[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 2 20:15:13 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
c4f5b44d by security tracker role at 2026-10-02T19:15:06+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,603 @@
+CVE-2026-97876 (A local attacker with control over GRUB's configuration can bypass loc ...)
+ TODO: check
+CVE-2026-97663 (The Customer Reviews for WooCommerce plugin for WordPress is vulnerabl ...)
+ TODO: check
+CVE-2026-97652 (The WP Statistics \u2013 Simple, privacy-friendly Google Analytics alt ...)
+ TODO: check
+CVE-2026-97641 (The Relevanssi \u2013 A Better Search plugin for WordPress is vulnerab ...)
+ TODO: check
+CVE-2026-97637 (The JSON API Auth plugin for WordPress is vulnerable to Authentication ...)
+ TODO: check
+CVE-2026-97634 (The Event Tickets and Registration plugin for WordPress is vulnerable ...)
+ TODO: check
+CVE-2026-97342 (The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordP ...)
+ TODO: check
+CVE-2026-97338 (The Download Manager plugin for WordPress is vulnerable to Stored Cros ...)
+ TODO: check
+CVE-2026-97336 (The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scrip ...)
+ TODO: check
+CVE-2026-96990 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-96940 (Weak authorization in Microsoft Exchange Server allows an authenticate ...)
+ TODO: check
+CVE-2026-96871 (The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site ...)
+ TODO: check
+CVE-2026-96647 (The Listdom: AI-powered Business Directory with Classifieds Ads Listin ...)
+ TODO: check
+CVE-2026-96613 (The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an autho ...)
+ TODO: check
+CVE-2026-96578 (The GSpeech TTS \u2013 WordPress Text To Speech Plugin plugin for Word ...)
+ TODO: check
+CVE-2026-96567 (The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site ...)
+ TODO: check
+CVE-2026-96566 (The Newsletter \u2013 Send awesome emails from WordPress plugin for Wo ...)
+ TODO: check
+CVE-2026-96294 (Uncaught exception, Improper Handling of Exceptional Conditions vulner ...)
+ TODO: check
+CVE-2026-96292 (Inefficient regular expression complexity, Inefficient Algorithmic Com ...)
+ TODO: check
+CVE-2026-96289 (Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. ...)
+ TODO: check
+CVE-2026-96288 (Uncontrolled Recursion, Allocation of resources without limits or thro ...)
+ TODO: check
+CVE-2026-96287 (Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl ...)
+ TODO: check
+CVE-2026-96286 (Uncaught exception vulnerability in Apache Thrift Perl bindings. Th ...)
+ TODO: check
+CVE-2026-96277 (Uncaught exception, Improper Handling of Exceptional Conditions vulner ...)
+ TODO: check
+CVE-2026-95817 (The DoFollow Case by Case plugin for WordPress is vulnerable to Stored ...)
+ TODO: check
+CVE-2026-95670 (The No External Links plugin for WordPress is vulnerable to Stored Cro ...)
+ TODO: check
+CVE-2026-95662 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-95512 (A flaw was found in FreeType, specifically within its CID font loader. ...)
+ TODO: check
+CVE-2026-94658 (Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua ...)
+ TODO: check
+CVE-2026-94657 (Allocation of resources without limits or throttling vulnerability in ...)
+ TODO: check
+CVE-2026-94656 (Allocation of resources without limits or throttling vulnerability in ...)
+ TODO: check
+CVE-2026-94655 (Allocation of resources without limits or throttling, Inefficient Algo ...)
+ TODO: check
+CVE-2026-94654 (Loop with unreachable exit condition ('infinite loop') vulnerability i ...)
+ TODO: check
+CVE-2026-94653 (Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP ...)
+ TODO: check
+CVE-2026-94652 (Missing release of memory after effective lifetime vulnerability in Ap ...)
+ TODO: check
+CVE-2026-94651 (improper handling of exceptional conditions, Missing release of resour ...)
+ TODO: check
+CVE-2026-94650 (Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. ...)
+ TODO: check
+CVE-2026-94648 (Allocation of resources without limits or throttling vulnerability in ...)
+ TODO: check
+CVE-2026-94646 (Uncaught exception, Improper validation of specified quantity in input ...)
+ TODO: check
+CVE-2026-94645 (Improper validation of specified quantity in input, Allocation of reso ...)
+ TODO: check
+CVE-2026-94644 (Allocation of resources without limits or throttling vulnerability in ...)
+ TODO: check
+CVE-2026-94642 (Uncaught exception vulnerability in Apache Thrift PHP bindings. Thi ...)
+ TODO: check
+CVE-2026-94639 (improper handling of exceptional conditions, Allocation of resources w ...)
+ TODO: check
+CVE-2026-94638 (Allocation of resources without limits or throttling vulnerability in ...)
+ TODO: check
+CVE-2026-94637 (Improper handling of highly compressed data (data amplification) vulne ...)
+ TODO: check
+CVE-2026-94636 (Improper handling of highly compressed data (data amplification), Func ...)
+ TODO: check
+CVE-2026-94635 (Allocation of resources without limits or throttling, Improper handlin ...)
+ TODO: check
+CVE-2026-94634 (Allocation of resources without limits or throttling, Initialization o ...)
+ TODO: check
+CVE-2026-94633 (Memory allocation with excessive size value, Improper handling of leng ...)
+ TODO: check
+CVE-2026-94544 (Next.js is a React framework for building full-stack web applications. ...)
+ TODO: check
+CVE-2026-94543 (Next.js is a React framework for building full-stack web applications. ...)
+ TODO: check
+CVE-2026-94541 (The WPMobile.App \u2013 Android and iOS App Builder plugin for WordPre ...)
+ TODO: check
+CVE-2026-94486 (Next.js is a React framework for building full-stack web applications. ...)
+ TODO: check
+CVE-2026-94485 (Next.js is a React framework for building full-stack web applications. ...)
+ TODO: check
+CVE-2026-94484 (Next.js is a React framework for building full-stack web applications. ...)
+ TODO: check
+CVE-2026-94483 (Next.js is a React framework for building full-stack web applications. ...)
+ TODO: check
+CVE-2026-94432 (The Appointment Booking Plugin \u2013 LatePoint | Calendar & Schedulin ...)
+ TODO: check
+CVE-2026-94405 (Authorization Bypass Through User-Controlled Key vulnerability in Shah ...)
+ TODO: check
+CVE-2026-94180 (Authorization Bypass Through User-Controlled Key vulnerability in Mone ...)
+ TODO: check
+CVE-2026-93926 (Missing release of memory after effective lifetime, Missing release of ...)
+ TODO: check
+CVE-2026-93925 (Stack-based buffer overflow, Incorrect bitwise shift of integer vulner ...)
+ TODO: check
+CVE-2026-93880 (The Greenshift \u2013 animation and page builder blocks plugin for Wor ...)
+ TODO: check
+CVE-2026-93875 (The JetAppointment plugin for WordPress is vulnerable to Stored Cross- ...)
+ TODO: check
+CVE-2026-93756 (The Smash Balloon Social Post Feed \u2013 Simple Social Feeds for Word ...)
