[Git][security-tracker-team/security-tracker][master] bugnums

Sun Nov 1 19:57:24 GMT 2026


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7eb19a81 by Moritz Muehlenhoff at 2026-11-01T20:55:33+01:00
bugnums

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1388,15 +1388,15 @@ CVE-2026-115604 (Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versio
 CVE-2026-115456 (A flaw was found in gcc. An attacker could cause a Denial of Service ( ...)
 	TODO: check
 CVE-2026-115455 (A flaw was found in GCC libstdc++. When an application extracts data i ...)
-	- gcc-16 <unfixed>
-	- gcc-15 <unfixed>
-	- gcc-14 <unfixed>
+	- gcc-16 <unfixed> (bug #1152819)
+	- gcc-15 <unfixed> (bug #1152818)
+	- gcc-14 <unfixed> (bug #1152817)
 	[trixie] - gcc-14 <no-dsa> (Minor issue)
-	- gcc-13 <unfixed>
+	- gcc-13 <unfixed> (bug #1152816)
 	[trixie] - gcc-13 <no-dsa> (Minor issue)
-	- gcc-12 <unfixed>
+	- gcc-12 <unfixed> (bug #1152815)
 	[trixie] - gcc-12 <no-dsa> (Minor issue)
-	- gcc-11 <unfixed>
+	- gcc-11 <unfixed> (bug #1152814)
 	NOTE: https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2562933
 CVE-2026-115346 (The Avada | Website Builder For WordPress & WooCommerce theme for Word ...)
@@ -1406,27 +1406,27 @@ CVE-2026-115274 (Improper Validation of Specified Quantity in Input vulnerabilit
 CVE-2026-114711 (Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versio ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-114691 (A flaw was found in the libstdc++ component of GCC. An attacker who ca ...)
-	- gcc-16 <unfixed>
-	- gcc-15 <unfixed>
-	- gcc-14 <unfixed>
+	- gcc-16 <unfixed> (bug #1152819)
+	- gcc-15 <unfixed> (bug #1152818)
+	- gcc-14 <unfixed> (bug #1152817)
 	[trixie] - gcc-14 <no-dsa> (Minor issue)
-	- gcc-13 <unfixed>
+	- gcc-13 <unfixed> (bug #1152816)
 	[trixie] - gcc-13 <no-dsa> (Minor issue)
-	- gcc-12 <unfixed>
+	- gcc-12 <unfixed> (bug #1152815)
 	[trixie] - gcc-12 <no-dsa> (Minor issue)
-	- gcc-11 <unfixed>
+	- gcc-11 <unfixed> (bug #1152814)
 	NOTE: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=2fd8866591b5aea7098835f80ab7e176382175ae
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478508
 CVE-2026-114690 (A flaw was found in GCC. An out-of-bounds memory access vulnerability  ...)
-	- gcc-16 <unfixed>
-	- gcc-15 <unfixed>
-	- gcc-14 <unfixed>
+	- gcc-16 <unfixed> (bug #1152819)
+	- gcc-15 <unfixed> (bug #1152818)
+	- gcc-14 <unfixed> (bug #1152817)
 	[trixie] - gcc-14 <no-dsa> (Minor issue)
-	- gcc-13 <unfixed>
+	- gcc-13 <unfixed> (bug #1152816)
 	[trixie] - gcc-13 <no-dsa> (Minor issue)
-	- gcc-12 <unfixed>
+	- gcc-12 <unfixed> (bug #1152815)
 	[trixie] - gcc-12 <no-dsa> (Minor issue)
-	- gcc-11 <unfixed>
+	- gcc-11 <unfixed> (bug #1152814)
 	NOTE: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=c1f32b67510f6f9998deadaef5090b6663adb979 (main)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478652
 CVE-2026-112905 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
@@ -13219,7 +13219,7 @@ CVE-2026-114439 (A vulnerability was determined in oretnom23 php-travel-agency-s
 CVE-2026-114438 (A flaw was found in the Update User Locale required action of the Keyc ...)
 	- keycloak <itp> (bug #1088287)
 CVE-2026-114437 (In the Golang Chi web framework, the ClientIPFromXFF middleware skips  ...)
-	- golang-github-go-chi-chi <unfixed>
+	- golang-github-go-chi-chi <unfixed> (bug #1152823)
 	[trixie] - golang-github-go-chi-chi <no-dsa> (Minor issue)
 	NOTE: https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3
 CVE-2026-114407 (e107 CMS before 2.3.13 contains a reflected cross-site scripting vulne ...)
@@ -13376,7 +13376,7 @@ CVE-2026-114142 (toml-node is a TOML parser for Node.js and the browser. Prior t
 CVE-2026-114141 (toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1 ...)
 	NOT-FOR-US: Node toml-node
 CVE-2026-114140 (The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to v ...)
-	- nbconvert <unfixed>
+	- nbconvert <unfixed> (bug #1152822)
 	NOTE: https://github.com/jupyter/nbconvert/security/advisories/GHSA-pjvx-prjx-h659
 	NOTE: Fixed by: https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f (v7.17.2)
 CVE-2026-114139 (Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36 ...)
@@ -15524,10 +15524,10 @@ CVE-2026-114112 (Sharp before 0.35.4 bundles a vulnerable libheif dependency tha
 CVE-2026-114111 (sharp before 0.35.5 bundles a librsvg dependency affected by a memory- ...)
 	NOT-FOR-US: Sharp
 CVE-2026-114110 (Astral uv before 0.11.6 contains a path traversal vulnerability that a ...)
-	- uv <unfixed>
+	- uv <unfixed> (bug #1152821)
 	NOTE: https://github.com/astral-sh/uv/security/advisories/GHSA-pjjw-68hj-v9mw
 CVE-2026-114109 (uv before 0.11.15 contains a path traversal vulnerability that allows  ...)
-	- uv <unfixed>
+	- uv <unfixed> (bug #1152820)
 	NOTE: https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph
 CVE-2026-114108 (HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authenti ...)
 	NOT-FOR-US: Vibe-Trading



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7eb19a812497db45b38dee8f76e653e5ec3baa38

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7eb19a812497db45b38dee8f76e653e5ec3baa38
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261101/1ad9b7ae/attachment-0001.htm>
