[Git][security-tracker-team/security-tracker][master] lts: follow no-dsa for some CVEs
Emilio Pozuelo Monfort (@pochu)
pochu at debian.org
Tue Nov 3 09:02:31 GMT 2026
Emilio Pozuelo Monfort pushed to branch master at Debian Security Tracker / security-tracker
Commits:
6056de26 by Emilio Pozuelo Monfort at 2026-11-03T10:02:17+01:00
lts: follow no-dsa for some CVEs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1317,6 +1317,7 @@ CVE-2026-13575 (HTTP::Session versions before 0.54 for Perl allow memcached comm
CVE-2026-111426
- kdeconnect 26.08.2-2 (bug #1152780)
[trixie] - kdeconnect <no-dsa> (Minor issue)
+ [bookworm] - kdeconnect <postponed> (Minor issue)
NOTE: https://kde.org/info/security/advisory-20261030-2.txt
NOTE: Fixed by: https://invent.kde.org/network/kdeconnect-kde/-/commit/71c63c47b51047533f5d9533f27be4375778b21d (release/26.08 branch)
CVE-2026-120252 (imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer ...)
@@ -1567,6 +1568,7 @@ CVE-2026-63410 (secp256k1-native is a native C secp256k1 implementation for Ruby
CVE-2026-63402 (i18next is an internationalization framework for JavaScript. Prior to ...)
- node-i18next <unfixed> (bug #1152688)
[trixie] - node-i18next <no-dsa> (Minor issue)
+ [bookworm] - node-i18next <postponed> (Minor issue)
NOTE: https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx
NOTE: Fixed by: https://github.com/i18next/i18next/commit/642137b7786d83661ec3ee53027798dc4b81d30a (v26.3.4)
CVE-2026-63401 (Coop is an open source review and moderation tool from ROOST. Prior to ...)
@@ -2154,6 +2156,7 @@ CVE-2026-119761 (Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a
CVE-2026-119760 (sniproxy through 0.7.0 contains a NULL pointer dereference vulnerabili ...)
- sniproxy 0.7.0-2
[trixie] - sniproxy <ignored> (Minor issue; binary packages not built with "Enable DNS resolution", --enable-dns)
+ [bookworm] - sniproxy <ignored> (Minor issue; binary packages not built with "Enable DNS resolution", --enable-dns)
NOTE: https://github.com/dlundquist/sniproxy/issues/411
NOTE: Fixed by: https://github.com/renaudallard/sniproxy/commit/17986ba7397297313331297cac3b9eb3f0ba96b7 (0.7.9)
CVE-2026-119729 (A flaw was found in GStreamer. An integer overflow vulnerability in th ...)
@@ -7197,16 +7200,19 @@ CVE-2026-116264 (MIME::Field::ParamVal versions before 5.521 for Perl allow one
CVE-2026-XXXX [qbittorrent: unauthenticated memory exhaustion in the embedded tracker]
- qbittorrent 5.3.0-1 (bug #1151742)
[trixie] - qbittorrent <no-dsa> (Minor issue)
+ [bookworm] - qbittorrent <postponed> (Minor issue)
NOTE: https://github.com/qbittorrent/qBittorrent/pull/24869
NOTE: https://github.com/qbittorrent/qBittorrent/commit/56c9b81571a15df2d4b1a8c3d40fe6d35bf6eea5 (release-5.3.0rc1)
CVE-2026-XXXX [qbittorrent: unsafe RSS and search-result URLs can execute JavaScript in WebUI]
- qbittorrent 5.3.0-1 (bug #1151741)
[trixie] - qbittorrent <no-dsa> (Minor issue)
+ [bookworm] - qbittorrent <postponed> (Minor issue)
NOTE: https://github.com/qbittorrent/qBittorrent/pull/24790
NOTE: https://github.com/qbittorrent/qBittorrent/commit/b1aa71d8445daeb49ec89afb8efc0c657d4d9663 (release-5.3.0beta1)
CVE-2026-XXXX [qbittorrent: malicious RSS entries can trigger arbitrary local file deletion]
- qbittorrent 5.3.0-1 (bug #1151740)
[trixie] - qbittorrent <no-dsa> (Minor issue)
+ [bookworm] - qbittorrent <postponed> (Minor issue)
NOTE: https://github.com/qbittorrent/qBittorrent/pull/24795
NOTE: https://github.com/qbittorrent/qBittorrent/commit/3b7441ee44c1cef6065945f77c2694cdc27e75ed (release-5.3.0rc1)
CVE-2026-94347 (PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7 ...)
@@ -8733,6 +8739,7 @@ CVE-2026-117557 (SDL_image through 3.4.8 and through 2.8.12 contains a stack out
[trixie] - libsdl3-image <no-dsa> (Minor issue)
- libsdl2-image <unfixed>
[trixie] - libsdl2-image <no-dsa> (Minor issue)
+ [bookworm] - libsdl2-image <postponed> (Minor issue)
- sdl-image1.2 <unfixed>
[trixie] - sdl-image1.2 <no-dsa> (Minor issue)
NOTE: https://github.com/libsdl-org/SDL_image/issues/769
@@ -9135,11 +9142,13 @@ CVE-2025-64394 (A vulnerability allowing a low-privileged local user to write ar
CVE-2026-XXXX [qbittorrent: WebUI authentication bypass via spoofed X-Forwarded-For]
- qbittorrent 5.3.0-1 (bug #1151739)
[trixie] - qbittorrent <no-dsa> (Minor issue)
+ [bookworm] - qbittorrent <postponed> (Minor issue)
NOTE: https://github.com/qbittorrent/qBittorrent/pull/24889
NOTE: https://github.com/qbittorrent/qBittorrent/commit/68a5d7e342230e5b6e5c2d755ac5dd815cba68e4 (release-5.3.0rc1)
CVE-2026-XXXX [qbittorrent: insecure dynamic DNS IP discovery allows hostname redirection]
- qbittorrent 5.3.0-1 (bug #1151738)
[trixie] - qbittorrent <no-dsa> (Minor issue)
+ [bookworm] - qbittorrent <postponed> (Minor issue)
NOTE: https://github.com/qbittorrent/qBittorrent/pull/24805
NOTE: https://github.com/qbittorrent/qBittorrent/commit/069e51015fb2ecffbe71c9741fb14f593d973d4f (release-5.3.0rc1)
CVE-2026-97028
@@ -9511,12 +9520,14 @@ CVE-2026-116745 (QloApps through 1.7.0 contains an information disclosure vulner
CVE-2026-116744 (ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in ...)
