[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 9 08:13:53 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
54bf67fe by security tracker role at 2026-10-09T07:13:46+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,16 +1,866 @@
-CVE-2026-97147
+CVE-2026-9209 (mJobTime through build 15.7.3.32 contains an unauthenticated SQL execu ...)
+ TODO: check
+CVE-2026-97076 (Executable Regular Expression Error vulnerability in WP Media WP Rocke ...)
+ TODO: check
+CVE-2026-96207 (Improper certificate validation in Microsoft Partner Center allows an ...)
+ TODO: check
+CVE-2026-95210 (Improper certificate validation in gnutls v3.8.13 causes the applicati ...)
+ TODO: check
+CVE-2026-95209 (An issue in gnutls v3.8.13 causes legitimate CA certificates to be rej ...)
+ TODO: check
+CVE-2026-95208 (An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c ...)
+ TODO: check
+CVE-2026-95184 (Improper certificate validation in gnutls v3.8.13 causes the applicati ...)
+ TODO: check
+CVE-2026-95125 (libming through 0.4.8 contains a heap buffer overflow in r_readc() in ...)
+ TODO: check
+CVE-2026-95116 (An issue in libming through 0.4.8 allows a remote attacker to cause a ...)
+ TODO: check
+CVE-2026-94510 (Authorization bypass through user-controlled key in Microsoft Bookings ...)
+ TODO: check
+CVE-2026-93699 (Argument injection in WP Toolkit for cPanel allows local users to exec ...)
+ TODO: check
+CVE-2026-93548 (The FooSales WordPress plugin before 1.43.3 does not verify that an a ...)
+ TODO: check
+CVE-2026-93509 (The Wallet System for WooCommerce WordPress plugin before 2.8.0 does n ...)
+ TODO: check
+CVE-2026-93034 (SGLang contains an arbitrary code execution vulnerability caused by th ...)
+ TODO: check
+CVE-2026-93017 (The `insights-operator-gather` ClusterRole grants the operator's servi ...)
+ TODO: check
+CVE-2026-92990 (The SendPress Newsletters WordPress plugin through 1.26.1.20 protects ...)
+ TODO: check
+CVE-2026-92989 (The SendPress Newsletters WordPress plugin through 1.26.1.20 does not ...)
+ TODO: check
+CVE-2026-92555 (Insertion of sensitive information into sent data vulnerability in AKI ...)
+ TODO: check
+CVE-2026-91844 (Unrestricted upload of file with dangerous type vulnerability in \u013 ...)
+ TODO: check
+CVE-2026-89290 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
+ TODO: check
+CVE-2026-89191 (Unsanitised input in the "template name" field of SQLView KRIS's Workf ...)
+ TODO: check
+CVE-2026-89091 (A flaw was found in ansible-core. When installing a collection with `a ...)
+ TODO: check
+CVE-2026-88931 (The Social Web Suite WordPress plugin through 4.1.12 does not restric ...)
+ TODO: check
+CVE-2026-88648 (Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers con ...)
+ TODO: check
+CVE-2026-88647 (A hostname verification bypass in GnuTLS v3.8.13 allows attackers to c ...)
+ TODO: check
+CVE-2026-88257 (Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKit ...)
+ TODO: check
+CVE-2026-88131 (Deserialization of untrusted data in Microsoft Dataverse allows an una ...)
+ TODO: check
+CVE-2026-87980 (IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local ...)
+ TODO: check
+CVE-2026-87841 (The UnitechPay WordPress plugin through 1.0.6.3 does not verify the a ...)
+ TODO: check
+CVE-2026-87110 (An unauthenticated user with network access to the Ops Manager web por ...)
+ TODO: check
+CVE-2026-87109 (An authenticated Ops Manager organization member can retrieve another ...)
+ TODO: check
+CVE-2026-87108 (An authenticated Ops Manager user with a read-only project role can re ...)
+ TODO: check
+CVE-2026-86850 (The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does ...)
+ TODO: check
+CVE-2026-84891 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
+ TODO: check
+CVE-2026-84875 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
+ TODO: check
+CVE-2026-84290 (IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improp ...)
+ TODO: check
+CVE-2026-84278 (IBM Guardium Data Protection 12.2 is affected by a command injection v ...)
+ TODO: check
+CVE-2026-84276 (IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service ...)
+ TODO: check
+CVE-2026-84275 (IBM Guardium Data Protection 12.2 is vulnerable to path traversal in t ...)
