[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 1 20:14:18 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
c2fa9156 by security tracker role at 2026-10-01T19:14:00+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,89 +1,565 @@
-CVE-2026-42356
+CVE-2026-9864 (Fortra BoKS Server Agent contains a predictable password generation vu ...)
+ TODO: check
+CVE-2026-9032 (Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTT ...)
+ TODO: check
+CVE-2026-97662 (An argument injection issue in the diff scan operation in AWS security ...)
+ TODO: check
+CVE-2026-97661 (The Business Essentials for Contact Form 7 plugin for WordPress is vul ...)
+ TODO: check
+CVE-2026-97297 (Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.)
+ TODO: check
+CVE-2026-97284 (Contributor PHP Object Injection in Icegram <= 3.1.31 versions.)
+ TODO: check
+CVE-2026-97281 (Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versio ...)
+ TODO: check
+CVE-2026-97280 (Missing Authorization vulnerability in Mamunur Rashid Review Schema re ...)
+ TODO: check
+CVE-2026-97277 (Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.)
+ TODO: check
+CVE-2026-97273 (Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for W ...)
+ TODO: check
+CVE-2026-97269 (Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels ...)
+ TODO: check
+CVE-2026-97268 (Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for W ...)
+ TODO: check
+CVE-2026-97260 (Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 ver ...)
+ TODO: check
+CVE-2026-97258 (Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 vers ...)
+ TODO: check
+CVE-2026-97251 (Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket ...)
+ TODO: check
+CVE-2026-96813 (The Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact For ...)
+ TODO: check
+CVE-2026-96659 (A flaw was found in Foreman. This vulnerability allows an authenticate ...)
+ TODO: check
+CVE-2026-96658 (A flaw was found in Foreman. An authenticated attacker with low-level ...)
+ TODO: check
+CVE-2026-96573 (The Appointment Hour Booking \u2013 Booking Calendar plugin for WordPr ...)
+ TODO: check
+CVE-2026-96268 (The Awesome Support \u2013 WordPress HelpDesk & Support Plugin plugin ...)
+ TODO: check
+CVE-2026-96256 (The Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Block ...)
+ TODO: check
+CVE-2026-95687 (The WPC Shop as a Customer for WooCommerce plugin for WordPress is vul ...)
+ TODO: check
+CVE-2026-95588 (Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter ...)
+ TODO: check
+CVE-2026-95137
+ REJECTED
+CVE-2026-94620 (Classroom 50 is a free and open-source tool for managing and grading p ...)
+ TODO: check
+CVE-2026-94390 (Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= ...)
+ TODO: check
+CVE-2026-94276 (Improper Authentication vulnerability in Apache APISIX. On a route us ...)
+ TODO: check
+CVE-2026-94269 (Use of Non-Canonical URL paths for authorization decisions vulnerabili ...)
+ TODO: check
+CVE-2026-94250 (Allocation of resources without limits or throttling vulnerability in ...)
+ TODO: check
+CVE-2026-94220 (Cross-Site request forgery (CSRF) vulnerability in feishu-auth and din ...)
+ TODO: check
+CVE-2026-94212 (Improper verification of cryptographic signature vulnerability in Apac ...)
+ TODO: check
+CVE-2026-93882 (The LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online ...)
+ TODO: check
+CVE-2026-92244 (The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress ...)
+ TODO: check
+CVE-2026-92144 (The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form B ...)
+ TODO: check
+CVE-2026-90992 (The Redux Framework plugin for WordPress is vulnerable to Stored Cross ...)
+ TODO: check
+CVE-2026-8618 (A stack-based buffer overflow vulnerability exists in the TDDPv2 servi ...)
+ TODO: check
+CVE-2026-89427 (The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for WordPress i ...)
+ TODO: check
+CVE-2026-89424 (The Duplicate Post plugin for WordPress is vulnerable to Stored Cross- ...)
+ TODO: check
+CVE-2026-89047 (The Social Media Share Buttons & Social Sharing Icons plugin for WordP ...)
+ TODO: check
+CVE-2026-88789 (Improper Restriction of XML External Entity Reference in the XSLT supp ...)
+ TODO: check
+CVE-2026-85235 (The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form B ...)
+ TODO: check
+CVE-2026-84682 (A command injection vulnerability exists in the TDDPv2 service (/usr/b ...)
+ TODO: check
+CVE-2026-82806 (Exposure of data element to wrong session vulnerability in Apache APIS ...)
+ TODO: check
+CVE-2026-7176 (CVE-2026-7176: the Help text and Title parameters in the endpoint /eve ...)
+ TODO: check
+CVE-2026-7175 (CVE-2026-7175: the Business Name parameter in the /promoters/edit endp ...)
+ TODO: check
+CVE-2026-7174 (CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, ...)
+ TODO: check
+CVE-2026-7173 (CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Cro ...)
+ TODO: check
+CVE-2026-79901 (In deployments using BoKS keytab management, affected versions of boks ...)
+ TODO: check
+CVE-2026-79900 (boks_ksllogsd accepts a checksum algorithm name in the MD field of an ...)
+ TODO: check
+CVE-2026-79899 (Fortra BoKS Manager contains an insecure temporary file vulnerability ...)
+ TODO: check
+CVE-2026-79898 (Fortra BoKS Manager contains a command injection vulnerability in crls ...)
+ TODO: check
+CVE-2026-79896 (Fortra BoKS Manager contains an out-of-bounds read vulnerability in th ...)
+ TODO: check
+CVE-2026-78578 (Tapo C120 v1 and C200 v5 do not enforce authentication for do method H ...)
+ TODO: check
+CVE-2026-78577 (Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboardi ...)
+ TODO: check
+CVE-2026-78249 (A path traversal vulnerability exists in the web management interface ...)
+ TODO: check
+CVE-2026-78242 (Insertion of sensitive information into log file vulnerability in Apac ...)
+ TODO: check
+CVE-2026-77387 (geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point a ...)
+ TODO: check
+CVE-2026-75957 (The Ultimate Multisite \u2013 WordPress Multisite SaaS & WaaS Platform ...)
+ TODO: check
+CVE-2026-75786 (Unsanitized concatenation of the module parameter in the Grafana datas ...)
+ TODO: check
+CVE-2026-73976 (djehuty is a research data repository system developed by 4TU.Research ...)
+ TODO: check
+CVE-2026-73975 (djehuty is a research data repository system developed by 4TU.Research ...)
+ TODO: check
+CVE-2026-68496 (The Smile parser in FasterXML jackson-dataformats-binary never invokes ...)
+ TODO: check
+CVE-2026-68495 (The CBOR parser in FasterXML jackson-dataformats-binary never invokes ...)
+ TODO: check
+CVE-2026-67172 (HCL BigFix Service Management is affected by an Information Disclosure ...)
+ TODO: check
+CVE-2026-67171 (HCL BigFix Service Management is affected by an Information Disclosure ...)
+ TODO: check
+CVE-2026-67106 (HCL BigFix Service Management is affected by an Information Disclosure ...)
+ TODO: check
+CVE-2026-67105 (HCL BigFix Service Management is affected by an Insecure Communication ...)
+ TODO: check
+CVE-2026-67104 (HCL BigFix Service Management is affected by an Information Disclosure ...)
+ TODO: check
+CVE-2026-66253 (iControl is affected by a Session Timeout vulnerability, which could a ...)
+ TODO: check
+CVE-2026-66249 (iControl is affected by a Missing Secure Attribute vulnerability, whic ...)
+ TODO: check
+CVE-2026-66248 (iControl is affected by an Improper Error Handling vulnerability, whic ...)
+ TODO: check
+CVE-2026-66247 (iControl is affected by an insecure Cross-Origin Resource Sharing (COR ...)
+ TODO: check
+CVE-2026-66246 (iControl is affected by a Broken Access Control vulnerability, which c ...)
+ TODO: check
+CVE-2026-64950 (Missing input validation and output encoding on the directory name par ...)
+ TODO: check
+CVE-2026-64949 (Incomplete extension blacklist in the File Manager module allows authe ...)
+ TODO: check
+CVE-2026-64948 (Missing authorization in module data retrieval allows unauthorized cro ...)
+ TODO: check
+CVE-2026-64947 (A chained CSRF bypass and unrestricted file upload vulnerability in th ...)
+ TODO: check
+CVE-2026-64946 (A chained CSRF and unrestricted SVG file upload vulnerability in the F ...)
+ TODO: check
+CVE-2026-63724
+ REJECTED
+CVE-2026-63721
+ REJECTED
+CVE-2026-62073 (Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 ...)
+ TODO: check
+CVE-2026-62071 (Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versi ...)
+ TODO: check
+CVE-2026-62063 (Missing Authorization vulnerability in Magepeople inc. WpTravelly tour ...)
+ TODO: check
+CVE-2026-62061 (Authorization Bypass Through User-Controlled Key vulnerability in Meta ...)
+ TODO: check
+CVE-2026-62060 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-62059 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-62058 (Insertion of Sensitive Information Into Sent Data vulnerability in WPE ...)
+ TODO: check
+CVE-2026-56599 (HCL BigFix Service Management is affected by an Insecure Cookie Attrib ...)
+ TODO: check
+CVE-2026-56589 (HCL BigFix Service Management is affected by a Stored Cross-Site Scrip ...)
+ TODO: check
+CVE-2026-56098 (A flaw was found in rubygem-katello. The RegistryProxiesController in ...)
+ TODO: check
+CVE-2026-56097 (A flaw was found in rubygem-katello. An SQL injection vulnerability ex ...)
+ TODO: check
+CVE-2026-55232 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
+ TODO: check
+CVE-2026-55231 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
+ TODO: check
+CVE-2026-55230 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
+ TODO: check
+CVE-2026-55083 (DHIS2 is a flexible information system for data capture, management, v ...)
+ TODO: check
+CVE-2026-34190 (Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized de ...)
+ TODO: check
+CVE-2026-34189 (Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized de ...)
+ TODO: check
+CVE-2026-27872 (- Improper Privilege Management vulnerability in Johnson Controls Easy ...)
+ TODO: check
+CVE-2026-21833 (HCL AION is affected by a vulnerability in which the Content-Security- ...)
+ TODO: check
+CVE-2026-19902 (The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for WordPress i ...)
+ TODO: check
+CVE-2026-19807 (The ByteCoreStack \u2013 MCP Connector for AI Tools plugin for WordPre ...)
+ TODO: check
+CVE-2026-18734
+ REJECTED
+CVE-2026-17053 (The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host ...)
+ TODO: check
+CVE-2026-15989 (The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress i ...)
+ TODO: check
+CVE-2026-15983 (The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress i ...)
+ TODO: check
+CVE-2026-15911 (Confluent Kafka Python client's HashiCorp Vault KMS integration could ...)
+ TODO: check
+CVE-2026-14995 (The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Sit ...)
+ TODO: check
+CVE-2026-14316 (The revoked-key error path builds a human-readable failure reason usin ...)
+ TODO: check
+CVE-2026-13043 (A missing authentication vulnerability in the Kernel Memory Access Dri ...)
+ TODO: check
+CVE-2026-12627 (Fortra's Core Privileged Access Manager (BoKS) contains a stack-based ...)
+ TODO: check
+CVE-2026-12545 (A flaw was found in rubygem-hammer_cli. A command injection vulnerabil ...)
+ TODO: check
+CVE-2026-12544 (A flaw was found in Foreman. The foreman-rake initialization logic in ...)
+ TODO: check
+CVE-2026-12542 (A flaw was found in Foreman. The foreman-tail utility is vulnerable to ...)
+ TODO: check
+CVE-2026-12541 (A flaw was found in Foreman. OS command injection vulnerabilities exis ...)
+ TODO: check
+CVE-2026-12540 (A flaw was found in Foreman. A command injection vulnerability exists ...)
+ TODO: check
+CVE-2026-12423 (A flaw was found in Foreman. The Red Hat Satellite /unattended/provisi ...)
+ TODO: check
+CVE-2026-12405 (A flaw was found in rubygem-foreman_remote_execution. A command inject ...)
+ TODO: check
+CVE-2026-104059 (Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulne ...)
+ TODO: check
+CVE-2026-104058 (Podgrab contains a missing authentication vulnerability in which the / ...)
+ TODO: check
+CVE-2026-104057 (Podgrab contains an unauthenticated denial-of-service vulnerability ca ...)
+ TODO: check
+CVE-2026-104056 (Authlib version 1.7.2 and below contains a vulnerability where discove ...)
+ TODO: check
+CVE-2026-104018 (An improper privilege management vulnerability (CWE-269) exists in the ...)
+ TODO: check
+CVE-2026-103923 (KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering ...)
+ TODO: check
+CVE-2026-103922 (Capacitor is a cross-platform native runtime for web applications. Fro ...)
+ TODO: check
+CVE-2026-103921 (GraphQL Tools provides utilities for building, stitching, and mocking ...)
+ TODO: check
+CVE-2026-103884 (A flaw was found in the X.509 client certificate authenticator of Keyc ...)
+ TODO: check
+CVE-2026-103858 (MISP contains an incomplete authorization check in the discussion post ...)
+ TODO: check
+CVE-2026-103758 (Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerabil ...)
+ TODO: check
+CVE-2026-103757 (Budibase through 3.41.0 contains a server-side request forgery vulnera ...)
