[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Oct 7 20:14:55 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
7f20e66d by security tracker role at 2026-10-07T19:14:31+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,13 +1,425 @@
-CVE-2026-92415
+CVE-2026-97720 (Incorrect implementation of JWT/OAuth authentication in Impala executo ...)
+ TODO: check
+CVE-2026-97294 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-97146 (Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the u ...)
+ TODO: check
+CVE-2026-96408 (A code injection vulnerability exists in the upgrade script of Movable ...)
+ TODO: check
+CVE-2026-96335 (Missing Authorization vulnerability in WPMU DEV Forminator allows Expl ...)
+ TODO: check
+CVE-2026-95606 (Deserialization of Untrusted Data vulnerability in Liquid Web / Stella ...)
+ TODO: check
+CVE-2026-95605 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-95595 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-95534 (Deserialization of Untrusted Data vulnerability in Unlimited Elements ...)
+ TODO: check
+CVE-2026-94670 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-94662 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-93684 (An SQL user using Impala up to and including version 4.5.2 with only S ...)
+ TODO: check
+CVE-2026-93026 (This vulnerability in Veeam Backup & Replication allows a Backup Viewe ...)
+ TODO: check
+CVE-2026-92543 (Docker Engine classifies a registry hostname as insecure using an any- ...)
+ TODO: check
+CVE-2026-92542 (The firewall rules which mark VXLAN datagrams for encryption indiscrim ...)
+ TODO: check
+CVE-2026-92533 (Path traversal vulnerability in the BugTracker.NET file download compo ...)
+ TODO: check
+CVE-2026-92532 (Unrestricted file upload vulnerability in the BugTracker.NET attachmen ...)
+ TODO: check
+CVE-2026-92531 (Operating system command injection vulnerability in the SVN integratio ...)
+ TODO: check
+CVE-2026-92393 (Apache YuniKorn 1.9.0 and earlier does not implement label and user an ...)
+ TODO: check
+CVE-2026-90466 (Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attack ...)
+ TODO: check
+CVE-2026-89417 (The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for ...)
+ TODO: check
+CVE-2026-88514 (An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obta ...)
+ TODO: check
+CVE-2026-78243 (Apache YuniKorn 1.8.0 and later, if configured with the LDAP group res ...)
+ TODO: check
+CVE-2026-76501 (A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Adm ...)
+ TODO: check
+CVE-2026-76500 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76499 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76498 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76488 (A vulnerability in the export policies functionality of Cisco Applicat ...)
+ TODO: check
+CVE-2026-76486 (A vulnerability in the VXLAN Operation, Administration, and Maintenanc ...)
+ TODO: check
+CVE-2026-76485 (A vulnerability in the VXLAN Operation, Administration, and Maintenanc ...)
+ TODO: check
+CVE-2026-76484 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76483 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76482 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76480 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76472 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76471 (A vulnerability in the NX-API feature of Cisco NX-OS Software could al ...)
+ TODO: check
+CVE-2026-76470 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76469 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76468 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76467 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76465 (A vulnerability in the MPLS Operation, Administration, and Maintenance ...)
+ TODO: check
+CVE-2026-76464 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76463 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76459 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76458 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76457 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76456 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76455 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76454 (A vulnerability in the Cisco Smart Licensing Utility API of Cisco Lice ...)
+ TODO: check
+CVE-2026-76453 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-76452 (A vulnerability in the web-based management interface of Cisco License ...)
+ TODO: check
+CVE-2026-76437 (A vulnerability in the web-based user interface of Cisco License On-Pr ...)
+ TODO: check
+CVE-2026-62253 (Homer is open source telecom observability software. Prior to version ...)
+ TODO: check
+CVE-2026-62252 (Homer is open source telecom observability software. Prior to version ...)
+ TODO: check
+CVE-2026-62251 (Homer is open source telecom observability software. Prior to version ...)
+ TODO: check
+CVE-2026-62179 (PraisonAI is a multi-agent teams system. In `praisonai-platform` prior ...)
+ TODO: check
+CVE-2026-62176 (PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the ...)
+ TODO: check
+CVE-2026-5703 (Path traversal vulnerability in the Satel Iberia SenNet Datalogger Ser ...)
+ TODO: check
+CVE-2026-58069 (This vulnerability in Veeam Backup & Replication allows an authenticat ...)
