[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Mon Oct 5 08:13:56 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
b6d86b96 by security tracker role at 2026-10-05T07:13:45+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,175 @@
+CVE-2026-84169 (The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does no ...)
+ TODO: check
+CVE-2026-78371 (The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 d ...)
+ TODO: check
+CVE-2026-20589 (In venc, there is a possible out of bounds write due to type confusion ...)
+ TODO: check
+CVE-2026-20588 (In mtee, there is a possible escalation of privilege due to a missing ...)
+ TODO: check
+CVE-2026-20587 (In mtee, there is a possible escalation of privilege due to type confu ...)
+ TODO: check
+CVE-2026-20586 (In vdec, there is a possible out of bounds write due to a missing boun ...)
+ TODO: check
+CVE-2026-20579 (In vdec, there is a possible out of bounds write due to type confusion ...)
+ TODO: check
+CVE-2026-20544 (In meta, there is a possible out of bounds write due to a missing boun ...)
+ TODO: check
+CVE-2026-20543 (In Modem, there is a possible information disclosure due to a logic er ...)
+ TODO: check
+CVE-2026-20542 (In apusys, there is a possible memory corruption due to use after free ...)
+ TODO: check
+CVE-2026-20541 (In Modem, there is a possible out of bounds read due to a missing perm ...)
+ TODO: check
+CVE-2026-20540 (In Modem, there is a possible out of bounds read due to a missing boun ...)
+ TODO: check
+CVE-2026-20539 (In Modem, there is a possible out of bounds read due to a missing boun ...)
+ TODO: check
+CVE-2026-20538 (In Modem, there is a possible out of bounds read due to a missing perm ...)
+ TODO: check
+CVE-2026-20537 (In aidl, there is a possible memory corruption due to use after free. ...)
+ TODO: check
+CVE-2026-20536 (In aidl, there is a possible memory corruption due to use after free. ...)
+ TODO: check
+CVE-2026-20535 (In aidl, there is a possible escalation of privilege due to a missing ...)
+ TODO: check
+CVE-2026-20534 (In Modem, there is a possible out of bounds read due to an incorrect b ...)
+ TODO: check
+CVE-2026-20533 (In display, there is a possible escalation of privilege due to an inte ...)
+ TODO: check
+CVE-2026-20532 (In apu, there is a possible application crash due to double free. This ...)
+ TODO: check
+CVE-2026-20531 (In apu, there is a possible memory corruption due to use after free. T ...)
+ TODO: check
+CVE-2026-20530 (In display, there is a possible out of bounds write due to a missing b ...)
+ TODO: check
+CVE-2026-20529 (In battery, there is a possible out of bounds write due to a missing b ...)
+ TODO: check
+CVE-2026-20528 (In ccci, there is a possible out of bounds write and read due to a mis ...)
+ TODO: check
+CVE-2026-20527 (In Modem, there is a possible system crash due to a missing bounds che ...)
+ TODO: check
+CVE-2026-20526 (In Modem, there is a possible out of bounds write due to a missing bou ...)
+ TODO: check
+CVE-2026-20525 (In Modem, there is a possible system crash due to improper input valid ...)
+ TODO: check
+CVE-2026-20524 (In apu, there is a possible memory corruption due to improper input va ...)
+ TODO: check
+CVE-2026-20523 (In neuropilot, there is a possible out of bounds write due to a missin ...)
+ TODO: check
+CVE-2026-20522 (In neuropilot, there is a possible out of bounds write due to a missin ...)
+ TODO: check
+CVE-2026-20521 (In Video HAL, there is a possible escalation of privilege due to a mis ...)
+ TODO: check
+CVE-2026-20520 (In Modem, there is a possible out of bounds write due to a missing bou ...)
+ TODO: check
+CVE-2026-20519 (In Modem, there is a possible out of bounds write due to a missing bou ...)
+ TODO: check
+CVE-2026-19954 (Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command ...)
