE-2026-53591 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
+ TODO: check
+CVE-2026-52656 (An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before ...)
+ TODO: check
+CVE-2026-51385 (An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 al ...)
+ TODO: check
+CVE-2026-51031 (FlareSolverr before version 3.4.7 contains a server-side request forge ...)
+ TODO: check
+CVE-2026-51025 (Cross Site Scripting vulnerability in fuint Member Marketing System <= ...)
+ TODO: check
+CVE-2026-47255 (AgenticMail gives AI agents real email addresses and phone numbers. @a ...)
+ TODO: check
+CVE-2026-47198 (Paymenter is a free and open-source webshop solution for management of ...)
+ TODO: check
+CVE-2026-47144 (Shamefile is a linter for undocumented linter warnings. Prior to versi ...)
+ TODO: check
+CVE-2026-47134 (ClearanceKit intercepts file-system access events on macOS and enforce ...)
+ TODO: check
+CVE-2026-47133 (ClearanceKit intercepts file-system access events on macOS and enforce ...)
+ TODO: check
+CVE-2026-47130 (NextCRM is open-source customer relationship management (CRM) software ...)
+ TODO: check
+CVE-2026-47129 (NextCRM is open-source customer relationship management (CRM) software ...)
+ TODO: check
+CVE-2026-47128 (nono is software that allows users to run AI agents in a zero-latency ...)
+ TODO: check
+CVE-2026-44585 (Paymenter is a free and open-source webshop solution for management of ...)
+ TODO: check
+CVE-2026-44584 (Paymenter is a free and open-source webshop solution for management of ...)
+ TODO: check
+CVE-2026-44583 (Paymenter is a free and open-source webshop solution for management of ...)
+ TODO: check
+CVE-2026-44510 (Rsync is a file-copying tool that uses a delta-transfer algorithm to s ...)
+ TODO: check
+CVE-2026-44509 (Rsync is a file-copying tool that uses a delta-transfer algorithm to s ...)
+ TODO: check
+CVE-2026-44508 (Rsync is a file-copying tool that uses a delta-transfer algorithm to s ...)
+ TODO: check
+CVE-2026-44507 (Rsync is a file-copying tool that uses a delta-transfer algorithm to s ...)
+ TODO: check
+CVE-2026-3182 (Zohocorp ManageEngine Endpoint Central versions before11.4.2528.34 are ...)
+ TODO: check
+CVE-2026-16337 (Improper authorization in the ToolGroupResource and RoleAjax REST/DWR ...)
+ TODO: check
+CVE-2026-16336 (A vulnerability was found in trinodb trino 481. Affected is an unknown ...)
+ TODO: check
+CVE-2026-16334 (A vulnerability was identified in itsourcecode Hospital Management Sys ...)
+ TODO: check
+CVE-2026-16332 (A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an ...)
+ TODO: check
+CVE-2026-16331 (A security vulnerability has been detected in D-Link DNS-320 1.0.2. Th ...)
+ TODO: check
+CVE-2026-16330 (A weakness has been identified in D-Link DNS-320 1.0.2. The impacted e ...)
+ TODO: check
+CVE-2026-16329 (A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an ...)
+ TODO: check
+CVE-2026-16327 (A vulnerability was determined in D-Link DNS-320 1.0.2. This issue aff ...)
+ TODO: check
+CVE-2026-16324 (A vulnerability was identified in Metasoft \u7f8e\u7279\u8f6f\u4ef6 Me ...)
+ TODO: check
+CVE-2026-16266 (Versions of the package mongo-object before 3.0.3 are vulnerable to Pr ...)
+ TODO: check
+CVE-2026-15927 (A flaw was found in Red Hat Quay's repository-level mirror configurati ...)
+ TODO: check
+CVE-2026-15812 (A vulnerability was found in the internal Access Control List (ACL) su ...)
+ TODO: check
+CVE-2026-15811 (A vulnerability was found in kronosnet's (version <=1.34) cryptographi ...)
+ TODO: check
+CVE-2026-15788 (BuildKit's cache mount source= selector on Windows Container on Window ...)
+ TODO: check
+CVE-2026-15782 (The WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, ...)
+ TODO: check
+CVE-2026-15156 (The Essential Addons for Elementor \u2013 Popular Elementor Templates ...)
