[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 8 08:14:06 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
9030b991 by security tracker role at 2026-10-08T07:13:55+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,311 @@
+CVE-2026-97717 (CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Ac ...)
+ TODO: check
+CVE-2026-97716 (CVE-2026-97716 is a vulnerability in the connection set up sub-system ...)
+ TODO: check
+CVE-2026-97715 (CVE-2026-97715is a vulnerability in the client registration process of ...)
+ TODO: check
+CVE-2026-97714 (CVE-2026-97714 is a is a vulnerability in the authentication sub-syste ...)
+ TODO: check
+CVE-2026-97664
+ REJECTED
+CVE-2026-94587 (A buffer overflow vulnerability exists in the WebTools administrative ...)
+ TODO: check
+CVE-2026-94586 (A command injection vulnerability exists in the WebTools administrativ ...)
+ TODO: check
+CVE-2026-94585 (An authentication bypass vulnerability exists in the web management in ...)
+ TODO: check
+CVE-2026-94584 (A race condition and thread-safety vulnerability exists in the web man ...)
+ TODO: check
+CVE-2026-94583 (A race condition vulnerability exists in the request processing logic ...)
+ TODO: check
+CVE-2026-94582 (A memory buffer overflow vulnerability exists in the internal diagnost ...)
+ TODO: check
+CVE-2026-94581 (An OS command injection vulnerability exists in the REST API managemen ...)
+ TODO: check
+CVE-2026-94580 (An arbitrary file and directory deletion vulnerability exists in the R ...)
+ TODO: check
+CVE-2026-94579 (An OS command injection vulnerability exists in the PAM (Pluggable Aut ...)
+ TODO: check
+CVE-2026-94578 (Brocade Fabric OS versions before 10.0.1 contain an authorization logi ...)
+ TODO: check
+CVE-2026-94577 (A privilege escalation vulnerability exists in the internal Command-Li ...)
+ TODO: check
+CVE-2026-94576 (An authentication logic and privilege escalation vulnerability exists ...)
+ TODO: check
+CVE-2026-94575 (A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web ...)
+ TODO: check
+CVE-2026-94275 (The Track Orders for WooCommerce WordPress plugin before 1.2.7 does n ...)
+ TODO: check
+CVE-2026-94258 (The SMS Alert WordPress plugin before 4.0.1 does not check that the a ...)
+ TODO: check
+CVE-2026-94246 (The Wallet System for WooCommerce WordPress plugin before 2.8.0 does ...)
+ TODO: check
+CVE-2026-94245 (The Wallet System for WooCommerce WordPress plugin before 2.8.0 does ...)
+ TODO: check
+CVE-2026-94244 (The Wallet System for WooCommerce WordPress plugin before 2.8.0 does ...)
+ TODO: check
+CVE-2026-94154 (The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross- ...)
+ TODO: check
+CVE-2026-92862 (The Android application "Ticket Ryutsu Center" improperly handles cust ...)
+ TODO: check
+CVE-2026-92861 (The Android application "Ticket Ryutsu Center" contains hard-coded cre ...)
+ TODO: check
+CVE-2026-89322 (Vault and Vault Enterprise did not consistently evaluate ACL policies ...)
+ TODO: check
+CVE-2026-87726 (Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC66 ...)
+ TODO: check
+CVE-2026-87688 (An input validation vulnerability exists in the security certificate m ...)
+ TODO: check
+CVE-2026-87687 (An authorization and input validation vulnerability exists in Brocade ...)
+ TODO: check
+CVE-2026-87686 (An authentication and access control bypass vulnerability exists in th ...)
+ TODO: check
+CVE-2026-87685 (An arbitrary file manipulation vulnerability exists in the WebTools ma ...)
+ TODO: check
+CVE-2026-87684 (A stack-based buffer overflow vulnerability exists in the SNMP daemon ...)
+ TODO: check
+CVE-2026-87683 (Multiple stack-based buffer overflow vulnerabilities exist in the REST ...)