+ TODO: check
+CVE-2026-84274 (IBM Guardium Data Protection 12.2.2 is affected by a sensitive informa ...)
+ TODO: check
+CVE-2026-84272 (IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing ...)
+ TODO: check
+CVE-2026-84271 (IBM Guardium Data Protection 12.2 is vulnerable to a signature verific ...)
+ TODO: check
+CVE-2026-84250 (IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptograp ...)
+ TODO: check
+CVE-2026-84249 (IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote att ...)
+ TODO: check
+CVE-2026-84247 (IBM Guardium Data Protection 12.2 could allow a remote authenticated a ...)
+ TODO: check
+CVE-2026-84246 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
+ TODO: check
+CVE-2026-84245 (IBM Guardium Data Protection 12.2 is vulnerable to a local privilege e ...)
+ TODO: check
+CVE-2026-84244 (IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protectio ...)
+ TODO: check
+CVE-2026-84230 (IBM Guardium Data Protection 12.2.2 could allow a remote attacker to c ...)
+ TODO: check
+CVE-2026-84209 (IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote att ...)
+ TODO: check
+CVE-2026-84198 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
+ TODO: check
+CVE-2026-84058 (IBM Guardium Data Protection 12.0, 12.1, and 12.2is vulnerable to a bu ...)
+ TODO: check
+CVE-2026-84057 (IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote att ...)
+ TODO: check
+CVE-2026-84035 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
+ TODO: check
+CVE-2026-84032 (IBM Guardium Data Protection 12.2.2 could allow a remote attacker to c ...)
+ TODO: check
+CVE-2026-83947 (Missing authorization in Azure Event Grid allows an authorized attacke ...)
+ TODO: check
+CVE-2026-83943 (Exposure of sensitive information to an unauthorized actor in Azure AP ...)
+ TODO: check
+CVE-2026-82900 (IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote att ...)
+ TODO: check
+CVE-2026-82895 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
+ TODO: check
+CVE-2026-82344 (IBM Guardium Data Protection 12.0, 12.1is vulnerable to a heap-based b ...)
+ TODO: check
+CVE-2026-82335 (IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap- ...)
+ TODO: check
+CVE-2026-82334 (IBM Guardium Data Protection 12.0, 12.1, 12.2is vulnerable to a heap-b ...)
+ TODO: check
+CVE-2026-81932 (IBM Guardium Data Protection 12.0, 12.1, and 12.2is vulnerable to SQL ...)
+ TODO: check
+CVE-2026-81929 (The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress ...)
+ TODO: check
+CVE-2026-80381 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
+ TODO: check
+CVE-2026-7827 (A stack-based buffer overflow in the _RdbLoadEntity function of the RD ...)
+ TODO: check
+CVE-2026-7826 (A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer ...)
+ TODO: check
+CVE-2026-79842 (An authentication bypass vulnerability exists in HPE Intelligent Manag ...)
+ TODO: check
+CVE-2026-78407 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-78406 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-78401 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-78399 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-78388 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-77900 (Missing authentication for critical function in Azure App Service allo ...)
+ TODO: check
+CVE-2026-75875 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
+ TODO: check
+CVE-2026-71896 (An authorization vulnerability in Apache DolphinScheduler allows authe ...)
+ TODO: check
+CVE-2026-71895 (An authorization vulnerability in Apache DolphinScheduler allows authe ...)
+ TODO: check
+CVE-2026-71183 (An authorization vulnerability in Apache DolphinScheduler allows authe ...)
+ TODO: check
+CVE-2026-69435 (Missing authorization in Azure SRE Agent allows an authorized attacker ...)
+ TODO: check
+CVE-2026-67693 (An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive inf ...)
+ TODO: check
+CVE-2026-66479 (Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / Stella ...)
+ TODO: check
+CVE-2026-66087 (An authorization bypass vulnerability in Apache DolphinScheduler allow ...)
+ TODO: check
+CVE-2026-66084 (An authorization bypass vulnerability in Apache DolphinScheduler allow ...)
+ TODO: check
+CVE-2026-66082 (An authorization bypass vulnerability in Apache DolphinScheduler allow ...)
+ TODO: check
+CVE-2026-62181
+ REJECTED
+CVE-2026-62171
+ REJECTED
+CVE-2026-62170
+ REJECTED
+CVE-2026-62167
+ REJECTED
+CVE-2026-62166
+ REJECTED
+CVE-2026-62163
+ REJECTED
+CVE-2026-62142 (Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp ...)
