[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 1 08:13:02 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
a84a2ba7 by security tracker role at 2026-10-01T07:12:54+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,351 @@
+CVE-2026-96561 (The AI Engine \u2013 The Chatbot, AI Framework & MCP for WordPress plu ...)
+ TODO: check
+CVE-2026-96255 (The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent ...)
+ TODO: check
+CVE-2026-96200 (The Payments for Hubtel WordPress plugin before 1.0.2 does not verify ...)
+ TODO: check
+CVE-2026-96173 (The Payments for Hubtel WordPress plugin before 1.0.2 does not verify ...)
+ TODO: check
+CVE-2026-93495 (Improper initialization in an ASUS certain motherboard allows an physi ...)
+ TODO: check
+CVE-2026-92966 (The The Appointment Booking Plugin \u2013 LatePoint | Calendar & Sched ...)
+ TODO: check
+CVE-2026-92548 (The WP Popular Posts plugin for WordPress is vulnerable to Sensitive I ...)
+ TODO: check
+CVE-2026-92537 (The Newsletter \u2013 Send awesome emails from WordPress plugin for Wo ...)
+ TODO: check
+CVE-2026-92412 (The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does n ...)
+ TODO: check
+CVE-2026-92245 (The Simply Schedule Appointments plugin for WordPress is vulnerable to ...)
+ TODO: check
+CVE-2026-92173 (Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver cou ...)
+ TODO: check
+CVE-2026-92172 (Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be ...)
+ TODO: check
+CVE-2026-91109 (The Simply Schedule Appointments plugin for WordPress is vulnerable to ...)
+ TODO: check
+CVE-2026-90974 (The WP Fusion Lite WordPress plugin before 3.48.0 does not require au ...)
+ TODO: check
+CVE-2026-90972 (The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a ...)
+ TODO: check
+CVE-2026-89296 (The Pro Like Button WordPress plugin before 2.0 does not properly sani ...)
+ TODO: check
+CVE-2026-88999 (The Redux Framework plugin for WordPress is vulnerable to authorizatio ...)
+ TODO: check
+CVE-2026-87973 (The If-So Dynamic Content WordPress plugin before 1.10.2 does not san ...)
+ TODO: check
+CVE-2026-87970 (The If-So Dynamic Content WordPress plugin before 1.10.2 does not esc ...)
+ TODO: check
+CVE-2026-86610 (The Download Manager WordPress plugin before 3.3.71 does not sufficien ...)
+ TODO: check
+CVE-2026-85679 (The Extendify plugin for WordPress is vulnerable to Stored Cross-Site ...)
+ TODO: check
+CVE-2026-82829 (Hitachi Coding Software Suite contains a vulnerability related to Hidd ...)
+ TODO: check
+CVE-2026-82828 (Hitachi Coding Software Suite contains an Incorrect Authorization vuln ...)
+ TODO: check
+CVE-2026-82827 (Hitachi Coding Software Suite contains a vulnerability related to Use ...)
+ TODO: check
+CVE-2026-82826 (Hitachi Coding Software Suite contains a vulnerability related to the ...)
+ TODO: check
+CVE-2026-82825 (Hitachi Coding Software Suite contains a vulnerability related to Miss ...)
+ TODO: check
+CVE-2026-82824 (Hitachi Coding Software Suite contains a vulnerability related to Path ...)
+ TODO: check
+CVE-2026-81809 (The Paytm Payment Gateway WordPress plugin before 2.8.9 does not prope ...)
+ TODO: check
+CVE-2026-81739 (The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanit ...)
+ TODO: check
+CVE-2026-80276 (Comelit Multi-User Gateway for VIP System (model 1456B) firmware versi ...)
+ TODO: check
+CVE-2026-80275 (Comelit Multi-User Gateway for VIP System (model 1456B) firmware versi ...)
+ TODO: check
+CVE-2026-78210 (In affected versions of Octopus Server, users with certain scoped perm ...)
+ TODO: check
+CVE-2026-76147 (A path traversal (ZIP Slip) vulnerability caused by insufficient autho ...)
+ TODO: check
+CVE-2026-76146 (An OS command injection vulnerability in Genian SSL PNS allows an atta ...)