+ TODO: check
+CVE-2026-87682 (Multiple OS Command Injection vulnerabilities exist in the management ...)
+ TODO: check
+CVE-2026-87681 (An Access Control Bypass vulnerability exists in the Role-Based Access ...)
+ TODO: check
+CVE-2026-87680 (A command injection vulnerability in the REST API management interface ...)
+ TODO: check
+CVE-2026-87679 (When Brocade Fabric OS versions before 10.0.1 processes trunk configur ...)
+ TODO: check
+CVE-2026-87678 (An input validation and output encoding vulnerability exists in the we ...)
+ TODO: check
+CVE-2026-87677 (An OS command injection vulnerability exists in the account management ...)
+ TODO: check
+CVE-2026-87676 (A stack-based buffer overflow vulnerability exists in the security lib ...)
+ TODO: check
+CVE-2026-87675 (An OS command injection vulnerability exists in the configuration mana ...)
+ TODO: check
+CVE-2026-87674 (A local privilege escalation vulnerability exists in the system loggin ...)
+ TODO: check
+CVE-2026-87673 (An OS command injection vulnerability exists in maintenance command-li ...)
+ TODO: check
+CVE-2026-87672 (An information disclosure vulnerability exists in the SupportLink diag ...)
+ TODO: check
+CVE-2026-87671 (An out-of-bounds memory read vulnerability exists in the web managemen ...)
+ TODO: check
+CVE-2026-87670 (An authorization logic vulnerability exists in the Brocade Fabric OS v ...)
+ TODO: check
+CVE-2026-87669 (A missing authorization check in Brocade Fabric OS versions before 10. ...)
+ TODO: check
+CVE-2026-87668 (A stack-based buffer overflow vulnerability exists in the diagnostic e ...)
+ TODO: check
+CVE-2026-87667 (An argument injection vulnerability exists in the configuration manage ...)
+ TODO: check
+CVE-2026-87666 (An OS command injection vulnerability exists in the time and zone mana ...)
+ TODO: check
+CVE-2026-87665 (A stack-based buffer overflow vulnerability exists in the Internet Key ...)
+ TODO: check
+CVE-2026-87664 (A session context forgery vulnerability exists in the web management d ...)
+ TODO: check
+CVE-2026-87663 (An authentication bypass and command injection vulnerability exists in ...)
+ TODO: check
+CVE-2026-87662 (Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 hand ...)
+ TODO: check
+CVE-2026-87661 (Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 d ...)
+ TODO: check
+CVE-2026-87660 (An improper file permission and missing authorization vulnerability ex ...)
+ TODO: check
+CVE-2026-87659 (A critical authorization bypass vulnerability exists in the Management ...)
+ TODO: check
+CVE-2026-87428 (In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM ...)
+ TODO: check
+CVE-2026-87426 (An unauthenticated network-based attacker can query specific internal ...)
+ TODO: check
+CVE-2026-87425 (An unauthenticated remote attacker can modify the TLS client trust sto ...)
+ TODO: check
+CVE-2026-87424 (A vulnerability in the SupportLink API authentication component of Bro ...)
+ TODO: check
+CVE-2026-86828 (The BackWPup WordPress plugin before 5.7.7 does not properly restrict ...)
+ TODO: check
+CVE-2026-86827 (The BackWPup WordPress plugin before 5.7.7 does not verify that a req ...)
+ TODO: check
+CVE-2026-86826 (The BackWPup WordPress plugin before 5.7.7 does not properly restrict ...)
+ TODO: check
+CVE-2026-85490 (When Brocade ASCG before 3.5.0 processes support bundle archives inges ...)
+ TODO: check
+CVE-2026-85489 (An authentication flaw exists in the Brocade ASCG administrative manag ...)
+ TODO: check
+CVE-2026-85488 (Brocade ASCG before 3.5.0 has a well-known Brocade default password em ...)
+ TODO: check
+CVE-2026-85487 (A path traversal vulnerability exists in the HTTP service component of ...)