+ TODO: check
+CVE-2026-14185 (The WPBot WordPress plugin before 8.2.0 does not perform a capability ...)
+ TODO: check
+CVE-2026-14184 (The Academy LMS WordPress plugin before 3.8.1 does not verify ownershi ...)
+ TODO: check
+CVE-2026-14183 (The Classified Listing WordPress plugin before 5.3.9 does not verify ...)
+ TODO: check
+CVE-2026-13694 (The Bit Form WordPress plugin before 3.1.0 does not properly validate ...)
+ TODO: check
+CVE-2026-13693 (The Bit Form WordPress plugin before 3.1.0 does not restrict a form f ...)
+ TODO: check
+CVE-2026-13439 (The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerabl ...)
+ TODO: check
+CVE-2026-13381 (VSee Clinic 7.1.26 and API1.3.0contain an Insecure Direct Object Refer ...)
+ TODO: check
+CVE-2026-13380 (VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP cr ...)
+ TODO: check
+CVE-2026-12900 (The Spectra Gutenberg Blocks \u2013 Website Builder for the Block Edit ...)
+ TODO: check
+CVE-2026-11767 (The Free Builder for Elementor WordPress plugin before 1.6.7 does no ...)
+ TODO: check
+CVE-2024-51316 (The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerabil ...)
+ TODO: check
+CVE-2024-51315 (The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability ...)
+ TODO: check
+CVE-2024-51314 (The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability ...)
+ TODO: check
+CVE-2024-51313 (The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability ...)
+ TODO: check
+CVE-2024-51312 (The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability ...)
+ TODO: check
+CVE-2024-51311 (The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability ...)
+ TODO: check
+CVE-2023-37508 (HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XS ...)
+ TODO: check
+CVE-2023-37507 (HCL DevOps Plan is susceptible to an information disclosure that can a ...)
+ TODO: check
+CVE-2026-58624 (Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA ...)
- mina2 <unfixed>
- mina <removed>
NOTE: https://www.openwall.com/lists/oss-security/2026/07/20/18
-CVE-2026-56624
+CVE-2026-56624 (Improper certificate validation in Apache MINA SSHD (server-side).Apac ...)
- mina2 <unfixed>
- mina <removed>
NOTE: https://www.openwall.com/lists/oss-security/2026/07/20/17
-CVE-2026-56623
+CVE-2026-56623 (Path traversal on Windows in Apache MINA SSHD component sshd-git.Apach ...)
- mina2 <not-affected> (Only affects MINA SSHD on Windows)
- mina <not-affected> (Only affects MINA SSHD on Windows)
NOTE: https://www.openwall.com/lists/oss-security/2026/07/20/16
-CVE-2026-56452
+CVE-2026-56452 (Path traversal in the sshd-scp component of Apache MINA SSHD.Apache MI ...)
- mina2 <unfixed>
- mina <removed>
NOTE: https://www.openwall.com/lists/oss-security/2026/07/20/15
@@ -3617,25 +3801,25 @@ CVE-2026-14266
NOTE: Since p7zip/16.02+transitional.1 src:p7zip is only an empty source package
NOTE: depending on 7zip. Mark this version as fixed version.
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-26-444/
-CVE-2026-15899
+CVE-2026-15899 (Use after free in CameraCapture in Google Chrome on Mac prior to 150.0 ...)
- chromium <unfixed>
[bullseye] - chromium <end-of-life> (see #1061268)
-CVE-2026-15900
+CVE-2026-15900 (Use after free in GPU in Google Chrome on Android prior to 150.0.7871. ...)
- chromium <unfixed>
[bullseye] - chromium <end-of-life> (see #1061268)
-CVE-2026-15901
+CVE-2026-15901 (Use after free in Network in Google Chrome prior to 150.0.7871.128 all ...)
- chromium <unfixed>
[bullseye] - chromium <end-of-life> (see #1061268)
-CVE-2026-15902
+CVE-2026-15902 (Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowe ...)
- chromium <unfixed>
[bullseye] - chromium <end-of-life> (see #1061268)
-CVE-2026-15903
+CVE-2026-15903 (Out of bounds read and write in V8 in Google Chrome prior to 150.0.787 ...)
- chromium <unfixed>
[bullseye] - chromium <end-of-life> (see #1061268)
-CVE-2026-15904
+CVE-2026-15904 (Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871. ...)