+ TODO: check
+CVE-2026-76145 (An improper privilege management vulnerability in Genian SSL PNS allow ...)
+ TODO: check
+CVE-2026-76144 (An unrestricted file upload vulnerability caused by insufficient file ...)
+ TODO: check
+CVE-2026-76143 (A missing authorization vulnerability in Genian SSL PNS allows an atta ...)
+ TODO: check
+CVE-2026-76142 (Insufficient authentication and access control on the internal-only IP ...)
+ TODO: check
+CVE-2026-67075 (HCL Digital Experience is affected by improper input sanitation. This ...)
+ TODO: check
+CVE-2026-51872 (Devika v1.0 is vulnerable to Code Injection via the Runner.run_code fu ...)
+ TODO: check
+CVE-2026-51871 (Devika v1.0 is vulnerable to Code Injection in the Runner.execute func ...)
+ TODO: check
+CVE-2026-51870 (DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent ...)
+ TODO: check
+CVE-2026-51869 (DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and exec ...)
+ TODO: check
+CVE-2026-51867 (agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src ...)
+ TODO: check
+CVE-2026-51866 (In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/s ...)
+ TODO: check
+CVE-2026-51864 (DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_u ...)
+ TODO: check
+CVE-2026-51862 (DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/db ...)
+ TODO: check
+CVE-2026-51861 (bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection ...)
+ TODO: check
+CVE-2026-51860 (bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Trave ...)
+ TODO: check
+CVE-2026-51859 (bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory trave ...)
+ TODO: check
+CVE-2026-51858 (In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.s ...)
+ TODO: check
+CVE-2026-51857 (In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionTool ...)
+ TODO: check
+CVE-2026-51856 (In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent sessio ...)
+ TODO: check
+CVE-2026-51853 (agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversa ...)
+ TODO: check
+CVE-2026-51852 (agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversa ...)
+ TODO: check
+CVE-2026-51570 (modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in ...)
+ TODO: check
+CVE-2026-51568 (modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal i ...)
+ TODO: check
+CVE-2026-47096 (AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scrip ...)
+ TODO: check
+CVE-2026-19253 (The Cache Enabler WordPress plugin before 1.8.17 does not validate a U ...)
+ TODO: check
+CVE-2026-14157 (Use of an Externally Controlled Format String in the ASUS Router modul ...)
+ TODO: check
+CVE-2026-13313 (An Active Debug Code vulnerability in certain ASUS router models allow ...)
+ TODO: check
+CVE-2026-12241 (The Advanced Woo Labels \u2013 Product Labels & Badges for WooCommerce ...)
+ TODO: check
+CVE-2026-103641 (A flaw was found in GEGL. The Radiance HDR loader reads past the end o ...)
+ TODO: check
+CVE-2026-103592 (simple-php-router through 5.4.1.7 contains an IP restriction bypass vu ...)
+ TODO: check
+CVE-2026-103591 (DeepWiki-Open through commit d92819a contains an unauthenticated arbit ...)
+ TODO: check
+CVE-2026-103590 (QloApps through 1.7.0 contains a reflected cross-site scripting vulner ...)
+ TODO: check
+CVE-2026-103589 (QloApps through 1.7.0 contains a reflected cross-site scripting vulner ...)
+ TODO: check
+CVE-2026-103588 (QloApps through 1.7.0 contains a reflected cross-site scripting vulner ...)
+ TODO: check
+CVE-2026-103587 (QloApps through 1.7.0 contains a reflected cross-site scripting vulner ...)
+ TODO: check
+CVE-2026-103585 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
+ TODO: check
+CVE-2026-103584 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
+ TODO: check
+CVE-2026-103548 (Improperly stored passwords in the config file in Itron MV-90 xi 3.0 a ...)
+ TODO: check
+CVE-2026-103547 (In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, d ...)
+ TODO: check
+CVE-2026-103544 (A vulnerability was found in datadrivenconstruction OpenConstructionER ...)
+ TODO: check
+CVE-2026-103543 (A vulnerability has been found in itsourcecode Leave Management System ...)
+ TODO: check
+CVE-2026-103542 (A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacte ...)
