[Git][security-tracker-team/security-tracker][master] Add new set of thumbor issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
454bd3ce by Salvatore Bonaccorso at 2026-07-31T22:11:06+02:00
Add new set of thumbor issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -59,17 +59,29 @@ CVE-2026-54729 (DSSRF is a Node.js library that provides a wide range of utiliti
 CVE-2026-54725 (vault-secrets-webhook is a Kubernetes mutating webhook that makes dire ...)
 	NOT-FOR-US: vault-secrets-webhook
 CVE-2026-53505 (Thumbor is an open-source photo thumbnail service by globo.com. Prior  ...)
-	TODO: check
+	- thumbor 7.8.0-1
+	NOTE: https://github.com/thumbor/thumbor/security/advisories/GHSA-phj3-59pf-cp83
+	NOTE: Fixed by: https://github.com/thumbor/thumbor/commit/2c716119de986cfc68c7071af52a98187e006023 (7.8.0)
 CVE-2026-53504 (Thumbor is an open-source photo thumbnail service by globo.com. Prior  ...)
-	TODO: check
+	- thumbor 7.8.0-1
+	NOTE: https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j
+	NOTE: Fixed by: https://github.com/thumbor/thumbor/commit/3f38fe1610d20168e91f76d432212de30727eb2e (7.8.0)
 CVE-2026-53503 (Thumbor is an open-source photo thumbnail service by globo.com. Prior  ...)
-	TODO: check
+	- thumbor 7.8.0-1
+	NOTE: https://github.com/thumbor/thumbor/security/advisories/GHSA-cqjp-jf4r-h5q9
+	NOTE: Fixed by: https://github.com/thumbor/thumbor/commit/447e192e3fb92e64c12e5354a56a4a7133f69d73 (7.8.0)
 CVE-2026-53502 (Thumbor is an open-source photo thumbnail service by globo.com. Prior  ...)
-	TODO: check
+	- thumbor 7.8.0-1
+	NOTE: https://github.com/thumbor/thumbor/security/advisories/GHSA-cj54-hpcc-gj6h
+	NOTE: Fixed by: https://github.com/thumbor/thumbor/commit/3b986d13677b30fe6651c8c72ebb25957ac0a40d (7.8.0)
 CVE-2026-53501 (Thumbor is an open-source photo thumbnail service by globo.com. Prior  ...)
-	TODO: check
+	- thumbor 7.8.0-1
+	NOTE: https://github.com/thumbor/thumbor/security/advisories/GHSA-mw3h-qjxj-6xg9
+	NOTE: Fixed by: https://github.com/thumbor/thumbor/commit/e3ae3e2500537b4d735df4144129a649374bb70b (7.8.0)
 CVE-2026-53500 (Thumbor is an open-source photo thumbnail service by globo.com. Prior  ...)
-	TODO: check
+	- thumbor 7.8.0-1
+	NOTE: https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537
+	NOTE: Fixed by: https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7 (7.8.0)
 CVE-2026-52857 (Wings is the server control plane for Pterodactyl, a free, open-source ...)
 	NOT-FOR-US: Wings
 CVE-2026-52856 (Wings is the server control plane for Pterodactyl, a free, open-source ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/454bd3ce771bd05983d647060b5dcce88d001a14

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/454bd3ce771bd05983d647060b5dcce88d001a14
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260731/c321f4d9/attachment.htm>