[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 2 08:13:35 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
9c9e108a by security tracker role at 2026-10-02T07:13:27+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,10 +1,272 @@
+CVE-2026-97318 (The Giveaways and Contests by RafflePress WordPress plugin before 1.1 ...)
+ TODO: check
+CVE-2026-97317 (The Giveaways and Contests by RafflePress WordPress plugin before 1.1 ...)
+ TODO: check
+CVE-2026-97219 (The MStore API WordPress plugin before 4.22.1 does not restrict which ...)
+ TODO: check
+CVE-2026-96780 (figlet.js is a FIG driver written in JavaScript that aims to implement ...)
+ TODO: check
+CVE-2026-94298 (The BuildKit WordPress plugin before 1.0.29 does not properly sanitis ...)
+ TODO: check
+CVE-2026-93832 (A component of one of the Motorola system applications was exported wi ...)
+ TODO: check
+CVE-2026-93698 (Insufficient validation allows arbitrary commands to be executed via t ...)
+ TODO: check
+CVE-2026-93697 (There is a stored XSS vulnerability allowing arbitrary code execution ...)
+ TODO: check
+CVE-2026-93367 (The Visitors Traffic Real Time Statistics Pro plugin for WordPress is ...)
+ TODO: check
+CVE-2026-93029 (There is a stored XSS vulnerability allowing arbitrary code execution ...)
+ TODO: check
+CVE-2026-92924 (The Unlimited Elements for Elementor WordPress plugin before 2.0.21 do ...)
+ TODO: check
+CVE-2026-92820 (The Ninja Forms - File Uploads plugin for WordPress is vulnerable to a ...)
+ TODO: check
+CVE-2026-92174 (The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Lo ...)
+ TODO: check
+CVE-2026-91828 (The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress ...)
+ TODO: check
+CVE-2026-91023 (The Motors WordPress plugin before 1.4.124 does not properly verify t ...)
+ TODO: check
+CVE-2026-91022 (The Motors WordPress plugin before 1.4.124 does not sanitise and esca ...)
+ TODO: check
+CVE-2026-91020 (The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 ...)
+ TODO: check
+CVE-2026-90988 (The Request a Quote WordPress plugin through 2.5.6 does not perform a ...)
+ TODO: check
+CVE-2026-90987 (The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 ...)
+ TODO: check
+CVE-2026-90952 (The WP Edit Password Protected WordPress plugin before 2.0.7 does not ...)
+ TODO: check
+CVE-2026-90438 (The Ninja Forms \u2013 The Contact Form Builder That Grows With You pl ...)
+ TODO: check
+CVE-2026-85016 (The Unlimited Elements for Elementor WordPress plugin before 2.0.21 do ...)
+ TODO: check
+CVE-2026-85005 (The Popup Maker WP WordPress plugin through 1.4.5 does not perform aut ...)
+ TODO: check
+CVE-2026-85004 (The Popup Maker WordPress plugin through 1.4.5 does not perform a cap ...)
+ TODO: check
+CVE-2026-84925 (The Avada | Website Builder For WordPress & WooCommerce theme for Word ...)
+ TODO: check
+CVE-2026-84740 (The Events Calendar WordPress plugin before 6.17.5.1 does not validate ...)
+ TODO: check
+CVE-2026-82358 (RT-Labs AB C-Open CANopen contains a write protection bypass in the SD ...)
+ TODO: check
+CVE-2026-82357 (RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the L ...)
+ TODO: check
+CVE-2026-81740 (The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verif ...)
+ TODO: check
+CVE-2026-79618 (The WP User Frontend WordPress plugin before 4.3.12 does not enforce i ...)
+ TODO: check
+CVE-2026-78471 (The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Sit ...)
+ TODO: check
+CVE-2026-71542 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
+ TODO: check
+CVE-2026-71454 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-71453 (- External Control of File Name or Path vulnerability in Johnson Contr ...)
+ TODO: check
+CVE-2026-71452 (- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 a ...)
+ TODO: check
+CVE-2026-71451 (- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 a ...)
+ TODO: check
+CVE-2026-71449 (: Use of Hard-coded Cryptographic Key vulnerability in Johnson Control ...)
+ TODO: check
+CVE-2026-71448 (: Insecure Default Initialization of Resource vulnerability in Johnson ...)
+ TODO: check
+CVE-2026-71426 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
+ TODO: check
+CVE-2026-70650 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
+ TODO: check
+CVE-2026-64893 (- Cleartext Transmission of Sensitive Information vulnerability in Joh ...)
+ TODO: check
+CVE-2026-64892 (- Exposure of Sensitive Information vulnerability in Johnson Controls ...)