+ TODO: check
+CVE-2026-103541 (A vulnerability was detected in formtools.org Form Tools up to 3.1.1. ...)
+ TODO: check
+CVE-2026-103540 (A security vulnerability has been detected in formtools.org Form Tools ...)
+ TODO: check
+CVE-2026-103539 (A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This aff ...)
+ TODO: check
+CVE-2026-103538 (A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Aff ...)
+ TODO: check
+CVE-2026-103536 (A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected ...)
+ TODO: check
+CVE-2026-103534 (A vulnerability was determined in David-Crty databasement up to 1.7.1. ...)
+ TODO: check
+CVE-2026-103533 (A vulnerability was found in David-Crty databasement up to 1.7.1. This ...)
+ TODO: check
+CVE-2026-103532 (A vulnerability has been found in immich-app Immich up to 2.7.5. This ...)
+ TODO: check
+CVE-2026-103531 (A flaw has been found in OpenSC up to 0.27.1. The impacted element is ...)
+ TODO: check
+CVE-2026-103530 (A vulnerability was detected in decolua 9Router up to 0.5.55. The affe ...)
+ TODO: check
+CVE-2026-103387 (A weakness has been identified in garycourt uri-js up to 4.4.1. This a ...)
+ TODO: check
+CVE-2026-103001 (PyJWT is a Python implementation of JSON Web Token standards. From 2.1 ...)
+ TODO: check
+CVE-2026-103000 (pypdf is a free and open-source pure-python PDF library. Prior to 6.19 ...)
+ TODO: check
+CVE-2026-102999 (pypdf is a free and open-source pure-python PDF library. Prior to 6.19 ...)
+ TODO: check
+CVE-2026-102998 (pypdf is a free and open-source pure-python PDF library. Prior to 6.19 ...)
+ TODO: check
+CVE-2026-102997 (pypdf is a free and open-source pure-python PDF library. Prior to 6.18 ...)
+ TODO: check
+CVE-2026-102996 (pypdf is a free and open-source pure-python PDF library. Prior to 6.18 ...)
+ TODO: check
+CVE-2026-102995 (pypdf is a free and open-source pure-python PDF library. Prior to 6.18 ...)
+ TODO: check
+CVE-2026-102994 (pypdf is a free and open-source pure-python PDF library. Prior to 6.18 ...)
+ TODO: check
+CVE-2026-102993 (pypdf is a free and open-source pure-python PDF library. Prior to 6.17 ...)
+ TODO: check
+CVE-2026-102992 (piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2 ...)
+ TODO: check
+CVE-2026-102991 (Mako is a template library written in Python. Prior to 1.4.2, on Windo ...)
+ TODO: check
+CVE-2026-102990 (basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() ...)
+ TODO: check
+CVE-2026-102150 (A function in the Kiteworks Advanced Forms component was reachable wit ...)
+ TODO: check
+CVE-2026-102149 (Kiteworks Email Protection Gateway did not sufficiently restrict which ...)
+ TODO: check
+CVE-2026-102147 (A stored cross-site scripting (XSS) weakness in Kiteworks Core could a ...)
+ TODO: check
+CVE-2026-102146 (An authenticated Email Protection Gateway administrator holding only l ...)
+ TODO: check
+CVE-2026-102145 (An authenticated administrator could cause the server to issue request ...)
+ TODO: check
+CVE-2026-102144 (A resource exhaustion vulnerability in Kiteworks Email Protection Gate ...)
+ TODO: check
+CVE-2026-102143 (An unauthenticated attacker could cause a file with attacker-controlle ...)
+ TODO: check
+CVE-2026-102142 (A system notification template on the Kiteworks appliance was rendered ...)
+ TODO: check
+CVE-2026-102141 (Two Kiteworks Core cluster-management operations did not validate file ...)
+ TODO: check
+CVE-2026-102140 (An authenticated administrator could initiate an administrative import ...)
+ TODO: check
+CVE-2026-102139 (An authorization check in the large file exchange feature of Kiteworks ...)
+ TODO: check
+CVE-2026-102138 (An authenticated administrator on a node with an optional, separately ...)
+ TODO: check
+CVE-2026-102137 (An authenticated administrator could bypass the content validation app ...)