+ TODO: check
+CVE-2026-92834 (Use of uninitialized resource, Return of wrong status code vulnerabili ...)
+ TODO: check
+CVE-2026-91784 (cjbassi/gotop is vulnerable to local argument injection via process te ...)
+ TODO: check
+CVE-2026-91137 (Improper validation of specified quantity in input, Allocation of reso ...)
+ TODO: check
+CVE-2026-91135 (Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderT ...)
+ TODO: check
+CVE-2026-90970 (GitLab has remediated a vulnerability in the GitLab AI Gateway compone ...)
+ TODO: check
+CVE-2026-90440 (Uncaught exception, improper handling of exceptional conditions, impro ...)
+ TODO: check
+CVE-2026-87920 (The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross- ...)
+ TODO: check
+CVE-2026-87117 (NULL pointer dereference vulnerability in Apache Thrift PHP bindings. ...)
+ TODO: check
+CVE-2026-86537 (Uncaught exception, Loop with unreachable exit condition ('infinite lo ...)
+ TODO: check
+CVE-2026-86536 (Improperly controlled modification of object prototype attributes ('pr ...)
+ TODO: check
+CVE-2026-86535 (Loop with unreachable exit condition ('infinite loop'), Improperly con ...)
+ TODO: check
+CVE-2026-86326 (An improper verification of cryptographic signature vulnerability exis ...)
+ TODO: check
+CVE-2026-86325 (A stack-based buffer overflow vulnerability exists in protocol gateway ...)
+ TODO: check
+CVE-2026-85494 (Improper handling of length parameter inconsistency, Uncaught exceptio ...)
+ TODO: check
+CVE-2026-85493 (Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME ...)
+ TODO: check
+CVE-2026-85492 (The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffi ...)
+ TODO: check
+CVE-2026-85483 (Use of uninitialized resource, Return of wrong status code vulnerabili ...)
+ TODO: check
+CVE-2026-85476 (Loop with unreachable exit condition ('infinite loop') vulnerability i ...)
+ TODO: check
+CVE-2026-85215 (Improper neutralization of special elements used in an SQL command ('S ...)
+ TODO: check
+CVE-2026-85209 (Missing Authorization vulnerability in AVEZ Electronics Communication ...)
+ TODO: check
+CVE-2026-85088 (Improper Validation of Certificate with Host Mismatch in the C++ and D ...)
+ TODO: check
+CVE-2026-85087 (Improper certificate validation, Return of wrong status code vulnerabi ...)
+ TODO: check
+CVE-2026-85086 (Improper certificate validation, Initialization of a resource with an ...)
+ TODO: check
+CVE-2026-83745 (Memory allocation with excessive size value, Improper handling of leng ...)
+ TODO: check
+CVE-2026-83663 (Uncontrolled Recursion vulnerability in Apache Thrift go bindings. ...)
+ TODO: check
+CVE-2026-83632 (Allocation of resources without limits or throttling, Integer overflow ...)
+ TODO: check
+CVE-2026-82459 (Integer underflow (wrap or wraparound), Out-of-bounds write vulnerabil ...)
+ TODO: check
+CVE-2026-82458 (Memory allocation with excessive size value, Allocation of resources w ...)
+ TODO: check
+CVE-2026-80464 (Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef ...)
+ TODO: check
+CVE-2026-80443 (Improper certificate validation vulnerability in HAVELSAN Inc. Sef - A ...)
+ TODO: check
+CVE-2026-80337 (Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot ...)
+ TODO: check
+CVE-2026-80298 (Improper neutralization of special elements used in an SQL command ('S ...)
+ TODO: check
+CVE-2026-67989 (crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 cont ...)
+ TODO: check
+CVE-2026-66859 (NULL Pointer Dereference, Use of Uninitialized Variable vulnerability ...)
+ TODO: check
+CVE-2026-66858 (The protocol skip routine in several Apache Thrift bindings did not ap ...)
+ TODO: check
+CVE-2026-66837 (Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerabil ...)
+ TODO: check
+CVE-2026-66331 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-66081 (Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib ...)
+ TODO: check
+CVE-2026-66055 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-66054 (Allocation of Resources Without Limits or Throttling, Improper Handlin ...)
+ TODO: check
+CVE-2026-64818
+ REJECTED
+CVE-2026-63772 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-63578 (Allocation of resources without limits in password-based private-key d ...)
+ TODO: check
+CVE-2026-63577 (Improper certificate validation in the directoryName name-constraint c ...)
+ TODO: check
+CVE-2026-63576 (Improper certificate validation in PkixNameConstraintValidator (Extrac ...)
+ TODO: check
+CVE-2026-63575 (Loop with unreachable exit condition in the PKCS#12 key derivation (Pk ...)
+ TODO: check
+CVE-2026-63574 (Memory allocation with excessive size value in the OpenPGP signature a ...)
+ TODO: check
+CVE-2026-63573 (Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap ...)
+ TODO: check
+CVE-2026-63572 (Allocation of resources without limits in PKCS#12 keystore loading (Pk ...)
+ TODO: check
+CVE-2026-63571 (Improper verification of cryptographic signature in the attribute cert ...)
+ TODO: check
+CVE-2026-63570 (Loop with unreachable exit condition in Pkcs12Store.GetCertificateChai ...)
+ TODO: check
+CVE-2026-61374 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-61373 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-5782 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-59673 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59672 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59671 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59670 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59669 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59668 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59667 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59666 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59665 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59664 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59663 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59662 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59661 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59660 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59659 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
+ TODO: check
+CVE-2026-59265 (A code execution issue in the Java integration in Apache OpenOffice v4 ...)
+ TODO: check
+CVE-2026-51922 (agentscope v1.0.20 contains code injection in execute_shell_command (s ...)
+ TODO: check
+CVE-2026-51918 (FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with ...)
+ TODO: check
+CVE-2026-51917 (FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_ ...)
+ TODO: check
+CVE-2026-51916 (TransformerOptimus SuperAGI v0.0.14 contains an incorrect access contr ...)
+ TODO: check
+CVE-2026-51915 (TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access ...)
+ TODO: check
+CVE-2026-51914 (TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access ...)
+ TODO: check
+CVE-2026-51911 (vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_ ...)
+ TODO: check
+CVE-2026-51907 (In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image ...)
+ TODO: check
+CVE-2026-51906 (In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_ima ...)
+ TODO: check
+CVE-2026-51904 (SuperAGI up to v0.0.14 contains an improper access control vulnerabili ...)
+ TODO: check
+CVE-2026-51901 (SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The a ...)
+ TODO: check
+CVE-2026-51899 (In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/creat ...)
+ TODO: check
+CVE-2026-51898 (sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExe ...)
+ TODO: check
+CVE-2026-39717 (Missing Authorization vulnerability in ThimPress LearnPress learnpress ...)
+ TODO: check
+CVE-2026-39601 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
+ TODO: check
+CVE-2026-39600 (URL Redirection to Untrusted Site ('Open Redirect') vulnerability in M ...)