+ TODO: check
+CVE-2026-13607 (The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 ...)
+ TODO: check
+CVE-2026-105306 (A flaw was found in the Dynamic Client Registration flow of the Keyclo ...)
+ TODO: check
+CVE-2026-105302 (A flaw was found in the User Session Note mapper of the Keycloak ident ...)
+ TODO: check
+CVE-2026-105301 (A flaw was found in the X.509 client-certificate authenticator of Keyc ...)
+ TODO: check
+CVE-2026-105295 (GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism tha ...)
+ TODO: check
+CVE-2026-105294 (Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnera ...)
+ TODO: check
+CVE-2026-105293 (Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in ...)
+ TODO: check
+CVE-2026-105292 (Chaterm before 0.12.1 contains a login cross-site request forgery vuln ...)
+ TODO: check
+CVE-2026-105246 (A vulnerability was found in SourceCodester Online Reviewer Management ...)
+ TODO: check
+CVE-2026-105245 (A vulnerability has been found in sgl-project sglang up to 0.5.21. Thi ...)
+ TODO: check
+CVE-2026-105238 (A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vu ...)
+ TODO: check
+CVE-2026-105237 (A vulnerability was detected in linlinjava litemall up to 1.8.0. This ...)
+ TODO: check
+CVE-2026-105233 (A vulnerability has been found in kishor-23 food-waste-management-syst ...)
+ TODO: check
+CVE-2026-105232 (A flaw has been found in kishor-23 food-waste-management-system 411989 ...)
+ TODO: check
+CVE-2026-105231 (A vulnerability was detected in kishor-23 food-waste-management-system ...)
+ TODO: check
+CVE-2026-105230 (A security vulnerability has been detected in kishor-23 food-waste-man ...)
+ TODO: check
+CVE-2026-105229 (A weakness has been identified in kishor-23 food-waste-management-syst ...)
+ TODO: check
+CVE-2026-105226 (A security flaw has been discovered in osCommerce osCommerce2 up to 2. ...)
+ TODO: check
+CVE-2026-105225 (A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1 ...)
+ TODO: check
+CVE-2026-105223 (maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate ...)
+ TODO: check
+CVE-2026-105222 (The alexpechkarev/google-maps Laravel package through 12.16 disables T ...)
+ TODO: check
+CVE-2026-105221 (The gist RubyGem before 6.1.0 contains an improper certificate validat ...)
+ TODO: check
+CVE-2026-105220 (Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnera ...)
+ TODO: check
+CVE-2026-105188 (A vulnerability was found in code-projects Human Resource Management S ...)
+ TODO: check
+CVE-2026-105187 (A vulnerability has been found in itsourcecode Online Admission System ...)
+ TODO: check
+CVE-2026-105186 (A flaw has been found in itsourcecode Online Admission System 1.0. Thi ...)
+ TODO: check
+CVE-2026-105185 (A vulnerability was detected in itsourcecode Online Admission System 1 ...)
+ TODO: check
+CVE-2026-105184 (A security vulnerability has been detected in itsourcecode Online Admi ...)
+ TODO: check
+CVE-2026-105183 (A weakness has been identified in itsourcecode Online Admission System ...)
+ TODO: check
+CVE-2026-105182 (A security flaw has been discovered in SourceCodester Online Reviewer ...)
+ TODO: check
+CVE-2026-105181 (A vulnerability was identified in itsourcecode Online Admission System ...)
+ TODO: check
+CVE-2026-105180 (A vulnerability was determined in Jeebase 0.0.1. This vulnerability af ...)
+ TODO: check
+CVE-2026-105179 (A weakness has been identified in SourceCodester Drug Recommendation S ...)
+ TODO: check
+CVE-2026-105178 (A security flaw has been discovered in SourceCodester Drug Recommendat ...)
+ TODO: check
+CVE-2026-105177 (A vulnerability was identified in SourceCodester Drug Recommendation S ...)