+ TODO: check
+CVE-2026-103754 (A flaw was found in ansible-runner. The unstream_dir() function, which ...)
+ TODO: check
+CVE-2026-103752 (Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.)
+ TODO: check
+CVE-2026-103690 (A flaw has been found in itsourcecode Leave Management System 1.0. Thi ...)
+ TODO: check
+CVE-2026-103687 (A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. ...)
+ TODO: check
+CVE-2026-103686 (A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted ...)
+ TODO: check
+CVE-2026-103680 (A flaw was found in tnef. A heap-based buffer overflow can occur in th ...)
+ TODO: check
+CVE-2026-103679 (A flaw was found in tnef. A remote attacker could exploit this vulnera ...)
+ TODO: check
+CVE-2026-103678 (A flaw was found in tnef. An attacker can exploit this vulnerability b ...)
+ TODO: check
+CVE-2026-103664 (MISP contains a reflected cross-site scripting (XSS) vulnerability in ...)
+ TODO: check
+CVE-2026-103662 (MISP contains a reflected cross-site scripting (XSS) vulnerability in ...)
+ TODO: check
+CVE-2026-103659 (MISP contains an authorization bypass in the event flattening feature. ...)
+ TODO: check
+CVE-2026-103656
+ REJECTED
+CVE-2026-103655 (MISP contains a vulnerability in its two-factor authentication (TOTP) ...)
+ TODO: check
+CVE-2026-103651 (MISP contains a vulnerability in its one-time password (OTP) authentic ...)
+ TODO: check
+CVE-2026-103505 (Improper neutralization of argument delimiters in the volume handling ...)
+ TODO: check
+CVE-2026-103497 (In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the Gi ...)
+ TODO: check
+CVE-2026-103496 (In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowe ...)
+ TODO: check
+CVE-2026-103495 (In JetBrains YouTrack before 2026.2.19422 missing authorisation allowe ...)
+ TODO: check
+CVE-2026-103494 (In JetBrains YouTrack before 2026.2.19422 privilege escalation was pos ...)
+ TODO: check
+CVE-2026-103493 (In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and L ...)
+ TODO: check
+CVE-2026-103492 (In JetBrains YouTrack before 2026.2.19422 doS attack was possible via ...)
+ TODO: check
+CVE-2026-103491 (In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities ...)
+ TODO: check
+CVE-2026-103490 (In JetBrains YouTrack before 2026.2.19422 privilege escalation was pos ...)
+ TODO: check
+CVE-2026-103489 (In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS comman ...)
+ TODO: check
+CVE-2026-103488 (In JetBrains YouTrack before 2026.2.19422 missing authorisation allowe ...)
+ TODO: check
+CVE-2026-103431 (colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 termin ...)
+ TODO: check
+CVE-2026-103353 (Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentFor ...)
+ TODO: check
+CVE-2026-103347 (Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versi ...)
+ TODO: check
+CVE-2026-103345 (Insertion of Sensitive Information Into Sent Data vulnerability in Sha ...)
+ TODO: check
+CVE-2026-103343 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-103341 (Missing Authorization vulnerability in Unlimited Elements Unlimited El ...)
+ TODO: check
+CVE-2026-103340 (Missing Authorization vulnerability in Gemini Labs Site Reviews site-r ...)
+ TODO: check
+CVE-2026-103339 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-103338 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-103336 (Insertion of Sensitive Information Into Sent Data vulnerability in Sma ...)
+ TODO: check
+CVE-2026-103292 (Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to san ...)
+ TODO: check
+CVE-2026-103291 (Ghost versions from 3.20.2 before 6.51.0 contain a server-side request ...)
+ TODO: check
+CVE-2026-103290 (Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path ...)
+ TODO: check
+CVE-2026-103289 (Ghost from 5.9.0 before 6.44.1 contains an input validation issue in t ...)
+ TODO: check
+CVE-2026-103288 (Ghost, an open-source publishing platform, contains an input validatio ...)
+ TODO: check
+CVE-2026-103287 (Ghost versions 1.18.0 before 6.27.0 contain a server-side request forg ...)
+ TODO: check
+CVE-2026-103286 (Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalatio ...)
+ TODO: check
+CVE-2026-103285 (Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request ...)
+ TODO: check
+CVE-2026-103284 (Ghost versions from 5.125.1 before 6.57.1 contain an information discl ...)
+ TODO: check
+CVE-2026-103283 (Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnera ...)
+ TODO: check
+CVE-2026-103282 (Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the ...)
+ TODO: check
+CVE-2026-103281 (Ghost (npm package 'ghost') versions from 3.23.0 up to, but not includ ...)
+ TODO: check
+CVE-2026-103280 (Ghost from version 0.8.0 before 6.23.0 contains an information disclos ...)
+ TODO: check
+CVE-2026-103279 (Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all ...)
+ TODO: check
+CVE-2026-103278 (Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnera ...)
+ TODO: check
+CVE-2026-103277 (Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script ex ...)
+ TODO: check
+CVE-2026-103276 (Ghost versions before 6.20.0 contain a file extension filtering bypass ...)
+ TODO: check
+CVE-2026-103275 (Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerab ...)
+ TODO: check
+CVE-2026-103274 (Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access con ...)
+ TODO: check
+CVE-2026-103273 (Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vu ...)
+ TODO: check
+CVE-2026-103272 (Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration v ...)
+ TODO: check
+CVE-2026-103271 (Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerab ...)
+ TODO: check
+CVE-2026-103269 (Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vul ...)
+ TODO: check
+CVE-2026-103268 (Ghost versions before 6.62.0 contain an authentication bypass vulnerab ...)
+ TODO: check
+CVE-2026-103267 (Ghost versions before 6.62.0 contain an authentication bypass vulnerab ...)
+ TODO: check
+CVE-2026-103266 (Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote a ...)
+ TODO: check
+CVE-2026-103265 (Fleet versions before 4.89.0 fail to properly filter MDM command resul ...)
+ TODO: check
+CVE-2026-103264 (Fleet versions before 4.87.0 contain an authentication bypass vulnerab ...)
+ TODO: check
+CVE-2026-103263 (Tornado before 6.5.9 contains a path traversal vulnerability in Static ...)
+ TODO: check
+CVE-2026-103262 (Tornado versions before 6.5.9 contain an unbounded memory accumulation ...)
+ TODO: check
+CVE-2026-103261 (Tornado before 6.5.9 fails to limit the number of query string fields ...)
+ TODO: check
+CVE-2026-103260 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approva ...)
+ TODO: check
+CVE-2026-103259 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session ...)
+ TODO: check
+CVE-2026-103258 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescap ...)
+ TODO: check
+CVE-2026-103257 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
+ TODO: check
+CVE-2026-103256 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credenti ...)
+ TODO: check
+CVE-2026-103255 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
+ TODO: check
+CVE-2026-103254 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
+ TODO: check
+CVE-2026-103253 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
+ TODO: check
+CVE-2026-103252 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
+ TODO: check
+CVE-2026-103251 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
+ TODO: check
+CVE-2026-103250 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
+ TODO: check
+CVE-2026-103249 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
+ TODO: check
+CVE-2026-103248 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
+ TODO: check
+CVE-2026-103247 (n8n versions before 1.123.80 contain a credential tampering vulnerabil ...)
+ TODO: check
+CVE-2026-103246 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate c ...)
+ TODO: check
+CVE-2026-103245 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
+ TODO: check
+CVE-2026-103244 (ground-station versions before 0.8.0 contain an authentication bypass ...)
+ TODO: check
+CVE-2026-103082 (Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studi ...)
+ TODO: check
+CVE-2026-103068 (Subscriber Privilege Escalation in ByteCoreStack – MCP Connector ...)
+ TODO: check
+CVE-2026-103067 (Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful ...)
+ TODO: check
+CVE-2026-103064 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-103063 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-103004 (Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using ...)
+ TODO: check
+CVE-2026-102394 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-102390 (Missing Authorization vulnerability in VillaTheme AFFI \u2013 Affiliat ...)
+ TODO: check
+CVE-2026-102382 (Authorization Bypass Through User-Controlled Key vulnerability in Ahma ...)
+ TODO: check
+CVE-2026-102381 (Missing Authorization vulnerability in Ahmad Majestic Support majestic ...)
+ TODO: check
+CVE-2026-102379 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-102378 (Unauthenticated Cross Site Scripting (XSS) in Parallax Section block < ...)
+ TODO: check
+CVE-2026-102369 (Tapo C120 v1 and C200 V5 do not adequately protect login challenge dat ...)
+ TODO: check
+CVE-2026-102294 (TP-Link TL-WR841N contains an authenticated OS command injection vulne ...)
+ TODO: check
+CVE-2026-101925 (The bbp style pack plugin for WordPress is vulnerable to Stored Cross- ...)
+ TODO: check
+CVE-2026-101890 (The Prime Mover plugin for WordPress before 2.2.1 contains a stored cr ...)
+ TODO: check
+CVE-2026-101889 (The Prime Mover plugin for WordPress before 2.2.1 contains a path trav ...)
+ TODO: check
+CVE-2026-101888 (The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip ...)
+ TODO: check
+CVE-2026-101322 (In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before ...)
+ TODO: check
+CVE-2026-100517 (Unauthenticated Insecure Direct Object References (IDOR) in Photo Revi ...)
+ TODO: check
+CVE-2026-100514 (Unauthenticated Insecure Direct Object References (IDOR) in REST API L ...)
+ TODO: check
+CVE-2026-100184 (The Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 ...)
+ TODO: check
+CVE-2026-100179 (The Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 ...)
+ TODO: check
+CVE-2025-31980 (HCL BigFix Service Management is affected by an Improper Input Validat ...)
+ TODO: check
+CVE-2024-58388 (Sharp (and Toshiba Tec rebranded) multifunction printers contain an un ...)
+ TODO: check
+CVE-2023-54404 (Zod schema-validation library through 4.6.5 contains an uncontrolled r ...)
+ TODO: check
+CVE-2026-42356 (Deployment of wrong handler vulnerability in Apache HTTP Server allows ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-42356
NOTE: Fixed by: https://github.com/apache/httpd/commit/863594b37381151c397b9fbc609170d026411614
-CVE-2026-42528
+CVE-2026-42528 (A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-42528
NOTE: Fixed by: https://github.com/apache/httpd/commit/a653b98099ced413982ddad6f9416e54292f4656
-CVE-2026-46729
+CVE-2026-46729 (NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_hear ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-46729
NOTE: Fixed by: https://github.com/apache/httpd/commit/7b12a7936ec439b3e1f5fc36cfacf5b915eb652c
-CVE-2026-47360
+CVE-2026-47360 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-47360
NOTE: Fixed by: https://github.com/apache/httpd/commit/cb5163f30dd0d6bc921eeac96415a381f153ac3a
-CVE-2026-48005
+CVE-2026-48005 (Missing authentication checks in mod_auth_digest in Apache Software Fo ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-48005
NOTE: Fixed by: https://github.com/apache/httpd/commit/fc722c619fdf7f8eb69eb8bd4201265065cd3ac2
-CVE-2026-56153
+CVE-2026-56153 (Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_ ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-56153
NOTE: Fixed by: https://github.com/apache/httpd/commit/6654234dcb395e07fd62255670356f84ec733195
-CVE-2026-56154
+CVE-2026-56154 (Use After Free vulnerability in Apache HTTP Server's mod_rewrite when ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-56154
NOTE: Fixed by: https://github.com/apache/httpd/commit/6e4d1e614597109909dda495d235b6a1331d7beb
-CVE-2026-56449
+CVE-2026-56449 (Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_ht ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-56449
NOTE: Fixed by: https://github.com/apache/httpd/commit/c721d4e1cf5c142149509490015cef1a75715595
-CVE-2026-57941
+CVE-2026-57941 (Use After Free vulnerability in Apache HTTP Server's mod_http2via shar ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-57941
NOTE: Fixed by: https://github.com/apache/httpd/commit/d072ed8f06d66a30072227d61a2fc04ad9ae5c99
-CVE-2026-58415
+CVE-2026-58415 (Internal state files accessible to external parties in mod_dav_fs in A ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-58415
NOTE: Fixed by: https://github.com/apache/httpd/commit/5a00f76e12c5e1e477e902b44b42b94d9bc571ed
-CVE-2026-59685
+CVE-2026-59685 (Out-of-bounds Write vulnerability in Apache HTTP Server on Windows whi ...)