+ TODO: check
+CVE-2026-102136 (In multi-node deployments, an attacker who had already obtained code e ...)
+ TODO: check
+CVE-2026-102135 (On a Kiteworks Email Protection Gateway cluster with database replicat ...)
+ TODO: check
+CVE-2026-102134 (Kiteworks Core did not apply its gateway-level API security controls t ...)
+ TODO: check
+CVE-2026-102133 (An optional, separately licensed repository-connector feature in Kitew ...)
+ TODO: check
+CVE-2026-102132 (An administrative import function in Kiteworks Core did not verify tha ...)
+ TODO: check
+CVE-2026-102131 (Kiteworks Email Protection Gateway rejected certain configuration sett ...)
+ TODO: check
+CVE-2026-102130 (Kiteworks Email Protection Gateway did not sufficiently validate the c ...)
+ TODO: check
+CVE-2026-102129 (A user-provisioning interface in Kiteworks Core did not verify that th ...)
+ TODO: check
+CVE-2026-102128 (An identity-verification weakness in Kiteworks Email Protection Gatewa ...)
+ TODO: check
+CVE-2026-102127 (An XML parser used by Kiteworks Email Protection Gateway did not restr ...)
+ TODO: check
+CVE-2026-102126 (A stored cross-site scripting (XSS) weakness in Kiteworks Core could a ...)
+ TODO: check
+CVE-2026-102125 (The sandbox that isolates document conversion on a Kiteworks appliance ...)
+ TODO: check
+CVE-2026-102124 (A Kiteworks appliance setup interface did not enforce authentication o ...)
+ TODO: check
+CVE-2026-102123 (A Kiteworks appliance setup interface did not confine a user-supplied ...)
+ TODO: check
+CVE-2026-102122 (Kiteworks did not correctly enforce which roles a shared folder's mana ...)
+ TODO: check
+CVE-2026-102121 (A form-rendering interface in the Advanced Forms component is reachabl ...)
+ TODO: check
+CVE-2026-102120 (A privilege escalation vulnerability in Kiteworks could have allowed a ...)
+ TODO: check
+CVE-2026-102119 (A path traversal weakness in an optional, non-default administrative f ...)
+ TODO: check
+CVE-2026-102118 (A local privilege escalation vulnerability in Kiteworks could have all ...)
+ TODO: check
+CVE-2026-102117 (On deployments where the remote-support capability is licensed and ena ...)
+ TODO: check
+CVE-2026-102116 (-A weakness could have allowed an authenticated Kiteworks Email Protec ...)
+ TODO: check
+CVE-2026-102115 (Kiteworks Core did not correctly validate a parameter submitted to the ...)
+ TODO: check
+CVE-2026-102114 (A command injection vulnerability in Kiteworks could allow a high-priv ...)
+ TODO: check
+CVE-2026-102113 (A privilege escalation vulnerability in Kiteworks could allow an attac ...)
+ TODO: check
+CVE-2026-102112 (A privilege escalation vulnerability in Kiteworks could allow an attac ...)
+ TODO: check
+CVE-2026-102111 (Kiteworks did not enforce the maximum permitted value for a configurab ...)
+ TODO: check
+CVE-2026-102110 (An endpoint used during initial appliance setup did not require authen ...)
+ TODO: check
+CVE-2026-102109 (A SQL injection vulnerability existed in Kiteworks Secure Data Forms, ...)
+ TODO: check
+CVE-2026-102108 (An authenticated administrator of Kiteworks Email Protection Gateway c ...)
+ TODO: check
+CVE-2026-102107 (Kiteworks Core contains a business logic flaw in a Kiteworks file-requ ...)
+ TODO: check
+CVE-2026-102106 (Improper authentication in a Kiteworks Email Protection Gateway admini ...)
+ TODO: check
+CVE-2026-102105 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
+ TODO: check
+CVE-2026-102104 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
+ TODO: check
+CVE-2026-102103 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
+ TODO: check
+CVE-2026-102102 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
+ TODO: check
+CVE-2026-102101 (Kiteworks Core before version 9.5.0 is vulnerable to Deserialization o ...)
+ TODO: check
+CVE-2026-102100 (Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site ...)