+ TODO: check
+CVE-2026-105176 (A vulnerability was determined in SourceCodester Drug Recommendation S ...)
+ TODO: check
+CVE-2026-105175 (A vulnerability was found in SourceCodester Drug Recommendation System ...)
+ TODO: check
+CVE-2026-105174 (A vulnerability has been found in Gerapy up to 0.9.13. This vulnerabil ...)
+ TODO: check
+CVE-2026-105173 (A flaw has been found in code-projects Human Resource Management 1.0. ...)
+ TODO: check
+CVE-2026-105172 (A vulnerability was detected in itsourcecode Online Admission System 1 ...)
+ TODO: check
+CVE-2026-105171 (A security vulnerability has been detected in kishor-23 food-waste-man ...)
+ TODO: check
+CVE-2026-105170 (A weakness has been identified in kishor-23 food-waste-management-syst ...)
+ TODO: check
+CVE-2026-105169 (A security flaw has been discovered in kishor-23 food-waste-management ...)
+ TODO: check
+CVE-2026-105168 (A vulnerability was identified in kishor-23 food-waste-management-syst ...)
+ TODO: check
+CVE-2026-105167 (A vulnerability was determined in kishor-23 food-waste-management-syst ...)
+ TODO: check
+CVE-2026-105166 (A vulnerability was found in kishor-23 food-waste-management-system 41 ...)
+ TODO: check
+CVE-2026-105165 (A vulnerability has been found in devopspolis secrets-replicator up to ...)
+ TODO: check
+CVE-2026-105164 (A flaw has been found in NASA cFS up to 7.0.1. This issue affects the ...)
+ TODO: check
+CVE-2026-105163 (A vulnerability was detected in crossplane crossplane-runtime up to 2. ...)
+ TODO: check
+CVE-2026-100727 (An improper access control vulnerability exists in GROWI, which allow ...)
+ TODO: check
+CVE-2019-25777 (YAML versions before 1.27_001 for Perl allow a loaded perl/glob docume ...)
+ TODO: check
+CVE-2017-20285 (YAML versions before 1.30 for Perl allow a loaded document to trigger ...)
+ TODO: check
CVE-2026-97307 (Insertion of Sensitive Information Into Sent Data vulnerability in Sty ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97276 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -107999,61 +108171,61 @@ CVE-2026-17545 (On Windows, PHP's filesystem and stream APIs do not reject reser
NOTE: https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-91766 (When the http:// stream wrapper follows a redirect it forwards the use ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-92842 (The convert.base64-encode, convert.quoted-printable-encode and convert ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-93682 (When the HTTP stream wrapper follows a redirect and the response carri ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2025-14181 (The SOAP HTTP client guards its response buffer growth with a check th ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-91765 (cleanup_xml_node() in the SOAP XML parser recurses once per XML nestin ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-6103 (phar_tar_number() parses the octal size field of a TAR header into a u ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-91767 (php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-91769 (PHP's OpenSSL stream peer verification checks the certificate's subjec ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2025-1218 (The mysqlnd wire protocol parser reads fields out of server packets be ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-91768 (The IPv6 branch of the FastCGI client access check compares only the f ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637
@@ -127542,82 +127714,82 @@ CVE-2026-45447 (Issue summary: A specially crafted PKCS#7 or S/MIME signed messa
NOTE: Fixed by: https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54 (openssl-3.0.21)
NOTE: Fixed by: https://github.com/openssl/openssl/commit/18de9aba8294b5fb0915866cf3a1bb45f9599b8d (openssl-3.0.21)
CVE-2026-62434 (A guest started with Populated on Demand enabled (PoD) can attempt to ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-507.html
CVE-2026-62433 (Parts of the DM_OP handling code assumes the caller has provided the r ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-506.html
CVE-2026-62432 (The EVTCHNOP_expand_array hypercall checks for whether FIFO event chan ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-505.html
CVE-2026-62431 (The logic to handle periodic Viridian STIMERs performs a division with ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-504.html
CVE-2026-62430 (Accesses to the CMOS memory contents are done using an indirect IO por ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-503.html
CVE-2026-62429 (Accessing the vNUMA configuration data of a guest is still possible wh ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-502.html