- apache2 <not-affected> (Oonly affects Apache on Windows)
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-59685
NOTE: Fixed by: https://github.com/apache/httpd/commit/7d158df34d07b53c010ff54bfa182a76f9fab672
-CVE-2026-59797
+CVE-2026-59797 (Improper Privilege Management vulnerability in Apache HTTP Server's mo ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-59797
NOTE: Fixed by: https://github.com/apache/httpd/commit/1ee1c1fef2511454461b6770b204c4934a6495d8
-CVE-2026-63045
+CVE-2026-63045 (Improper validation of FTP PASV reply address in mod_proxy_ftp in Apac ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-63045
NOTE: Fixed by: https://github.com/apache/httpd/commit/c0a3e5cbcb245022d08e490f98153f90120363ed
-CVE-2026-63292
+CVE-2026-63292 (Stack-based buffer overflow in mod_vhost_alias in Apache Software Foun ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-63292
NOTE: Fixed by: https://github.com/apache/httpd/commit/7ed3f91688b7a1e1ac48486fd2e5eeb2932e879f
-CVE-2026-63686
+CVE-2026-63686 (A NULL pointer dereference in mod_xml2enc in Apache Software Foundatio ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-63686
NOTE: Fixed by: https://github.com/apache/httpd/commit/6fa059e4a270e0a66dd398e96875df86abff3a75
-CVE-2026-63718
+CVE-2026-63718 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response S ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-63718
NOTE: Fixed by: https://github.com/apache/httpd/commit/7c32a06bc504875544185c27cfbc6d8dc257c941
-CVE-2026-73636
+CVE-2026-73636 (Authentication bypass by capture-replay in mod_auth_digest in Apache S ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-73636
NOTE: Fixed by: https://github.com/apache/httpd/commit/fc722c619fdf7f8eb69eb8bd4201265065cd3ac2
-CVE-2026-73637
+CVE-2026-73637 (Use after free in mod_auth_digest in Apache Software Foundation Apache ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-73637
NOTE: Fixed by: https://github.com/apache/httpd/commit/fc722c619fdf7f8eb69eb8bd4201265065cd3ac2
-CVE-2026-79768
+CVE-2026-79768 (Path equivalence: '/./' (single dot directory) vulnerability in Apache ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-79768
NOTE: Fixed by: https://github.com/apache/httpd/commit/dce2ddbca79be74e7bcb7b8cc7a3a291cf4e9588
-CVE-2026-93546
+CVE-2026-93546 (Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 al ...)
- apache2 <unfixed>
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-93546
NOTE: Fixed by: https://github.com/apache/httpd/commit/fa8c354189597453b2c8b38e081efa9b723abd3c
-CVE-2026-102505
+CVE-2026-102505 (Imager versions before 1.037 for Perl overflow a heap buffer fetching ...)
- libimager-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/43998313/
NOTE: https://github.com/tonycoz/imager/security/advisories/GHSA-4rx6-cgv3-fmxp
NOTE: Fixed by: https://github.com/tonycoz/imager/commit/aae49c6be065aa467e834105c816359394a634db (v1.037)
-CVE-2026-102504
+CVE-2026-102504 (Imager versions before 1.037 for Perl exit the process reading a raw i ...)
- libimager-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/43998314/
NOTE: https://github.com/tonycoz/imager/security/advisories/GHSA-g549-r73g-x7x6
@@ -2555,6 +3031,7 @@ CVE-2026-10739 (Cato Networks SDP Client for Windows before 6.12.6 allows a loca
CVE-2026-10726 (Cato Windows SDP Client before version 6.12.6 contains an arbitrary fi ...)
NOT-FOR-US: Cato
CVE-2026-103500 (An attacker could cause a heap buffer overflow by getting a user to op ...)
+ {DSA-6536-1}
- thunderbird 1:153.4.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-103500
CVE-2026-103476 (yii2-starter-kit through 4.2.0 fails to validate article publication s ...)
@@ -3280,68 +3757,100 @@ CVE-2026-XXXX [GHSA-5rfj-p5qw-w48g: Unauthenticated remote DoS via attacker-cont
NOTE: https://github.com/sshuttle/sshuttle/security/advisories/GHSA-5rfj-p5qw-w48g
NOTE: Fixed by: https://github.com/sshuttle/sshuttle/commit/baea31a6769baeb52e8837ad6cc582017d74676c (v2.0.0)
CVE-2026-102331 (Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0 ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102317 (Improper privilege management in Mojo in Google Chrome on on Windows p ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102312 (UI misrepresentation in Omnibox in Google Chrome on on Android prior t ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102313 (Uninitialized resource in ANGLE in Google Chrome on on Windows prior t ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102299 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102306 (Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 al ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102307 (Uninitialized resource in Dawn in Google Chrome on on Android prior to ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102323 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102303 (Uninitialized resource in GPU in Google Chrome on on Android prior to ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102311 (Uninitialized resource in GPU in Google Chrome on on Android prior to ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102300 (Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037. ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102326 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102316 (Use after free in Views in Google Chrome prior to 154.0.8037.92 allowe ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102304 (Use after free in Passwords in Google Chrome prior to 154.0.8037.92 al ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102328 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102309 (Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 a ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102325 (Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102308 (Use after free in Views in Google Chrome prior to 154.0.8037.92 allowe ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102301 (Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 all ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102319 (Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102324 (Use after free in PictureInPicture in Google Chrome prior to 154.0.803 ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102318 (Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 al ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102329 (Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102315 (Uninitialized resource in Media in Google Chrome on on Windows prior t ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102302 (Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102321 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102320 (Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102310 (Missing authorization in Payments in Google Chrome prior to 154.0.8037 ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102327 (Incorrect authorization in WebView in Google Chrome on on Android prio ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102330 (Incorrect authorization in SiteIsolation in Google Chrome prior to 154 ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102314 (UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037. ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-102305 (UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154 ...)
+ {DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-94053 (Authentication bypass via LDAP injection in component sshd-ldap in Apa ...)
- libmina-sshd-java <unfixed>
@@ -3867,7 +4376,7 @@ CVE-2022-51019 (Akaunting before 2.1.31 contains an OS command injection vulnera
CVE-2015-20122 (Seeyon A6 collaborative office automation platform contains an unauthe ...)
NOT-FOR-US: Seeyon
CVE-2026-100756 (Incorrect boundary conditions in the Audio/Video: Playback component. ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3875,7 +4384,7 @@ CVE-2026-100756 (Incorrect boundary conditions in the Audio/Video: Playback comp
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100756
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100756
CVE-2026-100757 (Use-after-free in the Widget component. This vulnerability was fixed i ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3883,7 +4392,7 @@ CVE-2026-100757 (Use-after-free in the Widget component. This vulnerability was
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100757
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100757
CVE-2026-100758 (Sandbox escape in the DOM: Navigation component. This vulnerability wa ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3891,7 +4400,7 @@ CVE-2026-100758 (Sandbox escape in the DOM: Navigation component. This vulnerabi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100758
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100758
CVE-2026-100759 (Uninitialized memory in the Storage: Quota Manager component. This vul ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3910,7 +4419,7 @@ CVE-2026-100761 (Privilege escalation due to use-after-free in the Graphics: Web
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100761
CVE-2026-100762 (Sandbox escape due to use-after-free in the DOM: Content Processes com ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3932,7 +4441,7 @@ CVE-2026-100765 (Use-after-free in the JavaScript: WebAssembly component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100765
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100765
CVE-2026-100766 (Information disclosure in the Networking: JAR component. This vulnerab ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3940,7 +4449,7 @@ CVE-2026-100766 (Information disclosure in the Networking: JAR component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100766
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100766
CVE-2026-100767 (Use-after-free in the Networking: Cache component. This vulnerability ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3951,7 +4460,7 @@ CVE-2026-100768 (Use-after-free in the Graphics: WebGPU component. This vulnerab
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100768
CVE-2026-100769 (Use-after-free in the JavaScript: WebAssembly component. This vulnerab ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3959,7 +4468,7 @@ CVE-2026-100769 (Use-after-free in the JavaScript: WebAssembly component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100769
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100769
CVE-2026-100770 (Sandbox escape due to use-after-free in the DOM: Content Processes com ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3967,7 +4476,7 @@ CVE-2026-100770 (Sandbox escape due to use-after-free in the DOM: Content Proces
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100770
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100770
CVE-2026-100771 (Undefined behavior in the DOM: Streams component. This vulnerability w ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3975,7 +4484,7 @@ CVE-2026-100771 (Undefined behavior in the DOM: Streams component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100771
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100771
CVE-2026-100772 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3983,7 +4492,7 @@ CVE-2026-100772 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100772
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100772
CVE-2026-100773 (Use-after-free in the Storage: IndexedDB component. This vulnerability ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3991,7 +4500,7 @@ CVE-2026-100773 (Use-after-free in the Storage: IndexedDB component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100773
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100773
CVE-2026-100774 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -3999,7 +4508,7 @@ CVE-2026-100774 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100774
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100774
CVE-2026-100775 (Sandbox escape in the Graphics component. This vulnerability was fixed ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4007,7 +4516,7 @@ CVE-2026-100775 (Sandbox escape in the Graphics component. This vulnerability wa
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100775
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100775
CVE-2026-100776 (Use-after-free in the JavaScript: WebAssembly component. This vulnerab ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4015,7 +4524,7 @@ CVE-2026-100776 (Use-after-free in the JavaScript: WebAssembly component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100776
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100776
CVE-2026-100777 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4023,7 +4532,7 @@ CVE-2026-100777 (Use-after-free in the Graphics: Canvas2D component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100777
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100777
CVE-2026-100778 (Sandbox escape due to use-after-free in the DOM: Core & HTML component ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4031,7 +4540,7 @@ CVE-2026-100778 (Sandbox escape due to use-after-free in the DOM: Core & HTML co
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100778
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100778
CVE-2026-100779 (Use-after-free in the XSLT component. This vulnerability was fixed in ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4039,7 +4548,7 @@ CVE-2026-100779 (Use-after-free in the XSLT component. This vulnerability was fi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100779
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100779
CVE-2026-100780 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4047,7 +4556,7 @@ CVE-2026-100780 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100780
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100780
CVE-2026-100781 (Sandbox escape due to incorrect boundary conditions in the Graphics: W ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4055,7 +4564,7 @@ CVE-2026-100781 (Sandbox escape due to incorrect boundary conditions in the Grap
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100781
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100781
CVE-2026-100782 (Privilege escalation due to incorrect boundary conditions in the Graph ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4063,7 +4572,7 @@ CVE-2026-100782 (Privilege escalation due to incorrect boundary conditions in th
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100782
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100782
CVE-2026-100783 (Uninitialized memory in the Audio/Video component. This vulnerability ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4071,7 +4580,7 @@ CVE-2026-100783 (Uninitialized memory in the Audio/Video component. This vulnera
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100783
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100783
CVE-2026-100784 (Use-after-free in the Layout: Text and Fonts component. This vulnerabi ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4079,7 +4588,7 @@ CVE-2026-100784 (Use-after-free in the Layout: Text and Fonts component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100784
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100784
CVE-2026-100785 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4087,7 +4596,7 @@ CVE-2026-100785 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100785
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100785
CVE-2026-100786 (Sandbox escape due to use-after-free in the Graphics component. This v ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4103,7 +4612,7 @@ CVE-2026-100787 (Sandbox escape in the XUL component. This vulnerability was fix
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100787
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100787
CVE-2026-100788 (Invalid pointer in the JavaScript: WebAssembly component. This vulnera ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4111,7 +4620,7 @@ CVE-2026-100788 (Invalid pointer in the JavaScript: WebAssembly component. This
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100788
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100788
CVE-2026-100789 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4119,7 +4628,7 @@ CVE-2026-100789 (Use-after-free in the Graphics: Canvas2D component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100789
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100789
CVE-2026-100790 (Use-after-free in the XSLT component. This vulnerability was fixed in ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4127,7 +4636,7 @@ CVE-2026-100790 (Use-after-free in the XSLT component. This vulnerability was fi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100790
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100790
CVE-2026-100791 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4135,7 +4644,7 @@ CVE-2026-100791 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100791
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100791
CVE-2026-100792 (JIT miscompilation in the JavaScript: WebAssembly component. This vuln ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4146,7 +4655,7 @@ CVE-2026-100793 (JIT miscompilation in the JavaScript Engine component. This vul
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100793
CVE-2026-100794 (Sandbox escape due to incorrect boundary conditions in the Internation ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4154,7 +4663,7 @@ CVE-2026-100794 (Sandbox escape due to incorrect boundary conditions in the Inte
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100794
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100794
CVE-2026-96869 (Information disclosure in the Networking component. This vulnerability ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4168,7 +4677,7 @@ CVE-2026-100796 (Use-after-free in the JavaScript: WebAssembly component. This v
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100796
CVE-2026-100797 (Privilege escalation due to use-after-free in the Graphics: WebRender ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4195,7 +4704,7 @@ CVE-2026-100800 (Sandbox escape due to use-after-free in the Disability Access A
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100800
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100800
CVE-2026-100801 (Privilege escalation in the DLL Services component. This vulnerability ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4206,7 +4715,7 @@ CVE-2026-100802 (Uninitialized memory in the Graphics: WebGPU component. This vu
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100802
CVE-2026-100803 (Same-origin policy bypass in the WebExtensions component. This vulnera ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4228,7 +4737,7 @@ CVE-2026-100806 (Uninitialized memory in the Graphics: WebGPU component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100806
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100806
CVE-2026-100807 (Privilege escalation in the DOM: Service Workers component. This vulne ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4255,7 +4764,7 @@ CVE-2026-100810 (Other issue in the DevTools component. This vulnerability was f
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100810
CVE-2026-100811 (Sandbox escape due to use-after-free in the DOM: Core & HTML component ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4301,7 +4810,7 @@ CVE-2026-100817 (Other issue in the JavaScript: WebAssembly component. This vuln
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100817
CVE-2026-100818 (Sandbox escape due to use-after-free in the Widget: Gtk component. Thi ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4309,7 +4818,7 @@ CVE-2026-100818 (Sandbox escape due to use-after-free in the Widget: Gtk compone
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100818
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100818
CVE-2026-100819 (Sandbox escape due to incorrect boundary conditions in the XPCOM compo ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4317,7 +4826,7 @@ CVE-2026-100819 (Sandbox escape due to incorrect boundary conditions in the XPCO
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100819
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100819
CVE-2026-100820 (Privilege escalation in the Address Bar component. This vulnerability ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4325,7 +4834,7 @@ CVE-2026-100820 (Privilege escalation in the Address Bar component. This vulnera
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100820
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100820
CVE-2026-100821 (Site isolation issue in the Panning and Zooming component. This vulner ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4400,7 +4909,7 @@ CVE-2026-100831 (Use-after-free in the DOM: UI Events & Focus Handling component
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100831
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100831
CVE-2026-100832 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
- {DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1}
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100832
@@ -4510,6 +5019,7 @@ CVE-2026-17588 [hw/usb/hcd-xhci: Set reentrancy guard in timer functions]
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/ed582623e2372fdf862a804d122766052aba81c7 (v11.1.2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1622c9abec17d5cba63383d4d4cb1419cedf8158 (v10.0.14)
CVE-2026-46675 [Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression]
+ {DSA-6537-1}
- libpng1.6 <unfixed>
NOTE: https://github.com/pnggroup/libpng/security/advisories/GHSA-qvg3-h654-xq3j
NOTE: https://github.com/pnggroup/libpng/issues/855
@@ -5556,7 +6066,7 @@ CVE-2026-100877 (A vulnerability was determined in mathurvishal CloudClassroom-P
NOT-FOR-US: mathurvishal CloudClassroom-PHP-Project
CVE-2026-100876 (A vulnerability was found in mathurvishal CloudClassroom-PHP-Project u ...)