- ndpi <unfixed>
[trixie] - ndpi <no-dsa> (Minor issue)
+ [bookworm] - ndpi <postponed> (Minor issue)
NOTE: https://github.com/ntop/nDPI/issues/3291
NOTE: https://github.com/ntop/nDPI/pull/3298
NOTE: Fixed by: https://github.com/ntop/nDPI/commit/ca9d819151606377ac53305583fe819748c69be2
CVE-2026-116743 (libyal libmsiecf through 20260525 contains a double free vulnerability ...)
- libmsiecf <unfixed>
[trixie] - libmsiecf <no-dsa> (Minor issue)
+ [bookworm] - libmsiecf <postponed> (Minor issue)
NOTE: https://github.com/libyal/libmsiecf/issues/6
NOTE: https://github.com/libyal/libmsiecf/commit/a99a703d190d62f6c21b6225cf84ce80037e45d5
CVE-2026-116742 (HTSlib through 1.24 contains a heap out-of-bounds write and read vulne ...)
@@ -9534,11 +9545,13 @@ CVE-2026-116740 (libcss through 0.9.2 contains a NULL pointer dereference vulner
CVE-2026-116739 (VMime through 0.9.2 contains an information disclosure vulnerability i ...)
- libvmime <unfixed>
[trixie] - libvmime <no-dsa> (Minor issue)
+ [bookworm] - libvmime <postponed> (Minor issue)
NOTE: https://github.com/kisli/vmime/pull/363
NOTE: Fixed by: https://github.com/kisli/vmime/commit/e85925eddc638939f0eeb7ee55ec047d04a760d8
CVE-2026-116738 (VMime through 0.9.2 contains an integer underflow in the uuEncoder::de ...)
- libvmime <unfixed>
[trixie] - libvmime <no-dsa> (Minor issue)
+ [bookworm] - libvmime <postponed> (Minor issue)
NOTE: https://github.com/kisli/vmime/pull/363
NOTE: Fixed by: https://github.com/kisli/vmime/commit/e85925eddc638939f0eeb7ee55ec047d04a760d8
CVE-2026-116737 (libphdi through 20260902 contains a heap out-of-bounds read vulnerabil ...)
@@ -10263,11 +10276,13 @@ CVE-2026-104598 (libosmo-sigtran through 2.2.1 contains an out-of-bounds read in
CVE-2026-104597 (libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_i ...)
- libosmocore 1.14.2-1
[trixie] - libosmocore <no-dsa> (Minor issue)
+ [bookworm] - libosmocore <postponed> (Minor issue)
NOTE: https://osmocom.org/issues/7052
NOTE: https://github.com/osmocom/libosmocore/commit/89e5ade1a01953752a53d83da4ba0b3ddbc30e30 (1.14.2)
CVE-2026-104596 (libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04. ...)
- libosmocore 1.14.2-1
[trixie] - libosmocore <no-dsa> (Minor issue)
+ [bookworm] - libosmocore <postponed> (Minor issue)
NOTE: https://osmocom.org/issues/7051
NOTE: https://github.com/osmocom/libosmocore/commit/b6c8c72c0c063ab2f293c5226472341c432454c2 (1.14.2)
CVE-2026-103359 (The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1. ...)
@@ -10670,6 +10685,7 @@ CVE-2026-115923 (Backstage is an open framework for building developer portals.
CVE-2026-115922 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
- onnx <unfixed> (bug #1152787)
[trixie] - onnx <no-dsa> (Minor issue)
+ [bookworm] - onnx <postponed> (Minor issue)
NOTE: https://github.com/onnx/onnx/security/advisories/GHSA-q69g-f4f5-v8m7
NOTE: https://github.com/onnx/onnx/pull/8033
NOTE: Fixed by: https://github.com/onnx/onnx/commit/dce5876d6cc6cc30157af7d26a752ef44976da8e (v1.23.0)
@@ -10679,18 +10695,21 @@ CVE-2026-115922 (Open Neural Network Exchange (ONNX) is an open standard for mac
CVE-2026-115921 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
- onnx <unfixed> (bug #1152787)
[trixie] - onnx <no-dsa> (Minor issue)
+ [bookworm] - onnx <postponed> (Minor issue)
NOTE: https://github.com/onnx/onnx/security/advisories/GHSA-m4pr-6v3c-6fgr
NOTE: https://github.com/onnx/onnx/pull/7916
NOTE: Fixed by: https://github.com/onnx/onnx/commit/dd6bc92ea39fd2274fd671f0734b0b8b558356f5 (v1.22.0)
CVE-2026-115920 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
- onnx <unfixed> (bug #1152787)
[trixie] - onnx <no-dsa> (Minor issue)
+ [bookworm] - onnx <postponed> (Minor issue)
NOTE: https://github.com/onnx/onnx/security/advisories/GHSA-6pwm-x34p-fvj2
NOTE: https://github.com/onnx/onnx/pull/7997
NOTE: Fixed by: https://github.com/onnx/onnx/commit/2ec288908952eea9dcf48d4b197915e1f72c6abf (v1.22.0)
CVE-2026-115919 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
- onnx <unfixed> (bug #1152787)
[trixie] - onnx <no-dsa> (Minor issue)
+ [bookworm] - onnx <postponed> (Minor issue)
NOTE: https://github.com/onnx/onnx/security/advisories/GHSA-48m4-24cq-37qf
NOTE: https://github.com/onnx/onnx/pull/7879
NOTE: Fixed by: https://github.com/onnx/onnx/commit/92e541266af5dd38cfa48aeb92206f4268a066cd (v1.22.0)
@@ -10912,6 +10931,7 @@ CVE-2026-105608 (HashiCorp Consul and Consul Enterprise are vulnerable to an aut
CVE-2026-104594 (libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM ...)
