[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Mon Oct 5 20:14:04 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
edd1fab6 by security tracker role at 2026-10-05T19:13:48+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,23 +1,475 @@
+CVE-2026-97309 (Missing Authorization vulnerability in Webful Creations RepairBuddy co ...)
+ TODO: check
+CVE-2026-97305 (Authorization Bypass Through User-Controlled Key vulnerability in Them ...)
+ TODO: check
+CVE-2026-97304 (Missing Authorization vulnerability in Arraytics Timetics timetics all ...)
+ TODO: check
+CVE-2026-97303 (Missing Authorization vulnerability in Apps Mav Scratch & Win \u2013 G ...)
+ TODO: check
+CVE-2026-97283 (Deserialization of Untrusted Data vulnerability in Liquid Web / Stella ...)
+ TODO: check
+CVE-2026-97275 (Improper Validation of Specified Quantity in Input vulnerability in Vi ...)
+ TODO: check
+CVE-2026-97071 (Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-curr ...)
+ TODO: check
+CVE-2026-97070 (Authorization Bypass Through User-Controlled Key vulnerability in Cozy ...)
+ TODO: check
+CVE-2026-95166 (In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat fi ...)
+ TODO: check
+CVE-2026-95165 (Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in ...)
+ TODO: check
+CVE-2026-94669 (Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms ...)
+ TODO: check
+CVE-2026-93323 (The Dockerfile frontend loaded the Dockerfile and .dockerignore files ...)
+ TODO: check
+CVE-2026-93322 (A malicious frontend can submit an LLB definition that causes buildkit ...)
+ TODO: check
+CVE-2026-93320 (BuildKit may be tricked into performing file actions with special file ...)
+ TODO: check
+CVE-2026-93319 (A malicious external BuildKit frontend can send requests using the int ...)
+ TODO: check
+CVE-2026-93318 (A malicious image can advertise DiffIDs from another image while conta ...)
+ TODO: check
+CVE-2026-93317 (An unauthenticated attacker controlling a registry or OCI-layout blob ...)
+ TODO: check
+CVE-2026-93316 (If BuildKit daemon is started with --cdi-disabled it can lead to daemo ...)
+ TODO: check
+CVE-2026-92931 (CWE-918: Server-Side Request Forgery in the Progress @progress/sitefin ...)
+ TODO: check
+CVE-2026-89039 (The convert_playwright_script prompt in the k6 MCP server accepts a fi ...)
+ TODO: check
+CVE-2026-88424 (FineAdmin v1.0 was discovered to contain a SQL injection vulnerability ...)
+ TODO: check
+CVE-2026-88397 (ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-l ...)
+ TODO: check
+CVE-2026-88396 (ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The adm ...)
+ TODO: check
+CVE-2026-88395 (GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/mess ...)
+ TODO: check
+CVE-2026-88394 (WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The ...)
+ TODO: check
+CVE-2026-88393 (WookTeam v1.6.6 and before is vulnerable to RCE in the project task ex ...)
+ TODO: check
+CVE-2026-88392 (Unimall v4 is vulnerable to Directory Traversal in FileUploadControlle ...)
+ TODO: check
+CVE-2026-88391 (Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 ...)
+ TODO: check
+CVE-2026-86671 (In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` a ...)
+ TODO: check
+CVE-2026-79820 (A remote user validation failure vulnerability exists in HPE Integrate ...)
+ TODO: check
+CVE-2026-78413 (Velociraptor allows collection of VQL queries packaged into Artifacts ...)
+ TODO: check
+CVE-2026-78412 (Velociraptor's WatchEvent gRPC API can specify the OrgId of the org fr ...)
+ TODO: check
+CVE-2026-78411 (Velociraptor's SetClientMetadata used the wrong permission check to en ...)
+ TODO: check
+CVE-2026-77805 (In Progress\xae Telerik\xae Fiddler\xae Classic for Windows, versions ...)
+ TODO: check
+CVE-2026-77804 (In Progress\xae Telerik\xae Fiddler\xae Classic for Windows, versions ...)
+ TODO: check
+CVE-2026-77803 (In Progress\xae Telerik\xae Fiddler\xae Classic for Windows, versions ...)
+ TODO: check
+CVE-2026-77802 (In Progress\xae Telerik\xae Fiddler\xae Classic for Windows, versions ...)
+ TODO: check
+CVE-2026-59788 (The email media type OAuth form passes the Authorization endpoint valu ...)
+ TODO: check
+CVE-2026-59787 (The Perl SNMP trap receiver script shipped with Zabbix does not proper ...)
