[Git][security-tracker-team/security-tracker][master] automatic update

Sat Oct 3 20:13:50 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9451eb76 by security tracker role at 2026-10-03T19:13:43+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,65 @@
+CVE-2026-97873 (In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy P ...)
+	TODO: check
+CVE-2026-96451 (Authorization Bypass Through User-Controlled Key vulnerability in Ulti ...)
+	TODO: check
+CVE-2026-92767 (The Twenty20 Image Before-After plugin for WordPress is vulnerable to  ...)
+	TODO: check
+CVE-2026-92084 (The The Beaver Builder Page Builder \u2013 Drag and Drop Website Build ...)
+	TODO: check
+CVE-2026-85515 (In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted m ...)
+	TODO: check
+CVE-2026-71892 (In Bouncy Castle for Java before 1.86, the opt-in key-size validation  ...)
+	TODO: check
+CVE-2026-71891 (In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidat ...)
+	TODO: check
+CVE-2026-71890 (In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) ...)
+	TODO: check
+CVE-2026-71889 (In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathRev ...)
+	TODO: check
+CVE-2026-71888 (In Bouncy Castle for Java before 1.86, the streaming CMS Authenticated ...)
+	TODO: check
+CVE-2026-71887 (In Bouncy Castle for Java before 1.86, the high-level OpenPGP API acce ...)
+	TODO: check
+CVE-2026-71886 (In Bouncy Castle for Java before 1.86, the high-level OpenPGP certific ...)
+	TODO: check
+CVE-2026-71885 (In Bouncy Castle for Java before 1.86, the Messaging Layer Security (M ...)
+	TODO: check
+CVE-2026-71883 (In Bouncy Castle for Java LTS before 2.73.13, the one-shot native pack ...)
+	TODO: check
+CVE-2026-18040 (In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data  ...)
+	TODO: check
+CVE-2026-105122 (OpenAM before 16.1.3 contains a server-side request forgery vulnerabil ...)
+	TODO: check
+CVE-2026-105121 (OpenAM before 16.1.3 contains an improper authorization vulnerability  ...)
+	TODO: check
+CVE-2026-105120 (OpenAM before 16.1.3 contains an authorization bypass vulnerability in ...)
+	TODO: check
+CVE-2026-105119 (OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only ...)
+	TODO: check
+CVE-2026-105118 (OpenAM before 16.1.3 contains an open redirect vulnerability that allo ...)
+	TODO: check
+CVE-2026-105117 (OpenAM before 16.1.3 contains an email content injection vulnerability ...)
+	TODO: check
+CVE-2026-105116 (OpenAM before 16.1.3 contains a latent cross-site scripting defect tha ...)
+	TODO: check
+CVE-2026-105115 (OpenAM before 16.1.3 contains an unauthenticated arbitrary class insta ...)
+	TODO: check
+CVE-2026-105114 (OpenAM before 16.1.3 contains a reflected cross-site scripting vulnera ...)
+	TODO: check
+CVE-2026-105113 (Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking  ...)
+	TODO: check
+CVE-2026-105112 (Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in Upda ...)
+	TODO: check
+CVE-2026-105105 (CWE-306: Missing Authentication for Critical Function in the ait.core. ...)
+	TODO: check
+CVE-2026-104983 (A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impa ...)
+	TODO: check
+CVE-2026-104982 (A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue af ...)
+	TODO: check
+CVE-2026-103342 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-103065 (Improper Validation of Specified Quantity in Input vulnerability in Th ...)
+	TODO: check
 CVE-2026-94291
 	- epiphany-browser 51.1-1
 	NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2952
@@ -61511,7 +61573,7 @@ CVE-2026-38165 (A Server-Side Template Injection (SSTI) vulnerability in the Vel
 CVE-2026-35219 (Budibase is an open-source low-code platform. Prior to 3.41.3, automat ...)
 	NOT-FOR-US: n8n
 CVE-2026-34789 (FreeCAD is a free and open-source multiplatform 3D parametric modeler. ...)
-	{DSA-6467-1}
+	{DSA-6467-1 DLA-4815-1}
 	- freecad 1.1.3+dfsg-1
 	NOTE: https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-493w-pp4h-h77v
 	NOTE: Fixed by: https://github.com/FreeCAD/FreeCAD/commit/81b73925ce22610542367301d8eff4259eb9596e (1.1.1)
@@ -70285,13 +70347,13 @@ CVE-2026-73241 (FreeRDP is a free implementation of the Remote Desktop Protocol.
 	NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/commit/b05a9510787c83c87ffc5fa8d7cc9f06ed971695 (3.30.0)
 	NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/pull/13065
 CVE-2026-73235 (FreeCAD is a free and open-source multiplatform 3D parametric modeler. ...)
-	{DSA-6467-1}
+	{DSA-6467-1 DLA-4815-1}
 	- freecad 1.1.3+dfsg-1 (bug #1144349)
 	NOTE: https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-cp6c-87x9-xf49
 	NOTE: https://github.com/FreeCAD/FreeCAD/pull/31280
 	NOTE: Fixed by: https://github.com/FreeCAD/FreeCAD/commit/7d1b8f5806db578db99feb348e55a6b0eaff7c73 (1.1.2)
 CVE-2026-73234 (FreeCAD is a free and open-source multiplatform 3D parametric modeler. ...)
-	{DSA-6467-1}
+	{DSA-6467-1 DLA-4815-1}
 	- freecad 1.1.3+dfsg-1 (bug #1144349)
 	NOTE: https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-5vqh-3v38-jw2r
 	NOTE: https://github.com/FreeCAD/FreeCAD/pull/31281



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9451eb76410145bdd276eca3809e1bae5c88c0a8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9451eb76410145bdd276eca3809e1bae5c88c0a8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/0f7eca6c/attachment.htm>