+ TODO: check
+CVE-2026-58068 (This vulnerability in Veeam Agent for Microsoft Windows allows any loc ...)
+ TODO: check
+CVE-2026-56851 (The Nickname profile can panic with an out-of-bounds slice error when ...)
+ TODO: check
+CVE-2026-46438 (wger is a free, open-source workout and fitness manager. Prior to vers ...)
+ TODO: check
+CVE-2026-46437 (wger is a free, open-source workout and fitness manager. Versions prio ...)
+ TODO: check
+CVE-2026-46434 (wger is a free, open-source workout and fitness manager. Prior to vers ...)
+ TODO: check
+CVE-2026-45161 (wger is a free, open-source workout and fitness manager. Prior to vers ...)
+ TODO: check
+CVE-2026-43976 (wger is a free, open-source workout and fitness manager. Prior to vers ...)
+ TODO: check
+CVE-2026-42721 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-42720 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-42714 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-42713 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-42710 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-42708 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-42532 (A path traversal vulnerability exists in the EmailSheet extract_parts ...)
+ TODO: check
+CVE-2026-41958 (A path traversal vulnerability exists in the unzip_http RemoteZipFile ...)
+ TODO: check
+CVE-2026-33586 (Authenticated users are able to manipulate both the SMTP envelope \u20 ...)
+ TODO: check
+CVE-2026-27434 (Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wp ...)
+ TODO: check
+CVE-2026-20362 (A vulnerability in the web-based management interface of Cisco Finesse ...)
+ TODO: check
+CVE-2026-20328 (A vulnerability in the web-based management interface of Cisco License ...)
+ TODO: check
+CVE-2026-20321 (A vulnerability in the web-based management API for Cisco Application ...)
+ TODO: check
+CVE-2026-20173 (A vulnerability in Cisco NX-OS Software could allow an unauthenticated ...)
+ TODO: check
+CVE-2026-20038 (A vulnerability in the endpoint group (EPG) contract functionality of ...)
+ TODO: check
+CVE-2026-20032 (A vulnerability in the Python interpreter of Cisco NX-OS Software coul ...)
+ TODO: check
+CVE-2026-19186 (ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee80215 ...)
+ TODO: check
+CVE-2026-15894 (The Bluetooth Mesh On-Demand Private Proxy solicitation handler in sub ...)
+ TODO: check
+CVE-2026-107313 (pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can sen ...)
+ TODO: check
+CVE-2026-107278 (MISP contains a validation flaw in its object synchronization logic. W ...)
+ TODO: check
+CVE-2026-107276 (MISP contains a race condition in the email-based one-time password (O ...)
+ TODO: check
+CVE-2026-107273 (Gophish 0.11.0 through 0.12.1 contains a server-side request forgery v ...)
+ TODO: check
+CVE-2026-107272 (Gophish through 0.12.1 contains stored and reflected cross-site script ...)
+ TODO: check
+CVE-2026-107271 (Gophish through 0.12.1 contains a rate limit bypass vulnerability that ...)
+ TODO: check
+CVE-2026-107270 (Gophish through 0.12.1 contains an insecure direct object reference vu ...)
+ TODO: check
+CVE-2026-107269 (Gophish through 0.12.1 contains a timing discrepancy vulnerability in ...)
+ TODO: check
+CVE-2026-107225 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107224 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107223 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107222 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107221 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107220 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107219 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107218 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107217 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107216 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107215 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107214 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107213 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107212 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107211 (Excelize is a Go language library for reading and writing Microsoft Ex ...)
+ TODO: check
+CVE-2026-107210 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-107209 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-107208 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-107207 (LMCache through 0.5.5 contains a server-side request forgery vulnerabi ...)
+ TODO: check
+CVE-2026-107206 (LMCache through 0.5.5 contains a missing authentication vulnerability ...)
+ TODO: check
+CVE-2026-107205 (LMCache through 0.5.5 contains a missing authentication vulnerability ...)
+ TODO: check
+CVE-2026-107204 (LMCache through 0.5.5 contains an unauthenticated remote code executio ...)
+ TODO: check
+CVE-2026-107202 (A command injection vulnerability exists in the h-ui (version v0.0.25 ...)
+ TODO: check
+CVE-2026-107194 (Sungrow iSolarCloud before 2026 allows authentication bypass and accou ...)