+ TODO: check
+CVE-2026-62128 (Missing Authorization vulnerability in Creator LMS Creator LMS creator ...)
+ TODO: check
+CVE-2026-62127 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-61801 (The `github.com/moby/sys/user` package provides Go utilities for parsi ...)
+ TODO: check
+CVE-2026-5759 (A double free and use-after-free vulnerability in the RdbLoadDeletedNo ...)
+ TODO: check
+CVE-2026-50055 (A policy-enforcement flaw in Zimbra Collaboration Suite allows an auth ...)
+ TODO: check
+CVE-2026-50054 (An authorization flaw in Zimbra Collaboration Suite\u2019s GrantRights ...)
+ TODO: check
+CVE-2026-4894 (A vulnerability has been identified regarding insufficient validation ...)
+ TODO: check
+CVE-2026-44038 (A global out-of-bounds read in the Huffman decoder of the bundled IJG ...)
+ TODO: check
+CVE-2026-44037 (Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), D ...)
+ TODO: check
+CVE-2026-44036 (Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet( ...)
+ TODO: check
+CVE-2026-44035 (Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/l ...)
+ TODO: check
+CVE-2026-44034 (A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() i ...)
+ TODO: check
+CVE-2026-44033 (Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::empt ...)
+ TODO: check
+CVE-2026-44031 (Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read ...)
+ TODO: check
+CVE-2026-42698 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
+ TODO: check
+CVE-2026-40804 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-27420 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-19878 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-19585 (HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions b ...)
+ TODO: check
+CVE-2026-19498 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-19494 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-19493 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-19491 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-19482 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-19218 (Weak Password Recovery Mechanism for Forgotten Password vulnerability ...)
+ TODO: check
+CVE-2026-19083 (Authorization bypass through User-Controlled key vulnerability in AKIN ...)
+ TODO: check
+CVE-2026-18740 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-17189 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-16916 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-16830 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-16823 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-16340 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16182 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10. ...)
+ TODO: check
+CVE-2026-16181 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16179 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16178 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16177 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16176 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16170 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16169 (IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote a ...)
+ TODO: check
+CVE-2026-16167 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16165 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16164 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16163 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16161 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16159 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-16111 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-15824 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-15822 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-15819 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-15784 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-15781 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-15762 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14999 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14992 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14991 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14990 (IBM DataPower Gateway 10.6.0.0 through 10.6.0.10is vulnerable to cross ...)
+ TODO: check
+CVE-2026-14988 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14905 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14888 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14521 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14509 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14508 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14507 (IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote a ...)
+ TODO: check
+CVE-2026-14502 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14497 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14496 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14273 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-14269 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-13258 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-13257 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
+ TODO: check
+CVE-2026-12859 (Missing Authorization vulnerability in Caz Informatics Services Trade ...)
+ TODO: check
+CVE-2026-12260 (SQL injection in the NetBoard CRM demo platform; specifically, the vul ...)
+ TODO: check
+CVE-2026-12109 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-12091 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-11939 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-11936 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-11930 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-11888 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
+ TODO: check
+CVE-2026-11318 (Deskin through 3.3.4.3 contains a privilege escalation vulnerability i ...)
+ TODO: check
+CVE-2026-10631 (An authorization bypass in the EWS FindItem handler of Zimbra Collabor ...)
+ TODO: check
+CVE-2026-107914 (Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't suffici ...)
+ TODO: check
+CVE-2026-107911 (A type confusion vulnerability in the _read_flags function (src/comman ...)
+ TODO: check
+CVE-2026-107910 (An improper authentication vulnerability in the is_authenticated funct ...)
+ TODO: check
+CVE-2026-107909 (A heap-based out-of-bounds write in the ws_read_frame function (src/bo ...)
+ TODO: check
+CVE-2026-107908 (A heap-based out-of-bounds write in the BoltReadHandler function (src/ ...)
+ TODO: check
+CVE-2026-107890 (OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference ca ...)
+ TODO: check
+CVE-2026-107889 (A flaw was found in the login theme rendering component of Keycloak. T ...)
+ TODO: check
+CVE-2026-107888 (OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in ...)
+ TODO: check
+CVE-2026-107886 (OpenPrinting CUPS before 2.4.20 contains a double-free in printer-clas ...)