NOT-FOR-US: mathurvishal CloudClassroom-PHP-Project
-CVE-2026-96577
+CVE-2026-96577 (A flaw was found in oc-mirror. During mirroring operations, the embedd ...)
NOT-FOR-US: openshift/oc-mirror
CVE-2026-96543
- gimp 3.2.6-1
@@ -10779,7 +11289,8 @@ CVE-2026-95514 (Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 version
NOT-FOR-US: WordPress plugin or theme
CVE-2026-95513 (Unauthenticated Broken Access Control in Online Booking & Scheduling C ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-94684 (Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 version ...)
+CVE-2026-94684
+ REJECTED
NOT-FOR-US: WordPress plugin or theme
CVE-2026-94682 (Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine ...)
NOT-FOR-US: WordPress plugin or theme
@@ -15409,6 +15920,7 @@ CVE-2026-85495
- ppp <unfixed> (bug #1148821)
NOTE: https://github.com/ppp-project/ppp/security/advisories/GHSA-frhv-j822-2pvx
CVE-2026-75883 (The code in pppd that formats a response to a PEAP Request packet in p ...)
+ {DLA-4808-1}
- ppp <unfixed> (bug #1148816)
NOTE: https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35
CVE-2026-75157 (Apache Airflow's asset queued-events DELETE endpoints checked the call ...)
@@ -25128,6 +25640,7 @@ CVE-2026-92016 (Use-after-free in the Disability Access APIs component. This vul
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-92/#CVE-2026-92016
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-96/#CVE-2026-92016
CVE-2026-92035 (Sandbox escape due to incorrect boundary conditions in the Graphics co ...)
+ {DSA-6536-1}
- firefox 156.0-1
- thunderbird 1:153.3.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-90/#CVE-2026-92035
@@ -25418,6 +25931,7 @@ CVE-2026-86901 (An out-of-bounds write issue was addressed with improved bounds
CVE-2026-86900 (An out-of-bounds read issue was addressed with improved input validati ...)
NOT-FOR-US: Apple
CVE-2026-86898 (A logic issue was addressed with improved state management. This issue ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -25477,6 +25991,7 @@ CVE-2026-85575 (The ShopEngine Elementor WooCommerce Builder Addon \u2013 All in
CVE-2026-84636 (An authorization issue was addressed with improved state management. T ...)
NOT-FOR-US: Apple
CVE-2026-84635 (A logic issue was addressed with improved state management. This issue ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -25854,6 +26369,7 @@ CVE-2026-64761 (A privacy issue was addressed with improved handling of user pre
CVE-2026-64756 (A path handling issue was addressed with improved validation. This iss ...)
NOT-FOR-US: Apple
CVE-2026-64753 (A permissions issue was addressed by removing the vulnerable code. Thi ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -26755,17 +27271,17 @@ CVE-2025-24890 (gitoxide is an implementation of git written in Rust. Prior to 0
CVE-2024-58383 (Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generate ...)
- froxlor <itp> (bug #581792)
CVE-2026-19624 (A flaw was found in NetworkManager-l2tp. The plugin writes attacker-co ...)
- {DSA-6498-1}
+ {DSA-6498-1 DLA-4808-1}
- network-manager-l2tp 1.52.6-1
NOTE: https://github.com/nm-l2tp/NetworkManager-l2tp/security/advisories/GHSA-fcq2-qh3w-4xq5
NOTE: Fixed by: https://github.com/nm-l2tp/NetworkManager-l2tp/commit/3704d8c9d5e5f9ed1626a8ce7627a04247cea673 (1.52.6, 1.20.26)
CVE-2026-75131 (NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privil ...)
- {DSA-6498-1}
+ {DSA-6498-1 DLA-4808-1}
- network-manager-l2tp 1.52.6-1
NOTE: https://github.com/nm-l2tp/NetworkManager-l2tp/security/advisories/GHSA-v2wj-xr2m-xc4j
NOTE: Fixed by: https://github.com/nm-l2tp/NetworkManager-l2tp/commit/64879ce0ad866f7c9a45babe4d95731a916ea00f (1.52.6, 1.20.26)
CVE-2026-93337 (NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an impro ...)
- {DSA-6498-1}
+ {DSA-6498-1 DLA-4808-1}
- network-manager-l2tp 1.52.6-1
NOTE: https://github.com/nm-l2tp/NetworkManager-l2tp/security/advisories/GHSA-rp84-8h2r-5xc3
NOTE: Fixed by: https://github.com/nm-l2tp/NetworkManager-l2tp/commit/64879ce0ad866f7c9a45babe4d95731a916ea00f (1.52.6, 1.20.26)
@@ -40962,7 +41478,7 @@ CVE-2026-84310 (pypdf is a free and open-source pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-23w6-3w8w-8484
NOTE: https://github.com/py-pdf/pypdf/pull/3966
NOTE: https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942 (6.16.1)
-CVE-2026-83589
+CVE-2026-83589 (A flaw was found in oauth-proxy. The application fails to properly val ...)
NOT-FOR-US: openshift/oauth-proxy
CVE-2026-80221
NOT-FOR-US: grafana-global-hub
@@ -47726,7 +48242,7 @@ CVE-2026-79276 (Improper privilege management in FileSystem in Google Chrome pri
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79275 (Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowe ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -47754,7 +48270,7 @@ CVE-2026-79271 (Information leak in DOM in Google Chrome prior to 152.0.7977.65
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79270 (Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.6 ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -47766,7 +48282,7 @@ CVE-2026-79270 (Uninitialized resource in ANGLE in Google Chrome prior to 152.0.
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-79269 (Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.6 ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -47930,7 +48446,7 @@ CVE-2026-79230 (Improper input validation in ANGLE in Google Chrome on on Mac pr
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79229 (Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.6 ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -48098,7 +48614,7 @@ CVE-2026-79190 (Incorrect authorization in Extensions in Google Chrome prior to
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79189 (Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 a ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -48110,7 +48626,7 @@ CVE-2026-79189 (Out of bounds write in ANGLE in Google Chrome prior to 152.0.797
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-79188 (Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 a ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -48202,7 +48718,7 @@ CVE-2026-79150 (Use after free in Views in Google Chrome on on Mac prior to 152.
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79149 (Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowe ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -48218,7 +48734,7 @@ CVE-2026-79148 (Off-by-one error in DevTools in Google Chrome prior to 152.0.797
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79147 (Information leak in Skia in Google Chrome prior to 152.0.7977.65 allow ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-3
@@ -48235,7 +48751,7 @@ CVE-2026-79146 (Information leak in CustomTabs in Google Chrome on on Android pr
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79144 (Information leak in Skia in Google Chrome prior to 152.0.7977.65 allow ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -48292,7 +48808,7 @@ CVE-2026-79132 (Improper input validation in Input in Google Chrome on on Androi
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79131 (Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 a ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -48304,7 +48820,7 @@ CVE-2026-79131 (Out of bounds write in ANGLE in Google Chrome prior to 152.0.797
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-79130 (Buffer overflow in ANGLE in Google Chrome prior to 152.0.7977.65 allow ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -48324,7 +48840,7 @@ CVE-2026-79128 (Use after free in Views in Google Chrome on on Mac prior to 152.
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79127 (Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 a ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -48360,7 +48876,7 @@ CVE-2026-79121 (Improper input validation in Chromecast in Google Chrome prior t
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79120 (Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.6 ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -48376,7 +48892,7 @@ CVE-2026-79119 (Use after free in PDF in Google Chrome prior to 152.0.7977.65 al
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79118 (Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.6 ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -48396,7 +48912,7 @@ CVE-2026-79116 (Missing authorization in Viz in Google Chrome prior to 152.0.797
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79112 (Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 all ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-3
@@ -48637,7 +49153,7 @@ CVE-2026-79044 (Missing authorization in WebAppInstalls in Google Chrome on on A
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79043 (Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 a ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -48721,7 +49237,7 @@ CVE-2026-79021 (Missing authorization in InterestGroups in Google Chrome prior t
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-79020 (Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 all ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -48898,7 +49414,7 @@ CVE-2026-78966 (Externally controlled reference in QUIC in Google Chrome prior t
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-78965 (Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.6 ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -48934,7 +49450,7 @@ CVE-2026-78959 (Improper handling of case sensitivity in FileSystem in Google Ch
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-78958 (Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -49047,7 +49563,7 @@ CVE-2026-78915 (Race condition in Enterprise in Google Chrome on on Windows prio
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-78914 (Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-3
@@ -49088,7 +49604,7 @@ CVE-2026-78907 (Incorrect authorization in WebProtect in Google Chrome prior to
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-78906 (Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowe ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -49100,7 +49616,7 @@ CVE-2026-78906 (Race condition in ANGLE in Google Chrome prior to 152.0.7977.65
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-78905 (Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowe ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -49112,7 +49628,7 @@ CVE-2026-78905 (Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-78904 (Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowe ...)
- {DSA-6482-1 DLA-4771-1}
+ {DSA-6534-1 DSA-6482-1 DLA-4771-1}
- chromium 152.0.7977.64-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -49471,6 +49987,7 @@ CVE-2026-44476 (Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version
NOTE: https://github.com/doorkeeper-gem/doorkeeper-openid_connect/security/advisories/GHSA-m6vc-f87m-cc2h
NOTE: Fixed by: https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/561af83dcf71b95b3772dfbc0a1796c7f50b2175 (v1.10.0)
CVE-2026-43670 (A Content Security Policy bypass was addressed with improved enforceme ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -50904,7 +51421,7 @@ CVE-2026-76847 (act starts an HTTP Artifacts V4 backend whenever a workflow uses
NOT-FOR-US: nektos act
CVE-2026-76845 (adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction d ...)
NOT-FOR-US: adm-zip
-CVE-2026-76844 (webpack-dev-middleware resolves a request to a local file in getFilena ...)
+CVE-2026-76844 (zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an un ...)
NOT-FOR-US: Node webpack-dev-middleware
CVE-2026-76843 (The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/mo ...)
NOT-FOR-US: Flair
@@ -57782,7 +58299,7 @@ CVE-2026-76043 (Incorrect calculation in V8 in Google Chrome prior to 151.0.7922
- chromium 151.0.7922.169-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-76041 (Information leak in Skia in Google Chrome prior to 151.0.7922.169 allo ...)
- {DSA-6455-1 DLA-4749-1}
+ {DSA-6534-1 DSA-6455-1 DLA-4749-1}
- chromium 151.0.7922.169-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -59149,6 +59666,7 @@ CVE-2026-65640 (WordPress is vulnerable to a remote code execution vulnerability
NOTE: https://wordpress.org/news/2026/08/wordpress-7-0-4-release/
NOTE: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w
CVE-2026-65351 (This issue was addressed through improved state management. This issue ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59166,6 +59684,7 @@ CVE-2026-65346 (An integer overflow was addressed with improved input validation
CVE-2026-65343 (A use after free issue was addressed with improved memory management. ...)
NOT-FOR-US: Apple
CVE-2026-65341 (The issue was addressed with improved memory handling. This issue is f ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59175,6 +59694,7 @@ CVE-2026-65341 (The issue was addressed with improved memory handling. This issu
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-65340 (This issue was addressed through improved state management. This issue ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59186,6 +59706,7 @@ CVE-2026-65340 (This issue was addressed through improved state management. This
CVE-2026-65339 (A logic issue was addressed with improved checks. This issue is fixed ...)
NOT-FOR-US: Apple
CVE-2026-65338 (The issue was addressed with improved memory handling. This issue is f ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59195,6 +59716,7 @@ CVE-2026-65338 (The issue was addressed with improved memory handling. This issu
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-65337 (This issue was addressed through improved state management. This issue ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59204,6 +59726,7 @@ CVE-2026-65337 (This issue was addressed through improved state management. This
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-65336 (This issue was addressed through improved state management. This issue ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59215,6 +59738,7 @@ CVE-2026-65336 (This issue was addressed through improved state management. This
CVE-2026-65335 (This issue was addressed through improved state management. This issue ...)
