[Git][security-tracker-team/security-tracker][master] bugnums

Moritz Muehlenhoff (@jmm) jmm at debian.org
Thu Oct 8 19:12:09 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6f8217a0 by Moritz Muehlenhoff at 2026-10-08T20:10:12+02:00
bugnums

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -241,71 +241,71 @@ CVE-2026-107355
 CVE-2026-107354
 	REJECTED
 CVE-2026-107353 (traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5. ...)
-	- node-traverse <unfixed>
+	- node-traverse <unfixed> (bug #1150332)
 	NOTE: https://github.com/ljharb/js-traverse/security/advisories/GHSA-rj28-8w7x-jmqc
 	NOTE: https://github.com/ljharb/js-traverse/commit/81ccab43e379cf42eb2a5f689630f7f79b3d71b8 (v0.6.12)
 	NOTE: https://github.com/ljharb/js-traverse/commit/37a9ebd103d2a259c824c29cdcc3f0dfe1acffce (v0.6.12)
 CVE-2026-107352 (Missing authorization checks in Amazon Athena engine version 3 request ...)
 	NOT-FOR-US: Amazon
 CVE-2026-107315 (pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pa ...)
-	- libpgjava <unfixed>
+	- libpgjava <unfixed> (bug #1150330)
 	NOTE: https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-f64h-wr5q-3qf3
 	NOTE: https://github.com/pgjdbc/pgjdbc/commit/c8998c8e9632a7cdecb128dd7cd122d330b3598a (REL42.7.14)
 CVE-2026-107314 (pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 e ...)
-	- libpgjava <unfixed>
+	- libpgjava <unfixed> (bug #1150330)
 	[trixie] - libpgjava <not-affected> (Vulnerable code not present, introduced in 42.7.11)
 	[bookworm] - libpgjava <not-affected> (Vulnerable code not present, introduced in 42.7.11)
 	NOTE: https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h
 	NOTE: https://github.com/pgjdbc/pgjdbc/commit/a65ef98fe37bf0ecbd1a6331205cdb924985ed75 (REL42.7.14)
 CVE-2026-107285 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- async-http-client <unfixed> (bug #1150331)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-3wp9-xfwm-rjjf
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/c4feab0f7f86d61505a48e40d383c8a375a22e18 (async-http-client-project-2.16.1)
 CVE-2026-107284 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- sync-http-client <unfixed> (bug #1150331)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-rwhr-j9rv-85f8
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/75a278550aa9a980009d022fb4e635f9c8738c03 (async-http-client-project-2.16.1)
 CVE-2026-107283 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- sync-http-client <unfixed> (bug #1150331)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mfj3-87qq-382v
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/e1f5fc88fe211d3f64032c33b91093ba3d5e793d (async-http-client-project-2.16.1)
 CVE-2026-107282 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- sync-http-client <unfixed> (bug #1150331)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-jmqq-x5g9-9p2w
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/bbc31aed3b044f9f7a126cf689a8c8d7ad2ae1cb (async-http-client-project-2.16.1)
 CVE-2026-107281 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- sync-http-client <unfixed> (bug #1150331)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-vvp4-63h8-v5pm
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/73813babf51231ee79f7da4f07b777f19f48d34d (async-http-client-project-2.16.1)
 CVE-2026-107280 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- sync-http-client <unfixed> (bug #1150331)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f9m8-cv68-674w
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f (async-http-client-project-2.16.1)
 CVE-2026-107279 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
 	- async-http-client <not-affected> (Only affects 3.x)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-qhv6-3pmh-95q4
 CVE-2026-107232 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- sync-http-client <unfixed> (bug #1150331)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-v9f2-7rw2-gr2x
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393 (async-http-client-project-2.16.1)
 CVE-2026-107231 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- sync-http-client <unfixed> (bug #1150331)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-rqf5-2wxv-rjf4
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6 (async-http-client-project-2.16.1)
 CVE-2026-107230 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- sync-http-client <unfixed> (bug #1150331)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-v2j5-22fr-j62r
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/d3bb4d68b41acf5d3ab7541afa9fdfe7ec3ba054 (async-http-client-project-3.0.14)
 CVE-2026-107229 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- sync-http-client <unfixed> (bug #1150331)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-qjr7-w8pj-pmv9
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/7dc5bbc2d0a48aa2a9caf089a626dcfd333168e9 (async-http-client-project-3.0.14)
 CVE-2026-107228 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- sync-http-client <unfixed> (bug #1150331)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-2jwh-9rmr-j4xf
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/fd9763620725126c1c8bb0af1ceb9a7523099a5f (async-http-client-project-3.0.14)
 CVE-2026-107227 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- sync-http-client <unfixed> (bug #1150331)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x8v2-478q-2hvg
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/commit/b61637f30327f314b7693418f12ce141ac6b2b30 (async-http-client-project-3.0.14)
 CVE-2026-107176 (A flaw was found in the cluster-samples-operator. The RBAC Role coreos ...)
@@ -615,7 +615,7 @@ CVE-2026-107183 (llama.cpp before b11393 contains a use-after-free and double fr
 	NOTE: https://github.com/ggml-org/llama.cpp/pull/29942
 	NOTE: Fixed by: https://github.com/ggml-org/llama.cpp/commit/dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f (b11393, v0.6.0)
 CVE-2026-107181 (Telegram Desktop before 7.2.9 contains an IPC record-separator injecti ...)
-	- telegram-desktop <unfixed>
+	- telegram-desktop <unfixed> (bug #1150328)
 	NOTE: https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
 	NOTE: https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a (v7.2.9)
 CVE-2026-107180 (On MISP instances configured to require TOTP enrolment (Security.otp_r ...)
@@ -20748,7 +20748,7 @@ CVE-2026-94490 (A security flaw has been discovered in OctoPrint 1.0.0. Affected
 CVE-2026-94489 (A vulnerability was identified in OctoPrint 1.0.0. Affected by this vu ...)
 	- octoprint <itp> (bug #718591)
 CVE-2026-94488 (Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The fi ...)
-	- telegram-desktop <unfixed>
+	- telegram-desktop <unfixed> (bug #1150329)
 	NOTE: https://expatch.com/writeups/telegram-html-export-xss.html
 	NOTE: https://github.com/telegramdesktop/tdesktop/commit/8457d13aa795fadf99c955d2a04f00ebc3c59df9 (v6.9.4)
 CVE-2026-94426 (A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The imp ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6f8217a0aabb3686a5f2420aa9c27caeaa91c78f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6f8217a0aabb3686a5f2420aa9c27caeaa91c78f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261008/a6005e3a/attachment.htm>

More information about the debian-security-tracker-commits mailing list