+ TODO: check
+CVE-2026-107885 (OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulner ...)
+ TODO: check
+CVE-2026-107831 (Jivejdon through 5.0 contains a cross-site request forgery vulnerabili ...)
+ TODO: check
+CVE-2026-107830 (Jivejdon from commit e0306088 through commit ee67a65e lacks rate limit ...)
+ TODO: check
+CVE-2026-107829 (Jivejdon through 5.0 contains a weak password storage vulnerability th ...)
+ TODO: check
+CVE-2026-107828 (Jivejdon through 5.0 contains an authentication bypass vulnerability t ...)
+ TODO: check
+CVE-2026-107802 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ...)
+ TODO: check
+CVE-2026-107801 (Jivejdon through 5.0 contains a stored cross-site scripting vulnerabil ...)
+ TODO: check
+CVE-2026-107800 (Jivejdon through 5.0 contains a stored cross-site scripting vulnerabil ...)
+ TODO: check
+CVE-2026-107799 (Jivejdon through 5.0 contains a stored cross-site scripting vulnerabil ...)
+ TODO: check
+CVE-2026-107798 (jivejdon from commit 595d8d22 through commit ee67a65e contains a store ...)
+ TODO: check
+CVE-2026-107797 (Jivejdon through 5.0 contains a reflected cross-site scripting vulnera ...)
+ TODO: check
+CVE-2026-107796 (Jivejdon from commit 5489372d through commit ee67a65e contains a refle ...)
+ TODO: check
+CVE-2026-107793 (Jivejdon through 5.0 contains an authorization bypass vulnerability in ...)
+ TODO: check
+CVE-2026-107792 (Jivejdon from commit d58a36b0 through commit ee67a65e contains a missi ...)
+ TODO: check
+CVE-2026-107782 (System Informer before 4.0.26241.138 contains an incorrect authorizati ...)
+ TODO: check
+CVE-2026-107781 (Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 ...)
+ TODO: check
+CVE-2026-107780 (Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 ...)
+ TODO: check
+CVE-2026-107779 (Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 ...)
+ TODO: check
+CVE-2026-107778 (MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereferen ...)
+ TODO: check
+CVE-2026-107738 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ...)
+ TODO: check
+CVE-2026-107737 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ...)
+ TODO: check
+CVE-2026-107736 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ...)
+ TODO: check
+CVE-2026-107735 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ...)
+ TODO: check
+CVE-2026-107734 (SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, ...)
+ TODO: check
+CVE-2026-107733 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ...)
+ TODO: check
+CVE-2026-107732 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ...)
+ TODO: check
+CVE-2026-107731 (SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four ...)
+ TODO: check
+CVE-2026-107730 (SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitPa ...)
+ TODO: check
+CVE-2026-107729 (SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/M ...)
+ TODO: check
+CVE-2026-107728 (Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217. ...)
+ TODO: check
+CVE-2026-107727 (Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312. ...)
+ TODO: check
+CVE-2026-107726 (Hazelcast is a unified real-time data platform combining stream proces ...)
+ TODO: check
+CVE-2026-107725 (Hazelcast is a unified real-time data platform combining stream proces ...)
+ TODO: check
+CVE-2026-107724 (fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, ...)
+ TODO: check
+CVE-2026-107723 (fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6 ...)
+ TODO: check
+CVE-2026-107722 (fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 ...)
+ TODO: check
+CVE-2026-107721 (fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6 ...)
+ TODO: check
+CVE-2026-107720 (fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6 ...)
+ TODO: check
+CVE-2026-107719 (fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6 ...)
+ TODO: check
+CVE-2026-107718 (AdonisJS HTTP Server is a package for handling HTTP requests in the Ad ...)
+ TODO: check
+CVE-2026-107717 (Banks generates meaningful LLM prompts using a simple template languag ...)
+ TODO: check
+CVE-2026-107716 (Banks generates meaningful LLM prompts using a simple template languag ...)
+ TODO: check
+CVE-2026-107715 (The Mechanize library is used for automating interaction with websites ...)
+ TODO: check
+CVE-2026-107714 (The Mechanize library is used for automating interaction with websites ...)
+ TODO: check
+CVE-2026-107709 (A path traversal vulnerability exists in Bower decompress-zip through ...)
+ TODO: check
+CVE-2026-107708 (MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerabil ...)
+ TODO: check
+CVE-2026-107707 (Intego Antivirus for Windows through 3.0.0.1 contains a link following ...)