+ TODO: check
+CVE-2026-59786 (Zabbix Server and Proxy accept the active agent heartbeat message rega ...)
+ TODO: check
+CVE-2026-59785 (Host search in Frontend allows filtering by fields that are not displa ...)
+ TODO: check
+CVE-2026-59783 (The Zabbix Server/Proxy has a vulnerability where binary items can cra ...)
+ TODO: check
+CVE-2026-59782 (The JavaScript preprocessing (Duktape) engine on Zabbix server has a v ...)
+ TODO: check
+CVE-2026-58880 (In handle_app_val_response of btif_rc.cc, there is a possible way to a ...)
+ TODO: check
+CVE-2026-58865 (In multiple functions of PduParser.java, there is a possible persisten ...)
+ TODO: check
+CVE-2026-58859 (In multiple places, there is a possible denial of service due to an u ...)
+ TODO: check
+CVE-2026-58856 (In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, th ...)
+ TODO: check
+CVE-2026-58854 (In multiple locations, there is a possible memory corruption due to ty ...)
+ TODO: check
+CVE-2026-58841 (In multiple functions of VirtualAudioControllerTest.java, there is a p ...)
+ TODO: check
+CVE-2026-58835 (In cfg2prop of btif_storage.cc, there is a possible out-of-bounds writ ...)
+ TODO: check
+CVE-2026-58834 (In setPermissionGrantState of DevicePolicyManagerService.java, there i ...)
+ TODO: check
+CVE-2026-58815 (In multiple locations, there is a possible out of bounds write due to ...)
+ TODO: check
+CVE-2026-55286 (In stpropnci_process of stpropnci.cc, there is a possible out of bound ...)
+ TODO: check
+CVE-2026-55280 (In multiple locations, there is a possible out-of-bounds write due to ...)
+ TODO: check
+CVE-2026-55270 (In dialInternal in multiple locations, there is a possible permission ...)
+ TODO: check
+CVE-2026-55269 (In FilterCapturedPacket of snoop_logger.cc, there is a possible memory ...)
+ TODO: check
+CVE-2026-55266 (In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bound ...)
+ TODO: check
+CVE-2026-55265 (In multiple functions of PduParser.java, there is a possible out of bo ...)
+ TODO: check
+CVE-2026-49937 (In multiple functions of MessageQueueBase.h, there is a possible out o ...)
+ TODO: check
+CVE-2026-49933 (In handle_le_monitor_device_event of msft.cc, there is a possible cont ...)
+ TODO: check
+CVE-2026-49885 (In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds ...)
+ TODO: check
+CVE-2026-49880 (In multiple functions of nfa_nfcee_act.cc, there is a possible out-of- ...)
+ TODO: check
+CVE-2026-49878 (In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a po ...)
+ TODO: check
+CVE-2026-45524 (In isSystem of WifiPermissionsUtil.java, there is a possible sandbox e ...)
+ TODO: check
+CVE-2026-42700 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-39783 (Missing Authorization vulnerability in WP SYNTEX Polylang polylang all ...)
+ TODO: check
+CVE-2026-39763 (Missing Authorization vulnerability in Deepak Anand WP Dummy Content G ...)
+ TODO: check
+CVE-2026-39721 (Missing Authorization vulnerability in Brainstorm Force Starter Templa ...)
+ TODO: check
+CVE-2026-37719 (An issue in dormakaba evolo Service (all versions) allows a remote att ...)
+ TODO: check
+CVE-2026-28667 (In multiple functions of rw_t5t.cc, there is a possible out-of-bounds ...)
+ TODO: check
+CVE-2026-28648 (In Settings, there is a possible permission bypass due to a confused d ...)
+ TODO: check
+CVE-2026-28647 (In updateState of DeviceAdminAppsPreferenceController.java, there is a ...)
+ TODO: check
+CVE-2026-28641 (In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceC ...)
+ TODO: check
+CVE-2026-28640 (In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActiv ...)
+ TODO: check
+CVE-2026-28625 (In multiple locations, there is a possible permission bypass due to a ...)
+ TODO: check
+CVE-2026-19185 (The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers. ...)
+ TODO: check
+CVE-2026-19184 (The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the ...)
+ TODO: check
+CVE-2026-12171 (auto-changelog before 2.6.1 merges configuration from inside the targe ...)
+ TODO: check
+CVE-2026-105712 (gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted dat ...)
+ TODO: check
+CVE-2026-105646 (Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, ...)
+ TODO: check
+CVE-2026-105645 (Ghost is a Node.js content management system. From 5.37.0 until 6.67.0 ...)