- libosmocore 1.14.2-1
[trixie] - libosmocore <no-dsa> (Minor issue)
+ [bookworm] - libosmocore <postponed> (Minor issue)
NOTE: https://osmocom.org/issues/7050
NOTE: Fixed by: https://github.com/osmocom/libosmocore/commit/8ba652bca2f28ec05ff5979846199e2c46657633 (1.14.2)
NOTE: Fixed by: https://github.com/osmocom/libosmocore/commit/325ffb5204d7e1659ca2fec3b2f14c33b969ee71 (1.14.2)
@@ -10919,17 +10939,20 @@ CVE-2026-104594 (libosmocore through 1.14.1 contains out-of-bounds reads in the
CVE-2026-104593 (osmo-msc through 1.15.0 contains a stack-based buffer overflow in deco ...)
- osmo-msc 1.16.0+dfsg1-2
[trixie] - osmo-msc <no-dsa> (Minor issue)
+ [bookworm] - osmo-msc <postponed> (Minor issue)
NOTE: https://osmocom.org/issues/7058
NOTE: Fixed by: https://github.com/osmocom/osmo-msc/commit/cd347bbe5392d8170ab87140b2bfdac683058b09 (1.16.0)
CVE-2026-104592 (libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP ...)
- libosmocore 1.14.2-1
[trixie] - libosmocore <no-dsa> (Minor issue)
+ [bookworm] - libosmocore <postponed> (Minor issue)
NOTE: https://osmocom.org/issues/7053
NOTE: https://gerrit.osmocom.org/c/libosmocore/+/43215
NOTE: Fixed by: https://github.com/osmocom/libosmocore/commit/1659b5874223934d5586e3e96b7d59f653c90ea6 (1.14.2)
CVE-2026-104591 (libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_com ...)
- libosmocore 1.14.2-1
[trixie] - libosmocore <no-dsa> (Minor issue)
+ [bookworm] - libosmocore <postponed> (Minor issue)
NOTE: https://osmocom.org/issues/7052
NOTE: Fixed by: https://github.com/osmocom/libosmocore/commit/0b0f165106b7918435a47f8cb28c651228b8e4aa (1.14.2)
CVE-2026-103377 (A reflected Cross-Site Scripting (XSS) vulnerability has been identifi ...)
@@ -11443,22 +11466,26 @@ CVE-2026-115825 (HTTP::Server::PSGI versions before 1.0056 for Perl allow a sing
CVE-2026-115824 (Starman versions before 0.4019 for Perl allow memory exhaustion via un ...)
- starman 0.4019-1 (bug #1152054)
[trixie] - starman <no-dsa> (Minor issue)
+ [bookworm] - starman <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44625161/
NOTE: Fixed by: https://github.com/miyagawa/Starman/commit/d789a02dbe5408ef5f7a4659078d0008dd84c308 (0.4019)
NOTE: Fixed by: https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf (0.4019)
CVE-2026-115823 (Starman versions before 0.4019 for Perl send response bodies for HEAD ...)
- starman 0.4019-1 (bug #1152054)
[trixie] - starman <no-dsa> (Minor issue)
+ [bookworm] - starman <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44625160/
NOTE: Fixed by: https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf (0.4019)
CVE-2026-115822 (Starman versions before 0.4019 for Perl allow CPU exhaustion via quadr ...)
- starman 0.4019-1 (bug #1152054)
[trixie] - starman <no-dsa> (Minor issue)
+ [bookworm] - starman <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44625157/
NOTE: Fixed by: https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf (0.4019)
CVE-2026-115817 (Starman versions before 0.4019 for Perl allow a stalled request body t ...)
- starman 0.4019-1 (bug #1152054)
[trixie] - starman <no-dsa> (Minor issue)
+ [bookworm] - starman <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44625155/
NOTE: Fixed by: https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558 (0.4019)
NOTE: Fixed by: https://github.com/miyagawa/Starman/commit/a30533c03051502d6b67cd48b3a95a61e129691b (0.4019)
@@ -11877,10 +11904,12 @@ CVE-2026-19741 (Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER
CVE-2026-16762 (An attacker able to supply a crafted XML document to an application us ...)
- qt6-base 6.11.2+dfsg-5
[trixie] - qt6-base <no-dsa> (Minor issue)
+ [bookworm] - qt6-base <postponed> (Minor issue)
- qtbase-opensource-src <unfixed>
[trixie] - qtbase-opensource-src <no-dsa> (Minor issue)
- qtbase-opensource-src-gles <unfixed>
[trixie] - qtbase-opensource-src-gles <no-dsa> (Minor issue)
+ [bookworm] - qtbase-opensource-src-gles <postponed> (Minor issue)
NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-16762:
NOTE: Fixed by: https://github.com/qt/qtbase/commit/564db12e40089b946c2feaac2a029a0c56e6e588 (v6.11.2)
NOTE: Fixed by: https://github.com/qt/qtbase/commit/cd0f0803955a04b9d7e3a24d4e40f8405df2bba8 (v6.11.2)
@@ -11916,6 +11945,7 @@ CVE-2026-115877 (Twisted is an event-based framework for internet applications,
CVE-2026-115863 (ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Rep ...)