NOT-FOR-US: Apple
CVE-2026-65334 (A memory corruption issue was addressed with improved state management ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59224,6 +59748,7 @@ CVE-2026-65334 (A memory corruption issue was addressed with improved state mana
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-65333 (This issue was addressed through improved state management. This issue ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59233,6 +59758,7 @@ CVE-2026-65333 (This issue was addressed through improved state management. This
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-65332 (This issue was addressed through improved state management. This issue ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59242,6 +59768,7 @@ CVE-2026-65332 (This issue was addressed through improved state management. This
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-65331 (This issue was addressed through improved state management. This issue ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59269,6 +59796,7 @@ CVE-2026-64787 (A use-after-free issue was addressed with improved memory manage
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0005.html
CVE-2026-64784 (An out-of-bounds access issue was addressed with improved bounds check ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59278,6 +59806,7 @@ CVE-2026-64784 (An out-of-bounds access issue was addressed with improved bounds
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-64782 (A memory corruption vulnerability was addressed with improved locking. ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59287,6 +59816,7 @@ CVE-2026-64782 (A memory corruption vulnerability was addressed with improved lo
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-64781 (The issue was addressed with improved input validation. This issue is ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59296,6 +59826,7 @@ CVE-2026-64781 (The issue was addressed with improved input validation. This iss
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-64780 (The issue was addressed with improved checks. This issue is fixed in S ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59305,6 +59836,7 @@ CVE-2026-64780 (The issue was addressed with improved checks. This issue is fixe
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-64779 (A memory corruption vulnerability was addressed with improved locking. ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59314,6 +59846,7 @@ CVE-2026-64779 (A memory corruption vulnerability was addressed with improved lo
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-64778 (The issue was addressed with improved checks. This issue is fixed in S ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -59325,6 +59858,7 @@ CVE-2026-64778 (The issue was addressed with improved checks. This issue is fixe
CVE-2026-64760 (An information leakage was addressed with additional validation. This ...)
NOT-FOR-US: Apple
CVE-2026-64715 (A use-after-free issue was addressed with improved memory management. ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -75104,7 +75638,7 @@ CVE-2026-19159 (Use after free in Views in Google Chrome prior to 151.0.7922.109
- chromium 151.0.7922.108-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-19160 (Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 all ...)
- {DSA-6422-1 DLA-4728-1}
+ {DSA-6534-1 DSA-6422-1 DLA-4728-1}
- chromium 151.0.7922.108-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -75117,7 +75651,7 @@ CVE-2026-19160 (Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.1
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-19161 (Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 all ...)
- {DSA-6422-1 DLA-4728-1}
+ {DSA-6534-1 DSA-6422-1 DLA-4728-1}
- chromium 151.0.7922.108-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -75158,7 +75692,7 @@ CVE-2026-19171 (Use after free in Media in Google Chrome on Windows prior to 151
- chromium 151.0.7922.108-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-19173 (Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 a ...)
- {DSA-6422-1 DLA-4728-1}
+ {DSA-6534-1 DSA-6422-1 DLA-4728-1}
- chromium 151.0.7922.108-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -75179,7 +75713,7 @@ CVE-2026-19175 (Use after free in Payments in Google Chrome prior to 151.0.7922.
- chromium 151.0.7922.108-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-19176 (Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowe ...)
- {DSA-6422-1 DLA-4728-1}
+ {DSA-6534-1 DSA-6422-1 DLA-4728-1}
- chromium 151.0.7922.108-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -80010,7 +80544,7 @@ CVE-2026-58045 (A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodezlib-sync-apis-can-crash-on-spoofed-typedarray-length-cve-2026-58045---medium
NOTE: Fixed by: https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343 (v22.23.2)
CVE-2026-58042 (A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Proces ...)
- {DSA-6517-1}
+ {DSA-6517-1 DLA-4809-1}
- nodejs 24.19.0+dfsg+~cs24.13.3-1
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#dnsresolveany-can-abort-on-dns-responses-with-many-a-records-cve-2026-58042---medium
NOTE: Fixed by: https://github.com/nodejs/node/commit/22efc051a3c3b3bbddbb3cb06ce1ca5775923c01 (v22.23.2)
@@ -80023,12 +80557,12 @@ CVE-2026-58041 (A flaw in Node.js node:sqlite allows a stale StatementSyncIterat
NOTE: Fixed by: https://github.com/nodejs/node/commit/af9ff0490ce834f3b28efbc2551f96a03a829fd2 (v24.18.1)
NOTE: experimental status for v22
CVE-2026-56848 (A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` ...)
- {DSA-6517-1}
+ {DSA-6517-1 DLA-4809-1}
- nodejs 24.19.0+dfsg+~cs24.13.3-1
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http2-re-entrant-send-can-cause-heap-use-after-free-cve-2026-56848---high
NOTE: Fixed by: https://github.com/nodejs/node/commit/daa6d25e3dceb30edb832a778ec0610c8bc2dd12 (v22.23.2)
CVE-2026-56846 (A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blo ...)
- {DSA-6517-1}
+ {DSA-6517-1 DLA-4809-1}
- nodejs 24.19.0+dfsg+~cs24.13.3-1
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http2-retained-headers-can-bypass-maxsessionmemory-limits-cve-2026-56846---high
NOTE: Fixed by: https://github.com/nodejs/node/commit/f14d78b9e0201bfe0291f2b0dc4b5d88c70cc28e (v22.23.2)
@@ -80146,13 +80680,14 @@ CVE-2026-58043 (A flaw in Node.js Permission Model enforcement can over-grant fi
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#permission-model-path-matching-can-over-grant-filesystem-access-cve-2026-58043---high
NOTE: Fixed by: https://github.com/nodejs/node/commit/440329f6247c8abb4c7cb4217e5a546ad41cd5ed (v22.23.2)
CVE-2026-58040 (An incomplete fix has been identified in Node.js: HTTPS Agent TLS sess ...)
+ {DLA-4809-1}
- nodejs 24.19.0+dfsg+~cs24.13.3-1
[trixie] - nodejs <not-affected> (Incomplete fix for CVE-2026-48934 not applied)
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#https-agent-session-reuse-can-skip-hostname-verification-cve-2026-58040---medium
NOTE: Fixed by: https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62 (v22.23.2)
NOTE: CVE exists because of an incomplete fix for CVE-2026-48934
CVE-2026-56850 (A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-ar ...)
- {DSA-6517-1}
+ {DSA-6517-1 DLA-4809-1}
- nodejs 24.19.0+dfsg+~cs24.13.3-1
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#https-agent-can-reuse-mtls-identities-across-pfx-certificates-cve-2026-56850---medium
NOTE: Fixed by: https://github.com/nodejs/node/commit/acaf4266b2be7958e3d7cb44b5ee1c2b96eca278 (v22.23.2)
@@ -80626,7 +81161,7 @@ CVE-2026-17915 (Inappropriate implementation in WebView in Google Chrome on Andr
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17914 (Side-channel information leakage in Skia in Google Chrome prior to 151 ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -80903,7 +81438,7 @@ CVE-2026-17848 (Integer overflow in Codecs in Google Chrome prior to 151.0.7922.
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17847 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -80971,7 +81506,7 @@ CVE-2026-17833 (Inappropriate implementation in Passwords in Google Chrome prior
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17832 (Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowe ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81103,7 +81638,7 @@ CVE-2026-17802 (Side-channel information leakage in GPU in Google Chrome on Andr
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17801 (Out of bounds read and write in ANGLE in Google Chrome prior to 151.0. ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81175,7 +81710,7 @@ CVE-2026-17786 (Insufficient validation of untrusted input in DevTools in Google
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17785 (Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 all ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81239,7 +81774,7 @@ CVE-2026-17772 (Out of bounds read in WebGL in Google Chrome prior to 151.0.7922
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17771 (Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allo ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81304,7 +81839,7 @@ CVE-2026-17758 (Heap buffer overflow in Dawn in Google Chrome prior to 151.0.792
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17757 (Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allo ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -81341,7 +81876,7 @@ CVE-2026-17751 (Inappropriate implementation in AdFilter in Google Chrome prior
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17750 (Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowe ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81369,7 +81904,7 @@ CVE-2026-17746 (Use after free in GPU in Google Chrome on Mac prior to 151.0.792
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17745 (Out of bounds read in Skia in Google Chrome prior to 151.0.7922.72 all ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -81398,7 +81933,7 @@ CVE-2026-17741 (Insufficient validation of untrusted input in WebView in Google
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17740 (Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 all ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81482,7 +82017,7 @@ CVE-2026-17722 (Object lifecycle issue in WebView in Google Chrome on Android pr
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17721 (Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 a ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81502,7 +82037,7 @@ CVE-2026-17719 (Use after free in Input in Google Chrome prior to 151.0.7922.72
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17718 (Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowe ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81514,7 +82049,7 @@ CVE-2026-17718 (Use after free in ANGLE in Google Chrome prior to 151.0.7922.72
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-17717 (Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allo ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81534,7 +82069,7 @@ CVE-2026-17715 (Inappropriate implementation in Passwords in Google Chrome prior
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17714 (Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 all ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81583,7 +82118,7 @@ CVE-2026-17705 (Integer overflow in libxml in Google Chrome prior to 151.0.7922.
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17704 (Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowe ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81599,7 +82134,7 @@ CVE-2026-17703 (Insufficient policy enforcement in Chrome for iOS in Google Chro
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17702 (Inappropriate implementation in Skia in Google Chrome prior to 151.0.7 ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -81628,7 +82163,7 @@ CVE-2026-17698 (Insufficient validation of untrusted input in UI in Google Chrom
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17697 (Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowe ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81668,7 +82203,7 @@ CVE-2026-17690 (Insufficient validation of untrusted input in PDF in Google Chro
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17689 (Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 all ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81684,7 +82219,7 @@ CVE-2026-17688 (Use after free in Input in Google Chrome prior to 151.0.7922.72
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17687 (Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowe ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81708,7 +82243,7 @@ CVE-2026-17684 (Insufficient validation of untrusted input in Chrome for iOS in
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17683 (Inappropriate implementation in ANGLE in Google Chrome prior to 151.0. ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81720,7 +82255,7 @@ CVE-2026-17683 (Inappropriate implementation in ANGLE in Google Chrome prior to
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-17682 (Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allo ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81744,7 +82279,7 @@ CVE-2026-17679 (Insufficient validation of untrusted input in Print Preview in G
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17678 (Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 al ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81764,7 +82299,7 @@ CVE-2026-17676 (Inappropriate implementation in ANGLE in Google Chrome on Androi
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17675 (Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 a ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81788,7 +82323,7 @@ CVE-2026-17672 (Insufficient validation of untrusted input in Chromecast in Goog
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17671 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81808,7 +82343,7 @@ CVE-2026-17669 (Inappropriate implementation in Chrome for iOS in Google Chrome
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17668 (Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 all ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81820,7 +82355,7 @@ CVE-2026-17668 (Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-17667 (Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 all ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81876,7 +82411,7 @@ CVE-2026-17656 (Use after free in Ozone in Google Chrome prior to 151.0.7922.72
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17655 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -81892,7 +82427,7 @@ CVE-2026-17654 (Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 a
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-17653 (Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed ...)
- {DSA-6408-1 DLA-4710-1}
+ {DSA-6534-1 DSA-6408-1 DLA-4710-1}
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -82279,7 +82814,7 @@ CVE-2026-58187 (The Apache Traffic Server multiplexer plugin overruns its chunk-
CVE-2026-58186 (The Apache Traffic Server webp_transform plugin can decode unsafely an ...)
- trafficserver <removed> (bug #1143062)
NOTE: https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d
-CVE-2026-58185 (The Apache Traffic Server intercept plugin has a use-after-free. This ...)
+CVE-2026-58185 (The Apache Traffic Server intercept plugin has a use-after-free. Th ...)
- trafficserver <removed> (bug #1143062)
NOTE: https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d
CVE-2026-58184 (The Apache Traffic Server header_rewrite plugin can crash or corrupt m ...)
@@ -87385,7 +87920,7 @@ CVE-2026-65484 (Contributor Broken Access Control in Style Kits <= 2.6.5 version
NOT-FOR-US: WordPress plugin or theme
CVE-2026-65483 (Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-65482 (Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for El ...)
+CVE-2026-65482 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-65481 (Contributor Local File Inclusion in Vino <= 1.9 versions.)
NOT-FOR-US: WordPress plugin or theme
@@ -91091,7 +91626,7 @@ CVE-2026-16421 (Inappropriate implementation in WebAudio in Google Chrome prior
- chromium 150.0.7871.181-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-16413 (Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 ...)
- {DSA-6396-1 DLA-4701-1}
+ {DSA-6534-1 DSA-6396-1 DLA-4701-1}
- chromium 150.0.7871.181-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -91115,7 +91650,7 @@ CVE-2026-16416 (Integer overflow in Chromecast in Google Chrome prior to 150.0.7
- chromium 150.0.7871.181-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-16417 (Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 all ...)
- {DSA-6396-1 DLA-4701-1}
+ {DSA-6534-1 DSA-6396-1 DLA-4701-1}
- chromium 150.0.7871.181-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -99135,7 +99670,7 @@ CVE-2026-15775 (Inappropriate implementation in V8 in Google Chrome prior to 150
- chromium 150.0.7871.124-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15774 (Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowe ...)
