[Git][security-tracker-team/security-tracker][master] bugnums

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c35dfcfb by Moritz Muehlenhoff at 2026-11-02T22:48:27+01:00
bugnums

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2007,7 +2007,7 @@ CVE-2026-107868 (Unauthenticated Bypass Vulnerability in YITH WooCommerce Produc
 CVE-2026-107630 (The Email Templates Customizer and Designer for WordPress and WooComme ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-105924 (A NULL pointer dereference vulnerability in the Qt QCborValue to JSON  ...)
-	- qt6-base <unfixed>
+	- qt6-base <unfixed> (bug #1152892)
 	- qtbase-opensource-src <unfixed>
 	NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/766809 (not public yet)
 	NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-105924
@@ -9448,7 +9448,7 @@ CVE-2026-97200 (Allocation of Resources Without Limits or Throttling vulnerabili
 CVE-2026-96581 (Authorization Bypass Through User-Controlled Key vulnerability in ash- ...)
 	NOT-FOR-US: ash-project
 CVE-2026-96432 (A malicious or compromised HTTP/2 server withholding SETTINGS ACK can  ...)
-	- qt6-base <unfixed>
+	- qt6-base <unfixed> (bug #1152890)
 	NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-96432:
 	NOTE: Fixed by: https://github.com/qt/qtbase/commit/156dcb4770d7f4747b973ba509f6df1933f64817 (v6.11.3)
 CVE-2026-95664 (Improper Neutralization of Special Elements used in an Expression Lang ...)
@@ -10010,7 +10010,7 @@ CVE-2026-108525 (Allocation of Resources Without Limits or Throttling vulnerabil
 CVE-2026-107656 (An authentication bypass using an alternate path or channel vulnerabil ...)
 	NOT-FOR-US: Fortinet
 CVE-2026-107157 (Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Co ...)
-	- qt6-base <unfixed>
+	- qt6-base <unfixed> (bug #1152890)
 	- qtbase-opensource-src <unfixed>
 	NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-107157:
 	NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/745719
@@ -10782,7 +10782,7 @@ CVE-2026-97353 (The News Kit Addons For Elementor WordPress plugin through 1.4.7
 CVE-2026-97352 (The News Kit Addons For Elementor WordPress plugin before 1.4.9 does n ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-95620 (A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2  ...)
-	- qt6-base <unfixed>
+	- qt6-base <unfixed> (bug #1152890)
 	[trixie] - qt6-base <not-affected> (Vulnerable code not present)
 	[bookworm] - qt6-base <not-affected> (Vulnerable code not present)
 	NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-95620:
@@ -14275,7 +14275,7 @@ CVE-2026-105927 (The Apache Pulsar WebSocket service allows a WebSocket consumer
 CVE-2026-105926 (The Pulsar broker serves two schema commands on its binary protocol: G ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105923 (A malicious SVG can trigger an integer overflow which in turn triggers ...)
-	- qt6-base <unfixed>
+	- qt6-base <unfixed> (bug #1152890)
 	[trixie] - qt6-base <no-dsa> (Minor issue)
 	- qtbase-opensource-src <unfixed>
 	[trixie] - qtbase-opensource-src <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c35dfcfb42faa8a96a8f4182be3a6568fbbaa065

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c35dfcfb42faa8a96a8f4182be3a6568fbbaa065
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261102/7ebf79fa/attachment-0001.htm>