+ TODO: check
+CVE-2026-39444 (Authorization Bypass Through User-Controlled Key vulnerability in Publ ...)
+ TODO: check
+CVE-2026-39439 (Missing Authorization vulnerability in Kiera Howe WebSamurai websamura ...)
+ TODO: check
+CVE-2026-32585 (Missing Authorization vulnerability in airano Airano MCP Bridge airano ...)
+ TODO: check
+CVE-2026-32584 (Insertion of Sensitive Information Into Sent Data vulnerability in Chi ...)
+ TODO: check
+CVE-2026-19856 (The All in One SEO WordPress plugin before 5.0.2.1 does not correctly ...)
+ TODO: check
+CVE-2026-19652 (The Divi Membership plugin for WordPress is vulnerable to Privilege Es ...)
+ TODO: check
+CVE-2026-18036 (In Bouncy Castle for Java before 1.86, NTRU reduced secret values with ...)
+ TODO: check
+CVE-2026-17508 (In Bouncy Castle for Java before 1.86, several password-based key deri ...)
+ TODO: check
+CVE-2026-17507 (In Bouncy Castle for Java before 1.86, the MLS implementation (org.bou ...)
+ TODO: check
+CVE-2026-12951 (The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to ...)
+ TODO: check
+CVE-2026-11795 (Observable discrepancy vulnerability in Softtr Informatics Trading Lim ...)
+ TODO: check
+CVE-2026-104914 (MISP contains an improper access control vulnerability in its attribut ...)
+ TODO: check
+CVE-2026-104912 (MISP contains an authorization flaw in its correlation handling during ...)
+ TODO: check
+CVE-2026-104910 (MISP contains an authorization bypass in the related events listing fu ...)
+ TODO: check
+CVE-2026-104908 (MISP contains an improper input validation vulnerability in the decayi ...)
+ TODO: check
+CVE-2026-104907 (MISP contains a cross-site scripting (XSS) vulnerability in the remote ...)
+ TODO: check
+CVE-2026-104906 (MISP contains a cross-site scripting (XSS) vulnerability in the TAXII ...)
+ TODO: check
+CVE-2026-104901 (MISP contains a cross-site scripting (XSS) vulnerability in the ID Tra ...)
+ TODO: check
+CVE-2026-104900 (MISP contains a stored cross-site scripting (XSS) vulnerability in the ...)
+ TODO: check
+CVE-2026-104861 (probe-image-size gets image dimensions without downloading the entire ...)
+ TODO: check
+CVE-2026-104859 (Nx is a monorepo solution for TypeScript and polyglot codebases. From ...)
+ TODO: check
+CVE-2026-104855 (Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47 ...)
+ TODO: check
+CVE-2026-104854 (Nx is a monorepo solution for TypeScript and polyglot codebases. From ...)
+ TODO: check
+CVE-2026-104853 (Nx is a monorepo solution for TypeScript and polyglot codebases. From ...)
+ TODO: check
+CVE-2026-104851 (fsspec is a specification and Python implementation framework for file ...)
+ TODO: check
+CVE-2026-104849 (Tinypool is a minimal Node.js worker thread pool implementation. Prior ...)
+ TODO: check
+CVE-2026-104848 (Tinypool is a minimal Node.js worker thread pool implementation. Prior ...)
+ TODO: check
+CVE-2026-104847 (ProseMirror's view component renders and manages the editable browser ...)
+ TODO: check
+CVE-2026-104846 (Seroval facilitates JS value stringification, including complex struct ...)
+ TODO: check
+CVE-2026-104845 (Seroval facilitates JS value stringification, including complex struct ...)
+ TODO: check
+CVE-2026-104844 (PostCSS Selector Parser is a CSS selector parser that integrates with ...)
+ TODO: check
+CVE-2026-104843 (uv is a Python package and project manager written in Rust. From 0.12. ...)
+ TODO: check
+CVE-2026-104733 (User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows ...)
+ TODO: check
+CVE-2026-104721 (Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (l ...)
+ TODO: check
+CVE-2026-104638 (A security vulnerability has been detected in onetwothreeneth Hospital ...)
+ TODO: check
+CVE-2026-104637 (A weakness has been identified in onetwothreeneth HospitalManagementSy ...)
+ TODO: check
+CVE-2026-104625 (A security flaw has been discovered in CodeAstro Simple Loan Managemen ...)
+ TODO: check
+CVE-2026-104614 (A vulnerability was identified in CodeAstro Simple Pharmacy Management ...)
+ TODO: check
+CVE-2026-104613 (A vulnerability was determined in CodeAstro Simple Pharmacy Management ...)
+ TODO: check
+CVE-2026-104612 (A vulnerability was found in SourceCodester Student Result Management ...)
+ TODO: check
+CVE-2026-104611 (A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an ...)
+ TODO: check
+CVE-2026-104610 (A security vulnerability has been detected in Tenda HG7, HG9 and HG10 ...)
+ TODO: check
+CVE-2026-104609 (A weakness has been identified in onetwothreeneth HospitalManagementSy ...)
+ TODO: check
+CVE-2026-104606 (A security flaw has been discovered in itsourcecode Online Admission S ...)
+ TODO: check
+CVE-2026-104473 (YesWiki before 4.5.3 contains multiple reflected cross-site scripting ...)
+ TODO: check
+CVE-2026-104472 (YesWiki before 4.6.7 contains a missing authorization vulnerability in ...)
+ TODO: check
+CVE-2026-104471 (YesWiki before 4.6.7 contains an unrestricted file upload vulnerabilit ...)
+ TODO: check
+CVE-2026-104470 (YesWiki before 4.6.7 contains a server-side request forgery vulnerabil ...)
+ TODO: check
+CVE-2026-104469 (YesWiki before 4.6.7 contains a session fixation vulnerability that al ...)
+ TODO: check
+CVE-2026-104468 (YesWiki before 4.6.7 contains an insufficient session expiration vulne ...)
+ TODO: check
+CVE-2026-104467 (YesWiki before 4.6.7 contains an authorization bypass vulnerability in ...)
+ TODO: check
+CVE-2026-104466 (YesWiki before 4.6.7 contains a stored cross-site scripting vulnerabil ...)
+ TODO: check
+CVE-2026-104465 (YesWiki before 4.6.7 contains a reflected cross-site scripting vulnera ...)
+ TODO: check
+CVE-2026-104464 (YesWiki before 4.6.7 contains a server-side request forgery vulnerabil ...)
+ TODO: check
+CVE-2026-104463 (YesWiki before 4.6.7 contains a server-side request forgery vulnerabil ...)
+ TODO: check
+CVE-2026-104462 (YesWiki before 4.6.7 contains an SQL injection vulnerability in the Ba ...)
+ TODO: check
+CVE-2026-104461 (YesWiki before 4.6.7 contains a stored cross-site scripting vulnerabil ...)
+ TODO: check
+CVE-2026-104460 (YesWiki before 4.6.7 contains a blind SQL injection vulnerability in t ...)