- connman <unfixed>
[trixie] - connman <no-dsa> (Minor issue)
+ [bookworm] - connman <postponed> (Minor issue)
NOTE: Introduced with: https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=bb06c47101ca243fa5c04fb4b03fe2a12420d280
NOTE: https://lore.kernel.org/connman/179274561161.81299.4579745057858200074@pm.me/
CVE-2026-115845 (An incomplete list of disallowed inputs in the Python code validator o ...)
@@ -12007,6 +12037,7 @@ CVE-2026-115723 (Snap7 through 1.4.3 contains an out-of-bounds write vulnerabili
CVE-2026-115722 (RPly through 1.1.4 contains an improper array index validation vulnera ...)
- python-rply <unfixed>
[trixie] - python-rply <no-dsa> (Minor issue)
+ [bookworm] - python-rply <postponed> (Minor issue)
NOTE: https://github.com/diegonehab/rply/issues/10
CVE-2026-115657 (When used as an executor in either KNIME Server or KNIME Business Hub, ...)
NOT-FOR-US: KNIME
@@ -12018,6 +12049,7 @@ CVE-2026-115586 (virtualenv is a tool for creating isolated virtual python envir
CVE-2026-115585 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf 6.21.4-1 (bug #1152684)
[trixie] - pypdf <no-dsa> (Minor issue)
+ [bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4
NOTE: https://github.com/py-pdf/pypdf/pull/4240
@@ -12025,6 +12057,7 @@ CVE-2026-115585 (pypdf is a free and open-source pure-python PDF library. Prior
CVE-2026-115580 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf 6.21.4-1 (bug #1152684)
[trixie] - pypdf <no-dsa> (Minor issue)
+ [bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5
NOTE: https://github.com/py-pdf/pypdf/pull/4239
@@ -12032,6 +12065,7 @@ CVE-2026-115580 (pypdf is a free and open-source pure-python PDF library. Prior
CVE-2026-115572 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf 6.21.4-1 (bug #1152684)
[trixie] - pypdf <no-dsa> (Minor issue)
+ [bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw
NOTE: https://github.com/py-pdf/pypdf/pull/4240
@@ -13420,11 +13454,13 @@ CVE-2026-77156 (Incomplete validation of extracted archive entry paths in ast-cl
CVE-2026-75508 (GraphQL-core is a Python port of the GraphQL.js reference implementati ...)
- graphql-core 3.2.12-1
[trixie] - graphql-core <no-dsa> (Minor issue)
+ [bookworm] - graphql-core <postponed> (Minor issue)
NOTE: https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8
NOTE: Fixed by: https://github.com/graphql-python/graphql-core/commit/80ef435a1808fbbcc4aaac63ae76771a1c91002d (v3.2.12)
CVE-2026-75507 (GraphQL-core is a Python port of the GraphQL.js reference implementati ...)
- graphql-core 3.2.12-1
[trixie] - graphql-core <no-dsa> (Minor issue)
+ [bookworm] - graphql-core <postponed> (Minor issue)
NOTE: https://github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc
NOTE: Fixed by: https://github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae0497d7 (v3.2.12)
CVE-2026-67597
@@ -13881,6 +13917,7 @@ CVE-2026-114583 (tarfile.tar_filter could be bypassed using crafted link entries
[bookworm] - jython <no-dsa> (Minor issue)
- pypy3 <unfixed>
[trixie] - pypy3 <no-dsa> (Minor issue)
+ [bookworm] - pypy3 <postponed> (Minor issue)
NOTE: https://github.com/python/cpython/issues/160097
NOTE: https://github.com/python/cpython/pull/160098
NOTE: https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5 (main)
@@ -14347,6 +14384,7 @@ CVE-2026-85683 (The Jane Menu WordPress plugin before 1.5.1 does not have any ca
CVE-2026-85518 (A flaw was found in OpenSCAP. When decomposing a Source DataStream (SD ...)
- openscap 1.4.6+dfsg-1
[trixie] - openscap <no-dsa> (Minor issue)
+ [bookworm] - openscap <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478522
NOTE: Fixed by: https://github.com/OpenSCAP/openscap/commit/aa1d6471b14d4f765704b2768865067eca49067a (1.4.6)
CVE-2026-84924 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
@@ -14963,6 +15001,7 @@ CVE-2026-113796 (Electron is a framework for writing cross-platform desktop appl
CVE-2026-113795 (pypdf is a free and open-source pure-python PDF library. Prior to 6.20 ...)
- pypdf 6.21.0-1
[trixie] - pypdf <no-dsa> (Minor issue)
+ [bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-7mh2-4gg2-979f
NOTE: https://github.com/py-pdf/pypdf/pull/4173
@@ -14970,6 +15009,7 @@ CVE-2026-113795 (pypdf is a free and open-source pure-python PDF library. Prior
CVE-2026-113794 (pypdf is a free and open-source pure-python PDF library. Prior to 6.20 ...)
- pypdf 6.21.0-1
[trixie] - pypdf <no-dsa> (Minor issue)
+ [bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-39mj-jf6j-2qj3
NOTE: https://github.com/py-pdf/pypdf/issues/4169
@@ -14978,6 +15018,7 @@ CVE-2026-113794 (pypdf is a free and open-source pure-python PDF library. Prior
CVE-2026-113793 (pypdf is a free and open-source pure-python PDF library. Prior to 6.20 ...)