+ TODO: check
+CVE-2026-102099 (Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Wr ...)
+ TODO: check
+CVE-2026-102098 (Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A ...)
+ TODO: check
+CVE-2026-102097 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
+ TODO: check
+CVE-2026-102096 (Kiteworks Core before version 9.5.0 is vulnerable to OS Command Inject ...)
+ TODO: check
+CVE-2026-102095 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
+ TODO: check
+CVE-2026-102094 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
+ TODO: check
+CVE-2026-102093 (Kiteworks Core before version 9.5.0 is vulnerable to Improper Privileg ...)
+ TODO: check
+CVE-2026-102092 (Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site ...)
+ TODO: check
+CVE-2026-102091 (Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Serv ...)
+ TODO: check
+CVE-2026-102090 (Kiteworks Core before version 9.5.1 is vulnerable to Content Injection ...)
+ TODO: check
+CVE-2026-102089 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
+ TODO: check
+CVE-2026-101887 (BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerabil ...)
+ TODO: check
+CVE-2026-101885 (ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain ...)
+ TODO: check
+CVE-2026-101884 (OpenClaw Windows Node before 2026.7.1 contains an incomplete environme ...)
+ TODO: check
+CVE-2026-101883 (OpenClaw Windows Node through 2026.9.4 contains a server-side request ...)
+ TODO: check
+CVE-2026-101882 (OpenClaw Windows Node before 2026.7.1 contains an incomplete validatio ...)
+ TODO: check
+CVE-2026-101881 (OpenClaw Windows Node before 2026.7.1 contains an allocation of resour ...)
+ TODO: check
+CVE-2026-101880 (OpenClaw Windows Node before 2026.7.1 contains an incorrect authorizat ...)
+ TODO: check
+CVE-2026-101879 (OpenClaw Windows Node before 2026.7.1-3 contains a missing authorizati ...)
+ TODO: check
+CVE-2026-101148 (The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 d ...)
+ TODO: check
+CVE-2026-101147 (The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Feat ...)
+ TODO: check
+CVE-2025-41753 (The object name of a dynamically created BACnet File Object is interpr ...)
+ TODO: check
+CVE-2024-58387 (Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability ...)
+ TODO: check
+CVE-2023-54403 (Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vul ...)
+ TODO: check
+CVE-2023-54402 (iDocView contains a server-side request forgery vulnerability in its / ...)
+ TODO: check
CVE-2026-XXXX [GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses multipart filename rules]
- modsecurity <unfixed>
- modsecurity-apache <unfixed>
@@ -292,13 +640,13 @@ CVE-2026-93514 (Unauthenticated Cross Site Scripting (XSS) in Notification for T
NOT-FOR-US: WordPress plugin or theme
CVE-2026-93512 (Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-93464 (Stored Cross-Site Scripting via custom content descriptions vulnerabil ...)
+CVE-2026-93464 (A stored cross-site scripting vulnerability via custom content descrip ...)
NOT-FOR-US: baserCMS
CVE-2026-93463 (Cross-Site Scripting via Script Validation Bypass exists in baserCMS. ...)
NOT-FOR-US: baserCMS
-CVE-2026-93462 (Missing authentication for critical function vulnerability exists in b ...)
+CVE-2026-93462 (A missing authentication for critical function vulnerability exists in ...)
NOT-FOR-US: baserCMS
-CVE-2026-93460 (Stored Cross-site scripting via appended strings in email form fields ...)
+CVE-2026-93460 (A stored cross-site scripting vulnerability via appended strings in em ...)
NOT-FOR-US: baserCMS
CVE-2026-92899 (Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so ...)
- wss4j <unfixed>
@@ -1349,11 +1697,11 @@ CVE-2026-102620 (A vulnerability was determined in Freedesktop Poppler 26.06.0/2
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1762
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2326
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/commit/245d3c6823377755f2c1d5fdddd010279c6ed94d
-CVE-2026-101283
+CVE-2026-101283 (iperf3 3.20\u20133.21 (esnet/iperf) has a pre-auth heap buffer overflo ...)