+ TODO: check
+CVE-2026-105644 (Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, ...)
+ TODO: check
+CVE-2026-105643 (Ghost is a Node.js content management system. From version 6.34.0 unti ...)
+ TODO: check
+CVE-2026-105642 (Ghost is a Node.js content management system. From 6.56.0 until 6.67.0 ...)
+ TODO: check
+CVE-2026-105641 (Plane is an open-source project management tool. Prior to 1.4.0, the d ...)
+ TODO: check
+CVE-2026-105640 (Plane is an open-source project management tool. Prior to 1.4.0, Plane ...)
+ TODO: check
+CVE-2026-105639 (Plane is an open-source project management tool. Prior to 1.4.0, Plane ...)
+ TODO: check
+CVE-2026-105638 (Plane is an open-source project management tool. Prior to 1.4.0, Plane ...)
+ TODO: check
+CVE-2026-105637 (Plane is an open-source project management tool. Prior to 1.4.0, Proje ...)
+ TODO: check
+CVE-2026-105636 (Plane is an open-source project management tool. Prior to 1.4.0, the w ...)
+ TODO: check
+CVE-2026-105635 (Plane is an open-source project management tool. Prior to 1.4.0, Proje ...)
+ TODO: check
+CVE-2026-105634 (Plane is an open-source project management tool. Prior to 1.3.0, the P ...)
+ TODO: check
+CVE-2026-105633 (Plane is an open-source project management tool. Prior to 1.4.0, the V ...)
+ TODO: check
+CVE-2026-105632 (Plane is an open-source project management tool. Prior to 1.4.0, the G ...)
+ TODO: check
+CVE-2026-105631 (Plane is an open-source project management tool. Prior to 1.4.0, Works ...)
+ TODO: check
+CVE-2026-105630 (Plane is an open-source project management tool. Prior to 1.4.0, an au ...)
+ TODO: check
+CVE-2026-105629 (Plane is an open-source project management tool. Prior to 1.4.0, BulkE ...)
+ TODO: check
+CVE-2026-105628 (Plane is an open-source project management tool. Prior to 1.4.0, Plane ...)
+ TODO: check
+CVE-2026-105421 (Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) f ...)
+ TODO: check
+CVE-2026-105397 (LearnPress plugin for WordPress through 4.4.9.1 contains a stored cros ...)
+ TODO: check
+CVE-2026-105396 (Heym before v0.0.112 contains a token leakage vulnerability in build_p ...)
+ TODO: check
+CVE-2026-105387 (A security flaw has been discovered in girishsaraf Online-Appointment- ...)
+ TODO: check
+CVE-2026-105386 (A vulnerability was identified in onetwothreeneth HospitalManagementSy ...)
+ TODO: check
+CVE-2026-105385 (A vulnerability was determined in onetwothreeneth HospitalManagementSy ...)
+ TODO: check
+CVE-2026-105384 (A vulnerability was found in UNION HospitalManagementSystem up to 9ef9 ...)
+ TODO: check
+CVE-2026-105383 (A vulnerability has been found in onetwothreeneth HospitalManagementSy ...)
+ TODO: check
+CVE-2026-105382 (A flaw has been found in onetwothreeneth HospitalManagementSystem up t ...)
+ TODO: check
+CVE-2026-105329 (A vulnerability was determined in TallCMS up to 4.8.0. This affects an ...)
+ TODO: check
+CVE-2026-105326 (An argument injection flaw was found in CUPS. When email notification ...)
+ TODO: check
+CVE-2026-105315 (A vulnerability has been found in django-haystack up to 3.3.0. Affecte ...)
+ TODO: check
+CVE-2026-105314 (Papermerge 3.5.3 allows remote code execution by a standard user via d ...)
+ TODO: check
+CVE-2026-105307 (A vulnerability was detected in Casdoor up to 3.161.1. Affected is the ...)
+ TODO: check
+CVE-2026-105291 (A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This ...)
+ TODO: check
+CVE-2026-105290 (A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This ...)
+ TODO: check
+CVE-2026-105289 (A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected b ...)
+ TODO: check
+CVE-2026-105288 (A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affec ...)
+ TODO: check
+CVE-2026-105287 (A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an ...)
+ TODO: check
+CVE-2026-105286 (A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. ...)
+ TODO: check
+CVE-2026-105285 (A security vulnerability has been detected in Totolink A3002MU 1.0.0-B ...)
+ TODO: check
+CVE-2026-105284 (A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.145 ...)