- pypdf 6.21.0-1
[trixie] - pypdf <no-dsa> (Minor issue)
+ [bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mx8-4j7g-633p
NOTE: https://github.com/py-pdf/pypdf/pull/4188
@@ -14985,6 +15026,7 @@ CVE-2026-113793 (pypdf is a free and open-source pure-python PDF library. Prior
CVE-2026-113792 (pypdf is a free and open-source pure-python PDF library. Prior to 6.20 ...)
- pypdf 6.21.0-1
[trixie] - pypdf <no-dsa> (Minor issue)
+ [bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-qfv9-64jg-mh7p
NOTE: https://github.com/py-pdf/pypdf/pull/4188
@@ -14992,6 +15034,7 @@ CVE-2026-113792 (pypdf is a free and open-source pure-python PDF library. Prior
CVE-2026-113791 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf 6.21.0-1
[trixie] - pypdf <no-dsa> (Minor issue)
+ [bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-cgf9-327m-v77c
NOTE: https://github.com/py-pdf/pypdf/pull/4218
@@ -14999,6 +15042,7 @@ CVE-2026-113791 (pypdf is a free and open-source pure-python PDF library. Prior
CVE-2026-113790 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf 6.21.0-1
[trixie] - pypdf <no-dsa> (Minor issue)
+ [bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-f54x-cmq8-qg57
NOTE: https://github.com/py-pdf/pypdf/pull/4218
@@ -15006,6 +15050,7 @@ CVE-2026-113790 (pypdf is a free and open-source pure-python PDF library. Prior
CVE-2026-113789 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf 6.21.0-1
[trixie] - pypdf <no-dsa> (Minor issue)
+ [bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-6vvc-x485-93v7
NOTE: https://github.com/py-pdf/pypdf/pull/4219
@@ -15166,10 +15211,12 @@ CVE-2026-105926 (The Pulsar broker serves two schema commands on its binary prot
CVE-2026-105923 (A malicious SVG can trigger an integer overflow which in turn triggers ...)
- qt6-base <unfixed> (bug #1152890)
[trixie] - qt6-base <no-dsa> (Minor issue)
+ [bookworm] - qt6-base <postponed> (Minor issue)
- qtbase-opensource-src <unfixed>
[trixie] - qtbase-opensource-src <no-dsa> (Minor issue)
- qtbase-opensource-src-gles <unfixed>
[trixie] - qtbase-opensource-src-gles <no-dsa> (Minor issue)
+ [bookworm] - qtbase-opensource-src-gles <postponed> (Minor issue)
NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/762279
NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-105923:
NOTE: Fixed by: https://github.com/qt/qtbase/commit/d2129a7f0e1f2ebef3f4897276db9b5b05874d8f (6.11-branch)
@@ -15317,6 +15364,7 @@ CVE-2026-94423 (Net::LibSSH versions before 0.004 for Perl authenticate to an un
CVE-2026-94140 (Rex versions through 1.16.1 for Perl accept an unknown SSH host key fo ...)
- rex <unfixed> (bug #1151676)
[trixie] - rex <no-dsa> (Minor issue)
+ [bookworm] - rex <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44533736/
CVE-2026-113811 (Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl all ...)
NOT-FOR-US: Algorithm::UrataniTakeda Perl module
@@ -15480,14 +15528,17 @@ CVE-2026-92997 (The Click n Chat (Chat Widget Integration) WordPress plugin befo
CVE-2026-92824 (A flaw was found in libmodulemd. In the module stream v2 rpm-map emiss ...)
- libmodulemd <unfixed>
[trixie] - libmodulemd <no-dsa> (Minor issue)
+ [bookworm] - libmodulemd <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478495
CVE-2026-92823 (A flaw was found in libmodulemd. In builds with rpmio support enabled, ...)
- libmodulemd <unfixed>
[trixie] - libmodulemd <no-dsa> (Minor issue)
+ [bookworm] - libmodulemd <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478703
CVE-2026-92822 (A flaw was found in libmodulemd. When parsing module metadata, the xmd ...)
- libmodulemd <unfixed>
[trixie] - libmodulemd <no-dsa> (Minor issue)
+ [bookworm] - libmodulemd <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479002
CVE-2026-92559 (IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a rem ...)
NOT-FOR-US: IBM
@@ -17232,6 +17283,7 @@ CVE-2026-113731 (djust provides Phoenix LiveView-style reactive server-side rend
CVE-2026-113730 (OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, ...)
- ognl <unfixed>
[trixie] - ognl <no-dsa> (Minor issue)
+ [bookworm] - ognl <postponed> (Minor issue)
NOTE: https://github.com/orphan-oss/ognl/security/advisories/GHSA-crwc-vw2r-qr6m
NOTE: https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2 (OGNL_3_4_13)
CVE-2026-113729 (Moov signedxml is a pure Go library for processing signed XML document ...)
@@ -19568,6 +19620,7 @@ CVE-2026-96402 (A malicious USB MTP/PTP device can cause the USBX host to read p
CVE-2026-95168 (An issue in nvbn thefuck v.3.32 allows a local attacker to execute arb ...)
- thefuck <unfixed> (bug #1151855)
[trixie] - thefuck <no-dsa> (Minor issue)
+ [bookworm] - thefuck <postponed> (Minor issue)
NOTE: https://github.com/nvbn/thefuck/issues/1623
CVE-2026-95111 (A memory-protected ThreadX module's queue request reaches the Module M ...)
