[Git][security-tracker-team/security-tracker][master] automatic update

Sun Oct 4 08:20:10 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
163856d2 by security tracker role at 2026-10-04T07:13:13+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,49 @@
+CVE-2026-97332 (The User Private Files  WordPress plugin before 2.2.0 does not properl ...)
+	TODO: check
+CVE-2026-93549 (The CoCart  WordPress plugin before 4.9.7 does not scope its REST API  ...)
+	TODO: check
+CVE-2026-88779 (Vulnerability in NetScaler ADC and NetScaler Gateway.  This issue affe ...)
+	TODO: check
+CVE-2026-86817 (The Five Star Business Profile and Schema WordPress plugin before 2.4. ...)
+	TODO: check
+CVE-2026-17005 (The Horizontal scrolling announcements WordPress plugin through 2.6 do ...)
+	TODO: check
+CVE-2026-105135 (A vulnerability has been found in InternLM MindSearch 0.1.0. This issu ...)
+	TODO: check
+CVE-2026-105134 (A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerabili ...)
+	TODO: check
+CVE-2026-105133 (A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affe ...)
+	TODO: check
+CVE-2026-105131 (ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulne ...)
+	TODO: check
+CVE-2026-105130 (LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulner ...)
+	TODO: check
+CVE-2026-105129 (LaraDashboard before 1.4.8 contains an incorrect authorization vulnera ...)
+	TODO: check
+CVE-2026-105128 (LaraDashboard before 1.4.8 contains an open redirect vulnerability tha ...)
+	TODO: check
+CVE-2026-105127 (LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to  ...)
+	TODO: check
+CVE-2026-105126 (LaraDashboard before 1.4.8 contains an improper privilege management v ...)
+	TODO: check
+CVE-2026-105125 (LaraDashboard before 1.4.8 contains a path traversal vulnerability tha ...)
+	TODO: check
+CVE-2026-105124 (W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site s ...)
+	TODO: check
+CVE-2026-105123 (W (vincent-peugnet/wcms) through 3.18.0 contains a remote code executi ...)
+	TODO: check
+CVE-2026-105099 (A weakness has been identified in Omega Solution CoinEx Crypto 2025. A ...)
+	TODO: check
+CVE-2026-105098 (A security flaw has been discovered in Omega Solution CoinEx Crypto 20 ...)
+	TODO: check
+CVE-2026-105097 (A vulnerability was identified in Omega Solution CoinEx Crypto 2025. T ...)
+	TODO: check
+CVE-2026-105096 (A vulnerability was determined in Omega Solution CoinEx Crypto 2025. T ...)
+	TODO: check
+CVE-2026-104119 (The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape ...)
+	TODO: check
+CVE-2026-104118 (The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not pe ...)
+	TODO: check
 CVE-2026-97873 (In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy P ...)
 	- bouncycastle 1.86-1
 	NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9097873
@@ -7552,7 +7598,7 @@ CVE-2026-97029 (Flatpak's process ID namespace separation does not prevent a san
 	- flatpak 1.18.4-1
 	NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2
 CVE-2026-103111 (PCRE2 before 10.49, when there is an attacker-controlled regular expre ...)
-	{DSA-6530-1}
+	{DSA-6530-1 DLA-4816-1}
 	- pcre2 10.48-3.1 (bug #1149217)
 	NOTE: https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m
 	NOTE: Fixed by: https://github.com/PCRE2Project/pcre2/commit/2b4038298072684b0fae29b15bedfb1a75bda46d (pcre2-10.49)
@@ -8371,7 +8417,7 @@ CVE-2026-100632 (Parse Server is an open-source backend server. In versions >= 9
 	NOT-FOR-US: Parse Server
 CVE-2026-100631 (Parse Server is an open source backend server. In versions prior to 8. ...)
 	NOT-FOR-US: Parse Server
-CVE-2026-100630 (AVideo contains a stored cross-site scripting vulnerability in the vid ...)
+CVE-2026-100630 (AVideo before 29.1.0 contains a stored cross-site scripting vulnerabil ...)
 	NOT-FOR-US: WWBN AVideo
 CVE-2026-100629 (Capgo (capgo.app backend) before 12.127.5 contains an authorization fl ...)
 	NOT-FOR-US: Cap-go



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/163856d21ca41f57e91a183e185bce459973bafb

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/163856d21ca41f57e91a183e185bce459973bafb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261004/b9386a1f/attachment-0001.htm>