+ TODO: check
+CVE-2026-107183 (llama.cpp before b11393 contains a use-after-free and double free vuln ...)
+ TODO: check
+CVE-2026-107181 (Telegram Desktop before 7.2.9 contains an IPC record-separator injecti ...)
+ TODO: check
+CVE-2026-107180 (On MISP instances configured to require TOTP enrolment (Security.otp_r ...)
+ TODO: check
+CVE-2026-107177 (Express Gateway through 1.16.11 contains a hardcoded cryptographic key ...)
+ TODO: check
+CVE-2026-107175 (MISP contains a defect in its event save workflow that prevents the co ...)
+ TODO: check
+CVE-2026-107174 (A flaw was found in source-to-image. When unpacking archive files, the ...)
+ TODO: check
+CVE-2026-107170 (A flaw was found in m17n-lib. A partial failure during library initial ...)
+ TODO: check
+CVE-2026-107169 (A flaw was found in m17n-lib. An attacker could provide specially craf ...)
+ TODO: check
+CVE-2026-107168 (A flaw was found in m17n-lib. By providing crafted input containing an ...)
+ TODO: check
+CVE-2026-107167 (A flaw was found in m17n-lib. A user providing specially crafted text ...)
+ TODO: check
+CVE-2026-107166 (A weakness has been identified in Open5GS up to 2.7.7. This vulnerabil ...)
+ TODO: check
+CVE-2026-107162 (Express Gateway through 1.16.11 contains an authentication bypass vuln ...)
+ TODO: check
+CVE-2026-107159 (MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero ...)
+ TODO: check
+CVE-2026-107151 (Missing authentication has been found in remote-execution task updates ...)
+ TODO: check
+CVE-2026-107125 (A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown ...)
+ TODO: check
+CVE-2026-107121 (A flaw was found in the SMTP email configuration handling of the keycl ...)
+ TODO: check
+CVE-2026-107104 (This vulnerability exists in the ERP system due to unsafe deserializat ...)
+ TODO: check
+CVE-2026-107103 (This vulnerability exists in the ERP system due to insufficient valida ...)
+ TODO: check
+CVE-2026-107102 (This vulnerability exists in the ERP system due to improper validation ...)
+ TODO: check
+CVE-2026-106580 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106579 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106578 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106577 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106576 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106575 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106574 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106573 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106572 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106571 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106570 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106569 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106568 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106567 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106566 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106565 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106564 (ImageMagick is free and open-source software used for editing and mani ...)
+ TODO: check
+CVE-2026-106563 (Backstage is an open framework for building developer portals. Prior t ...)
+ TODO: check
+CVE-2026-106562 (Backstage is an open framework for building developer portals. Prior t ...)
+ TODO: check
+CVE-2026-106561 (Backstage is an open framework for building developer portals. Prior t ...)
+ TODO: check
+CVE-2026-106560 (Backstage is an open framework for building developer portals. Prior t ...)
+ TODO: check
+CVE-2026-106559 (Backstage is an open framework for building developer portals. Prior t ...)
+ TODO: check
+CVE-2026-106558 (Backstage is an open framework for building developer portals. Prior t ...)
+ TODO: check
+CVE-2026-106557 (Backstage is an open framework for building developer portals. Prior t ...)
+ TODO: check
+CVE-2026-106556 (Backstage is an open framework for building developer portals. Prior t ...)
+ TODO: check
+CVE-2026-106510 (Backstage is an open framework for building developer portals. Prior t ...)
+ TODO: check
+CVE-2026-106164 (In Progress\xae Telerik\xae Document Processing SpreadProcessing libra ...)
+ TODO: check
+CVE-2026-106067 (A heap-based buffer overflow was found in GIMP\u2019s Hot color filter ...)
+ TODO: check
+CVE-2026-106066 (A heap-based buffer overflow was found in GIMP\u2019s raw data export ...)
+ TODO: check
+CVE-2026-106065 (A heap-based buffer overflow was found in GIMP\u2019s PCX export plug- ...)
+ TODO: check
+CVE-2026-106064 (A heap-based buffer overflow was found in GIMP\u2019s GIF export plug- ...)
+ TODO: check
+CVE-2026-106059 (GitAhead through 2.7.1 on macOS contains a command injection vulnerabi ...)
+ TODO: check
+CVE-2026-106058 (GitAhead through 2.7.1 contains an OS command injection vulnerability ...)