NOT-FOR-US: Eclipse
@@ -20232,10 +20285,12 @@ CVE-2026-101296 (A missing critical step in authentication vulnerability in Apac
CVE-2026-101201 (A malformed header in the binary file fed to QBinaryJson::fromBinaryDa ...)
- qt6-5compat 6.11.2-3 (bug #1152312)
[trixie] - qt6-5compat <no-dsa> (Minor issue)
+ [bookworm] - qt6-5compat <postponed> (Minor issue)
- qtbase-opensource-src <unfixed> (bug #1152313)
[trixie] - qtbase-opensource-src <no-dsa> (Minor issue)
- qtbase-opensource-src-gles <unfixed> (bug #1152314)
[trixie] - qtbase-opensource-src-gles <no-dsa> (Minor issue)
+ [bookworm] - qtbase-opensource-src-gles <postponed> (Minor issue)
NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-101201:
NOTE: https://github.com/qt/qt5compat/commit/721ed576391211ca53ecdaaecf6dd41df7bc962e
NOTE: https://github.com/qt/qt5compat/commit/c0a495894d83a3c48055bd1e544f93147fc6ade1
@@ -21003,6 +21058,7 @@ CVE-2026-90910 (Missing authentication for critical function vulnerability in Ap
CVE-2026-8168 (Uncontrolled recursion in the SVG parser and renderer of the Qt SVG mo ...)
- qt6-svg 6.11.2-2
[trixie] - qt6-svg <no-dsa> (Minor issue)
+ [bookworm] - qt6-svg <postponed> (Minor issue)
- qtsvg-opensource-src <unfixed>
[trixie] - qtsvg-opensource-src <no-dsa> (Minor issue)
NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-8168:
@@ -21801,6 +21857,7 @@ CVE-2026-112037 (A flaw has been found in diem-project diem up to 116974edfb9a5b
CVE-2026-112036 (A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impac ...)
- mupdf <unfixed>
[trixie] - mupdf <no-dsa> (Minor issue)
+ [bookworm] - mupdf <postponed> (Minor issue)
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=709768
NOTE: Fixed by: http://www.ghostscript.com/cgi-bin/findgit.cgi?3984925b660afb8a781ddf504021e91be1bc671e
CVE-2026-112035 (A security vulnerability has been detected in aircheng-org iWebShop-5 ...)
@@ -24724,6 +24781,7 @@ CVE-2026-96768 (The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cros
CVE-2026-96425 (Incorrect DBus policy for lomiri-download-manager allows arbitrary use ...)
- lomiri-download-manager 0.3.3-1
[trixie] - lomiri-download-manager <no-dsa> (Minor issue)
+ [bookworm] - lomiri-download-manager <postponed> (Minor issue)
NOTE: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/17
NOTE: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/5fd50939a3cacef4181f6bcb58796bdcbc17984d (0.3.3)
NOTE: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/779dfd5bbeb5fe8877627b772e5024e40eda38aa (0.3.3)
@@ -24731,6 +24789,7 @@ CVE-2026-96425 (Incorrect DBus policy for lomiri-download-manager allows arbitra
CVE-2026-96424 (Incorrect DBus policy for lomiri-upload-manager (part of lomiri-downlo ...)
- lomiri-download-manager 0.3.3-1
[trixie] - lomiri-download-manager <no-dsa> (Minor issue)
+ [bookworm] - lomiri-download-manager <postponed> (Minor issue)
NOTE: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/18
NOTE: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/779dfd5bbeb5fe8877627b772e5024e40eda38aa (0.3.3)
NOTE: https://forums.ubports.com/topic/12671/security-advisory-arbitrary-root-command-execution-and-unauthenticated-arbitrary-file-read-as-root-in-lomiri-download-manager
@@ -24877,6 +24936,7 @@ CVE-2026-55836 (Open Zaak is an open-source data and services layer for Dutch ca
CVE-2026-55543 (TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, a ...)
- tuxguitar <unfixed> (bug #1151103)
[trixie] - tuxguitar <no-dsa> (Minor issue)
+ [bookworm] - tuxguitar <postponed> (Minor issue)
NOTE: https://github.com/helge17/tuxguitar/security/advisories/GHSA-v66p-c82h-w3cq
NOTE: Fixed by: https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636 (2.1.0)
CVE-2026-54657 (Open Zaak is an open-source data and services layer for Dutch case-ori ...)
@@ -25939,6 +25999,7 @@ CVE-2026-88794 (Enterprise Architect is vulnerable to XML External Entity (XXE)
CVE-2026-88753 (A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extra ...)
- python-markdown2 <unfixed> (bug #1151085)
[trixie] - python-markdown2 <no-dsa> (Minor issue)
+ [bookworm] - python-markdown2 <postponed> (Minor issue)
NOTE: https://gist.github.com/NanaSec/354b4188bbd7f4105008c7b8be49b0ba
CVE-2026-87029 (undici is an HTTP client library for Node.js. In versions 7.15.0 throu ...)
- node-undici 8.12.2+dfsg+~cs3.2.3-1
@@ -26322,6 +26383,7 @@ CVE-2026-111148 (libsidplayfp through 3.1.1 contains a heap out-of-bounds read v
[experimental] - libsidplayfp 3.1.2-1
- libsidplayfp <unfixed>
[trixie] - libsidplayfp <no-dsa> (Minor issue)
+ [bookworm] - libsidplayfp <postponed> (Minor issue)
NOTE: https://github.com/libsidplayfp/libsidplayfp/issues/280
NOTE: https://github.com/libsidplayfp/libsidplayfp/commit/afa48cda489ad3a7c5ad12b635632f160599add8 (v3.1.2)
CVE-2026-111147 (Libyal libesedb through 20260704 contains a heap out-of-bounds read vu ...)