CVE-2026-62435 ([This CNA information record relates to multiple CVEs; the text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-501.html
CVE-2026-62436 ([This CNA information record relates to multiple CVEs; the text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-501.html
CVE-2026-62428 (When grant-copy operations are processed, the respective grant may or ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-500.html
CVE-2026-62426 ([This CNA information record relates to multiple CVEs; the text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-499.html
CVE-2026-62427 ([This CNA information record relates to multiple CVEs; the text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-499.html
CVE-2026-42494 ([This CNA information record relates to multiple CVEs; the text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-497.html
CVE-2026-42495 ([This CNA information record relates to multiple CVEs; the text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-497.html
CVE-2026-62423 ([This CNA information record relates to multiple CVEs; the text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-497.html
CVE-2026-62424 ([This CNA information record relates to multiple CVEs; the text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-497.html
CVE-2026-62425 ([This CNA information record relates to multiple CVEs; the text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-497.html
@@ -127625,17 +127797,17 @@ CVE-2026-42492 (Xenstore, to have an up-to-date picture of the entire system, wa
- xen <not-affected> (Vulnerable code introduced later)
NOTE: https://xenbits.xen.org/xsa/advisory-496.html
CVE-2026-42493 (Addressing certain issues, in particular related to operations which m ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-495.html
CVE-2026-42488 (Some shadow paging errors paths will switch the page-tables without up ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-494.html
CVE-2025-10263 (Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1 ...)
- {DSA-6424-1 DLA-4671-1 DLA-4665-1 DLA-4664-1}
+ {DSA-6424-1 DLA-4818-1 DLA-4671-1 DLA-4665-1 DLA-4664-1}
- linux 7.0.13-1
[trixie] - linux 6.12.94-1
- xen 4.20.3+127-gc42374a105-1
@@ -127643,17 +127815,17 @@ CVE-2025-10263 (Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neove
NOTE: https://xenbits.xen.org/xsa/advisory-493.html
NOTE: Mitigations in src:linux: https://lore.kernel.org/all/20260609101203.1512409-1-mark.rutland@arm.com/
CVE-2026-42490 ([This CNA information record relates to multiple CVEs; the text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-492.html
CVE-2026-42489 ([This CNA information record relates to multiple CVEs; the text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-492.html
CVE-2026-42487 (HVM guest I/O port accesses are subject to either emulation or at leas ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-491.html
@@ -148002,7 +148174,7 @@ CVE-2025-12659 (Siemens Simcenter Femapcontains a memory corruption vulnerabilit
CVE-2024-54017 (A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All v ...)
NOT-FOR-US: Siemens
CVE-2025-54518 (Improper isolation of shared resources within the CPU operation cache ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
NOTE: https://xenbits.xen.org/xsa/advisory-490.html
@@ -158065,12 +158237,12 @@ CVE-2026-6691 (The MongoDB C Driver's Cyrus SASL integration performs unsafe str
NOTE: https://github.com/mongodb/mongo-c-driver/commit/b4984965877d559862e225beba09cb4e9d4a56a6 (2.2.0)
NOTE: https://github.com/mongodb/mongo-c-driver/commit/d9c26f49e75d3de746a690db9c81ff5b4f6e21b0 (2.2.0)
CVE-2026-23556 (When oxenstored is tearing a domain down, the node data is cleaned up ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
NOTE: https://xenbits.xen.org/xsa/advisory-483.html
CVE-2026-23557 (Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES c ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1 (unimportant)
NOTE: https://xenbits.xen.org/xsa/advisory-484.html
NOTE: Debian uses the ocaml-based xenstored
@@ -158079,7 +158251,7 @@ CVE-2026-31786 (In the Linux kernel, the following vulnerability has been resolv
- linux 7.0.3-1
NOTE: https://xenbits.xen.org/xsa/advisory-485.html
CVE-2026-23558 (The adjustments made for XSA-379 as well as those subsequently becomin ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
NOTE: https://xenbits.xen.org/xsa/advisory-486.html
@@ -163795,7 +163967,7 @@ CVE-2026-1838 (The Hostel plugin for WordPress is vulnerable to Reflected Cross-
CVE-2026-1559 (The Youzify plugin for WordPress is vulnerable to Stored Cross-Site Sc ...)