- chromium <unfixed>
[bullseye] - chromium <end-of-life> (see #1061268)
-CVE-2026-15905
+CVE-2026-15905 (Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowe ...)
- chromium <unfixed>
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-59173 (Uncontrolled Resource Consumption vulnerability in Apache Traffic Serv ...)
@@ -45859,13 +46043,13 @@ CVE-2026-41073 (RT is an open source, enterprise-grade issue and ticket tracking
- request-tracker4 <removed>
NOTE: https://github.com/bestpractical/rt/releases/tag/rt-5.0.10
NOTE: Fixed by: https://github.com/bestpractical/rt/commit/dce7ff6799d930d09c10a50539325f1290440d4b (rt-5.0.10)
-CVE-2026-44229
+CVE-2026-44229 (RT is an open source, enterprise-grade issue and ticket tracking syste ...)
{DSA-6327-1 DSA-6324-1}
- request-tracker5 5.0.10+dfsg-1
- request-tracker4 <removed>
NOTE: https://github.com/bestpractical/rt/releases/tag/rt-5.0.10
NOTE: Fixed by: https://github.com/bestpractical/rt/commit/ecdb229b38206888401655974d0aec153640eb59 (rt-5.0.10)
-CVE-2026-44230
+CVE-2026-44230 (RT is an open source, enterprise-grade issue and ticket tracking syste ...)
- request-tracker5 5.0.10+dfsg-1
[trixie] - request-tracker5 5.0.7+dfsg-4+deb13u3
[bookworm] - request-tracker5 <not-affected> (Vulnerable code introduced later)
@@ -45894,7 +46078,7 @@ CVE-2026-41075 (RT is an open source, enterprise-grade issue and ticket tracking
- request-tracker4 <removed>
NOTE: https://github.com/bestpractical/rt/releases/tag/rt-5.0.10
NOTE: Fixed by: https://github.com/bestpractical/rt/commit/9ed06dadc29a75e17b25017f929edeff62d224bc (rt-5.0.10)
-CVE-2026-44231
+CVE-2026-44231 (RT is an open source, enterprise-grade issue and ticket tracking syste ...)
{DSA-6327-1 DSA-6324-1}
- request-tracker5 5.0.10+dfsg-1
- request-tracker4 <removed>
@@ -53800,7 +53984,7 @@ CVE-2026-7263 (In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNo
- php7.4 <not-affected> (Only affects 8.4 and later)
NOTE: https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733
NOTE: https://github.com/php/php-src/commit/d43c523c48960e9ca0bf9c747e9bad8e5121edff
-CVE-2026-8149 (A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS on Linux, X ...)
+CVE-2026-8149 (A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8 ...)
NOT-FOR-US: FIPS provider for Bouncycastle, not part of the Debian package for Bouncycastle
CVE-2026-8148 (NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local atta ...)
NOT-FOR-US: NAVER MYBOX Explorer for Windows
@@ -76469,6 +76653,7 @@ CVE-2026-5292 (Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7
- chromium 146.0.7680.177-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-34743 (XZ Utils provide a general-purpose data-compression library plus comma ...)
+ {DLA-4690-1}
- xz-utils 5.8.3-1 (bug #1132497)
[trixie] - xz-utils 5.8.1-1+deb13u1
[bookworm] - xz-utils 5.4.1-1+deb12u1
@@ -172191,6 +172376,7 @@ CVE-2023-32251 (A vulnerability has been identified in the Linux kernel's ksmbd
NOTE: https://git.kernel.org/linus/b096d97f47326b1e2dbdef1c91fab69ffda54d17 (6.4-rc1)
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-699/
CVE-2025-53399 (In Sipwise rtpengine before 13.4.1.1, an origin-validation error in th ...)
+ {DLA-4691-1}
- rtpengine 12.5.1.35-1 (bug #1110316)
NOTE: https://www.openwall.com/lists/oss-security/2025/07/31/1
NOTE: https://github.com/EnableSecurity/advisories/tree/master/ES2025-01-rtpengine-improper-behavior-bleed-inject
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d918ae95d4f14171710a893bf000e2a4b86a48e4
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d918ae95d4f14171710a893bf000e2a4b86a48e4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260721/1247bf7c/attachment.htm>
More information about the debian-security-tracker-commits
mailing list