- {DSA-6390-1 DLA-4687-1}
+ {DSA-6534-1 DSA-6390-1 DLA-4687-1}
- chromium 150.0.7871.124-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -99176,7 +99711,7 @@ CVE-2026-15767 (Heap buffer overflow in libyuv in Google Chrome on Windows prior
- chromium 150.0.7871.124-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15766 (Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 all ...)
- {DSA-6390-1 DLA-4687-1}
+ {DSA-6534-1 DSA-6390-1 DLA-4687-1}
- chromium 150.0.7871.124-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-4
@@ -102420,7 +102955,7 @@ CVE-2026-15108 (Integer overflow in Extensions API in Google Chrome prior to 150
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-15109 (Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.115 al ...)
- {DSA-6387-1 DLA-4677-1}
+ {DSA-6534-1 DSA-6387-1 DLA-4677-1}
- chromium 150.0.7871.114-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -106095,7 +106630,7 @@ CVE-2026-14430 (Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 a
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14429 (Insufficient validation of untrusted input in Skia in Google Chrome pr ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-2
@@ -106112,7 +106647,7 @@ CVE-2026-14428 (Insufficient validation of untrusted input in Dawn in Google Chr
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14427 (Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 a ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-2
@@ -106129,7 +106664,7 @@ CVE-2026-14426 (Use after free in V8 in Google Chrome prior to 150.0.7871.46 all
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14425 (Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowe ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -106161,7 +106696,7 @@ CVE-2026-14420 (Out of bounds read and write in Dawn in Google Chrome prior to 1
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14419 (Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-2
@@ -106174,7 +106709,7 @@ CVE-2026-14419 (Use after free in Skia in Google Chrome prior to 150.0.7871.46 a
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-14418 (Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 all ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -106198,7 +106733,7 @@ CVE-2026-14415 (Inappropriate implementation in V8 in Google Chrome prior to 150
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14414 (Insufficient validation of untrusted input in Skia in Google Chrome pr ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-2
@@ -106211,7 +106746,7 @@ CVE-2026-14414 (Insufficient validation of untrusted input in Skia in Google Chr
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-14413 (Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 all ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -106223,7 +106758,7 @@ CVE-2026-14413 (Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-14412 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -106235,7 +106770,7 @@ CVE-2026-14412 (Insufficient validation of untrusted input in ANGLE in Google Ch
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-14411 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -106247,7 +106782,7 @@ CVE-2026-14411 (Insufficient validation of untrusted input in ANGLE in Google Ch
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-14410 (Inappropriate implementation in Skia in Google Chrome prior to 150.0.7 ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-2
@@ -106296,7 +106831,7 @@ CVE-2026-14401 (Insufficient validation of untrusted input in ANGLE in Google Ch
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14400 (Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 a ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -106312,7 +106847,7 @@ CVE-2026-14399 (Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.4
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14398 (Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowe ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -106328,7 +106863,7 @@ CVE-2026-14397 (Out of bounds write in ANGLE in Google Chrome on Mac prior to 15
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14396 (Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 al ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -106360,7 +106895,7 @@ CVE-2026-14391 (Integer overflow in ANGLE in Google Chrome on Windows prior to 1
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14390 (Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowe ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -106372,7 +106907,7 @@ CVE-2026-14390 (Use after free in ANGLE in Google Chrome prior to 150.0.7871.46
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-14389 (Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allow ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-2
@@ -106385,7 +106920,7 @@ CVE-2026-14389 (Integer overflow in Skia in Google Chrome prior to 150.0.7871.46
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-14388 (Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 al ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -106397,7 +106932,7 @@ CVE-2026-14388 (Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-14387 (Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allow ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-2
@@ -106410,7 +106945,7 @@ CVE-2026-14387 (Integer overflow in Skia in Google Chrome prior to 150.0.7871.46
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-14386 (Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 al ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -106434,7 +106969,7 @@ CVE-2026-14383 (Inappropriate implementation in V8 in Google Chrome prior to 150
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14382 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -107631,7 +108166,7 @@ CVE-2026-13779 (Use after free in Chromoting in Google Chrome on ChromeOS prior
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-13780 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -107643,7 +108178,7 @@ CVE-2026-13780 (Insufficient validation of untrusted input in ANGLE in Google Ch
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-13781 (Insufficient validation of untrusted input in Skia in Google Chrome pr ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-1
@@ -107865,7 +108400,7 @@ CVE-2026-13833 (Uninitialized Use in ANGLE in Google Chrome on Mac prior to 150.
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-13834 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -107901,7 +108436,7 @@ CVE-2026-13840 (Insufficient policy enforcement in Canvas in Google Chrome prior
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-13841 (Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allow ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-1
@@ -107988,7 +108523,7 @@ CVE-2026-13858 (Out of bounds read in FFmpeg in Google Chrome prior to 150.0.787
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/256d93413f260e1524c2ab994dc72c4edaa0d04c (n9.0)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cb8a5ca8ab36884064ac4de5175ae82c93edfcb2 (n7.1.5)
CVE-2026-13859 (Inappropriate implementation in ANGLE in Google Chrome prior to 150.0. ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -108068,7 +108603,7 @@ CVE-2026-13876 (Inappropriate implementation in Network in Google Chrome prior t
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-13877 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -108100,7 +108635,7 @@ CVE-2026-13882 (Race in USB in Google Chrome prior to 150.0.7871.47 allowed a re
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-13883 (Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowe ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -108461,7 +108996,7 @@ CVE-2026-13970 (Uninitialized Use in Media in Google Chrome prior to 150.0.7871.
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-13971 (Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.47 allo ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260602~git.3476902+dfsg-1
@@ -108758,7 +109293,7 @@ CVE-2026-14043 (Use after free in GetUserMedia in Google Chrome prior to 150.0.7
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14044 (Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowe ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -109090,7 +109625,7 @@ CVE-2026-14124 (Inappropriate implementation in CredentialProvider in Google Chr
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14125 (Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.47 all ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -109206,7 +109741,7 @@ CVE-2026-14151 (Inappropriate implementation in AI in Google Chrome prior to 150
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-14152 (Out of bounds read and write in ANGLE in Google Chrome prior to 150.0. ...)
- {DSA-6378-1 DLA-4672-1}
+ {DSA-6534-1 DSA-6378-1 DLA-4672-1}
- chromium 150.0.7871.46-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -117893,7 +118428,7 @@ CVE-2026-55766 (guzzlehttp/psr7 is a PSR-7 HTTP message library implementation i
[bullseye] - php-guzzlehttp-psr7 <postponed> (Minor issue; CR/LF accepted in method/protocol-version/reason-phrase)
NOTE: https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432
CVE-2026-48931 (A flaw in Node.js HTTP Agent can cause a client to accept as valid a r ...)
- {DSA-6517-1}
+ {DSA-6517-1 DLA-4809-1}
- nodejs 24.17.0+dfsg+~cs24.13.2-1
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#http-response-queue-poisoning-via-toctou-race-condition-in-httpagent-cve-2026-48931---low
NOTE: https://github.com/nodejs/node/commit/0a22d40180cb796e0d68e94c1a7a8a05a8f47c10 (v22.23.0)
@@ -117910,18 +118445,18 @@ CVE-2026-48935 (A flaw in Node.js Permission API can cause a file metadata to be
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#permission-model-bypass-via-filehandleutimes-in-the-promises-api-cve-2026-48935---low
NOTE: https://github.com/nodejs/node/commit/28dcd388644c676b5b8149abfe18ec32cd010781 (v22.23.0)
CVE-2026-48934 (A flaw in Node.js TLS host verification can cause an attacker to bypas ...)
- {DSA-6517-1}
+ {DSA-6517-1 DLA-4809-1}
- nodejs 24.17.0+dfsg+~cs24.13.2-1
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#tls-host-identity-verification-bypass-via-session-reuse-with-different-servername-leads-to-unauthorized-connections-cve-2026-48934---medium
NOTE: https://github.com/nodejs/node/commit/fd890ba01d508ac111bbba302981d7fdf734d2ce (v22.23.0)
NOTE: When fixing this issue make sure to apply a complete fix to not open up CVE-2026-58040.
CVE-2026-48930 (A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnam ...)
- {DSA-6517-1}
+ {DSA-6517-1 DLA-4809-1}
- nodejs 24.17.0+dfsg+~cs24.13.2-1
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#embedded-nul-hostnames-can-lead-to-silent-authority-rebinding-due-to-c-string-truncation-in-resolver-bindings-cve-2026-48930---medium
NOTE: https://github.com/nodejs/node/commit/c551a51d0c58dfc91961fb3f24c2c86af6183eca (v22.23.0)
CVE-2026-48928 (A inconsistency in Node.js hostname matching can cause a trust-policy ...)
- {DSA-6517-1}
+ {DSA-6517-1 DLA-4809-1}
- nodejs 24.17.0+dfsg+~cs24.13.2-1
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#uppercase-sni-context-matching-can-lead-to-mtls-authorization-bypass-due-to-case-sensitive-hostname-matching-cve-2026-48928---medium
NOTE: https://github.com/nodejs/node/commit/39d1d0968471a144d93dc293d640008f57d3c58e (v22.23.0)
@@ -117938,12 +118473,12 @@ CVE-2026-48615 (A flaw in Node.js proxy tunnel error handling could expose proxy
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#proxy-credentials-leaked-in-err_proxy_tunnel-error-message-cve-2026-48615---medium
NOTE: https://github.com/nodejs/node/commit/9b6af26132f6e87659ce360e6a59f42a03ff1701 (v22.23.0)
CVE-2026-48618 (A flaw in Node.js TLS hostname handling can cause Node.js unicode dot ...)
- {DSA-6517-1}
+ {DSA-6517-1 DLA-4809-1}
- nodejs 24.17.0+dfsg+~cs24.13.2-1
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#nodejs-unicode-dot-separator-handling-can-lead-to-tls-wildcard-depth-authentication-bypass-due-to-resolver-and-verifier-hostname-normalization-mismat-cve-2026-48618---high
NOTE: https://github.com/nodejs/node/commit/2197a47144f3356ab451c5dcd858a49eb5957a70 (v22.23.0)
CVE-2026-48933 (A flaw in Node.js WebCrypto implementation can crash the process if th ...)
- {DSA-6517-1}
+ {DSA-6517-1 DLA-4809-1}
- nodejs 24.17.0+dfsg+~cs24.13.2-1
[bullseye] - nodejs <not-affected> (WebCrypto (SubtleCrypto) introduced in Node 15; not present)
NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#nodejs-webcrypto-aes-integer-overflow-leads-to-remote-process-abort-dos-cve-2026-48933---high
@@ -119776,7 +120311,7 @@ CVE-2026-12360 (The JetEngine plugin for WordPress is vulnerable to SQL injectio
NOT-FOR-US: WordPress plugin
CVE-2026-12348 (Address bar spoofing in Arc Search for Android allows a remote attacke ...)
NOT-FOR-US: Arc Search for Android
-CVE-2026-12256 (Contributor PHP Object Injection in Avada <= 3.15.3 versions.)
+CVE-2026-12256 (Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-12117 (Improper access control in the social login connection endpoint in De ...)
NOT-FOR-US: Devolutions
@@ -125378,7 +125913,7 @@ CVE-2026-11662 (Type Confusion in Bindings in Google Chrome prior to 149.0.7827.
- chromium 149.0.7827.102-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11663 (Use after free in Skia in Google Chrome prior to 149.0.7827.103 allowe ...)
- {DSA-6337-1}
+ {DSA-6534-1 DSA-6337-1}
- chromium 149.0.7827.102-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -125434,7 +125969,7 @@ CVE-2026-11674 (Use after free in Guest View in Google Chrome prior to 149.0.782
- chromium 149.0.7827.102-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11675 (Out of bounds read in Skia in Google Chrome prior to 149.0.7827.103 al ...)
- {DSA-6337-1}
+ {DSA-6534-1 DSA-6337-1}
- chromium 149.0.7827.102-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -126744,7 +127279,7 @@ CVE-2026-11322 (Hermes WebUI prior to v0.51.221 contains a path traversal vulner
CVE-2026-11312 (A vulnerability was found in bytedance InfiniStore up to 0.2.33. The i ...)