+ TODO: check
+CVE-2026-104459 (YesWiki before 4.6.7 contains a server-side request forgery vulnerabil ...)
+ TODO: check
+CVE-2026-104458 (YesWiki before 4.6.7 contains a server-side request forgery vulnerabil ...)
+ TODO: check
+CVE-2026-104457 (YesWiki before 4.6.7 contains an SQL injection vulnerability in the Ba ...)
+ TODO: check
+CVE-2026-104456 (YesWiki before 4.6.7 contains a second-order SQL injection vulnerabili ...)
+ TODO: check
+CVE-2026-104455 (YesWiki before 4.6.7 contains an access control bypass vulnerability t ...)
+ TODO: check
+CVE-2026-104454 (YesWiki before 4.6.7 contains an algorithmic-complexity denial of serv ...)
+ TODO: check
+CVE-2026-104453 (YesWiki before 4.6.7 contains a cross-site request forgery vulnerabili ...)
+ TODO: check
+CVE-2026-104452 (YesWiki before 4.6.7 contains a cross-site request forgery vulnerabili ...)
+ TODO: check
+CVE-2026-104451 (YesWiki before 4.6.7 contains a cross-site request forgery vulnerabili ...)
+ TODO: check
+CVE-2026-104450 (YesWiki before 4.6.7 contains a missing authorization flaw in the poin ...)
+ TODO: check
+CVE-2026-104449 (YesWiki before 4.6.7 contains an access control vulnerability allowing ...)
+ TODO: check
+CVE-2026-104448 (YesWiki before 4.6.7 contains a cross-site request forgery vulnerabili ...)
+ TODO: check
+CVE-2026-104447 (YesWiki before 4.6.7 contains a cross-site request forgery vulnerabili ...)
+ TODO: check
+CVE-2026-104446 (YesWiki before 4.6.7 contains an authentication bypass in the contact ...)
+ TODO: check
+CVE-2026-104445 (YesWiki before 4.6.7 contains an authentication bypass vulnerability i ...)
+ TODO: check
+CVE-2026-104444 (YesWiki before 4.6.7 contains an authorization bypass vulnerability in ...)
+ TODO: check
+CVE-2026-104443 (YesWiki before 4.6.7 contains an empty-filter scope bypass in the trip ...)
+ TODO: check
+CVE-2026-104442 (YesWiki before 4.6.7 contains an unauthenticated server-side request f ...)
+ TODO: check
+CVE-2026-104441 (YesWiki before 4.6.7 contains an unauthenticated server-side request f ...)
+ TODO: check
+CVE-2026-104440 (YesWiki before 4.6.7 contains a blind server-side request forgery vuln ...)
+ TODO: check
+CVE-2026-104439 (YesWiki before 4.6.7 contains a user enumeration vulnerability in Lost ...)
+ TODO: check
+CVE-2026-104438 (YesWiki before 4.6.7 contains a missing authorization vulnerability in ...)
+ TODO: check
+CVE-2026-104437 (Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 ...)
+ TODO: check
+CVE-2026-104436 (Zebra before 4.5.0 contains an uncontrolled resource consumption vulne ...)
+ TODO: check
+CVE-2026-104435 (Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 co ...)
+ TODO: check
+CVE-2026-104434 (ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 c ...)
+ TODO: check
+CVE-2026-104432 (Zebra before 6.3.0 contains an improper exceptional condition check in ...)
+ TODO: check
+CVE-2026-104431 (Zebra before 6.0.0 contains a denial of service vulnerability that all ...)
+ TODO: check
+CVE-2026-104430 (Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script sig ...)
+ TODO: check
+CVE-2026-104429 (Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mem ...)
+ TODO: check
+CVE-2026-104428 (The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash ...)
+ TODO: check
+CVE-2026-104427 (Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the ...)
+ TODO: check
+CVE-2026-104426 (Zebra before 6.1.0 contains an inefficient algorithmic complexity vuln ...)
+ TODO: check
+CVE-2026-104425 (ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vuln ...)
+ TODO: check
+CVE-2026-104424 (Zebra before 6.1.0 contains an incorrect calculation vulnerability in ...)
+ TODO: check
+CVE-2026-104423 (Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumptio ...)
+ TODO: check
+CVE-2026-104422 (The block sync download path in Zebra (zebrad) before 6.3.0 reads a bl ...)
+ TODO: check
+CVE-2026-104421 (Zebra before 6.2.1 contains an incomplete cleanup vulnerability that a ...)
+ TODO: check
+CVE-2026-104420 (Zebra before 6.3.0 contains a protection mechanism failure that allows ...)
+ TODO: check
+CVE-2026-104419 (Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the blo ...)
+ TODO: check
+CVE-2026-104418 (Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulne ...)
+ TODO: check
+CVE-2026-104417 (Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerabilit ...)
+ TODO: check
+CVE-2026-104416 (Ghost from 4.39.0 before 6.64.0 contains an information disclosure vul ...)
+ TODO: check
+CVE-2026-104415 (Ghost from 0.7.2 before 6.64.0 contains an information disclosure vuln ...)
+ TODO: check
+CVE-2026-104414 (Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting ...)
+ TODO: check
+CVE-2026-104413 (Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting ...)
+ TODO: check
+CVE-2026-104412 (Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assig ...)
+ TODO: check
+CVE-2026-104411 (Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting ...)
+ TODO: check
+CVE-2026-104410 (SiYuan before 3.8.5 contains an information disclosure vulnerability t ...)
+ TODO: check
+CVE-2026-104403 (Authorization Bypass Through User-Controlled Key vulnerability in Thim ...)
+ TODO: check
+CVE-2026-104026 (In Sapling SCM prior to v0.2.20260929-102736, control characters were ...)
+ TODO: check
+CVE-2026-103958 (Server-side request forgery in the tool server and remote agent connec ...)
+ TODO: check
+CVE-2026-103957 (Server-side request forgery in the OAuth2 discovery handling in Loom f ...)
+ TODO: check
+CVE-2026-103956 (Missing authentication for critical function in the authentication dep ...)
+ TODO: check
+CVE-2026-103885 (Asymmetric Resource Consumptionvulnerability in Apache Directory LDAP ...)
+ TODO: check
+CVE-2026-103880 (Asymmetric Resource Consumptionvulnerability in Apache Directory LDAP ...)
+ TODO: check
+CVE-2026-103878 (Cleartext transmission of sensitive informationvulnerability in Apache ...)
+ TODO: check
+CVE-2026-103877 (Deserialization of Untrusted Data vulnerability in Apache Directory LD ...)
+ TODO: check
+CVE-2026-103763 (SiYuan before v3.8.5 contains an information disclosure vulnerability ...)
+ TODO: check
+CVE-2026-103762 (SiYuan before v3.8.5 contains a missing authorization vulnerability in ...)
+ TODO: check
+CVE-2026-103648 (Path traversal in image-downloader 4.3.0 allows an attacker who can co ...)
+ TODO: check
+CVE-2026-103631 (Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allo ...)
+ TODO: check
+CVE-2026-103630 (Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowe ...)