+ TODO: check
+CVE-2026-63569 (Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 tw ...)
+ TODO: check
+CVE-2026-63568 (Allocation of resources without limits or throttling in the CMP/CRMF p ...)
+ TODO: check
+CVE-2026-63567 (Observable discrepancy in IesEngine.DecryptBlock in Legion of the Boun ...)
+ TODO: check
+CVE-2026-63566 (Memory allocation with excessive size value in the DTLS handshake reas ...)
+ TODO: check
+CVE-2026-56662 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
+ TODO: check
+CVE-2026-56661 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
+ TODO: check
+CVE-2026-56660 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
+ TODO: check
+CVE-2026-55396 (Cleartext transmission without a cryptographic integrity check in oper ...)
+ TODO: check
+CVE-2026-55395 (Hardcoded passwords in the access control in Teledyne FLIR Aware2 vers ...)
+ TODO: check
+CVE-2026-55394 (Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 vers ...)
+ TODO: check
+CVE-2026-55393 (Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 ver ...)
+ TODO: check
+CVE-2026-55252 (OpenRun is an open-source, self-hosted GitOps platform for deploying w ...)
+ TODO: check
+CVE-2026-55251 (NetBox Device Type Library is a collection of community-sourced device ...)
+ TODO: check
+CVE-2026-54049 (Sakai is a Collaboration and Learning Environment (CLE). From versions ...)
+ TODO: check
+CVE-2026-53964 (Document Merge Service is a document template merge service providing ...)
+ TODO: check
+CVE-2026-53953 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
+ TODO: check
+CVE-2026-51897 (RAGFlow 0.24.0 contains improper access control in get_dataset (api/ap ...)
+ TODO: check
+CVE-2026-51896 (infiniflow ragflow 0.25.3 contains improper access control in resume ( ...)
+ TODO: check
+CVE-2026-51895 (Ragflow 0.24.0 and prior contains improper access control in update_me ...)
+ TODO: check
+CVE-2026-51894 (infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control vi ...)
+ TODO: check
+CVE-2026-51893 (infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control vi ...)
+ TODO: check
+CVE-2026-51892 (infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control vi ...)
+ TODO: check
+CVE-2026-51888 (langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The i ...)
+ TODO: check
+CVE-2026-51886 (langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact ...)
+ TODO: check
+CVE-2026-51884 (The /knowledge_base/upload_temp_docs temporary document upload endpoin ...)
+ TODO: check
+CVE-2026-51883 (The knowledge base creation and document upload interfaces in Langchai ...)
+ TODO: check
+CVE-2026-51882 (The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Ch ...)
+ TODO: check
+CVE-2026-51881 (deeptutor 1.4.0 contains code injection in ExecTool.execute. Through t ...)
+ TODO: check
+CVE-2026-51880 (deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execut ...)
+ TODO: check
+CVE-2026-51879 (deeptutor 1.4.0 contains an authorization bypass through a user-contro ...)
+ TODO: check
+CVE-2026-51878 (deeptutor 1.4.0 contains an authorization bypass through a user-contro ...)
+ TODO: check
+CVE-2026-51876 (DeepTutor 1.4.0 contains an authorization bypass vulnerability in the ...)
+ TODO: check
+CVE-2026-51875 (In Devika v1.0, the Feature Agent save_code_to_project function contai ...)
+ TODO: check
+CVE-2026-51874 (In Devika v1.0, the Patcher Agent save_code_to_project function contai ...)
+ TODO: check
+CVE-2026-51873 (Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_cod ...)
+ TODO: check
+CVE-2026-34494 (- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series ...)
+ TODO: check
+CVE-2026-34493 (- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS3 ...)
+ TODO: check
+CVE-2026-27874 (: Use of Hard-coded Credentials vulnerability in Johnson Controls Easy ...)
+ TODO: check
+CVE-2026-27873 (- Use of Hard-coded Credentials vulnerability in Johnson Controls Easy ...)
+ TODO: check
+CVE-2026-21140 (Improper access control in ManagedProvisioning prior to SMR Sep-2026 R ...)
+ TODO: check
+CVE-2026-1661 (The WP Mail Logging WordPress plugin before 1.17.0 does not properly r ...)
+ TODO: check
+CVE-2026-19660 (The Divi Membership plugin for WordPress is vulnerable to Authenticati ...)
+ TODO: check
+CVE-2026-18397 (This vulnerability enables unauthenticated remote code execution (RCE) ...)
+ TODO: check
+CVE-2026-16001 (Exposure of the message authentication key through the encryption keys ...)
+ TODO: check
+CVE-2026-16000 (Missing cryptographic step in the DSTU 7624 CCM mode implementation (K ...)