+ TODO: check
+CVE-2026-105263 (A security flaw has been discovered in Shaarli up to 0.16.3. The affec ...)
+ TODO: check
+CVE-2026-105254 (A vulnerability was identified in itsourcecode Online Admission System ...)
+ TODO: check
+CVE-2026-105253 (A vulnerability was determined in itsourcecode Online Admission System ...)
+ TODO: check
+CVE-2026-105251 (A vulnerability was detected in vgmstream up to r2117. Affected by thi ...)
+ TODO: check
+CVE-2026-105250 (A security vulnerability has been detected in vgmstream up to r2117. A ...)
+ TODO: check
+CVE-2026-105249 (A weakness has been identified in vgmstream up to r2117. This impacts ...)
+ TODO: check
+CVE-2026-105248 (A security flaw has been discovered in vgmstream up to r2117. This aff ...)
+ TODO: check
+CVE-2026-105247 (A vulnerability was determined in SourceCodester Online Reviewer Manag ...)
+ TODO: check
+CVE-2026-105073 (Exposure of Sensitive System Information to an Unauthorized Control Sp ...)
+ TODO: check
+CVE-2026-105069 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-105068 (Insertion of Sensitive Information Into Sent Data vulnerability in Pix ...)
+ TODO: check
+CVE-2026-105064 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe ...)
+ TODO: check
+CVE-2026-105062 (Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-adm ...)
+ TODO: check
+CVE-2026-105060 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-105056 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-105055 (Missing Authorization vulnerability in WP Mailster WP Mailster wp-mail ...)
+ TODO: check
+CVE-2026-104979 (Plane is an open-source project management tool. Prior to 1.4.0, Intak ...)
+ TODO: check
+CVE-2026-104978 (Plane is an open-source project management tool. Prior to 1.4.0, Plane ...)
+ TODO: check
+CVE-2026-104977 (Plane is an open-source project management tool. Prior to 1.4.0, the f ...)
+ TODO: check
+CVE-2026-104976 (Plane is an open-source project management tool. Prior to 1.4.0, Plane ...)
+ TODO: check
+CVE-2026-104975 (Plane is an open-source project management tool. Prior to 1.4.0, Plane ...)
+ TODO: check
+CVE-2026-104974 (Plane is an open-source project management tool. Prior to 1.4.0, a use ...)
+ TODO: check
+CVE-2026-104973 (Plane is an open-source project management tool. Prior to 1.4.0, the f ...)
+ TODO: check
+CVE-2026-104971 (Plane is an open-source project management tool. Prior to 1.4.0, Dupli ...)
+ TODO: check
+CVE-2026-104970 (Plane is an open-source project management tool. From 0.13 until 1.4.0 ...)
+ TODO: check
+CVE-2026-104969 (Plane is an open-source project management tool. Prior to 1.4.0, the c ...)
+ TODO: check
+CVE-2026-104968 (Plane is an open-source project management tool. Prior to 1.4.0, GET / ...)
+ TODO: check
+CVE-2026-104967 (Plane is an open-source project management tool. Prior to 1.4.0, BulkD ...)
+ TODO: check
+CVE-2026-104966 (Plane is an open-source project management tool. Prior to 1.4.0, two e ...)
+ TODO: check
+CVE-2026-104965 (Plane is an open-source project management tool. Prior to 1.4.0, the i ...)
+ TODO: check
+CVE-2026-104964 (Plane is an open-source project management tool. Prior to 1.4.0, Plane ...)
+ TODO: check
+CVE-2026-104963 (Plane is an open-source project management tool. Prior to 1.4.0, GET / ...)
+ TODO: check
+CVE-2026-104962 (Plane is an open-source project management tool. Prior to 1.4.0, GET / ...)
+ TODO: check
+CVE-2026-104961 (Plane is an open-source project management tool. Prior to 1.4.0, Works ...)
+ TODO: check
+CVE-2026-104960 (Plane is an open-source project management tool. Prior to 1.4.0, Plane ...)
+ TODO: check
+CVE-2026-104956 (Plane is an open-source project management tool. Prior to 1.4.0, the u ...)
+ TODO: check
+CVE-2026-104955 (Plane is an open-source project management tool. Prior to 1.4.0, a Pro ...)
+ TODO: check
+CVE-2026-104905 (FacturaScripts before version 2026.7 contains a PHP object injection v ...)
+ TODO: check
+CVE-2026-104894 (Plane is an open-source project management tool. Prior to 1.4.0, the m ...)
+ TODO: check
+CVE-2026-104893 (Plane is an open-source project management tool. Prior to 1.4.0, GET / ...)