- iperf3 <unfixed>
NOTE: https://github.com/esnet/iperf/releases/tag/3.22
NOTE: https://github.com/esnet/iperf/commit/e29f6504dcfac7d2961fed4fd66364115e36fe5a (3.22)
-CVE-2026-101276
+CVE-2026-101276 (iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use- ...)
- iperf3 <unfixed>
NOTE: https://github.com/esnet/iperf/releases/tag/3.22
NOTE: https://github.com/esnet/iperf/commit/9bea2d9a49d54870e2405c209fa60bf134a8a1a1 (3.22)
@@ -3475,7 +3823,8 @@ CVE-2026-97029 (Flatpak's process ID namespace separation does not prevent a san
{DSA-6524-1}
- flatpak 1.18.4-1
NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2
-CVE-2026-103111 [GHSA-r9hj-j2rw-4q3m: PCRE2: out-of-bounds write in JIT matching with large stack allocations]
+CVE-2026-103111 (PCRE2 before 10.49, when there is an attacker-controlled regular expre ...)
+ {DSA-6530-1}
- pcre2 10.48-3.1 (bug #1149217)
NOTE: https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m
NOTE: Fixed by: https://github.com/PCRE2Project/pcre2/commit/2b4038298072684b0fae29b15bedfb1a75bda46d (pcre2-10.49)
@@ -12416,6 +12765,7 @@ CVE-2026-93992 (Gopeed through 2.0.0-beta.3 contains a path traversal vulnerabil
CVE-2026-93991 (Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization b ...)
NOT-FOR-US: Argo Workflows
CVE-2026-93990 (Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 i ...)
+ {DLA-4807-1}
- expat 2.8.4-2 (bug #1148665)
NOTE: https://github.com/libexpat/libexpat/pull/1282
NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/0cfd15bdf4b2c22d6b0df73610709dfb60921091 (R_2_8_5)
@@ -56618,6 +56968,7 @@ CVE-2026-66621 (Improper Neutralization of Input During Web Page Generation ('Cr
CVE-2026-66620 (Editor PHP Object Injection in OptionTree <= 2.7.3 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-66046 (Expat through 2.8.3 contains a denial of service vulnerability caused ...)
+ {DLA-4807-1}
- expat 2.8.4-1 (bug #1144925)
[trixie] - expat <no-dsa> (Minor issue)
NOTE: https://github.com/libexpat/libexpat/pull/1321
@@ -144576,7 +144927,7 @@ CVE-2026-8195 (A vulnerability was detected in JeecgBoot up to 3.9.1. The affect
CVE-2026-8194 (A security vulnerability has been detected in osTicket up to 1.18.3. I ...)
- osticket <itp> (bug #998157)
CVE-2026-45186 (In libexpat before 2.8.1, the computational complexity of attribute na ...)
- {DSA-6404-1}
+ {DSA-6404-1 DLA-4807-1}
- expat 2.8.0-2 (bug #1136164)
NOTE: https://github.com/libexpat/libexpat/pull/1216
NOTE: https://blog.hartwork.org/posts/expat-2-8-1-released/
@@ -178080,14 +178431,14 @@ CVE-2026-4172 (A vulnerability was detected in TRENDnet TEW-632BRP 1.010B32. Thi
CVE-2026-4171 (A security vulnerability has been detected in CodeGenieApp serverless- ...)
NOT-FOR-US: CodeGenieApp serverless-express
CVE-2026-32778 (libexpat before 2.7.5 allows a NULL pointer dereference in the functio ...)
- {DSA-6404-1}
+ {DSA-6404-1 DLA-4807-1}
- expat 2.7.5-1 (bug #1131119)
[bullseye] - expat <postponed> (Minor issue)
NOTE: https://github.com/libexpat/libexpat/pull/1163
NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/576b61e42feeea704253cb7c7bedb2eeb3754387
NOTE: Test: https://github.com/libexpat/libexpat/commit/d5fa769b7a7290a7e2c4a0b2287106dec9b3c030
CVE-2026-32777 (libexpat before 2.7.5 allows an infinite loop while parsing DTD conten ...)