+ TODO: check
+CVE-2026-15999 (Improper validation of integrity check value in the AES-CCM implementa ...)
+ TODO: check
+CVE-2026-15897 (The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress i ...)
+ TODO: check
+CVE-2026-15896 (The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress i ...)
+ TODO: check
+CVE-2026-14984 (Cleartext transmission in the primary control endpoints of Teledyne FL ...)
+ TODO: check
+CVE-2026-14983 (Missing authentication in the web interface in Teledyne FLIR Aware2 ve ...)
+ TODO: check
+CVE-2026-14378 (The DevKit Pro plugin for WordPress is vulnerable to Authentication By ...)
+ TODO: check
+CVE-2026-13718 (The Tabs Responsive WordPress plugin through 2.5 does not sanitize th ...)
+ TODO: check
+CVE-2026-13413 (The CMP \u2013 Coming Soon & Maintenance WordPress plugin before 4.1.2 ...)
+ TODO: check
+CVE-2026-10026 (The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection ...)
+ TODO: check
+CVE-2026-104480 (Discord libdave before 1.2.0 did not reject an MLS Welcome message whe ...)
+ TODO: check
+CVE-2026-104356 (PictShare before version 3.7.1 contains a weak randomness vulnerabilit ...)
+ TODO: check
+CVE-2026-104286 (An improper limitation of a pathname to a restricted directory ('path ...)
+ TODO: check
+CVE-2026-104183 (stream-json is a micro-library of stream components for processing JSO ...)
+ TODO: check
+CVE-2026-104182 (stream-json is a micro-library of stream components for processing JSO ...)
+ TODO: check
+CVE-2026-104181 (Filament is a collection of full-stack components for accelerated Lara ...)
+ TODO: check
+CVE-2026-104123 (A vulnerability was detected in SourceCodester Online Reviewer Managem ...)
+ TODO: check
+CVE-2026-104120 (A security vulnerability has been detected in modelcontextprotocol mcp ...)
+ TODO: check
+CVE-2026-104054 (A security flaw has been discovered in calcom cal.diy up to 6.2.0. Thi ...)
+ TODO: check
+CVE-2026-104053 (A vulnerability was identified in itsourcecode Pet Shop Management Sys ...)
+ TODO: check
+CVE-2026-104052 (A vulnerability was determined in itsourcecode Pet Shop Management Sys ...)
+ TODO: check
+CVE-2026-104051 (PictShare before 3.7.1 contains an information disclosure vulnerabilit ...)
+ TODO: check
+CVE-2026-104020 (Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0 ...)
+ TODO: check
+CVE-2026-104002 (A fail-open error handling issue within the data masking utility of Po ...)
+ TODO: check
+CVE-2026-103766 (ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerabili ...)
+ TODO: check
+CVE-2026-103765 (Mooncake through 0.3.13.post1 contains a missing authentication vulner ...)
+ TODO: check
+CVE-2026-103764 (Mooncake transfer engine before 0.3.13 contains an untrusted pointer d ...)
+ TODO: check
+CVE-2026-103761 (Mooncake transfer engine through 0.3.13.post1 contains a memory exhaus ...)
+ TODO: check
+CVE-2026-103760 (Mooncake transfer engine through 0.3.13.post1 contains a denial of ser ...)
+ TODO: check
+CVE-2026-103484 (IVFFlat index build in pgvector before 0.8.7 allows a database user to ...)
+ TODO: check
+CVE-2026-103098 (Transmission of a sensitive key in the URL over an unencrypted HTTP co ...)
+ TODO: check
+CVE-2026-103097 (An API key is hardcoded and retrievable from the application package. ...)
+ TODO: check
+CVE-2026-103096 (API key is hardcoded and retrievable from the application package. Sin ...)
+ TODO: check
+CVE-2026-102671 (The Joyland AI app accepts invalid SSL certificates in the invisible a ...)
+ TODO: check
+CVE-2026-102670 (Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ ...)
+ TODO: check
+CVE-2026-102669 (Joyland AI app does not verify hostnames, allowing a malicious host to ...)
+ TODO: check
+CVE-2026-102668 (The Joyland AI app accepts any TLS certificates from any server withou ...)
+ TODO: check
+CVE-2026-102667 (Joyland AI app allows an attacker with shared network access to inject ...)
+ TODO: check
+CVE-2026-102666 (The Joyland AI app contains hard-coded credentials for the GeTui push ...)
+ TODO: check
+CVE-2026-102628 (The Cadmos LTI application hosted at cadmos.eummena.io had Laravel deb ...)