+ TODO: check
+CVE-2026-104892 (Plane is an open-source project management tool. Prior to 1.4.0, aPITo ...)
+ TODO: check
+CVE-2026-104891 (mppx-condition-gate provides conditional free-access wrappers for mppx ...)
+ TODO: check
+CVE-2026-104890 (Kunstmaan CMS is an open source content management system based on the ...)
+ TODO: check
+CVE-2026-104811 (DigitalCanion SA has discovered a vulnerability that allows remote att ...)
+ TODO: check
+CVE-2026-104810 (This vulnerability allows remote attackers to delete sensitive files o ...)
+ TODO: check
+CVE-2026-104809 (DigitalCanion has discovered a vulnerability that allows an attacker t ...)
+ TODO: check
+CVE-2026-104808 (DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulne ...)
+ TODO: check
+CVE-2026-104807 (DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulne ...)
+ TODO: check
+CVE-2026-104806 (DigitalCanion has discovered a path traversal vulnerability that allow ...)
+ TODO: check
+CVE-2026-104805 (DigitalCanion has discovered a vulnerability in the backup restoration ...)
+ TODO: check
+CVE-2026-104714 (Concurrent execution using shared resource with improper synchronizati ...)
+ TODO: check
+CVE-2026-104713 (Allocation of resources without limits or throttling vulnerability in ...)
+ TODO: check
+CVE-2026-104712 (Asymmetric resource consumption (amplification) vulnerability in Apach ...)
+ TODO: check
+CVE-2026-104711 (Improper neutralization of special elements used in an expression lang ...)
+ TODO: check
+CVE-2026-104706 (DigitalCanion has discovered a path traversal vulnerability that allow ...)
+ TODO: check
+CVE-2026-104675 (Missing Authorization vulnerability in Liquid Web / StellarWP Event Ti ...)
+ TODO: check
+CVE-2026-104673 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-104409 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-104408 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-104407 (Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting ...)
+ TODO: check
+CVE-2026-104404 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-104401 (Exposure of Sensitive System Information to an Unauthorized Control Sp ...)
+ TODO: check
+CVE-2026-104400 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-104397 (Missing Authorization vulnerability in Jeroen Peters Name Directory na ...)
+ TODO: check
+CVE-2026-104396 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-104389 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-104388 (Missing Authorization vulnerability in Blubrry Podcasting PowerPress P ...)
+ TODO: check
+CVE-2026-104386 (Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allow ...)
+ TODO: check
+CVE-2026-103684 (Missing Authorization vulnerability in Arraytics WP Event Solution wp- ...)
+ TODO: check
+CVE-2026-103512 (Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address ...)
+ TODO: check
+CVE-2026-103511 (Perforce P4 Search prior to 2026.4.2 does notvalidatefile names suppli ...)
+ TODO: check
+CVE-2026-103510 (P4 Search prior to 2026.4.2 does not fail securely when its service au ...)
+ TODO: check
+CVE-2026-103507 (Perforce P4 Search prior to 2026.4.2 does not restrict file paths writ ...)
+ TODO: check
+CVE-2026-103352 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-103351 (Improper Validation of Specified Quantity in Input vulnerability in Ma ...)
+ TODO: check
+CVE-2026-103349 (Deserialization of Untrusted Data vulnerability in Rymera Web Co Produ ...)
+ TODO: check
+CVE-2026-103335 (Insertion of Sensitive Information Into Sent Data vulnerability in Dee ...)
+ TODO: check
+CVE-2026-103334 (Insertion of Sensitive Information Into Sent Data vulnerability in Eto ...)
+ TODO: check
+CVE-2026-103086 (Missing Authorization vulnerability in Stiofan UsersWP userswp allows ...)
+ TODO: check
+CVE-2026-103085 (Improper Access Control vulnerability in WP User Manager WP User Manag ...)
+ TODO: check
+CVE-2026-103084 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-103079 (Authorization Bypass Through User-Controlled Key vulnerability in Ahma ...)
+ TODO: check
+CVE-2026-103078 (Authorization Bypass Through User-Controlled Key vulnerability in Ahma ...)
+ TODO: check
+CVE-2026-102914 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-102780 (Joomla Extension - joomlafry.com - Unauthenticated cross-record public ...)
+ TODO: check
+CVE-2026-102779 (Joomla Extension - joomlafry.com - Unauthenticated forced execution of ...)
+ TODO: check
+CVE-2026-102778 (Joomla Extension - svenbluege.de - Cross-site scripting and open redir ...)