+ TODO: check
+CVE-2026-103629 (Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allow ...)
+ TODO: check
+CVE-2026-103628 (Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 a ...)
+ TODO: check
+CVE-2026-103627 (Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowe ...)
+ TODO: check
+CVE-2026-103626 (Incorrect authorization in FileSystem in Google Chrome on on Windows p ...)
+ TODO: check
+CVE-2026-103625 (Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a ...)
+ TODO: check
+CVE-2026-103624 (Use after free in Contextual Tasks in Google Chrome on on Windows prio ...)
+ TODO: check
+CVE-2026-103623 (Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 ...)
+ TODO: check
+CVE-2026-103622 (Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed ...)
+ TODO: check
+CVE-2026-103621 (Integer overflow in Compositing in Google Chrome prior to 154.0.8037.9 ...)
+ TODO: check
+CVE-2026-103604 (Inefficient algorithmic complexity in X.509 distinguished name string ...)
+ TODO: check
+CVE-2026-103603 (Memory allocation with excessive size value in the HSS/LMS signature c ...)
+ TODO: check
+CVE-2026-103602 (Improper certificate validation in PkixNameConstraintValidator in Legi ...)
+ TODO: check
+CVE-2026-103601 (Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7 ...)
+ TODO: check
+CVE-2026-103600 (Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1Strea ...)
+ TODO: check
+CVE-2026-103552 (Stack Overflow vulnerability in Apache Directory LDAP API. Before b ...)
+ TODO: check
+CVE-2026-103426 (The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cr ...)
+ TODO: check
+CVE-2026-102798 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-102797 (Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group The ...)
+ TODO: check
+CVE-2026-102795 (Improper Access Control vulnerability in Apache Traffic Server. Thi ...)
+ TODO: check
+CVE-2026-102772 (The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scrip ...)
+ TODO: check
+CVE-2026-102731 (Memory allocation with excessive size value vulnerability in Apache Di ...)
+ TODO: check
+CVE-2026-102626 (An authenticated LimeSurvey Community Edition 7.4.0user with the globa ...)
+ TODO: check
+CVE-2026-102002 (The Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg E ...)
+ TODO: check
+CVE-2026-101104 (The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an autho ...)
+ TODO: check
+CVE-2026-100182 (The Download Monitor plugin for WordPress is vulnerable to Stored Cros ...)
+ TODO: check
+CVE-2026-100107 (The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored ...)
+ TODO: check
+CVE-2023-54405 (H3C CVM, the Cloud Virtualization Management component of the H3C CAS ...)
+ TODO: check
+CVE-2020-37278 (Weaver e-Bridge contains an unauthenticated arbitrary file read vulner ...)
+ TODO: check
+CVE-2014-125130 (CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for W ...)
+ TODO: check
CVE-2026-102966
- mediawiki 1:1.43.10+dfsg-1
NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
@@ -1407,7 +2007,7 @@ CVE-2026-97288 (Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97287 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-97286 (Contributor Cross Site Scripting (XSS) in Strong Testimonials <= 3.3.1 ...)
+CVE-2026-97286 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97285 (Contributor Broken Access Control in The Events Calendar <= 6.17.5 ver ...)
NOT-FOR-US: WordPress plugin or theme
@@ -4769,7 +5369,7 @@ CVE-2022-51019 (Akaunting before 2.1.31 contains an OS command injection vulnera
CVE-2015-20122 (Seeyon A6 collaborative office automation platform contains an unauthe ...)
NOT-FOR-US: Seeyon
CVE-2026-100756 (Incorrect boundary conditions in the Audio/Video: Playback component. ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4777,7 +5377,7 @@ CVE-2026-100756 (Incorrect boundary conditions in the Audio/Video: Playback comp
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100756
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100756
CVE-2026-100757 (Use-after-free in the Widget component. This vulnerability was fixed i ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4785,7 +5385,7 @@ CVE-2026-100757 (Use-after-free in the Widget component. This vulnerability was
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100757
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100757
CVE-2026-100758 (Sandbox escape in the DOM: Navigation component. This vulnerability wa ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4793,7 +5393,7 @@ CVE-2026-100758 (Sandbox escape in the DOM: Navigation component. This vulnerabi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100758
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100758
CVE-2026-100759 (Uninitialized memory in the Storage: Quota Manager component. This vul ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4801,7 +5401,7 @@ CVE-2026-100759 (Uninitialized memory in the Storage: Quota Manager component. T
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100759
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100759
CVE-2026-100760 (Sandbox escape in the Security: Process Sandboxing component. This vul ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4814,7 +5414,7 @@ CVE-2026-100761 (Privilege escalation due to use-after-free in the Graphics: Web
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100761
CVE-2026-100762 (Sandbox escape due to use-after-free in the DOM: Content Processes com ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4828,7 +5428,7 @@ CVE-2026-100764 (Privilege escalation due to incorrect boundary conditions in th
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100764
CVE-2026-100765 (Use-after-free in the JavaScript: WebAssembly component. This vulnerab ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4838,7 +5438,7 @@ CVE-2026-100765 (Use-after-free in the JavaScript: WebAssembly component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100765
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100765
CVE-2026-100766 (Information disclosure in the Networking: JAR component. This vulnerab ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4846,7 +5446,7 @@ CVE-2026-100766 (Information disclosure in the Networking: JAR component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100766
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100766
CVE-2026-100767 (Use-after-free in the Networking: Cache component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4857,7 +5457,7 @@ CVE-2026-100768 (Use-after-free in the Graphics: WebGPU component. This vulnerab
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100768
CVE-2026-100769 (Use-after-free in the JavaScript: WebAssembly component. This vulnerab ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4865,7 +5465,7 @@ CVE-2026-100769 (Use-after-free in the JavaScript: WebAssembly component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100769
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100769
CVE-2026-100770 (Sandbox escape due to use-after-free in the DOM: Content Processes com ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4873,7 +5473,7 @@ CVE-2026-100770 (Sandbox escape due to use-after-free in the DOM: Content Proces
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100770
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100770
CVE-2026-100771 (Undefined behavior in the DOM: Streams component. This vulnerability w ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4881,7 +5481,7 @@ CVE-2026-100771 (Undefined behavior in the DOM: Streams component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100771
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100771
CVE-2026-100772 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4889,7 +5489,7 @@ CVE-2026-100772 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100772
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100772
CVE-2026-100773 (Use-after-free in the Storage: IndexedDB component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4897,7 +5497,7 @@ CVE-2026-100773 (Use-after-free in the Storage: IndexedDB component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100773
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100773
CVE-2026-100774 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4905,7 +5505,7 @@ CVE-2026-100774 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100774
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100774
CVE-2026-100775 (Sandbox escape in the Graphics component. This vulnerability was fixed ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4913,7 +5513,7 @@ CVE-2026-100775 (Sandbox escape in the Graphics component. This vulnerability wa
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100775
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100775
CVE-2026-100776 (Use-after-free in the JavaScript: WebAssembly component. This vulnerab ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4921,7 +5521,7 @@ CVE-2026-100776 (Use-after-free in the JavaScript: WebAssembly component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100776
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100776
CVE-2026-100777 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4929,7 +5529,7 @@ CVE-2026-100777 (Use-after-free in the Graphics: Canvas2D component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100777
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100777
CVE-2026-100778 (Sandbox escape due to use-after-free in the DOM: Core & HTML component ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4937,7 +5537,7 @@ CVE-2026-100778 (Sandbox escape due to use-after-free in the DOM: Core & HTML co
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100778
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100778
CVE-2026-100779 (Use-after-free in the XSLT component. This vulnerability was fixed in ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4945,7 +5545,7 @@ CVE-2026-100779 (Use-after-free in the XSLT component. This vulnerability was fi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100779
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100779
CVE-2026-100780 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4953,7 +5553,7 @@ CVE-2026-100780 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100780
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100780
CVE-2026-100781 (Sandbox escape due to incorrect boundary conditions in the Graphics: W ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4961,7 +5561,7 @@ CVE-2026-100781 (Sandbox escape due to incorrect boundary conditions in the Grap
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100781
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100781
CVE-2026-100782 (Privilege escalation due to incorrect boundary conditions in the Graph ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4969,7 +5569,7 @@ CVE-2026-100782 (Privilege escalation due to incorrect boundary conditions in th
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100782
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100782
CVE-2026-100783 (Uninitialized memory in the Audio/Video component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4977,7 +5577,7 @@ CVE-2026-100783 (Uninitialized memory in the Audio/Video component. This vulnera
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100783
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100783
CVE-2026-100784 (Use-after-free in the Layout: Text and Fonts component. This vulnerabi ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4985,7 +5585,7 @@ CVE-2026-100784 (Use-after-free in the Layout: Text and Fonts component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100784
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100784
CVE-2026-100785 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4993,7 +5593,7 @@ CVE-2026-100785 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100785
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100785
CVE-2026-100786 (Sandbox escape due to use-after-free in the Graphics component. This v ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5001,7 +5601,7 @@ CVE-2026-100786 (Sandbox escape due to use-after-free in the Graphics component.