+ TODO: check
+CVE-2026-102565 (The BA Book Everything plugin for WordPress is vulnerable to Stored Cr ...)
+ TODO: check
+CVE-2026-102514 (Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (p ...)
+ TODO: check
+CVE-2026-102370 (Kasa EC70 v4 and EC71 v4 do not logically disable the production debug ...)
+ TODO: check
+CVE-2026-100251 (Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TU ...)
+ TODO: check
+CVE-2025-71427 (Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal v ...)
+ TODO: check
CVE-2026-94603
- podman <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2542566
-CVE-2026-86345
+CVE-2026-86345 (A flaw was found in 389-ds-base. The server does not discard plaintext ...)
- 389-ds-base <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2529332
-CVE-2026-86344
+CVE-2026-86344 (A flaw was found in 389-ds-base. An unauthenticated remote attacker ca ...)
- 389-ds-base <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2529329
TODO: check, not details provided on 2026-10-02 in Red Hat bugzilla
@@ -1062,7 +1324,7 @@ CVE-2026-97289 (Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Ma
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97288 (Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versio ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-97287 (Contributor SQL Injection in Event Tickets <= 5.29.5 versions.)
+CVE-2026-97287 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97286 (Contributor Cross Site Scripting (XSS) in Strong Testimonials <= 3.3.1 ...)
NOT-FOR-US: WordPress plugin or theme
@@ -1299,7 +1561,7 @@ CVE-2026-93512 (Unauthenticated Cross Site Scripting (XSS) in JW Player for Word
NOT-FOR-US: WordPress plugin or theme
CVE-2026-93464 (A stored cross-site scripting vulnerability via custom content descrip ...)
NOT-FOR-US: baserCMS
-CVE-2026-93463 (Cross-Site Scripting via Script Validation Bypass exists in baserCMS. ...)
+CVE-2026-93463 (A cross-site scripting vulnerability via script validation bypass exis ...)
NOT-FOR-US: baserCMS
CVE-2026-93462 (A missing authentication for critical function vulnerability exists in ...)
NOT-FOR-US: baserCMS
@@ -3068,7 +3330,7 @@ CVE-2026-10739 (Cato Networks SDP Client for Windows before 6.12.6 allows a loca
CVE-2026-10726 (Cato Windows SDP Client before version 6.12.6 contains an arbitrary fi ...)
NOT-FOR-US: Cato
CVE-2026-103500 (An attacker could cause a heap buffer overflow by getting a user to op ...)
- {DSA-6536-1}
+ {DSA-6536-1 DLA-4810-1}
- thunderbird 1:153.4.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-103500
CVE-2026-103476 (yii2-starter-kit through 4.2.0 fails to validate article publication s ...)
@@ -3798,100 +4060,100 @@ CVE-2026-XXXX [GHSA-5rfj-p5qw-w48g: Unauthenticated remote DoS via attacker-cont
NOTE: https://github.com/sshuttle/sshuttle/security/advisories/GHSA-5rfj-p5qw-w48g
NOTE: Fixed by: https://github.com/sshuttle/sshuttle/commit/baea31a6769baeb52e8837ad6cc582017d74676c (v2.0.0)
CVE-2026-102331 (Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0 ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102317 (Improper privilege management in Mojo in Google Chrome on on Windows p ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102312 (UI misrepresentation in Omnibox in Google Chrome on on Android prior t ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102313 (Uninitialized resource in ANGLE in Google Chrome on on Windows prior t ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102299 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102306 (Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 al ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102307 (Uninitialized resource in Dawn in Google Chrome on on Android prior to ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102323 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102303 (Uninitialized resource in GPU in Google Chrome on on Android prior to ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102311 (Uninitialized resource in GPU in Google Chrome on on Android prior to ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102300 (Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037. ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102326 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102316 (Use after free in Views in Google Chrome prior to 154.0.8037.92 allowe ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102304 (Use after free in Passwords in Google Chrome prior to 154.0.8037.92 al ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102328 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102309 (Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 a ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102325 (Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102308 (Use after free in Views in Google Chrome prior to 154.0.8037.92 allowe ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102301 (Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 all ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102319 (Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102324 (Use after free in PictureInPicture in Google Chrome prior to 154.0.803 ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102318 (Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 al ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102329 (Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102315 (Uninitialized resource in Media in Google Chrome on on Windows prior t ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102302 (Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102321 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102320 (Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102310 (Missing authorization in Payments in Google Chrome prior to 154.0.8037 ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102327 (Incorrect authorization in WebView in Google Chrome on on Android prio ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102330 (Incorrect authorization in SiteIsolation in Google Chrome prior to 154 ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102314 (UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037. ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-102305 (UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154 ...)