+ TODO: check
+CVE-2026-102777 (Joomla Extension - svenbluege.de - Server-side request forgery in the ...)
+ TODO: check
+CVE-2026-102776 (Joomla Extension - svenbluege.de - Cross-site request forgery of list ...)
+ TODO: check
+CVE-2026-102775 (Joomla Extension - phoca.cz - Authorisation bypass through user-contro ...)
+ TODO: check
+CVE-2026-102576 (A flaw was found in Quay. A remote attacker could trick a user into lo ...)
+ TODO: check
+CVE-2026-102428 (Joomla Extension - ordasoft.com - Unauthenticated SQL injection in Ord ...)
+ TODO: check
+CVE-2026-102426 (Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Conte ...)
+ TODO: check
+CVE-2026-102393 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-102383 (Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook ...)
+ TODO: check
+CVE-2026-102295 (A flaw was found in Quay. A cross-site scripting (XSS) vulnerability i ...)
+ TODO: check
+CVE-2026-102282 (adm-zip is a JavaScript library for creating and extracting ZIP archiv ...)
+ TODO: check
+CVE-2026-101919 (A flaw was found in the HyperShift operator. The operator copies user- ...)
+ TODO: check
+CVE-2026-100515 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-100509 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-100103 (Perforce P4 Search container images prior to 2026.4.2 reset the servic ...)
+ TODO: check
+CVE-2026-100102 (Perforce P4 Search container images prior to 2026.4.2enablean unauthen ...)
+ TODO: check
+CVE-2025-15643 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
CVE-2026-XXXX [OSSN-0112]
- gnocchi 4.7.0-7 (bug #1150009)
NOTE: https://github.com/gnocchixyz/gnocchi/security/advisories/GHSA-cjq3-6hm7-q33w
NOTE: https://wiki.openstack.org/wiki/OSSN/OSSN-0112
-CVE-2026-63266 [Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality]
+CVE-2026-63266 (LibreOffice Calc can link a cell range to an external data source, and ...)
+ {DSA-6543-1}
- libreoffice 4:26.2.5.2-1
NOTE: https://www.libreoffice.org/security/#cve-2026-63266
-CVE-2026-63267 [LFI and GET SSRF via calcext:data-mappings and csv provider]
+CVE-2026-63267 (LibreOffice Calc can link a cell range to an external csv data source, ...)
+ {DSA-6543-1}
- libreoffice 4:26.2.5.2-1
NOTE: https://www.libreoffice.org/security/#cve-2026-63267
-CVE-2026-63268 [LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href]
+CVE-2026-63268 (LibreOffice Calc can link a cell range to an external data source, and ...)
+ {DSA-6543-1}
- libreoffice 4:26.2.5.2-1
NOTE: https://www.libreoffice.org/security/#cve-2026-63268
-CVE-2026-63269 [LFI and GET SSRF via GStreamer and HLS playlists]
+CVE-2026-63269 (LibreOffice can link to audio and video files from a document, and on ...)
+ {DSA-6543-1}
- libreoffice 4:26.2.5.2-1
NOTE: https://www.libreoffice.org/security/#cve-2026-63269
-CVE-2026-63270 [Environment/ini-file leaks]
+CVE-2026-63270 (URLs could be constructed which expanded environment variable or INI f ...)
+ {DSA-6543-1}
- libreoffice 4:26.2.5.2-1
NOTE: https://www.libreoffice.org/security/#cve-2026-63270
-CVE-2026-63277 [RCE via calcext:data-mappings, sql provider and jdbc connector]
+CVE-2026-63277 (LibreOffice Calc can link a cell range to an external data source, and ...)
+ {DSA-6543-1}
- libreoffice 4:26.2.5.2-1
NOTE: https://www.libreoffice.org/security/#cve-2026-63277
CVE-2026-84169 (The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does no ...)
@@ -3019,7 +3471,7 @@ CVE-2026-94177 (Unauthenticated SQL Injection in GamiPress <= 8.0.2 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-94173 (Contributor Insecure Direct Object References (IDOR) in Business Direc ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-94171 (Unauthenticated Cross Site Scripting (XSS) in CURCY <= 2.2.16 versions ...)
+CVE-2026-94171 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-94123 (Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 ve ...)
NOT-FOR-US: WordPress plugin or theme
@@ -6000,7 +6452,7 @@ CVE-2026-95520 (A heap-based buffer overflow flaw was found in rpm. Parsing a sy
[trixie] - rpm <no-dsa> (Minor issue)
[bookworm] - rpm <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2537809
-CVE-2026-19395
+CVE-2026-19395 (In Qt for MCUs, a Text element that displays styled text halts the dev ...)