+ TODO: check
+CVE-2026-85486 (Brocade ASCG before 3.5.0 improperly processes user input by evaluatin ...)
+ TODO: check
+CVE-2026-85423 (A vulnerability has been identified in the data collection service of ...)
+ TODO: check
+CVE-2026-85422 (A vulnerability in Brocade ASCG version before 3.5.0 could allow an at ...)
+ TODO: check
+CVE-2026-85421 (A critical security vulnerability has been identified in Brocade ASCG ...)
+ TODO: check
+CVE-2026-85097 (The Bricksforge plugin for WordPress is vulnerable to unauthenticated ...)
+ TODO: check
+CVE-2026-82627 (The Uncanny Automator \u2013 AI + Automation for WordPress | AI Agent, ...)
+ TODO: check
+CVE-2026-76286 (In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could sen ...)
+ TODO: check
+CVE-2026-76285 (Improper Adherence to Coding Standards. Splunk addressed multiple inte ...)
+ TODO: check
+CVE-2026-76284 (Improper Neutralization. Splunk addressed multiple internally identifi ...)
+ TODO: check
+CVE-2026-76283 (Protection Mechanism Failure. Splunk addressed multiple internally ide ...)
+ TODO: check
+CVE-2026-76282 (Improper Control of a Resource Through its Lifetime. Splunk addressed ...)
+ TODO: check
+CVE-2026-76281 (Improper Access Control. Splunk addressed multiple internally identifi ...)
+ TODO: check
+CVE-2026-76280 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.1 ...)
+ TODO: check
+CVE-2026-76279 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.1 ...)
+ TODO: check
+CVE-2026-76278 (In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a use ...)
+ TODO: check
+CVE-2026-76277 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.1 ...)
+ TODO: check
+CVE-2026-76276 (In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low ...)
+ TODO: check
+CVE-2026-76275 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.1 ...)
+ TODO: check
+CVE-2026-76274 (In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a use ...)
+ TODO: check
+CVE-2026-76273 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.1 ...)
+ TODO: check
+CVE-2026-76272 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.1 ...)
+ TODO: check
+CVE-2026-76271 (In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low ...)
+ TODO: check
+CVE-2026-76270 (In Splunk Enterprise versions below 10.4.3, a user that holds a role w ...)
+ TODO: check
+CVE-2026-76269 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.1 ...)
+ TODO: check
+CVE-2026-76268 (In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthentica ...)
+ TODO: check
+CVE-2026-76267 (In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a use ...)
+ TODO: check
+CVE-2026-76266 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.1 ...)
+ TODO: check
+CVE-2026-76265 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.1 ...)
+ TODO: check
+CVE-2026-76264 (In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.1 ...)
+ TODO: check
+CVE-2026-5769 (A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fa ...)
+ TODO: check
+CVE-2026-5049 (A path traversal vulnerability affects the The Zone Alias Import flow ...)
+ TODO: check
+CVE-2026-5048 (In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in var ...)
+ TODO: check
+CVE-2026-5047 (A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encod ...)
+ TODO: check
+CVE-2026-34499 (Use of hard-coded cryptographic key vulnerability in Johnson Controls ...)
+ TODO: check
+CVE-2026-17609 (The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress i ...)
+ TODO: check
+CVE-2026-17538 (The LatePoint - Appointment Booking & Reservation plugin for WordPress ...)
+ TODO: check
+CVE-2026-17196 (The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress i ...)
+ TODO: check
+CVE-2026-107459 (The SecuShare Pro developed by Openfind has an OS Command Injection vu ...)
+ TODO: check
+CVE-2026-107450 (In Stump through 0.1.10, the updateSmartList and deleteSmartList Graph ...)
+ TODO: check
+CVE-2026-107449 (linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF pro ...)
+ TODO: check
+CVE-2026-107448 (Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127 ...)
+ TODO: check
+CVE-2026-107446 (containerd overlaybd through 1.0.18 has a do_load_index (LSMT index lo ...)