- {DSA-6535-1}
+ {DSA-6535-1 DLA-4811-1}
- chromium 154.0.8037.92-1
CVE-2026-94053 (Authentication bypass via LDAP injection in component sshd-ldap in Apa ...)
- libmina-sshd-java <unfixed> (bug #1149652)
@@ -4417,7 +4679,7 @@ CVE-2022-51019 (Akaunting before 2.1.31 contains an OS command injection vulnera
CVE-2015-20122 (Seeyon A6 collaborative office automation platform contains an unauthe ...)
NOT-FOR-US: Seeyon
CVE-2026-100756 (Incorrect boundary conditions in the Audio/Video: Playback component. ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4425,7 +4687,7 @@ CVE-2026-100756 (Incorrect boundary conditions in the Audio/Video: Playback comp
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100756
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100756
CVE-2026-100757 (Use-after-free in the Widget component. This vulnerability was fixed i ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4433,7 +4695,7 @@ CVE-2026-100757 (Use-after-free in the Widget component. This vulnerability was
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100757
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100757
CVE-2026-100758 (Sandbox escape in the DOM: Navigation component. This vulnerability wa ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4441,7 +4703,7 @@ CVE-2026-100758 (Sandbox escape in the DOM: Navigation component. This vulnerabi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100758
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100758
CVE-2026-100759 (Uninitialized memory in the Storage: Quota Manager component. This vul ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4460,7 +4722,7 @@ CVE-2026-100761 (Privilege escalation due to use-after-free in the Graphics: Web
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100761
CVE-2026-100762 (Sandbox escape due to use-after-free in the DOM: Content Processes com ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4482,7 +4744,7 @@ CVE-2026-100765 (Use-after-free in the JavaScript: WebAssembly component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100765
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100765
CVE-2026-100766 (Information disclosure in the Networking: JAR component. This vulnerab ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4490,7 +4752,7 @@ CVE-2026-100766 (Information disclosure in the Networking: JAR component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100766
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100766
CVE-2026-100767 (Use-after-free in the Networking: Cache component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4501,7 +4763,7 @@ CVE-2026-100768 (Use-after-free in the Graphics: WebGPU component. This vulnerab
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100768
CVE-2026-100769 (Use-after-free in the JavaScript: WebAssembly component. This vulnerab ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4509,7 +4771,7 @@ CVE-2026-100769 (Use-after-free in the JavaScript: WebAssembly component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100769
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100769
CVE-2026-100770 (Sandbox escape due to use-after-free in the DOM: Content Processes com ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4517,7 +4779,7 @@ CVE-2026-100770 (Sandbox escape due to use-after-free in the DOM: Content Proces
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100770
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100770
CVE-2026-100771 (Undefined behavior in the DOM: Streams component. This vulnerability w ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4525,7 +4787,7 @@ CVE-2026-100771 (Undefined behavior in the DOM: Streams component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100771
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100771
CVE-2026-100772 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4533,7 +4795,7 @@ CVE-2026-100772 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100772
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100772
CVE-2026-100773 (Use-after-free in the Storage: IndexedDB component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4541,7 +4803,7 @@ CVE-2026-100773 (Use-after-free in the Storage: IndexedDB component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100773
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100773
CVE-2026-100774 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4549,7 +4811,7 @@ CVE-2026-100774 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100774
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100774
CVE-2026-100775 (Sandbox escape in the Graphics component. This vulnerability was fixed ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4557,7 +4819,7 @@ CVE-2026-100775 (Sandbox escape in the Graphics component. This vulnerability wa
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100775
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100775
CVE-2026-100776 (Use-after-free in the JavaScript: WebAssembly component. This vulnerab ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4565,7 +4827,7 @@ CVE-2026-100776 (Use-after-free in the JavaScript: WebAssembly component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100776
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100776
CVE-2026-100777 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4573,7 +4835,7 @@ CVE-2026-100777 (Use-after-free in the Graphics: Canvas2D component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100777
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100777
CVE-2026-100778 (Sandbox escape due to use-after-free in the DOM: Core & HTML component ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4581,7 +4843,7 @@ CVE-2026-100778 (Sandbox escape due to use-after-free in the DOM: Core & HTML co
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100778
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100778
CVE-2026-100779 (Use-after-free in the XSLT component. This vulnerability was fixed in ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4589,7 +4851,7 @@ CVE-2026-100779 (Use-after-free in the XSLT component. This vulnerability was fi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100779
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100779
CVE-2026-100780 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4597,7 +4859,7 @@ CVE-2026-100780 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100780
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100780
CVE-2026-100781 (Sandbox escape due to incorrect boundary conditions in the Graphics: W ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4605,7 +4867,7 @@ CVE-2026-100781 (Sandbox escape due to incorrect boundary conditions in the Grap
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100781
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100781
CVE-2026-100782 (Privilege escalation due to incorrect boundary conditions in the Graph ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4613,7 +4875,7 @@ CVE-2026-100782 (Privilege escalation due to incorrect boundary conditions in th