NOT-FOR-US: WordPress plugin
CVE-2025-54505 (A transient execution vulnerability within AMD CPUs may allow a local ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (not supported under bullseye)
NOTE: AMD CPU HW issue:
@@ -173313,7 +173485,7 @@ CVE-2026-4819 (In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit lo
CVE-2026-4818 (In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an i ...)
NOT-FOR-US: Search Guard FLX
CVE-2026-4800 (Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHS ...)
- {DLA-4663-1}
+ {DLA-4820-1 DLA-4663-1}
- node-lodash 4.18.1+dfsg-1 (bug #1132500)
[trixie] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
NOTE: Fixed by: https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6 (4.18.0)
@@ -173720,7 +173892,7 @@ CVE-2026-30277 (An arbitrary file overwrite vulnerability in PDF Reader App : TA
CVE-2026-30276 (An arbitrary file overwrite vulnerability in DeftPDF Document Translat ...)
NOT-FOR-US: DeftPDF
CVE-2026-2950 (Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototy ...)
- {DLA-4663-1}
+ {DLA-4820-1 DLA-4663-1}
- node-lodash 4.18.1+dfsg-1
[trixie] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
NOTE: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
@@ -205732,7 +205904,7 @@ CVE-2025-13878 (Malformed BRID/HHIT records can cause `named` to terminate unexp
NOTE: Fixed by: https://gitlab.isc.org/isc-projects/bind9/-/commit/d4c0d617015625330f08a3f86a10a533cec0f6ec (v9.20.18)
NOTE: Fixed by: https://gitlab.isc.org/isc-projects/bind9/-/commit/7bf83f69a80bdc6094c2adee3595e28b1b3e19ea (v9.21.17)
CVE-2025-13465 (Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype poll ...)
- {DLA-4663-1}
+ {DLA-4820-1 DLA-4663-1}
- node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-10 (bug #1126265)
[trixie] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
NOTE: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
@@ -278357,11 +278529,12 @@ CVE-2026-23555 (Any guest issuing a Xenstore command accessing a node using the
NOTE: https://xenbits.xen.org/xsa/advisory-481.html
NOTE: Debian uses the ocaml-based xenstored
CVE-2026-23554 (The Intel EPT paging code uses an optimization to defer flushing of an ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <not-affected> (Vulnerable code not present)
NOTE: https://xenbits.xen.org/xsa/advisory-480.html
CVE-2026-23553 (In the context switch logic Xen attempts to skip an IBPB in the case o ...)
+ {DLA-4818-1}
- xen 4.20.2+37-g61ff35323e-1
[trixie] - xen 4.20.2+37-g61ff35323e-0+deb13u1
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
@@ -278370,6 +278543,7 @@ CVE-2025-58151 (varstored is a component of the Xapi toolstack handling UEFI Var
- xen-api <removed>
NOTE: https://xenbits.xen.org/xsa/advisory-478.html
CVE-2025-58150 (Shadow mode tracing code uses a set of per-CPU variables to avoid cumb ...)
+ {DLA-4818-1}
- xen 4.20.2+37-g61ff35323e-1
[trixie] - xen 4.20.2+37-g61ff35323e-0+deb13u1
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6d86b96583f9421659c423dc7475367500adaa4
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6d86b96583f9421659c423dc7475367500adaa4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261005/82372d4b/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list