NOT-FOR-US: bytedance InfiniStore
CVE-2026-10881 (Out of bounds read and write in ANGLE in Google Chrome prior to 149.0. ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -126760,7 +127295,7 @@ CVE-2026-10882 (Use after free in Network in Google Chrome prior to 149.0.7827.5
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-10883 (Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowe ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -126792,7 +127327,7 @@ CVE-2026-10888 (Use after free in Cast Streaming in Google Chrome prior to 149.0
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-10889 (Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 al ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -126872,7 +127407,7 @@ CVE-2026-10906 (Use after free in WebAuthentication in Google Chrome prior to 14
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-10907 (Out of bounds write in ANGLE in Google Chrome prior to 149.0.7827.53 a ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -126928,7 +127463,7 @@ CVE-2026-10918 (Use after free in Viz in Google Chrome prior to 149.0.7827.53 al
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-10919 (Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowe ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127024,7 +127559,7 @@ CVE-2026-10940 (Race in Codecs in Google Chrome on Windows prior to 149.0.7827.5
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-10941 (Out of bounds memory access in Skia in Google Chrome prior to 149.0.78 ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127164,7 +127699,7 @@ CVE-2026-10973 (Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.5
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-10974 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127184,7 +127719,7 @@ CVE-2026-10976 (Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.5
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-10977 (Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allo ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127200,7 +127735,7 @@ CVE-2026-10978 (Use after free in Chromoting in Google Chrome on Windows prior t
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-10979 (Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 al ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127232,7 +127767,7 @@ CVE-2026-10984 (Inappropriate implementation in Accessibility in Google Chrome o
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-10985 (Out of bounds read in Skia in Google Chrome prior to 149.0.7827.53 all ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127272,7 +127807,7 @@ CVE-2026-10992 (Insufficient data validation in Animation in Google Chrome prior
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-10993 (Heap buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 a ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127284,7 +127819,7 @@ CVE-2026-10993 (Heap buffer overflow in Skia in Google Chrome prior to 149.0.782
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-10994 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 all ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127332,7 +127867,7 @@ CVE-2026-11003 (Use after free in WebRTC in Google Chrome prior to 149.0.7827.53
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11004 (Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 al ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127420,7 +127955,7 @@ CVE-2026-11023 (Inappropriate implementation in WebAppInstalls in Google Chrome
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11024 (Stack buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127488,7 +128023,7 @@ CVE-2026-11038 (Insufficient policy enforcement in Subresource Integrity in Goog
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11039 (Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allo ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127500,7 +128035,7 @@ CVE-2026-11039 (Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.5
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-11040 (Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowe ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127552,7 +128087,7 @@ CVE-2026-11050 (Use after free in V8 in Google Chrome prior to 149.0.7827.53 all
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11051 (Out of bounds read in ANGLE in Google Chrome on Linux prior to 149.0.7 ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127584,7 +128119,7 @@ CVE-2026-11056 (Insufficient validation of untrusted input in SiteIsolation in G
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11057 (Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allo ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127608,7 +128143,7 @@ CVE-2026-11060 (Use after free in Media in Google Chrome on Windows prior to 149
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11061 (Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowe ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127632,7 +128167,7 @@ CVE-2026-11064 (Race in GPU in Google Chrome on Android prior to 149.0.7827.53 a
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11065 (Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowe ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127644,7 +128179,7 @@ CVE-2026-11065 (Use after free in ANGLE in Google Chrome prior to 149.0.7827.53
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-11066 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127736,7 +128271,7 @@ CVE-2026-11086 (Inappropriate implementation in Dawn in Google Chrome prior to 1
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11087 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 all ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127748,7 +128283,7 @@ CVE-2026-11087 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-11088 (Integer overflow in ANGLE in Google Chrome prior to 149.0.7827.53 allo ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127764,7 +128299,7 @@ CVE-2026-11089 (Uninitialized Use in Media in Google Chrome prior to 149.0.7827.
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11090 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 all ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127828,7 +128363,7 @@ CVE-2026-11103 (Inappropriate implementation in Installer in Google Chrome on Wi
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11104 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 all ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127856,7 +128391,7 @@ CVE-2026-11108 (Inappropriate implementation in NFC in Google Chrome on Android
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11109 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 all ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127868,7 +128403,7 @@ CVE-2026-11109 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-11110 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 all ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127880,7 +128415,7 @@ CVE-2026-11110 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-11111 (Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 al ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127896,7 +128431,7 @@ CVE-2026-11112 (Insufficient validation of untrusted input in Chromoting in Goog
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11113 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127936,7 +128471,7 @@ CVE-2026-11120 (Insufficient validation of untrusted input in Enterprise Reporti
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11121 (Insufficient validation of untrusted input in Skia in Google Chrome pr ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127952,7 +128487,7 @@ CVE-2026-11122 (Inappropriate implementation in Keyboard in Google Chrome prior
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11123 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 all ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -127964,7 +128499,7 @@ CVE-2026-11123 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-11124 (Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allow ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -128024,7 +128559,7 @@ CVE-2026-11136 (Use after free in Canvas in Google Chrome prior to 149.0.7827.53
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11137 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 all ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -128036,7 +128571,7 @@ CVE-2026-11137 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-11138 (Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 all ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -128128,7 +128663,7 @@ CVE-2026-11158 (Insufficient validation of untrusted input in Downloads in Googl
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11159 (Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allo ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -128264,7 +128799,7 @@ CVE-2026-11190 (Inappropriate implementation in Extensions in Google Chrome prio
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-11191 (Out of bounds memory access in ANGLE in Google Chrome prior to 149.0.7 ...)
- {DSA-6325-1}
+ {DSA-6534-1 DSA-6325-1}
- chromium 149.0.7827.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132255,7 +132790,7 @@ CVE-2026-9999 (Inappropriate implementation in ANGLE in Google Chrome on Mac pri
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9998 (Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allo ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-5
@@ -132324,7 +132859,7 @@ CVE-2026-9984 (Use after free in UI in Google Chrome on Windows prior to 148.0.7
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9983 (Type Confusion in Skia in Google Chrome prior to 148.0.7778.216 allowe ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-5
@@ -132337,7 +132872,7 @@ CVE-2026-9983 (Type Confusion in Skia in Google Chrome prior to 148.0.7778.216 a
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9982 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132349,7 +132884,7 @@ CVE-2026-9982 (Insufficient validation of untrusted input in ANGLE in Google Chr
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9981 (Inappropriate implementation in Skia in Google Chrome prior to 148.0.7 ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-5
@@ -132382,7 +132917,7 @@ CVE-2026-9976 (Inappropriate implementation in USB in Google Chrome prior to 148
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9975 (Out of bounds read and write in ANGLE in Google Chrome prior to 148.0. ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132414,7 +132949,7 @@ CVE-2026-9970 (Use after free in WebGL in Google Chrome prior to 148.0.7778.216
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9969 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132438,7 +132973,7 @@ CVE-2026-9966 (Integer overflow in XML in Google Chrome on Windows prior to 148.
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9965 (Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132494,7 +133029,7 @@ CVE-2026-9954 (Use after free in TabStrip in Google Chrome prior to 148.0.7778.2
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9953 (Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 a ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132530,7 +133065,7 @@ CVE-2026-9947 (Use after free in XML in Google Chrome prior to 148.0.7778.216 al
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9946 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allow ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132546,7 +133081,7 @@ CVE-2026-9945 (Use after free in Media in Google Chrome on Windows prior to 148.
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9944 (Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 al ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132562,7 +133097,7 @@ CVE-2026-9943 (Out of bounds read in WebGL in Google Chrome on Android prior to
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9942 (Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 al ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132574,7 +133109,7 @@ CVE-2026-9942 (Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.2
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9941 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allow ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132586,7 +133121,7 @@ CVE-2026-9941 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9940 (Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132614,7 +133149,7 @@ CVE-2026-9936 (Use after free in GFX in Google Chrome on Mac prior to 148.0.7778
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9935 (Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 al ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132654,7 +133189,7 @@ CVE-2026-9928 (Out of bounds read in ANGLE in Google Chrome on Windows prior to
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9927 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allow ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132666,7 +133201,7 @@ CVE-2026-9927 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9926 (Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132678,7 +133213,7 @@ CVE-2026-9926 (Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.777
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9925 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allow ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132694,7 +133229,7 @@ CVE-2026-9924 (Heap buffer overflow in ANGLE in Google Chrome on Windows prior t
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9923 (Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowe ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-5
@@ -132731,7 +133266,7 @@ CVE-2026-9917 (Uninitialized Use in WebGL in Google Chrome on Android prior to 1
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9916 (Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132743,7 +133278,7 @@ CVE-2026-9916 (Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9915 (Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132755,7 +133290,7 @@ CVE-2026-9915 (Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.777
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9914 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132767,7 +133302,7 @@ CVE-2026-9914 (Insufficient validation of untrusted input in ANGLE in Google Chr
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9913 (Inappropriate implementation in ANGLE in Google Chrome prior to 148.0. ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132783,7 +133318,7 @@ CVE-2026-9912 (Inappropriate implementation in GPU in Google Chrome on Android p
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9911 (Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 all ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132795,7 +133330,7 @@ CVE-2026-9911 (Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.21
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9910 (Out of bounds memory access in ANGLE in Google Chrome prior to 148.0.7 ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132807,7 +133342,7 @@ CVE-2026-9910 (Out of bounds memory access in ANGLE in Google Chrome prior to 14
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9909 (Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allo ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-5
@@ -132820,7 +133355,7 @@ CVE-2026-9909 (Integer overflow in Skia in Google Chrome prior to 148.0.7778.216
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9908 (Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 a ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132844,7 +133379,7 @@ CVE-2026-9905 (Use after free in Accessibility in Google Chrome on Windows prior
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9904 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allow ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132864,7 +133399,7 @@ CVE-2026-9902 (Use after free in Accessibility in Google Chrome prior to 148.0.7
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9901 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allow ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132876,7 +133411,7 @@ CVE-2026-9901 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9900 (Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132888,7 +133423,7 @@ CVE-2026-9900 (Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9899 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allow ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132920,7 +133455,7 @@ CVE-2026-9894 (Use after free in GPU in Google Chrome prior to 148.0.7778.216 al
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9893 (Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowe ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-5
@@ -132974,7 +133509,7 @@ CVE-2026-9883 (Use after free in Base in Google Chrome prior to 148.0.7778.216 a
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9882 (Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 all ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -132994,7 +133529,7 @@ CVE-2026-9880 (Insufficient validation of untrusted input in WebGL in Google Chr
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9879 (Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -133006,7 +133541,7 @@ CVE-2026-9879 (Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9878 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allow ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -133018,7 +133553,7 @@ CVE-2026-9878 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-9877 (Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allow ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -133287,7 +133822,7 @@ CVE-2026-10020 (Insufficient validation of untrusted input in Skia in Google Chr
- libskia <unfixed> (unimportant)
NOTE: Root cause for vulnerability is not in libskia (and fixed outside of Skia source)
CVE-2026-10019 (Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 all ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -133299,7 +133834,7 @@ CVE-2026-10019 (Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.2
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-10018 (Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 all ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -133331,7 +133866,7 @@ CVE-2026-10013 (Use after free in WebCodecs in Google Chrome prior to 148.0.7778
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-10012 (Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowe ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-5
@@ -133344,7 +133879,7 @@ CVE-2026-10012 (Use after free in Skia in Google Chrome prior to 148.0.7778.216
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-10011 (Inappropriate implementation in Skia in Google Chrome prior to 148.0.7 ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-5
@@ -133361,7 +133896,7 @@ CVE-2026-10010 (Inappropriate implementation in Input in Google Chrome on Androi
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-10009 (Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allo ...)
- {DSA-6316-1}
+ {DSA-6534-1 DSA-6316-1}
- chromium 148.0.7778.215-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-5
@@ -142634,7 +143169,7 @@ CVE-2026-8578 (Out of bounds read in GPU in Google Chrome on Linux prior to 148.
- chromium 148.0.7778.167-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-8579 (Insufficient validation of untrusted input in Skia in Google Chrome pr ...)
- {DSA-6273-1}
+ {DSA-6534-1 DSA-6273-1}
- chromium 148.0.7778.167-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-4
@@ -149453,7 +149988,7 @@ CVE-2026-7950 (Out of bounds read and write in GFX in Google Chrome prior to 148
- chromium 148.0.7778.96-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-7949 (Out of bounds read in Skia in Google Chrome prior to 148.0.7778.96 all ...)
- {DSA-6250-1}
+ {DSA-6534-1 DSA-6250-1}
- chromium 148.0.7778.96-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-3
@@ -149486,7 +150021,7 @@ CVE-2026-7944 (Insufficient validation of untrusted input in Persistent Cache in
- chromium 148.0.7778.96-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-7943 (Insufficient validation of untrusted input in ANGLE in Google Chrome p ...)
- {DSA-6250-1}
+ {DSA-6534-1 DSA-6250-1}
- chromium 148.0.7778.96-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -149498,7 +150033,7 @@ CVE-2026-7943 (Insufficient validation of untrusted input in ANGLE in Google Chr
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-7942 (Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allo ...)
- {DSA-6250-1}
+ {DSA-6534-1 DSA-6250-1}
- chromium 148.0.7778.96-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -149578,7 +150113,7 @@ CVE-2026-7924 (Uninitialized Use in Dawn in Google Chrome prior to 148.0.7778.96
- chromium 148.0.7778.96-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-7923 (Out of bounds write in Skia in Google Chrome prior to 148.0.7778.96 al ...)
- {DSA-6250-1}
+ {DSA-6534-1 DSA-6250-1}
- chromium 148.0.7778.96-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-3
@@ -149599,7 +150134,7 @@ CVE-2026-7921 (Use after free in Passwords in Google Chrome prior to 148.0.7778.
- chromium 148.0.7778.96-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-7920 (Use after free in Skia in Google Chrome prior to 148.0.7778.96 allowed ...)
- {DSA-6250-1}
+ {DSA-6534-1 DSA-6250-1}
- chromium 148.0.7778.96-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-3
@@ -149688,7 +150223,7 @@ CVE-2026-7901 (Use after free in ANGLE in Google Chrome on Mac prior to 148.0.77
- chromium 148.0.7778.96-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-7900 (Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 ...)
- {DSA-6250-1}
+ {DSA-6534-1 DSA-6250-1}
- chromium 148.0.7778.96-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -154946,7 +155481,7 @@ CVE-2026-7360 (Insufficient validation of untrusted input. in Compositing in Goo
- chromium 147.0.7727.137-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-7359 (Use after free in ANGLE in Google Chrome prior to 147.0.7727.138 allow ...)