+ TODO: check
+CVE-2026-106057 (patool before 4.0.6 contains an OS command injection vulnerability on ...)
+ TODO: check
+CVE-2026-106056 (Rundeck before 6.2.0 contains an OS command injection vulnerability th ...)
+ TODO: check
+CVE-2026-105884 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-105876 (Missing Authorization vulnerability in WP Chill Modula Image Gallery m ...)
+ TODO: check
+CVE-2026-105875 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-105873 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-105871 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-105192 (LMCache multiprocess mode, also called distributed mode, opens an unau ...)
+ TODO: check
+CVE-2026-105140 (Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race con ...)
+ TODO: check
+CVE-2026-105139 (Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerabili ...)
+ TODO: check
+CVE-2026-105138 (Obot 0.12.0 before 0.26.2 contains an insufficiently protected credent ...)
+ TODO: check
+CVE-2026-104393 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-104391 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-104390 (Missing Authorization vulnerability in Arraytics Booktics booktics all ...)
+ TODO: check
+CVE-2026-104074 (Coturn 4.10.0 contains an uninitialized memory disclosure vulnerabilit ...)
+ TODO: check
+CVE-2026-103668 (An SQL Injection vulnerability exists in the Site Search function of M ...)
+ TODO: check
+CVE-2026-103435 (Claude Code validated that a target file path resided within the proje ...)
+ TODO: check
+CVE-2026-103416 (Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Du ...)
+ TODO: check
+CVE-2026-103371 (Insertion of Sensitive Information into Log File in Apache Geode Web M ...)
+ TODO: check
+CVE-2026-103075 (Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup ...)
+ TODO: check
+CVE-2026-102782 (Joomla Extension - ordasoft.com - Unauthenticated SQL injection in Ord ...)
+ TODO: check
+CVE-2026-102781 (Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in ...)
+ TODO: check
+CVE-2026-102258 (Post-authentication Stored Cross-Site Scripting (XSS) vulnerability ha ...)
+ TODO: check
+CVE-2026-102257 (A Zip Slip vulnerability in the in the SMA1000 Appliance Management Co ...)
+ TODO: check
+CVE-2026-102256 (Post-authentication Improper Neutralization of Special Elements used i ...)
+ TODO: check
+CVE-2026-102255 (A Pre-authentication SSRF vulnerability exists in the SMA1000 Applianc ...)
+ TODO: check
+CVE-2026-101886 (Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains ...)
+ TODO: check
+CVE-2025-70522 (The request handler of Fanvil x7a firmware version 2.6.0.1182 does not ...)
+ TODO: check
+CVE-2025-70521 (The management portal's diagnostic ping tool of Fanvil x7a firmware ve ...)
+ TODO: check
+CVE-2025-70520 (The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does n ...)
+ TODO: check
+CVE-2025-70519 (The device log component of Fanvil x7a firmware version 2.6.0.1182 doe ...)
+ TODO: check
+CVE-2025-70518 (The management portal's diagnostic ping tool of Fanvil x7a firmware ve ...)
+ TODO: check
+CVE-2025-70517 (The request handler of Fanvil x7a firmware version 2.6.0.1182 does not ...)
+ TODO: check
+CVE-2025-70516 (The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does n ...)
+ TODO: check
+CVE-2025-70515 (The device log component of Fanvil x7a firmware version 2.6.0.1182 doe ...)
+ TODO: check
+CVE-2025-64393 (This vulnerability in Veeam Backup & Replication allows a Backup Viewe ...)
+ TODO: check
+CVE-2025-64392 (This vulnerability in Veeam Backup Enterprise Manager allows an attack ...)
+ TODO: check
+CVE-2025-64391 (This vulnerability in Veeam Agent for Microsoft Windows allows a low-p ...)
+ TODO: check
+CVE-2026-92415 (\u2014 Use of Externally-Controlled Input to Select Classes or Code vu ...)
- jackrabbit <unfixed>
NOTE: https://www.openwall.com/lists/oss-security/2026/10/07/28
-CVE-2026-92414
+CVE-2026-92414 (: Session Fixation / Session Reuse across Users vulnerability in Apach ...)
- jackrabbit <unfixed>
NOTE: https://www.openwall.com/lists/oss-security/2026/10/07/27
-CVE-2026-98374 [tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()]
+CVE-2026-98374 (In the Linux kernel, the following vulnerability has been resolved: t ...)