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100786
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100786
CVE-2026-100787 (Sandbox escape in the XUL component. This vulnerability was fixed in F ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5011,7 +5611,7 @@ CVE-2026-100787 (Sandbox escape in the XUL component. This vulnerability was fix
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100787
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100787
CVE-2026-100788 (Invalid pointer in the JavaScript: WebAssembly component. This vulnera ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5019,7 +5619,7 @@ CVE-2026-100788 (Invalid pointer in the JavaScript: WebAssembly component. This
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100788
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100788
CVE-2026-100789 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5027,7 +5627,7 @@ CVE-2026-100789 (Use-after-free in the Graphics: Canvas2D component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100789
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100789
CVE-2026-100790 (Use-after-free in the XSLT component. This vulnerability was fixed in ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5035,7 +5635,7 @@ CVE-2026-100790 (Use-after-free in the XSLT component. This vulnerability was fi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100790
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100790
CVE-2026-100791 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5043,7 +5643,7 @@ CVE-2026-100791 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100791
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100791
CVE-2026-100792 (JIT miscompilation in the JavaScript: WebAssembly component. This vuln ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5054,7 +5654,7 @@ CVE-2026-100793 (JIT miscompilation in the JavaScript Engine component. This vul
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100793
CVE-2026-100794 (Sandbox escape due to incorrect boundary conditions in the Internation ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5062,7 +5662,7 @@ CVE-2026-100794 (Sandbox escape due to incorrect boundary conditions in the Inte
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100794
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100794
CVE-2026-96869 (Information disclosure in the Networking component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5076,7 +5676,7 @@ CVE-2026-100796 (Use-after-free in the JavaScript: WebAssembly component. This v
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100796
CVE-2026-100797 (Privilege escalation due to use-after-free in the Graphics: WebRender ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5084,7 +5684,7 @@ CVE-2026-100797 (Privilege escalation due to use-after-free in the Graphics: Web
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100797
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100797
CVE-2026-100798 (Cryptography misuse in Storage: Quota Manager component. This vulnerab ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5097,7 +5697,7 @@ CVE-2026-100799 (Uninitialized memory in the Graphics: WebGPU component. This vu
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100799
CVE-2026-100800 (Sandbox escape due to use-after-free in the Disability Access APIs com ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5107,7 +5707,7 @@ CVE-2026-100800 (Sandbox escape due to use-after-free in the Disability Access A
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100800
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100800
CVE-2026-100801 (Privilege escalation in the DLL Services component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5118,7 +5718,7 @@ CVE-2026-100802 (Uninitialized memory in the Graphics: WebGPU component. This vu
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100802
CVE-2026-100803 (Same-origin policy bypass in the WebExtensions component. This vulnera ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5132,7 +5732,7 @@ CVE-2026-100805 (Race condition, use-after-free in the Audio/Video component. Th
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100805
CVE-2026-100806 (Uninitialized memory in the Graphics: WebGPU component. This vulnerabi ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5142,7 +5742,7 @@ CVE-2026-100806 (Uninitialized memory in the Graphics: WebGPU component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100806
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100806
CVE-2026-100807 (Privilege escalation in the DOM: Service Workers component. This vulne ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5150,7 +5750,7 @@ CVE-2026-100807 (Privilege escalation in the DOM: Service Workers component. Thi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100807
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100807
CVE-2026-100808 (Mitigation bypass in the DOM: Service Workers component. This vulnerab ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5160,7 +5760,7 @@ CVE-2026-100808 (Mitigation bypass in the DOM: Service Workers component. This v
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100808
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100808
CVE-2026-100809 (Same-origin policy bypass in the DevTools component. This vulnerabilit ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5173,7 +5773,7 @@ CVE-2026-100810 (Other issue in the DevTools component. This vulnerability was f
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100810
CVE-2026-100811 (Sandbox escape due to use-after-free in the DOM: Core & HTML component ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5181,7 +5781,7 @@ CVE-2026-100811 (Sandbox escape due to use-after-free in the DOM: Core & HTML co
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100811
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100811
CVE-2026-100812 (Denial-of-service in the Graphics component. This vulnerability was fi ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5194,7 +5794,7 @@ CVE-2026-100813 (Invalid pointer in the JavaScript Engine: JIT component. This v
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100813
CVE-2026-100814 (Incorrect boundary conditions in the JavaScript Engine: JIT component. ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5204,7 +5804,7 @@ CVE-2026-100814 (Incorrect boundary conditions in the JavaScript Engine: JIT com
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100814
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100814
CVE-2026-100815 (Use-after-free in the CSS Parsing and Computation component. This vuln ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5214,7 +5814,7 @@ CVE-2026-100815 (Use-after-free in the CSS Parsing and Computation component. Th
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100815
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100815
CVE-2026-100816 (Site isolation issue in the DOM: Networking component. This vulnerabil ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5227,7 +5827,7 @@ CVE-2026-100817 (Other issue in the JavaScript: WebAssembly component. This vuln
- firefox 157.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100817
CVE-2026-100818 (Sandbox escape due to use-after-free in the Widget: Gtk component. Thi ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5235,7 +5835,7 @@ CVE-2026-100818 (Sandbox escape due to use-after-free in the Widget: Gtk compone
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100818