NOT-FOR-US: Qt for MCUs
CVE-2026-95509 (Strings optimized for Latin-1 displaying Latin-1 characters cause inco ...)
NOT-FOR-US: Qt for MCUs
@@ -18244,7 +18696,6 @@ CVE-2026-85495
[bookworm] - ppp <postponed> (Minor issue)
NOTE: https://github.com/ppp-project/ppp/security/advisories/GHSA-frhv-j822-2pvx
CVE-2026-75883 (The code in pppd that formats a response to a PEAP Request packet in p ...)
- {DLA-4808-1}
- ppp <unfixed> (bug #1148816)
[bookworm] - ppp <not-affected> (PEAP support introduced in 2.5.0)
NOTE: https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35
@@ -69647,6 +70098,7 @@ CVE-2026-19694 (TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of
NOTE: https://www.wireshark.org/security/wnpa-sec-2026-68.html
NOTE: https://gitlab.com/wireshark/wireshark/-/work_items/21389
CVE-2026-19487 (Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expre ...)
+ {DLA-4821-1}
- perl 5.42.2-3 (bug #1144668)
[trixie] - perl 5.40.1-6+deb13u1
NOTE: https://lists.security.metacpan.org/cve-announce/msg/42658992/
@@ -86020,6 +86472,7 @@ CVE-2026-54605 (OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, pr
NOTE: Introduced with: https://github.com/ruby-oauth/oauth/commit/d74b767f464ee045cec75504974ff897b3dc0076 (v0.5.5)
NOTE: Fixed by: https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f (v1.1.6)
CVE-2026-54603 (OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frame ...)
+ {DLA-4822-1}
- ruby-oauth2 2.0.25-1 (bug #1143054)
[trixie] - ruby-oauth2 <no-dsa> (Minor issue)
NOTE: https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9
@@ -102957,12 +103410,14 @@ CVE-2026-57691 (Improper Neutralization of Input During Web Page Generation ('Cr
CVE-2026-57668 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-57433 (Storable versions before 3.41 for Perl have a signed integer overflow ...)
+ {DLA-4821-1}
- perl 5.40.1-8 (bug #1138906; bug #1142035)
[trixie] - perl 5.40.1-6+deb13u1
- libstorable-perl <removed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41780100/
NOTE: Fixed by: https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7 (v5.43.11)
CVE-2026-57432 (Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5 ...)
+ {DLA-4821-1}
- perl 5.40.1-8 (bug #1138905; bug #1142036)
[trixie] - perl 5.40.1-6+deb13u1
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41780102/
@@ -103184,6 +103639,7 @@ CVE-2026-14453 (This vulnerability is a critical Server-Side Template Injection
CVE-2026-14165 (An Authorization Bypass Through User-Controlled Key vulnerability affe ...)
NOT-FOR-US: Dassault Systemes
CVE-2026-13221 (Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5 ...)
+ {DLA-4821-1}
[experimental] - perl 5.44.0-1
- perl 5.42.3-1 (bug #1142037)
[trixie] - perl 5.40.1-6+deb13u1
@@ -106670,6 +107126,7 @@ CVE-2011-10043 (Module::Load versions before 0.22 for Perl allow arbitrary modul
- perl 5.18.1-2
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41608305/
CVE-2026-7017 (HTTP::Tiny versions before 0.095 for Perl forward credential headers t ...)
+ {DLA-4821-1}
- libhttp-tiny-perl 0.096-1 (bug #1141638)
[trixie] - libhttp-tiny-perl 0.090-1+deb13u1
[bookworm] - libhttp-tiny-perl <postponed> (Minor issue; leak requires caller-supplied credential headers and an attacker-influenced redirect)
@@ -124226,6 +124683,7 @@ CVE-2026-53705 (A flaw was found in GStreamer's WavPack audio decoder in gst-plu
NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/9326c636a22a678952a6cae6518465d35d441a87 (1.28.4)
NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f7cb3e0288627cce919e656584b852ac8605c922 (1.28.4)
CVE-2026-12087 (Socket versions before 2.041 for Perl have an out-of-bounds heap read. ...)
+ {DLA-4821-1}
- libsocket-perl 2.041-1 (bug #1146063)
[trixie] - libsocket-perl 2.038-1+deb13u1
[bookworm] - libsocket-perl <postponed> (Minor issue; up-to-3-byte heap over-read, only reachable when a script passes attacker-controlled source to pack_ip_mreq_source())
@@ -133336,7 +133794,7 @@ CVE-2025-53440 (Improper Control of Filename for Include/Require Statement in PH
NOT-FOR-US: WordPress plugin or theme
CVE-2025-53346 (Missing Authorization vulnerability in ThimPress Thim Core allows Expl ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2025-53345 (Missing Authorization vulnerability leading to code execution after in ...)