- linux 7.2.9-1
NOTE: https://git.kernel.org/linus/fe99bbeee5c5dbd3abc30721a8079ced59649d97 (7.3-rc5)
-CVE-2026-98373 [mm/hugetlb: preserve mremap address delta when skipping page tables]
+CVE-2026-98373 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 7.2.9-1
NOTE: https://git.kernel.org/linus/9bdad082d44bdcf93716973dcba6be77e8a06e7b (7.3-rc5)
CVE-2026-97680 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
@@ -800,7 +1212,7 @@ CVE-2026-48199 (Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versi
NOT-FOR-US: WordPress plugin or theme
CVE-2026-48197 (Incorrect Privilege Assignment vulnerability in PublishPress PublishPr ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-42638 (Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.7 ...)
+CVE-2026-42638 (Missing Authorization vulnerability in Awesomemotive Easy Digital Down ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-42637 (Unauthenticated Settings Change in PayPlug for WooCommerce (Official) ...)
NOT-FOR-US: WordPress plugin or theme
@@ -810,7 +1222,7 @@ CVE-2026-42635 (Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple
NOT-FOR-US: WordPress plugin or theme
CVE-2026-42634 (Unauthenticated Cross Site Scripting (XSS) in Video Background Block \ ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-42418 (Unauthenticated Cross Site Scripting (XSS) in Social Rocket <= 1.3.5 v ...)
+CVE-2026-42418 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-42417 (Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.)
NOT-FOR-US: WordPress plugin or theme
@@ -884,7 +1296,8 @@ CVE-2026-39770 (Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versi
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39769 (Unauthenticated Broken Authentication in Graphina <= 3.1.12 versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-39768 (Unauthenticated Cross Site Scripting (XSS) in Security & Malware scan ...)
+CVE-2026-39768
+ REJECTED
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39767 (Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.)
NOT-FOR-US: WordPress plugin or theme
@@ -9780,7 +10193,7 @@ CVE-2026-102635 (ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain unin
NOTE: https://github.com/ImageMagick/ImageMagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5 (6.9.13-57)
CVE-2026-102634 (SGLang through 0.5.20 in prefill/decode disaggregation mode fails to v ...)
NOT-FOR-US: SGLang
-CVE-2026-77214
+CVE-2026-77214 (libexpat before commit 13c5f63 contains a heap buffer over-read vulner ...)
- expat 2.9.0-1
NOTE: https://github.com/libexpat/libexpat/pull/1393
NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/4d9b1c499ecb66323260a7274edcf86c5eab0517 (R_2_9_0)
@@ -41290,7 +41703,7 @@ CVE-2026-69439 (Heap-based buffer overflow in .NET and Visual Studio allows an u
NOT-FOR-US: Microsoft
CVE-2026-69438 (Incorrect conversion between numeric types in Microsoft JScript allows ...)
NOT-FOR-US: Microsoft
-CVE-2026-69436 (Heap-based buffer overflow in Windows Error Reporting allows an author ...)
+CVE-2026-69436 (Heap-based buffer overflow in Windows State Repository Service allows ...)
NOT-FOR-US: Microsoft
CVE-2026-69434 (Heap-based buffer overflow in Windows URL Moniker allows an unauthoriz ...)
NOT-FOR-US: Microsoft
@@ -64756,7 +65169,7 @@ CVE-2026-74012 (Deserialization of Untrusted Data vulnerability in TaxoPress all
NOT-FOR-US: WordPress plugin or theme
CVE-2026-74009 (Unauthenticated Insecure Direct Object References (IDOR) in Razorpay f ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-74008 (Unauthenticated Sensitive Data Exposure in Shortcodes and extra featur ...)
+CVE-2026-74008 (Insertion of Sensitive Information Into Sent Data vulnerability in Ave ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-74007 (Unauthenticated Sensitive Data Exposure in 3D FlipBook \u2013 PDF Flip ...)
NOT-FOR-US: WordPress plugin or theme
@@ -103822,43 +104235,43 @@ CVE-2026-56135 (In NTFS-3G through 2026.2.25, a heap-based buffer overflow exist
- ntfs-3g 1:2026.7.7-2 (bug #1142144)
NOTE: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-c9qg-fh4v-mq8r
NOTE: https://www.openwall.com/lists/oss-security/2026/07/15/6
-CVE-2026-46572
+CVE-2026-46572 (In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_c ...)