- {DSA-6404-1}
+ {DSA-6404-1 DLA-4807-1}
- expat 2.7.5-1 (bug #1131118)
[bullseye] - expat <postponed> (Minor issue)
NOTE: https://github.com/libexpat/libexpat/issues/1161
@@ -178095,7 +178446,7 @@ CVE-2026-32777 (libexpat before 2.7.5 allows an infinite loop while parsing DTD
NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/55cda8c7125986e17d7e1825cba413bd94a35d02
NOTE: Test: https://github.com/libexpat/libexpat/commit/a7805c1a8a48d2ce83ef289cf55bdc8b45de76a8
CVE-2026-32776 (libexpat before 2.7.5 allows a NULL pointer dereference with empty ext ...)
- {DSA-6404-1}
+ {DSA-6404-1 DLA-4807-1}
- expat 2.7.5-1 (bug #1131117)
[bullseye] - expat <postponed> (Minor issue)
NOTE: https://github.com/libexpat/libexpat/pull/1158
@@ -196676,7 +197027,7 @@ CVE-2026-1117 (A vulnerability in the `lollms_generation_events.py` component of
NOT-FOR-US: parisneo/lollms
CVE-2026-0921
REJECTED
-CVE-2026-0631 (An OS Command Injection vulnerability in OpenVPN modules in TP-Link Ar ...)
+CVE-2026-0631 (An OS Command Injection vulnerability exists in the Surfshark VPN logi ...)
NOT-FOR-US: TP-Link
CVE-2026-0630 (An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web ...)
NOT-FOR-US: TP-Link
@@ -197381,7 +197732,7 @@ CVE-2025-15288 (Tanium addressed an improper access controls vulnerability in In
CVE-2025-12899 (A flaw in Zephyr\u2019s network stack allows an IPv4 packet containing ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-25210 (In libexpat before 2.7.4, the doContent function does not properly det ...)
- {DSA-6404-1}
+ {DSA-6404-1 DLA-4807-1}
- expat 2.7.4-1 (bug #1126697)
[bullseye] - expat <postponed> (Minor issue)
NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/7ddea353ad3795f7222441274d4d9a155b523cba (R_2_7_4)
@@ -199778,7 +200129,7 @@ CVE-2025-71146 (In the Linux kernel, the following vulnerability has been resolv
CVE-2025-71145 (In the Linux kernel, the following vulnerability has been resolved: u ...)
- linux <not-affected> (Vulnerable code not present)
CVE-2026-24515 (In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy ...)
- {DSA-6404-1}
+ {DSA-6404-1 DLA-4807-1}
- expat 2.7.3-2 (bug #1126277)
[bullseye] - expat <postponed> (Minor issue, DoS)
NOTE: https://github.com/libexpat/libexpat/pull/1131
@@ -251492,7 +251843,7 @@ CVE-2025-59378 (In guix-daemon in GNU Guix before 1618ca7, a content-addressed-m
NOTE: Fixed by: https://codeberg.org/guix/guix/commit/f607aaaaaafe19257ef09ca519d325df6ae97e05
NOTE: Fixed by: https://codeberg.org/guix/guix/commit/9202921e812708b23788b2209cdb576d456f56db
CVE-2025-59375 (libexpat in Expat before 2.7.2 allows attackers to trigger large dynam ...)
- {DSA-6404-1 DSA-6179-1 DSA-6178-1 DLA-4511-1 DLA-4510-1}
+ {DSA-6404-1 DSA-6179-1 DSA-6178-1 DLA-4807-1 DLA-4511-1 DLA-4510-1}
- firefox 149.0-1
- firefox-esr 140.9.0esr-1
- thunderbird 1:140.9.0esr-1
@@ -420511,6 +420862,7 @@ CVE-2024-2351 (A vulnerability classified as critical was found in CodeAstro Eco
CVE-2024-27698
REJECTED
CVE-2024-28757 (libexpat through 2.6.1 allows an XML Entity Expansion attack when ther ...)
+ {DLA-4807-1}
- expat 2.6.1-2 (bug #1065868; unimportant)
- libxmltok <removed>
[bookworm] - libxmltok <ignored> (Minor issue, no runtime dependencies left)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a84a2ba7a33dd6cb82713db17784b4b6bea4528b
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a84a2ba7a33dd6cb82713db17784b4b6bea4528b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261001/1592dc2f/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list