@@ -26908,18 +26970,22 @@ CVE-2026-110873 (Heym from 0.0.55 before 0.0.121 contains a privilege escalation
CVE-2026-110872 (Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity d ...)
- node-nodemailer 10.0.10+~8.0.1-1
[trixie] - node-nodemailer <no-dsa> (Minor issue)
+ [bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc
CVE-2026-110871 (Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vuln ...)
- node-nodemailer 10.0.10+~8.0.1-1
[trixie] - node-nodemailer <no-dsa> (Minor issue)
+ [bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27
CVE-2026-110870 (Nodemailer from 3.0.0 before 10.0.13 contains an improper input valida ...)
- node-nodemailer 10.0.13+~8.0.2-1
[trixie] - node-nodemailer <no-dsa> (Minor issue)
+ [bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g73g-hqqh-jr95
CVE-2026-110869 (Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of ser ...)
- node-nodemailer 10.0.13+~8.0.2-1
[trixie] - node-nodemailer <no-dsa> (Minor issue)
+ [bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx
CVE-2026-110868 (Renovate before 44.79.0 contains a server-side request forgery vulnera ...)
NOT-FOR-US: Renovate
@@ -27620,6 +27686,7 @@ CVE-2026-110716 (unshield through 1.6.2 contains a heap out-of-bounds read vulne
CVE-2026-110715 (MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write v ...)
- mujs 1.3.11-1
[trixie] - mujs <no-dsa> (Minor issue)
+ [bookworm] - mujs <postponed> (Minor issue)
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=709180
NOTE: Fixed by: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mujs.git/commit/?id=32064e10caa45e68fc87331ca53d042049cc9396 (1.3.11)
NOTE: Fixed by: https://codeberg.org/ccxvii/mujs/commit/32064e10caa45e68fc87331ca53d042049cc9396 (1.3.11)
@@ -31461,6 +31528,7 @@ CVE-2026-110453 (Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorr
CVE-2026-110452 (The multi-user installer in Nix before 2.35.3 sets the ownership of st ...)
- nix 2.35.4+dfsg-1 (bug #1151197)
[trixie] - nix <no-dsa> (Minor issue)
+ [bookworm] - nix <postponed> (Minor issue)
NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-hf6w-2rg9-v84g
CVE-2026-110451 (Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sand ...)
@@ -31471,11 +31539,13 @@ CVE-2026-110451 (Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbe
CVE-2026-110450 (Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via ...)
- nix 2.35.4+dfsg-1 (bug #1151197)
[trixie] - nix <no-dsa> (Minor issue)
+ [bookworm] - nix <postponed> (Minor issue)
NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-jwvx-xq5j-gc56
CVE-2026-110449 (Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and r ...)
- nix 2.35.4+dfsg-1 (bug #1151197)
[trixie] - nix <no-dsa> (Minor issue)
+ [bookworm] - nix <postponed> (Minor issue)
NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-25vp-6h23-hj3g
CVE-2026-110447 (Collabora Online Built-in CODE Server before 26.4.303 (richdocumentsco ...)
@@ -33395,6 +33465,7 @@ CVE-2026-102832 (JupyterLab is an extensible environment for interactive and rep
CVE-2026-102734 (asteval is a Python expression evaluator designed for restricted execu ...)
- python-asteval <unfixed> (bug #1150909)
[trixie] - python-asteval <no-dsa> (Minor issue)
+ [bookworm] - python-asteval <postponed> (Minor issue)
NOTE: https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx
NOTE: https://github.com/lmfit/asteval/pull/153
NOTE: Fixed by (merge): https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4 (1.0.9)
@@ -34444,6 +34515,7 @@ CVE-2026-109598 (Frappe Framework before 15.120.0 and 16.x before 16.33.0 contai
CVE-2026-109597 (Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripti ...)
- hugo 0.167.0-1
[trixie] - hugo <no-dsa> (Minor issue)
+ [bookworm] - hugo <postponed> (Minor issue)
NOTE: https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg
CVE-2026-109596 (Hugo from v0.162.0 before v0.167.0 contains an improper link resolutio ...)
- hugo 0.167.0-1
@@ -34453,12 +34525,14 @@ CVE-2026-109596 (Hugo from v0.162.0 before v0.167.0 contains an improper link re
CVE-2026-109595 (Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerabil ...)
- hugo 0.167.0-1
[trixie] - hugo <no-dsa> (Minor issue)
+ [bookworm] - hugo <postponed> (Minor issue)
NOTE: https://github.com/gohugoio/hugo/security/advisories/GHSA-r4xx-89rf-5424
CVE-2026-109575 (In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enter ...)
NOT-FOR-US: HAProxy Data Plane API
CVE-2026-109574 (Hugo before v0.167.0 contains a path traversal vulnerability in css.Sa ...)
- hugo 0.167.0-1
[trixie] - hugo <no-dsa> (Minor issue)
+ [bookworm] - hugo <postponed> (Minor issue)
NOTE: https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf
CVE-2026-109573 (phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMy ...)
NOT-FOR-US: phpMyFAQ
@@ -35614,6 +35688,7 @@ CVE-2026-103061 (Improper Limitation of a Pathname to a Restricted Directory ('P
CVE-2026-103060 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- rebar3 3.27.3-1
[trixie] - rebar3 <no-dsa> (Minor issue)
+ [bookworm] - rebar3 <postponed> (Minor issue)
NOTE: https://github.com/erlang/rebar3/security/advisories/GHSA-6ggr-r7mh-2mv8
NOTE: https://cna.erlef.org/cves/CVE-2026-103060.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-103060
@@ -37030,6 +37105,7 @@ CVE-2026-108554 (PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side
CVE-2026-108553 (OpenRefine through 3.10.1 contains a cross-site request forgery vulner ...)