+ TODO: check
+CVE-2026-107445 (A flaw was found in Katello where the Flatpak Remote Repositories API ...)
+ TODO: check
+CVE-2026-107444 (A flaw was found in Katello where the Docker Tags repositories API doe ...)
+ TODO: check
+CVE-2026-107355
+ REJECTED
+CVE-2026-107354
+ REJECTED
+CVE-2026-107353 (traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5. ...)
+ TODO: check
+CVE-2026-107352 (Missing authorization checks in Amazon Athena engine version 3 request ...)
+ TODO: check
+CVE-2026-107315 (pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pa ...)
+ TODO: check
+CVE-2026-107314 (pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 e ...)
+ TODO: check
+CVE-2026-107285 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107284 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107283 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107282 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107281 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107280 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107279 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107232 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107231 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107230 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107229 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107228 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107227 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
+ TODO: check
+CVE-2026-107176 (A flaw was found in the cluster-samples-operator. The RBAC Role coreos ...)
+ TODO: check
+CVE-2026-107161 (A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_ ...)
+ TODO: check
+CVE-2026-105820 (Vault's ACL policy cache allowed namespace traversal when policy names ...)
+ TODO: check
+CVE-2026-105818 (Vault's PKI secrets engine ACME server did not restrict certificate id ...)
+ TODO: check
+CVE-2026-105816 (Vault and Vault Enterprise did not consistently verify that stored plu ...)
+ TODO: check
+CVE-2026-105260 (The Database Addon For WPForms ( wpforms entries ) WordPress plugin b ...)
+ TODO: check
+CVE-2026-105198 (The Appointment Booking Plugin WordPress plugin before 5.7.3 does not ...)
+ TODO: check
+CVE-2026-105197 (The Appointment Booking Plugin WordPress plugin before 5.6.5 does not ...)
+ TODO: check
+CVE-2026-105196 (The Appointment Booking Plugin WordPress plugin before 5.6.9 does not ...)
+ TODO: check
+CVE-2026-105195 (The Booking Calendar WordPress plugin before 11.8.3 does not adequatel ...)
+ TODO: check
+CVE-2026-105194 (The Easy Digital Downloads WordPress plugin before 3.7.1 does not res ...)
+ TODO: check
+CVE-2026-105193 (The Booking Calendar WordPress plugin before 11.8 does not generate it ...)
+ TODO: check
+CVE-2026-104646 (The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.1 ...)
+ TODO: check
+CVE-2026-104645 (The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.1 ...)
+ TODO: check
+CVE-2026-103692 (The Frontend Dashboard WordPress plugin before 3.0.5 does not perform ...)
+ TODO: check
+CVE-2026-103646 (The Ultimate Multisite WordPress plugin before 2.17.0 does not requir ...)
+ TODO: check
+CVE-2026-103309 (The GPTranslate WordPress plugin before 2.34.14 does not properly res ...)
+ TODO: check
+CVE-2026-102488 (In affected versions, Octopus Server incorrectly evaluates multiple sc ...)
+ TODO: check
+CVE-2024-8122 (The WSO2 Identity Server fails to enforce a default expiry time for SM ...)
+ TODO: check
+CVE-2023-5649 (An Improper Input Validation vulnerability for the registered case cre ...)
+ TODO: check
+CVE-2023-5648 (In Brocade ASCG before Brocade ASCG v3.0, several security-related HTT ...)
+ TODO: check
+CVE-2017-20283 (NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerabili ...)
+ TODO: check
CVE-2026-84790
- openvpn 2.7.8-1
NOTE: Fixed by: https://github.com/OpenVPN/openvpn/commit/cf4384eef4676a01bd3ee98fa602f7b2af8079ea (v2.7.8)
@@ -558,7 +866,7 @@ CVE-2026-95106 (Gitea accepted pushed Git trees containing two entries with the
NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-94205 (Gitea Actions decided whether a fork pull request run needed approval ...)
NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
-CVE-2026-94114 (Symbolic name not mapping to correct object vulnerability in Apache Co ...)
+CVE-2026-94114 (Symbolic name not mapping to correct class. BCEL caches attacker-co ...)
- bcel <unfixed> (bug #1150215)
[trixie] - bcel <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/07/12
@@ -3160,7 +3468,7 @@ CVE-2026-39723 (Unauthenticated Broken Access Control in Morning for WooCommerce
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39599 (Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-32582 (Contributor Broken Access Control in IATO MCP <= 1.11.0 versions.)
+CVE-2026-32582 (Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-32576 (Authorization Bypass Through User-Controlled Key vulnerability in ZWEI ...)
NOT-FOR-US: WordPress plugin or theme
@@ -9061,6 +9369,7 @@ CVE-2026-27371 (Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.
CVE-2026-27085 (Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 ver ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-19553 (ssl.SSLContext.wrap_bio() didn't require the server_hostname argument ...)
+ {DLA-4827-1}
- python3.15 3.15.0~rc3-1
- python3.14 3.14.8-1
- python3.13 <unfixed>
@@ -9374,6 +9683,7 @@ CVE-2026-100253 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sand
CVE-2025-14564 (The Viable URL Media Uploader plugin for WordPress is vulnerable to St ...)
NOT-FOR-US: WordPress plugin
CVE-2026-19445 (A remote, unauthenticated TLS client can make a server crash or call t ...)
+ {DLA-4827-1}
- python3.15 3.15.0~rc3-1
- python3.14 3.14.8-1
- python3.13 <unfixed>
@@ -16302,7 +16612,7 @@ CVE-2026-12227 (The Visual Composer Website Builder plugin for WordPress is vuln
NOT-FOR-US: WordPress plugin
CVE-2025-32000 (HCL Sametime is vulnerable to insufficient input sanitization. The app ...)
NOT-FOR-US: HCL
-CVE-2026-107363 [OSSA-2026-043]
+CVE-2026-107363 (In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bin ...)
- zaqar 23.0.0-2 (bug #1150261)
NOTE: https://security.openstack.org/ossa/OSSA-2026-043.html
NOTE: https://bugs.launchpad.net/ossa/+bug/2161402
@@ -57211,6 +57521,7 @@ CVE-2026-16233 (There is a memory corruption vulnerability recently discovered i
CVE-2026-16231 (hbs is an Express view engine that wraps Handlebars. Its registerAsync ...)
NOT-FOR-US: express-hbs
CVE-2026-15310 (When decompressing crafted zip files using the bzip/LZMA/Zstandard c ...)
+ {DLA-4827-1}
- python3.15 3.15.0~rc2-1
- python3.14 3.14.7-3
- python3.13 <unfixed>
@@ -65956,6 +66267,7 @@ CVE-2026-17106 (The tar extraction routines in moby/go-archive (Unpack, UnpackLa
- golang-github-moby-go-archive 0.3.3-1 (bug #1145200)
NOTE: https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
CVE-2026-17084 (The "stringprep" module didn't process characters from RFC 3454 tables ...)
+ {DLA-4827-1}
- python3.15 3.15.0~rc2-1
- python3.14 3.14.7-3
- python3.13 <unfixed>
@@ -65976,6 +66288,7 @@ CVE-2026-17084 (The "stringprep" module didn't process characters from RFC 3454
CVE-2026-16309 (Authorization bypass through User-Controlled key vulnerability in Neti ...)
NOT-FOR-US: EdoWEB
CVE-2026-15806 (The HTTPPasswordMgr class in the urllib.request module, along with its ...)
+ {DLA-4827-1}
- python3.15 3.15.0~rc2-1
- python3.14 3.14.7-3
- python3.13 <unfixed>
@@ -78515,6 +78828,7 @@ CVE-2026-19404 (A flaw was found in 389 Directory Server. The CleanAllRUV and Ab
CVE-2026-19278 (A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine ( ...)