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100818
CVE-2026-100819 (Sandbox escape due to incorrect boundary conditions in the XPCOM compo ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5243,7 +5843,7 @@ CVE-2026-100819 (Sandbox escape due to incorrect boundary conditions in the XPCO
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100819
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100819
CVE-2026-100820 (Privilege escalation in the Address Bar component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5251,7 +5851,7 @@ CVE-2026-100820 (Privilege escalation in the Address Bar component. This vulnera
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100820
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100820
CVE-2026-100821 (Site isolation issue in the Panning and Zooming component. This vulner ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5259,7 +5859,7 @@ CVE-2026-100821 (Site isolation issue in the Panning and Zooming component. This
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100821
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100821
CVE-2026-100822 (Spoofing issue in the Networking: HTTP component. This vulnerability w ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5272,7 +5872,7 @@ CVE-2026-100823 (Spoofing issue in the Downloads component in Firefox for Androi
- firefox <not-affected> (Only affects Firefox on Android)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100823
CVE-2026-100824 (Privilege escalation in the Places component. This vulnerability was f ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5282,7 +5882,7 @@ CVE-2026-100824 (Privilege escalation in the Places component. This vulnerabilit
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100824
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100824
CVE-2026-100825 (Use-after-free in the JavaScript Engine: JIT component. This vulnerabi ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5292,7 +5892,7 @@ CVE-2026-100825 (Use-after-free in the JavaScript Engine: JIT component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100825
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100825
CVE-2026-100826 (Denial-of-service in the Storage: StorageManager component. This vulne ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5302,7 +5902,7 @@ CVE-2026-100826 (Denial-of-service in the Storage: StorageManager component. Thi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100826
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100826
CVE-2026-100828 (Mitigation bypass in the Bookmarks & History component. This vulnerabi ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5312,7 +5912,7 @@ CVE-2026-100828 (Mitigation bypass in the Bookmarks & History component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100828
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100828
CVE-2026-100829 (Mitigation bypass in the DOM: Security component. This vulnerability w ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5322,7 +5922,7 @@ CVE-2026-100829 (Mitigation bypass in the DOM: Security component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100829
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100829
CVE-2026-100830 (Mitigation bypass in the DOM: Navigation component. This vulnerability ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5332,7 +5932,7 @@ CVE-2026-100830 (Mitigation bypass in the DOM: Navigation component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100830
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100830
CVE-2026-100831 (Use-after-free in the DOM: UI Events & Focus Handling component. This ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5340,7 +5940,7 @@ CVE-2026-100831 (Use-after-free in the DOM: UI Events & Focus Handling component
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100831
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100831
CVE-2026-100832 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100832
@@ -7558,6 +8158,7 @@ CVE-2026-100310 (GNU libextractor before 1.16 loads plugins from an untrusted se
CVE-2026-100208 (Integer overflow or wraparound in Microsoft Office Outlook allows an u ...)
NOT-FOR-US: Microsoft
CVE-2026-104201 [GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption]
+ {DSA-6540-1}
- radsecproxy 1.11.4-1
NOTE: https://github.com/radsecproxy/radsecproxy/security/advisories/GHSA-wj29-mxmc-q98c
NOTE: https://github.com/radsecproxy/radsecproxy/commit/9256b4a78ad6b14d97f80a0e749c66d97e46d5e1 (1.11.4)
@@ -9930,7 +10531,7 @@ CVE-2026-97181 (GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vu
NOT-FOR-US: ezGlobal
CVE-2026-97179 (A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. ...)
NOT-FOR-US: O2OA
-CVE-2026-97062 (Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk ...)
+CVE-2026-97062 (Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG ...)
NOT-FOR-US: Aureus ERP
CVE-2026-97061 (Black Candy through 3.2.1 fails to scope playlist search queries to th ...)
NOT-FOR-US: Black Candy
@@ -9968,6 +10569,7 @@ CVE-2026-96746 (An out-of-bounds write in the connection-monitoring logic of the
NOTE: https://github.com/mongodb/mongo-c-driver/commit/52352bfdea96506fafe0f53e222a1f61eebe54f2 (2.5.5)
NOTE: https://github.com/mongodb/mongo-c-driver/commit/59bcc756ad8f04af74b84b88ab747adfd2647b5b (1.30.12)
CVE-2026-96745 (Deserialization of untrusted data in the command monitoring support of ...)
+ {DSA-6539-1}
- php-mongodb 2.5.3-1 (bug #1148966)
NOTE: https://github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c
NOTE: https://jira.mongodb.org/browse/PHPC-2743
@@ -11914,7 +12516,7 @@ CVE-2026-91789 (Foxit PDF Editor/Reader\u2019s U3D/GIF texture decoding path con
NOT-FOR-US: Foxit
CVE-2026-91788 (When implementing the JavaScript interface, Foxit PDF Editor/Reader di ...)
NOT-FOR-US: Foxit
-CVE-2026-91775 (LimeSurvey fails to safely encode attacker-controlled content from a c ...)
+CVE-2026-91775 (LimeSurvey Community Edition 7.0.14fails to safely encode attacker-con ...)
- limesurvey <itp> (bug #472802)
CVE-2026-90950 (The Paid Membership Subscriptions WordPress plugin before 3.1.0 does n ...)
NOT-FOR-US: WordPress plugin
@@ -12634,7 +13236,7 @@ CVE-2026-86243 (Buffer over-read vulnerability in Apache Tomcat Native during th
NOTE: Fixed by: https://github.com/apache/tomcat-native/commit/9a7c804afc05fdc630520eb4012ce1c4ff787862 (2.0.16)
NOTE: Fixed by: https://github.com/apache/tomcat-native/commit/ce019af0db385dfd5bc7c7a759f71602559a0499 (1.3.9)
NOTE: https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557
-CVE-2026-94422
+CVE-2026-94422 (An incorrect implementation of message filtering in xdg-dbus-proxy ver ...)
{DSA-6510-1}
- xdg-dbus-proxy 0.1.9-1 (bug #1148782)
NOTE: https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq
@@ -15324,13 +15926,13 @@ CVE-2026-93986 (rclone before 1.75.1 fails to confine names from server and thir
- rclone <unfixed> (bug #1148669)
[trixie] - rclone <no-dsa> (Minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q
-CVE-2026-93985 (OpenPanel js-runtime through commit bad75bdd contains a sandbox escape ...)
+CVE-2026-93985 (OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerabi ...)
NOT-FOR-US: OpenPanel
-CVE-2026-93984 (OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b8 ...)
+CVE-2026-93984 (OpenPanel tracking API through 2.3.0 fails to verify client secret cry ...)
NOT-FOR-US: OpenPanel
-CVE-2026-93983 (OpenPanel through commit bad75bdd fails to escape property keys in Cli ...)
+CVE-2026-93983 (OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQ ...)