{DSA-6389-1}
[experimental] - ntfs-3g 1:2026.7.7-1
- ntfs-3g 1:2026.7.7-2 (bug #1142144)
NOTE: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-wx5r-gc7w-9hhc
NOTE: https://www.openwall.com/lists/oss-security/2026/07/15/6
-CVE-2026-46570
+CVE-2026-46570 (In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_inde ...)
{DSA-6389-1}
[experimental] - ntfs-3g 1:2026.7.7-1
- ntfs-3g 1:2026.7.7-2 (bug #1142144)
NOTE: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-m6qq-pv5j-2wxc
NOTE: https://www.openwall.com/lists/oss-security/2026/07/15/6
-CVE-2026-46571
+CVE-2026-46571 (In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_fi ...)
{DSA-6389-1}
[experimental] - ntfs-3g 1:2026.7.7-1
- ntfs-3g 1:2026.7.7-2 (bug #1142144)
NOTE: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-52gr-j4pv-9pjh
NOTE: https://www.openwall.com/lists/oss-security/2026/07/15/6
-CVE-2026-46569
+CVE-2026-46569 (In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_c ...)
{DSA-6389-1}
[experimental] - ntfs-3g 1:2026.7.7-1
- ntfs-3g 1:2026.7.7-2 (bug #1142144)
NOTE: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xxv8-9r24-hcj9
NOTE: https://www.openwall.com/lists/oss-security/2026/07/15/6
-CVE-2026-42618
+CVE-2026-42618 (In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_deco ...)
{DSA-6389-1}
[experimental] - ntfs-3g 1:2026.7.7-1
- ntfs-3g 1:2026.7.7-2 (bug #1142144)
NOTE: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6whp-3f63-97qw
NOTE: https://www.openwall.com/lists/oss-security/2026/07/15/6
-CVE-2026-42617
+CVE-2026-42617 (In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_t ...)
{DSA-6389-1}
[experimental] - ntfs-3g 1:2026.7.7-1
- ntfs-3g 1:2026.7.7-2 (bug #1142144)
NOTE: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-jv65-qqf7-f692
NOTE: https://www.openwall.com/lists/oss-security/2026/07/15/6
-CVE-2026-42616
+CVE-2026-42616 (In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ...)
{DSA-6389-1}
[experimental] - ntfs-3g 1:2026.7.7-1
- ntfs-3g 1:2026.7.7-2 (bug #1142144)
@@ -105482,6 +105895,7 @@ CVE-2026-47767 (Symfony is a PHP framework for web and console applications and
NOTE: https://github.com/symfony/symfony/security/advisories/GHSA-fqc7-9xjw-jrh3
NOTE: https://github.com/symfony/symfony/commit/3228c3806ee511008bea19a95084d460b17e5d25 (v5.4.52, v6.4.40, v7.4.12, v8.0.12)
CVE-2026-47737 (Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until ...)
+ {DLA-4826-1}
- puma 8.0.2-1
[trixie] - puma <no-dsa> (Minor issue)
NOTE: https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx
@@ -105490,6 +105904,7 @@ CVE-2026-47737 (Puma is a Ruby/Rack web server built for parallelism. From 5.5.0
NOTE: https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f (v8.0.2)
NOTE: https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58 (v7.2.1)
CVE-2026-47736 (Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until ...)
+ {DLA-4826-1}
- puma 8.0.2-1
[trixie] - puma <no-dsa> (Minor issue)
NOTE: https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8
@@ -218433,7 +218848,7 @@ CVE-2025-69018 (Improper Neutralization of Input During Web Page Generation ('Cr
NOT-FOR-US: WordPress plugin or theme
CVE-2025-69017 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2025-69016 (Missing Authorization vulnerability in averta Shortcodes and extra fea ...)
+CVE-2025-69016 (Missing Authorization vulnerability in Averta LTD Shortcodes and extra ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-69015 (Missing Authorization vulnerability in Automattic Crowdsignal Forms cr ...)
NOT-FOR-US: WordPress plugin or theme
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7f20e66d9f717ec97bd311856f9e044a8c98ab95
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7f20e66d9f717ec97bd311856f9e044a8c98ab95
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/581cff3f/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list