+CVE-2025-53345 (Missing Authorization vulnerability in ThimPress Thim Core thim-core.T ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-53302 (Missing Authorization vulnerability in Anton Shevchuk Constructor allo ...)
NOT-FOR-US: WordPress plugin or theme
@@ -140417,7 +140875,7 @@ CVE-2026-46644 (Symfony Polyfill backports PHP features and provides compatibili
NOTE: https://symfony.com/blog/cve-2026-46644-insecure-equivalence-in-symfony-polyfill-intl-idn-for-ascii-only-xn-labels
NOTE: https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq
CVE-2026-48962 (IO::Compress versions before 2.220 for Perl can execute arbitrary code ...)
- {DLA-4812-1}
+ {DLA-4821-1 DLA-4812-1}
- libio-compress-perl 2.220-1 (bug #1138055)
[trixie] - libio-compress-perl 2.213-1+deb13u1
- perl 5.40.1-8 (bug #1138854)
@@ -140436,7 +140894,7 @@ CVE-2026-48961 (IO::Compress versions from 2.207 before 2.220 for Perl ship a zi
NOTE: Introduced with: https://github.com/pmqs/IO-Compress/commit/ddfe67584a228877e5d28840da75ff32e435a5e3 (v2.207)
NOTE: Fixed by: https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7 (v2.220)
CVE-2026-48959 (IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaust ...)
- {DLA-4812-1}
+ {DLA-4821-1 DLA-4812-1}
- libio-compress-perl 2.220-1 (bug #1138051)
[trixie] - libio-compress-perl 2.213-1+deb13u1
- perl 5.40.1-8 (bug #1138856)
@@ -140444,7 +140902,7 @@ CVE-2026-48959 (IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU e
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40434381/
NOTE: Fixed by: https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2 (v2.220)
CVE-2025-15649 (IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaugh ...)
- {DLA-4812-1}
+ {DLA-4821-1 DLA-4812-1}
- libio-compress-perl 2.217-1 (bug #1146065)
[trixie] - libio-compress-perl 2.213-1+deb13u1
- perl 5.40.1-8 (bug #1138863)
@@ -141109,12 +141567,14 @@ CVE-2026-9538 (Archive::Tar versions before 3.10 for Perl allow memory exhaustio
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40396448/
NOTE: https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7 (3.10)
CVE-2026-42497 (Archive::Tar versions before 3.08 for Perl extract hardlinks to attack ...)
+ {DLA-4821-1}
[experimental] - perl 5.44.0-1
- perl 5.42.3-1 (bug #1138859)
[trixie] - perl 5.40.1-6+deb13u1
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40396457/
NOTE: https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158 (3.08)
CVE-2026-42496 (Archive::Tar versions before 3.08 for Perl extract symlinks with attac ...)
+ {DLA-4821-1}
[experimental] - perl 5.44.0-1
- perl 5.42.3-1 (bug #1138860)
[trixie] - perl 5.40.1-6+deb13u1
@@ -142257,6 +142717,7 @@ CVE-2026-5091 (Catalyst::Plugin::Authentication versions through 0.10024 for Per
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40281889/
NOTE: https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/b0515f492257438cf07082acf1e10d06e8088a5e (v0.10_025)
CVE-2026-8376 (Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5 ...)
+ {DLA-4821-1}
- perl 5.40.1-8 (bug #1137345)
[trixie] - perl 5.40.1-6+deb13u1
[bullseye] - perl <postponed> (Minor issue; can be fixed in point release)
@@ -148777,6 +149238,7 @@ CVE-2026-0541 (ACAP applications can gain elevated privileges due to improper in
CVE-2026-0502 (Due to insufficient CSRF protection in SAP BusinessObjects Business In ...)
NOT-FOR-US: SAP
CVE-2026-7010 (HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP ...)
+ {DLA-4821-1}
- libhttp-tiny-perl 0.092-2 (bug #1146064)
[trixie] - libhttp-tiny-perl 0.090-1+deb13u1
[bookworm] - libhttp-tiny-perl <no-dsa> (Minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/edd1fab6c5b5adbf7a5450faa8afbc01a40dddc8
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/edd1fab6c5b5adbf7a5450faa8afbc01a40dddc8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261005/483dc9e4/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list