NOT-FOR-US: OpenPanel
-CVE-2026-93982 (OpenPanel through commit bad75bdd writes Model Context Protocol authen ...)
+CVE-2026-93982 (OpenPanel through 2.3.0 writes Model Context Protocol authentication t ...)
NOT-FOR-US: OpenPanel
CVE-2026-93981 (hono before 4.13.7 fails to HTML-escape plain strings rendered by hono ...)
NOT-FOR-US: Hono
@@ -31201,13 +31803,13 @@ CVE-2026-88895 (CyberPanel before 3.0.5 fails to enforce two-factor authenticati
NOT-FOR-US: CyberPanel
CVE-2026-88894 (Snipe-IT's predefined kit checkout path does not enforce Full Multiple ...)
- snipe-it <itp> (bug #1005172)
-CVE-2026-88893 (OpenPanel share lookup procedures fail to validate access controls and ...)
+CVE-2026-88893 (OpenPanel through 2.3.0 share lookup procedures fail to validate acces ...)
NOT-FOR-US: OpenPanel
-CVE-2026-88892 (OpenPanel is an analytics platform. In all versions (no patched releas ...)
+CVE-2026-88892 (In OpenPanel through 2.3.0, the data importer fetches a caller-supplie ...)
NOT-FOR-US: OpenPanel
-CVE-2026-88891 (OpenPanel fails to enforce read-only project access level on 26 of 29 ...)
+CVE-2026-88891 (OpenPanel through 2.3.0 fails to enforce read-only project access leve ...)
NOT-FOR-US: OpenPanel
-CVE-2026-88890 (OpenPanel through commit cd24bb8 contains an SQL injection vulnerabili ...)
+CVE-2026-88890 (OpenPanel through 2.3.0 contains an SQL injection vulnerability in the ...)
NOT-FOR-US: OpenPanel
CVE-2026-88889 (Renovate before 44.14.7 contains a command injection vulnerability in ...)
NOT-FOR-US: Renovate
@@ -31591,7 +32193,7 @@ CVE-2026-81795 (Unauthenticated Cross Site Scripting (XSS) in Page Visits Counte
NOT-FOR-US: WordPress plugin or theme
CVE-2026-81794 (Unauthenticated Broken Access Control in Shirt Product Designer for Wo ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-81793 (Unauthenticated Broken Access Control in Salon booking system <= 10.31 ...)
+CVE-2026-81793 (Missing Authorization vulnerability in Dimitri Grassi Salon booking sy ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-81791 (Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.)
NOT-FOR-US: WordPress plugin or theme
@@ -40240,6 +40842,7 @@ CVE-2026-84969 (A memory-handling error in the BSON-to-JSON conversion helpers o
NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/08d0cfaaf08a54d7e87a5e5fa8d38251bf0eeca6 (1.30.9)
NOTE: Introduced by: https://github.com/mongodb/mongo-c-driver/commit/f2c1bb7989177fa2ddba1a915e8423e46ee1defe (1.30.0)
CVE-2026-84968 (An out-of-bounds read in the BSON decoding component of the MongoDB PH ...)
+ {DSA-6539-1}
- php-mongodb 2.5.3-1 (bug #1149050)
[bookworm] - php-mongodb <postponed> (Minor issue, infoleak)
NOTE: https://jira.mongodb.org/browse/PHPC-2744
@@ -46207,7 +46810,7 @@ CVE-2026-82072 (Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-81934 (Redis contains a use-after-free vulnerability in the 'tlsProcessPendin ...)
- {DLA-4794-1}
+ {DSA-6538-1 DLA-4794-1}
- redis 5:8.0.6-3 (bug #1147423)
NOTE: https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834 (8.8.2)
NOTE: The same flaw in valkey is tracked in CVE-2026-56684
@@ -142998,6 +143601,7 @@ CVE-2026-8596 (Cleartext storage of sensitive information in the ModelBuilder/Se
CVE-2026-7373 (Rapid7 Metasploit Pro is vulnerable to a local privilege escalation at ...)
NOT-FOR-US: Rapid7 Metasploit Pro
CVE-2026-6811 (Stack exhaustion vulnerability in the MongoDB PHP driver can cause app ...)
+ {DSA-6539-1}
- php-mongodb 2.5.3-1 (bug #1136802)
[bookworm] - php-mongodb <no-dsa> (Minor issue)
[bullseye] - php-mongodb <postponed> (Minor issue, DoS in unusual circumstances)
@@ -152449,7 +153053,7 @@ CVE-2026-25589 (RedisBloom is a probabilistic data structures module for Redis.
CVE-2026-25588 (RedisTimeSeries is a time-series module for Redis. In all versions bef ...)
NOT-FOR-US: RedisTimeSeries Redis module
CVE-2026-25243 (Redis is an in-memory data structure store. In versions of redis-serve ...)
- {DLA-4682-1}
+ {DSA-6538-1 DLA-4682-1}
- redict <unfixed>
[experimental] - redis 5:8.6.3-1
- redis 5:8.0.6-3 (bug #1147421)
@@ -152465,7 +153069,7 @@ CVE-2026-25243 (Redis is an in-memory data structure store. In versions of redis
NOTE: https://github.com/valkey-io/valkey/pull/3619
NOTE: valkey fixed by: https://github.com/valkey-io/valkey/commit/fea0b4064cf612d1c365b032326832bff0946bd9 (8.1.7)
CVE-2026-23631 (Redis is an in-memory data structure store. In all versions of redis-s ...)
- {DLA-4682-1}
+ {DSA-6538-1 DLA-4682-1}
- redict <unfixed>
[experimental] - redis 5:8.6.3-1
- redis 5:8.0.6-3 (bug #1147421)
@@ -152480,6 +153084,7 @@ CVE-2026-23631 (Redis is an in-memory data structure store. In all versions of r
NOTE: valkey fixed by: https://github.com/valkey-io/valkey/commit/c7c92db43b63be0599a076590f012ed35d279a47 (8.1.7)
NOTE: redict has the yielding-long-command mechanism but readSyncBulkPayload() lacks the guard
CVE-2026-23479 (Redis is an in-memory data structure store. In redis-server from 7.2.0 ...)
+ {DSA-6538-1}
- redict <unfixed>
[experimental] - redis 5:8.6.3-1
- redis 5:8.0.6-3 (bug #1147421)
@@ -249886,7 +250491,7 @@ CVE-2025-58224 (Cross-Site Request Forgery (CSRF) vulnerability in Printeers Pri
NOT-FOR-US: WordPress plugin or theme
CVE-2025-58223 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2025-58222 (Missing Authorization vulnerability in Maidul Team Manager wp-team-man ...)
+CVE-2025-58222 (Missing Authorization vulnerability in Dynamic Web Lab Team Manager wp ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-58221 (Missing Authorization vulnerability in ONTRAPORT PilotPress pilotpress ...)
NOT-FOR-US: WordPress plugin or theme
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c4f5b44d6ba8403b14820366e42471b40aba63de
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c4f5b44d6ba8403b14820366e42471b40aba63de
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/32cd96b2/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list