NOT-FOR-US: Red Hat Advanced Cluster Security
CVE-2026-18503 (Attacker-controlled CSV samples can trigger super-linear regular-expr ...)
+ {DLA-4827-1}
- python3.15 3.15.0~rc1-1
- python3.14 3.14.7-1
- python3.13 3.13.15-1
@@ -108929,6 +109243,7 @@ CVE-2026-1989 (Authorization bypass through User-Controlled key vulnerability in
CVE-2026-1365 (Insertion of sensitive information into sent data vulnerability in Say ...)
NOT-FOR-US: OSOS
CVE-2026-15308 (The incremental HTML parser (html.parser.HTMLParser) allows for CPU de ...)
+ {DLA-4827-1}
- python3.14 3.14.7-1
- python3.13 3.13.15-1
[trixie] - python3.13 <no-dsa> (Minor issue)
@@ -132633,6 +132948,7 @@ CVE-2026-11701 (Inappropriate implementation in Guest View in Google Chrome prio
- chromium 149.0.7827.102-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9669 (bz2.BZ2Decompressor objects could be reused after a decompression erro ...)
+ {DLA-4827-1}
- python3.14 3.14.6-1
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u3
@@ -136645,6 +136961,7 @@ CVE-2022-49036 (An inclusion of functionality from untrusted control sphere vuln
CVE-2019-25720 (Dr\xe4ger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 800 ...)
NOT-FOR-US: Draeger
CVE-2026-3276 (unicodedata.normalize() can take excessive CPU time when processing sp ...)
+ {DLA-4827-1}
- python3.14 3.14.6-1
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u3
@@ -150171,6 +150488,7 @@ CVE-2026-8367 (aria2c accepts a server certificate with incorrect Extended Key U
[bullseye] - aria2 <postponed> (Minor issue, revisit when fixed upstream)
NOTE: https://github.com/aria2/aria2/issues/2355
CVE-2026-8328 (The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4 ...)
+ {DLA-4827-1}
- python3.14 3.14.6-1
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u3
@@ -164715,6 +165033,7 @@ CVE-2026-6878 (A vulnerability was identified in ByteDance verl up to 0.7.0. Aff
CVE-2026-6874 (A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. Th ...)
NOT-FOR-US: ericc-ch copilot-api
CVE-2026-6019 (http.cookies.Morsel.js_output() returns an inline <script> snippet and ...)
+ {DLA-4827-1}
- python3.14 3.14.5~rc1-1
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u2
@@ -171430,6 +171749,7 @@ CVE-2026-22750 (When configuring SSL bundles in Spring Cloud Gateway by using th
CVE-2026-22560 (An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 ...)
NOT-FOR-US: Rocket.Chat
CVE-2026-1502 (CR/LF bytes were not rejected by HTTP client proxy tunnel headers or h ...)
+ {DLA-4827-1}
- python3.14 3.14.5-1
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u3
@@ -172363,7 +172683,7 @@ CVE-2025-14551 (In Ubuntu, Subiquity version 24.04.4 could leak sensitive user c
NOT-FOR-US: Subiquity
CVE-2024-1490 (An authenticated remote attacker with high privileges can exploit the ...)
NOT-FOR-US: WAGO
-CVE-2026-1403
+CVE-2026-1403 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- gitlab <removed>
CVE-2026-93602 (rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain fau ...)
- rust-rustls-webpki 0.103.10+ds-1 (bug #1133085)
@@ -191885,6 +192205,7 @@ CVE-2025-70230 (Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via
CVE-2025-70229 (Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the cu ...)
NOT-FOR-US: D-Link
CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HT ...)
+ {DLA-4827-1}
- python3.14 <not-affected> (Fixed before initial upload to Debian unstable)
- python3.13 3.13.4-1
- python3.11 <removed>
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9030b99138e1331ffa697423fbef5c3b6509dd90
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9030b99138e1331ffa697423fbef5c3b6509dd90
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261008/430950bc/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list