- {DSA-6239-1}
+ {DSA-6534-1 DSA-6239-1}
- chromium 147.0.7727.137-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -154974,7 +155509,7 @@ CVE-2026-7356 (Use after free in Navigation in Google Chrome prior to 147.0.7727
- chromium 147.0.7727.137-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-7354 (Out of bounds read and write in Angle in Google Chrome prior to 147.0. ...)
- {DSA-6239-1}
+ {DSA-6534-1 DSA-6239-1}
- chromium 147.0.7727.137-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -154986,7 +155521,7 @@ CVE-2026-7354 (Out of bounds read and write in Angle in Google Chrome prior to 1
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-7353 (Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.138 ...)
- {DSA-6239-1}
+ {DSA-6534-1 DSA-6239-1}
- chromium 147.0.7727.137-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -161957,7 +162492,7 @@ CVE-2026-40915 (A flaw was found in GIMP. A remote attacker could exploit an int
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/issues/16051
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/e0bd82f290d42af4018b0ab3f4367ae0435a207f (GIMP_3_2_2)
CVE-2026-6364 (Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 al ...)
- {DSA-6214-1}
+ {DSA-6534-1 DSA-6214-1}
- chromium 147.0.7727.101-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-1 (bug #1134991)
@@ -162078,7 +162613,7 @@ CVE-2026-6299 (Use after free in Prerender in Google Chrome prior to 147.0.7727.
- chromium 147.0.7727.101-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-6298 (Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 ...)
- {DSA-6214-1}
+ {DSA-6534-1 DSA-6214-1}
- chromium 147.0.7727.101-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-1 (bug #1134991)
@@ -162095,7 +162630,7 @@ CVE-2026-6297 (Use after free in Proxy in Google Chrome prior to 147.0.7727.101
- chromium 147.0.7727.101-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-6296 (Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 ...)
- {DSA-6214-1}
+ {DSA-6534-1 DSA-6214-1}
- chromium 147.0.7727.101-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -165468,7 +166003,7 @@ CVE-2026-5871 (Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allo
- chromium 147.0.7727.55-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-5870 (Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allow ...)
- {DSA-6205-1}
+ {DSA-6534-1 DSA-6205-1}
- chromium 147.0.7727.55-1
[bullseye] - chromium <end-of-life> (see #1061268)
- libskia 146.20260414~git.ef5f213+dfsg-1 (bug #1134991)
@@ -171090,7 +171625,7 @@ CVE-2026-5282 (Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7
- chromium 146.0.7680.177-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-5283 (Inappropriate implementation in ANGLE in Google Chrome prior to 146.0. ...)
- {DSA-6192-1}
+ {DSA-6534-1 DSA-6192-1}
- chromium 146.0.7680.177-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -178157,7 +178692,7 @@ CVE-2026-30872 (OpenWrt Project is a Linux operating system targeting embedded d
CVE-2026-30871 (OpenWrt Project is a Linux operating system targeting embedded devices ...)
NOT-FOR-US: mdns deamon in OpenWrt
CVE-2026-4464 (Integer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 all ...)
- {DSA-6171-1}
+ {DSA-6534-1 DSA-6171-1}
- chromium 146.0.7680.153-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -178181,7 +178716,7 @@ CVE-2026-4461 (Inappropriate implementation in V8 in Google Chrome prior to 146.
- chromium 146.0.7680.153-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-4460 (Out of bounds read in Skia in Google Chrome prior to 146.0.7680.153 al ...)
- {DSA-6171-1}
+ {DSA-6534-1 DSA-6171-1}
- chromium 146.0.7680.153-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -178237,7 +178772,7 @@ CVE-2026-4449 (Use after free in Blink in Google Chrome prior to 146.0.7680.153
- chromium 146.0.7680.153-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-4448 (Heap buffer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 ...)
- {DSA-6171-1}
+ {DSA-6534-1 DSA-6171-1}
- chromium 146.0.7680.153-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -180854,7 +181389,7 @@ CVE-2026-3910 (Inappropriate implementation in V8 in Google Chrome prior to 146.
- chromium 146.0.7680.80-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-3909 (Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 al ...)
- {DSA-6165-1}
+ {DSA-6534-1 DSA-6165-1}
- chromium 146.0.7680.80-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -181437,7 +181972,7 @@ CVE-2026-3932 (Insufficient policy enforcement in PDF in Google Chrome on Androi
- chromium 146.0.7680.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-3931 (Heap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 a ...)
- {DSA-6164-1}
+ {DSA-6534-1 DSA-6164-1}
- chromium 146.0.7680.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -185579,7 +186114,7 @@ CVE-2026-3540 (Inappropriate implementation in WebAudio in Google Chrome prior t
CVE-2026-3539
REJECTED
CVE-2026-3538 (Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allo ...)
- {DSA-6157-1}
+ {DSA-6534-1 DSA-6157-1}
- chromium 145.0.7632.159-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -185595,7 +186130,7 @@ CVE-2026-3537 (Object lifecycle issue in PowerVR in Google Chrome on Android pri
- chromium 145.0.7632.159-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-3536 (Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 all ...)
- {DSA-6157-1}
+ {DSA-6534-1 DSA-6157-1}
- chromium 145.0.7632.159-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -206003,7 +206538,7 @@ CVE-2025-55131 (A flaw in Node.js's buffer allocation logic can expose uninitial
NOTE: Fixed by: https://github.com/nodejs/node/commit/51f4de4b4a52b5b0eb2c63ecbb4126577e05f636 (v20.20.0)
NOTE: Introduced by: https://github.com/nodejs/node/commit/c943cb4809d382d1816a5f435c0eacc14e750ab2 (v15.0.0)
CVE-2026-0908 (Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowe ...)
- {DSA-6100-1}
+ {DSA-6534-1 DSA-6100-1}
- chromium 144.0.7559.59-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -223841,6 +224376,7 @@ CVE-2025-48624 (In multiple functions of arm-smmu-v3.c, there is a possible out-
CVE-2025-48623 (In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds wri ...)
NOT-FOR-US: Android
CVE-2025-48622 (In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bou ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -250492,7 +251028,7 @@ CVE-2025-10501 (Use after free in WebRTC in Google Chrome prior to 140.0.7339.18
- chromium 140.0.7339.185-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2025-10502 (Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 ...)
- {DSA-6004-1}
+ {DSA-6534-1 DSA-6004-1}
- chromium 140.0.7339.185-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -256020,6 +256556,7 @@ CVE-2025-35451 (PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras
CVE-2025-32320 (In System UI, there is a possible way to view other users' images due ...)
NOT-FOR-US: Android
CVE-2025-32318 (In Skia, there is a possible out of bounds write due to a heap buffer ...)
+ {DSA-6534-1}
- libskia <not-affected> (Fixed before first version packaged in Debian)
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
@@ -257512,6 +258049,7 @@ CVE-2025-57806 (Local Deep Research is an AI-powered research assistant for deep
CVE-2025-54588 (Envoy is an open source L7 proxy and communication bus designed for la ...)
- envoyproxy <itp> (bug #987544)
CVE-2025-26416 (In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible o ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -259345,7 +259883,7 @@ CVE-2025-9482 (A vulnerability was detected in Linksys RE6250, RE6300, RE6350, R
CVE-2025-9481 (A security vulnerability has been detected in Linksys RE6250, RE6300, ...)
NOT-FOR-US: Linksys
CVE-2025-9478 (Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allow ...)
- {DSA-5988-1}
+ {DSA-6534-1 DSA-5988-1}
- chromium 139.0.7258.154-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -264123,7 +264661,7 @@ CVE-2025-8881 (Inappropriate implementation in File Picker in Google Chrome prio
- chromium 139.0.7258.127-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2025-8901 (Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 ...)
- {DSA-5976-1}
+ {DSA-6534-1 DSA-5976-1}
- chromium 139.0.7258.127-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -265978,6 +266516,7 @@ CVE-2025-54629 (Race condition issue occurring in the physical page import proce
CVE-2025-54628 (Vulnerability of incomplete verification information in the communicat ...)
NOT-FOR-US: Huawei
CVE-2025-54627 (Out-of-bounds write vulnerability in the skia module. Impact: Successf ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -325670,7 +326209,7 @@ CVE-2025-0445 (Use after free in V8 in Google Chrome prior to 133.0.6943.53 allo
- chromium 133.0.6943.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2025-0444 (Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed ...)
- {DSA-5859-1}
+ {DSA-6534-1 DSA-5859-1}
- chromium 133.0.6943.53-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -331665,7 +332204,7 @@ CVE-2025-0437 (Out of bounds read in Metrics in Google Chrome prior to 132.0.683
- chromium 132.0.6834.83-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2025-0436 (Integer overflow in Skia in Google Chrome prior to 132.0.6834.83 allow ...)
- {DSA-5844-1}
+ {DSA-6534-1 DSA-5844-1}
- chromium 132.0.6834.83-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -335797,6 +336336,7 @@ CVE-2024-47032 (In construct_transaction_from_cmd of lwis_ioctl.c, there is a po
CVE-2024-43769 (In isPackageDeviceAdmin of PackageManagerService.java, there is a poss ...)
NOT-FOR-US: Android
CVE-2024-43768 (In skia_alloc_func of SkDeflate.cpp, there is a possible out of bounds ...)
+ {DSA-6534-1}
- libskia <not-affected> (Fixed before initial upload to the archive)
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
@@ -335810,6 +336350,7 @@ CVE-2024-43768 (In skia_alloc_func of SkDeflate.cpp, there is a possible out of
NOTE: confirmed by the Mozilla security team
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2024-43767 (In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a p ...)
+ {DSA-6534-1}
- libskia <not-affected> (Fixed before initial upload to the archive)
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
@@ -335827,7 +336368,7 @@ CVE-2024-43764 (In onPrimaryClipChanged of ClipboardListener.java, there is a po
CVE-2024-43762 (In multiple locations, there is a possible way to avoid unbinding of a ...)
NOT-FOR-US: Android
CVE-2024-43097 (In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds ...)
- {DSA-5876-1 DSA-5874-1 DLA-4081-1 DLA-4078-1}
+ {DSA-6534-1 DSA-5876-1 DSA-5874-1 DLA-4081-1 DLA-4078-1}
- firefox-esr 128.8.0esr-1
- thunderbird 1:128.8.0esr-1
- webkit2gtk <unfixed>
@@ -349838,6 +350379,7 @@ CVE-2024-45594 (Decidim is a participatory democracy framework. The meeting embe
CVE-2024-43093 (In shouldHideDocument of ExternalStorageProvider.java, there is a poss ...)
NOT-FOR-US: Android
CVE-2024-43091 (In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bo ...)
+ {DSA-6534-1}
- webkit2gtk <unfixed>
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -364450,7 +364992,7 @@ CVE-2024-45817 (In x86's APIC (Advanced Programmable Interrupt Controller) archi
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
NOTE: https://xenbits.xen.org/xsa/advisory-462.html
CVE-2024-9123 (Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allow ...)
- {DSA-5775-1}
+ {DSA-6534-1 DSA-5775-1}
- chromium 129.0.6668.70-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -367314,7 +367856,7 @@ CVE-2024-8637 (Use after free in Media Router in Google Chrome on Android prior
- chromium 128.0.6613.137-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2024-8636 (Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.137 ...)
- {DSA-5768-1}
+ {DSA-6534-1 DSA-5768-1}
- chromium 128.0.6613.137-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -369895,7 +370437,7 @@ CVE-2024-8250 (NTLMSSP dissector crash in Wireshark 4.2.0 to 4.0.6 and 4.0.0 to
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/19943
NOTE: Fixed by: https://gitlab.com/wireshark/wireshark/-/commit/66dcd56f1eae615697b6588ac4778a61a5576391 (v4.3.1)
CVE-2024-8198 (Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 ...)
- {DSA-5761-1}
+ {DSA-6534-1 DSA-5761-1}
- chromium 128.0.6613.113-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -369911,7 +370453,7 @@ CVE-2024-8194 (Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 all
- chromium 128.0.6613.113-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2024-8193 (Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 ...)
- {DSA-5761-1}
+ {DSA-6534-1 DSA-5761-1}
- chromium 128.0.6613.113-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -371439,7 +371981,7 @@ CVE-2024-7967 (Heap buffer overflow in Fonts in Google Chrome prior to 128.0.661
- chromium 128.0.6613.84-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2024-7966 (Out of bounds memory access in Skia in Google Chrome prior to 128.0.66 ...)
- {DSA-5757-1}
+ {DSA-6534-1 DSA-5757-1}
- chromium 128.0.6613.84-1
[bullseye] - chromium <end-of-life> (see #1061268)
- webkit2gtk <unfixed>
@@ -430727,7 +431269,7 @@ CVE-2024-1284 (Use after free in Mojo in Google Chrome prior to 121.0.6167.160 a
[bullseye] - chromium <end-of-life> (see #1061268)
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2024-1283 (Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 ...)
- {DSA-5617-1}
+ {DSA-6534-1 DSA-5617-1}
- chromium 121.0.6167.160-1
[bullseye] - chromium <end-of-life> (see #1061268)
[buster] - chromium <end-of-life> (see DSA 5046)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c2fa9156d32d9cdd8018d60fa07603ba5c4adaf3
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c2fa9156d32d9cdd8018d60fa07603ba5c4adaf3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261001/768ef834/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list