- openrefine <unfixed> (bug #1150650)
[trixie] - openrefine <no-dsa> (Minor issue)
+ [bookworm] - openrefine <postponed> (Minor issue)
NOTE: https://github.com/OpenRefine/OpenRefine/issues/7999
CVE-2026-108551 (openapi-typescript-codegen through 0.31.0 contains a code injection vu ...)
NOT-FOR-US: openapi-typescript-codegen
@@ -37126,6 +37202,7 @@ CVE-2026-100147 (The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout pl
CVE-2026-107794 (ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a ...)
- libextutils-typemaps-default-perl 1.07-1 (bug #1150541)
[trixie] - libextutils-typemaps-default-perl <no-dsa> (Minor issue)
+ [bookworm] - libextutils-typemaps-default-perl <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44246012/
NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=91213
NOTE: Fixed by: https://github.com/tsee/extutils-typemap-default/commit/10f45bf0d00d3140499755c2ad49f8bf435851ac (ExtUtils-Typemaps-Default-1.07)
@@ -37138,6 +37215,7 @@ CVE-2013-10076 (ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl al
CVE-2026-107373 (ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_ST ...)
- libextutils-typemaps-default-perl 1.07-1 (bug #1150541)
[trixie] - libextutils-typemaps-default-perl <no-dsa> (Minor issue)
+ [bookworm] - libextutils-typemaps-default-perl <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44245994/
NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=94110
NOTE: Fixed by: https://github.com/tsee/extutils-typemap-default/commit/a6b9c298b34ddadc582961403e715d292f82a22d (ExtUtils-Typemaps-Default-1.06)
@@ -39038,21 +39116,25 @@ CVE-2025-15700 (The AWP Classifieds WordPress plugin before 4.4.9 does not valid
CVE-2026-97147 (In OpenStack Mistral through 23.0.0, several of the v2 API write paths ...)
- mistral 23.0.0-2 (bug #1150346)
[trixie] - mistral <no-dsa> (Minor issue)
+ [bookworm] - mistral <postponed> (Minor issue)
NOTE: https://launchpad.net/bugs/2160267
NOTE: https://security.openstack.org/ossa/OSSA-2026-044.html
CVE-2026-93861 (In OpenStack Mistral through 23.0.0, the workflow membership API lets ...)
- mistral 23.0.0-2 (bug #1150346)
[trixie] - mistral <no-dsa> (Minor issue)
+ [bookworm] - mistral <postponed> (Minor issue)
NOTE: https://launchpad.net/bugs/2161277
NOTE: https://security.openstack.org/ossa/OSSA-2026-044.html
CVE-2026-93858 (In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes ...)
- mistral 23.0.0-2 (bug #1150346)
[trixie] - mistral <no-dsa> (Minor issue)
+ [bookworm] - mistral <postponed> (Minor issue)
NOTE: https://launchpad.net/bugs/2162100
NOTE: https://security.openstack.org/ossa/OSSA-2026-044.html
CVE-2026-93860 (In OpenStack Mistral through 23.0.0, the /v2/maintenance API controlle ...)
- mistral 23.0.0-2 (bug #1150346)
[trixie] - mistral <no-dsa> (Minor issue)
+ [bookworm] - mistral <postponed> (Minor issue)
NOTE: https://launchpad.net/bugs/2162789
NOTE: https://security.openstack.org/ossa/OSSA-2026-044.html
CVE-2026-105517
@@ -39510,6 +39592,7 @@ CVE-2026-107354
CVE-2026-107353 (traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5. ...)
- node-traverse <unfixed> (bug #1150332)
[trixie] - node-traverse <no-dsa> (Minor issue)
+ [bookworm] - node-traverse <postponed> (Minor issue)
NOTE: https://github.com/ljharb/js-traverse/security/advisories/GHSA-rj28-8w7x-jmqc
NOTE: https://github.com/ljharb/js-traverse/commit/81ccab43e379cf42eb2a5f689630f7f79b3d71b8 (v0.6.12)
NOTE: https://github.com/ljharb/js-traverse/commit/37a9ebd103d2a259c824c29cdcc3f0dfe1acffce (v0.6.12)
@@ -52748,6 +52831,7 @@ CVE-2026-XXXX [Infinite loops and heap OOB read when parsing malformed ASF heade
CVE-2026-XXXX [unbounded list indices from a Word document reach a wild pointer dereference in wvAssembleSimplePAP]
- wv <unfixed> (bug #1148725)
[trixie] - wv <no-dsa> (Minor issue)
+ [bookworm] - wv <postponed> (Minor issue)
CVE-2026-XXXX [GHSA-h547-rmjf-5m2m: Table permission bypass using trailing newlines in table names]
- datasette 0.65.5+ds-1 (bug #1148576)
NOTE: https://github.com/simonw/datasette/security/advisories/GHSA-h547-rmjf-5m2m
@@ -196586,6 +196670,7 @@ CVE-2026-41692 (i18nextify is a JavaScript library that adds website internation
CVE-2026-41691 (Copilot said: i18nextify is a JavaScript library that adds i18nextify ...)
- node-i18next-http-backend <unfixed> (bug #1150648)
[trixie] - node-i18next-http-backend <no-dsa> (Minor issue)
+ [bookworm] - node-i18next-http-backend <postponed> (Minor issue)
NOTE: https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g
NOTE: Fixed by: https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621 (v3.0.5)
NOTE: When fixing this issue make sure to make the fix complete and not open up CVE-2026-105800 and CVE-2026-41691
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6056de260f4a049e3a57a1ff7cec005cabc268a7
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6056de260f4a049e3a57a1ff7cec005cabc268a7
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261103/eac469e7/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list