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100782
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100782
CVE-2026-100783 (Uninitialized memory in the Audio/Video component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4621,7 +4883,7 @@ CVE-2026-100783 (Uninitialized memory in the Audio/Video component. This vulnera
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100783
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100783
CVE-2026-100784 (Use-after-free in the Layout: Text and Fonts component. This vulnerabi ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4629,7 +4891,7 @@ CVE-2026-100784 (Use-after-free in the Layout: Text and Fonts component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100784
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100784
CVE-2026-100785 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4637,7 +4899,7 @@ CVE-2026-100785 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100785
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100785
CVE-2026-100786 (Sandbox escape due to use-after-free in the Graphics component. This v ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4653,7 +4915,7 @@ CVE-2026-100787 (Sandbox escape in the XUL component. This vulnerability was fix
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100787
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100787
CVE-2026-100788 (Invalid pointer in the JavaScript: WebAssembly component. This vulnera ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4661,7 +4923,7 @@ CVE-2026-100788 (Invalid pointer in the JavaScript: WebAssembly component. This
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100788
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100788
CVE-2026-100789 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4669,7 +4931,7 @@ CVE-2026-100789 (Use-after-free in the Graphics: Canvas2D component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100789
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100789
CVE-2026-100790 (Use-after-free in the XSLT component. This vulnerability was fixed in ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4677,7 +4939,7 @@ CVE-2026-100790 (Use-after-free in the XSLT component. This vulnerability was fi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100790
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100790
CVE-2026-100791 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4685,7 +4947,7 @@ CVE-2026-100791 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100791
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100791
CVE-2026-100792 (JIT miscompilation in the JavaScript: WebAssembly component. This vuln ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4696,7 +4958,7 @@ CVE-2026-100793 (JIT miscompilation in the JavaScript Engine component. This vul
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100793
CVE-2026-100794 (Sandbox escape due to incorrect boundary conditions in the Internation ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4704,7 +4966,7 @@ CVE-2026-100794 (Sandbox escape due to incorrect boundary conditions in the Inte
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100794
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100794
CVE-2026-96869 (Information disclosure in the Networking component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4718,7 +4980,7 @@ CVE-2026-100796 (Use-after-free in the JavaScript: WebAssembly component. This v
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100796
CVE-2026-100797 (Privilege escalation due to use-after-free in the Graphics: WebRender ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4745,7 +5007,7 @@ CVE-2026-100800 (Sandbox escape due to use-after-free in the Disability Access A
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100800
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100800
CVE-2026-100801 (Privilege escalation in the DLL Services component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4756,7 +5018,7 @@ CVE-2026-100802 (Uninitialized memory in the Graphics: WebGPU component. This vu
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100802
CVE-2026-100803 (Same-origin policy bypass in the WebExtensions component. This vulnera ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4778,7 +5040,7 @@ CVE-2026-100806 (Uninitialized memory in the Graphics: WebGPU component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100806
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100806
CVE-2026-100807 (Privilege escalation in the DOM: Service Workers component. This vulne ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4805,7 +5067,7 @@ CVE-2026-100810 (Other issue in the DevTools component. This vulnerability was f
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100810
CVE-2026-100811 (Sandbox escape due to use-after-free in the DOM: Core & HTML component ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4851,7 +5113,7 @@ CVE-2026-100817 (Other issue in the JavaScript: WebAssembly component. This vuln
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100817
CVE-2026-100818 (Sandbox escape due to use-after-free in the Widget: Gtk component. Thi ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4859,7 +5121,7 @@ CVE-2026-100818 (Sandbox escape due to use-after-free in the Widget: Gtk compone
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100818
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100818
CVE-2026-100819 (Sandbox escape due to incorrect boundary conditions in the XPCOM compo ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4867,7 +5129,7 @@ CVE-2026-100819 (Sandbox escape due to incorrect boundary conditions in the XPCO
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100819
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100819
CVE-2026-100820 (Privilege escalation in the Address Bar component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4875,7 +5137,7 @@ CVE-2026-100820 (Privilege escalation in the Address Bar component. This vulnera
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100820
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100820
CVE-2026-100821 (Site isolation issue in the Panning and Zooming component. This vulner ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4950,7 +5212,7 @@ CVE-2026-100831 (Use-after-free in the DOM: UI Events & Focus Handling component
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100831
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100831
CVE-2026-100832 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4810-1}
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100832
@@ -25688,7 +25950,7 @@ CVE-2026-92016 (Use-after-free in the Disability Access APIs component. This vul
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-92/#CVE-2026-92016
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-96/#CVE-2026-92016
CVE-2026-92035 (Sandbox escape due to incorrect boundary conditions in the Graphics co ...)
- {DSA-6536-1}
+ {DSA-6536-1 DLA-4810-1}
- firefox 156.0-1
- thunderbird 1:153.3.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-90/#CVE-2026-92035
@@ -58910,7 +59172,7 @@ CVE-2026-73392
REJECTED
CVE-2026-73383 (Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-73382 (Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 ve ...)
+CVE-2026-73382 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-73381 (Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 ...)
NOT-FOR-US: WordPress plugin or theme
@@ -60559,6 +60821,7 @@ CVE-2026-66798 (Use after free in Microsoft Edge (Chromium-based) allows an unau
CVE-2026-66797 (Improper access control in CloudStack's annotation functionality allow ...)
NOT-FOR-US: Red Hat cluster-backup-operator
CVE-2026-18725
+ {DLA-4813-1}
- open-iscsi 2.1.13-1 (bug #1144935)
[trixie] - open-iscsi <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2462023
@@ -60566,6 +60829,7 @@ CVE-2026-18725
NOTE: https://github.com/open-iscsi/open-iscsi/pull/544
NOTE: Fixed by: https://github.com/open-iscsi/open-iscsi/commit/0bdc1ab6718215e67a4acff1e711fc8c6693cff4
CVE-2026-18724
+ {DLA-4813-1}
- open-iscsi 2.1.13-1 (bug #1144935)
[trixie] - open-iscsi <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2461994
@@ -67921,6 +68185,7 @@ CVE-2026-18749 (The type=track branch authorises on _is_my_case(t_attach.case) o
CVE-2026-18744 (Any authenticated case participant can fetch any OTHER vendor's CaseSt ...)
NOT-FOR-US: CERT/CC VINCE
CVE-2026-18728 (A flaw was found in open-iscsi. An integer underflow vulnerability in ...)
+ {DLA-4813-1}
- open-iscsi 2.1.13-1 (bug #1144935)
[trixie] - open-iscsi <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2463029
@@ -67928,6 +68193,7 @@ CVE-2026-18728 (A flaw was found in open-iscsi. An integer underflow vulnerabili
NOTE: https://github.com/open-iscsi/open-iscsi/pull/544
NOTE: Fixed by: https://github.com/open-iscsi/open-iscsi/commit/0bdc1ab6718215e67a4acff1e711fc8c6693cff4
CVE-2026-18727 (A flaw was found in open-iscsi's iscsiuio component. This vulnerabilit ...)
+ {DLA-4813-1}
- open-iscsi 2.1.13-1 (bug #1144935)
[trixie] - open-iscsi <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2462956
@@ -67935,6 +68201,7 @@ CVE-2026-18727 (A flaw was found in open-iscsi's iscsiuio component. This vulner
NOTE: https://github.com/open-iscsi/open-iscsi/pull/544
NOTE: Fixed by: https://github.com/open-iscsi/open-iscsi/commit/0bdc1ab6718215e67a4acff1e711fc8c6693cff4
CVE-2026-18726 (A flaw was found in open-iscsi. This vulnerability allows a remote att ...)
+ {DLA-4813-1}
- open-iscsi 2.1.13-1 (bug #1144935)
[trixie] - open-iscsi <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2462331
@@ -80566,7 +80833,7 @@ CVE-2026-71190 (In OpenStack Swift through 2.38.0, the proxy server Accept heade
NOTE: https://security.openstack.org/ossa/OSSA-2026-031.html
NOTE: https://bugs.launchpad.net/swift/+bug/2158771
CVE-2026-71192 (In OpenStack Swift through 2.38.0, the S3API middleware does not sanit ...)
- {DSA-6449-1}
+ {DSA-6449-1 DLA-4801-1}
- swift 2.37.1-6 (bug #1142972)
NOTE: https://security.openstack.org/ossa/OSSA-2026-030.html
NOTE: https://bugs.launchpad.net/swift/+bug/2158733
@@ -83015,10 +83282,12 @@ CVE-2026-50558 (Penelope Shell Handler is a post-exploitation shell handler for
CVE-2026-4604 (The Klubraum Membership Request plugin for WordPress is vulnerable to ...)
NOT-FOR-US: WordPress plugin
CVE-2026-44944 (An Incorrect Authorization vulnerability in open-iscsi allowsunprivili ...)
+ {DLA-4813-1}
- open-iscsi 2.1.12-1 (bug #1143059)
[trixie] - open-iscsi <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e (2.1.12)
CVE-2026-44943 (An Improper Limitation of a Pathname to a Restricted Directory ('Path ...)
+ {DLA-4813-1}
- open-iscsi 2.1.12-1 (bug #1143059)
[trixie] - open-iscsi <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e (2.1.12)
@@ -112913,7 +113182,7 @@ CVE-2026-56013 (Unauthenticated Insecure Direct Object References (IDOR) in Lice
NOT-FOR-US: WordPress plugin or theme
CVE-2026-56006 (Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-56005 (Subscriber Cross Site Scripting (XSS) in WP Activity Log <= 5.6.3.1 ve ...)
+CVE-2026-56005 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-55967 (AES-GCM encryption/decryption with extremely large cumulative single m ...)
{DLA-4683-1}
@@ -126383,7 +126652,7 @@ CVE-2026-11555 (A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006.
NOT-FOR-US: D-Link
CVE-2026-11554 (A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vul ...)
NOT-FOR-US: TOTOLINK
-CVE-2026-11553 (A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. ...)
+CVE-2026-11553 (A vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon ...)
NOT-FOR-US: Tenda
CVE-2026-11552 (A vulnerability has been found in SourceCodester Onlne Examination & L ...)
NOT-FOR-US: SourceCodester
@@ -126451,9 +126720,9 @@ CVE-2026-11501 (A security flaw has been discovered in SourceCodester Hospitals
NOT-FOR-US: SourceCodester
CVE-2026-11500 (A vulnerability was identified in Weaviate up to 1.37.7. This vulnerab ...)
NOT-FOR-US: Weaviate
-CVE-2026-11499 (A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_x ...)
+CVE-2026-11499 (A vulnerability was determined in Tenda HG7, HG9 and HG10 300001138_en ...)
NOT-FOR-US: Tenda
-CVE-2026-11498 (A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. ...)
+CVE-2026-11498 (A vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon ...)
NOT-FOR-US: Tenda
CVE-2026-11497 (A vulnerability has been found in D-Link DCS-5615 1.01.00. Affected by ...)
NOT-FOR-US: D-Link
@@ -138004,6 +138273,7 @@ CVE-2026-46644 (Symfony Polyfill backports PHP features and provides compatibili
NOTE: https://symfony.com/blog/cve-2026-46644-insecure-equivalence-in-symfony-polyfill-intl-idn-for-ascii-only-xn-labels
NOTE: https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq
CVE-2026-48962 (IO::Compress versions before 2.220 for Perl can execute arbitrary code ...)
+ {DLA-4812-1}
- libio-compress-perl 2.220-1 (bug #1138055)
[trixie] - libio-compress-perl 2.213-1+deb13u1
- perl 5.40.1-8 (bug #1138854)
@@ -138022,6 +138292,7 @@ CVE-2026-48961 (IO::Compress versions from 2.207 before 2.220 for Perl ship a zi
NOTE: Introduced with: https://github.com/pmqs/IO-Compress/commit/ddfe67584a228877e5d28840da75ff32e435a5e3 (v2.207)
NOTE: Fixed by: https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7 (v2.220)
CVE-2026-48959 (IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaust ...)
+ {DLA-4812-1}
- libio-compress-perl 2.220-1 (bug #1138051)
[trixie] - libio-compress-perl 2.213-1+deb13u1
- perl 5.40.1-8 (bug #1138856)
@@ -138029,6 +138300,7 @@ CVE-2026-48959 (IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU e
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40434381/
NOTE: Fixed by: https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2 (v2.220)
CVE-2025-15649 (IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaugh ...)
+ {DLA-4812-1}
- libio-compress-perl 2.217-1 (bug #1146065)
[trixie] - libio-compress-perl 2.213-1+deb13u1
- perl 5.40.1-8 (bug #1138863)
@@ -140667,7 +140939,7 @@ CVE-2026-22554 (A heap-based buffer overflow vulnerability exists in the Channel
NOT-FOR-US: MediaInfoLib
CVE-2026-22315
REJECTED
-CVE-2026-22314 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
+CVE-2026-22314 (Vendor disputed record. The reported behaviour is documented administ ...)
NOT-FOR-US: Meona
CVE-2026-21836 (The HCL DominoIQ RAG feature isaffected bya Broken Access Control vuln ...)
NOT-FOR-US: HCL
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9c9e108a41dc774e6d696455e1a4b33f7eaed8b9
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9c9e108a41dc774e6d696455e1a4b33f7eaed8b9
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/e867cf86/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list