+ TODO: check
+CVE-2026-107706 (Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vul ...)
+ TODO: check
+CVE-2026-107705 (Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow ...)
+ TODO: check
+CVE-2026-107704 (The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS comman ...)
+ TODO: check
+CVE-2026-107703 (@enmaso/node-convert through 1.0.0 contains an OS command injection vu ...)
+ TODO: check
+CVE-2026-107702 (QloApps through 1.7.0 contains an authorization bypass vulnerability i ...)
+ TODO: check
+CVE-2026-107701 (dot-access through 1.0.0 contains a prototype pollution vulnerability ...)
+ TODO: check
+CVE-2026-107700 (dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability ...)
+ TODO: check
+CVE-2026-107699 (ppt2png through 0.0.6 contains an OS command injection vulnerability t ...)
+ TODO: check
+CVE-2026-107698 (FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side requ ...)
+ TODO: check
+CVE-2026-107697 (FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS ...)
+ TODO: check
+CVE-2026-107696 (FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rts ...)
+ TODO: check
+CVE-2026-107695 (FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS ...)
+ TODO: check
+CVE-2026-107678 (FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_e ...)
+ TODO: check
+CVE-2026-107677 (FFmpeg through 9.0.2 contains a denial of service vulnerability in the ...)
+ TODO: check
+CVE-2026-107676 (FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulne ...)
+ TODO: check
+CVE-2026-107675 (FFmpeg through 9.0.2 contains a missing host key verification vulnerab ...)
+ TODO: check
+CVE-2026-107660 (FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certific ...)
+ TODO: check
+CVE-2026-107651 (A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow e ...)
+ TODO: check
+CVE-2026-107640 (Integrics Enswitch 3.13 through 4.4 contains an authentication bypass ...)
+ TODO: check
+CVE-2026-107639 (ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an ...)
+ TODO: check
+CVE-2026-107638 (pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper ...)
+ TODO: check
+CVE-2026-107637 (pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper ...)
+ TODO: check
+CVE-2026-107636 (pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment va ...)
+ TODO: check
+CVE-2026-107635 (Dislocker through 0.7.3 contains an integer underflow vulnerability in ...)
+ TODO: check
+CVE-2026-107634 (Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerabili ...)
+ TODO: check
+CVE-2026-107623 (A flaw was found in the OIDC Dynamic Client Registration (DCR) compone ...)
+ TODO: check
+CVE-2026-107615 (An uncontrolled search path element vulnerability in GlavSoft TightVNC ...)
+ TODO: check
+CVE-2026-107614 (An integer underflow in WinCursorShapeUtils::trimTransparent() in Glav ...)
+ TODO: check
+CVE-2026-107613 (A NULL pointer dereference vulnerability in the Win8ScreenDriver compo ...)
+ TODO: check
+CVE-2026-107612 (Incorrect permission assignment in GlavSoft TightVNC Server for Window ...)
+ TODO: check
+CVE-2026-107611 (An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft Ti ...)
+ TODO: check
+CVE-2026-107608 (Improper link resolution before file access in the asset bundling outp ...)
+ TODO: check
+CVE-2026-107604 (A flaw was found in the installation provider and client registration ...)
+ TODO: check
+CVE-2026-107589 (Insufficient job validation for service accounts in Jacamar CI prior t ...)
+ TODO: check
+CVE-2026-107587 (Improper certificate validation in the webmail of Progressive Robot hM ...)
+ TODO: check
+CVE-2026-107586 (Uncontrolled eviction in the browser session table of the REST API in ...)
+ TODO: check
+CVE-2026-107585 (Uncontrolled eviction in the pending sign-in tables of the REST API in ...)
+ TODO: check
+CVE-2026-107584 (Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when appl ...)
+ TODO: check
+CVE-2026-107583 (Inefficient algorithmic complexity in the webmail's message view of th ...)
+ TODO: check
+CVE-2026-107582 (Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3. ...)
+ TODO: check
+CVE-2026-107581 (Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IM ...)
+ TODO: check
+CVE-2026-107580 (Inefficient algorithmic complexity in the decoding of message header f ...)
+ TODO: check
+CVE-2026-107579 (Inefficient algorithmic complexity in the bounce and complaint process ...)
+ TODO: check
+CVE-2026-107578 (Improper link resolution and external control of file paths in the adm ...)
+ TODO: check
+CVE-2026-107577 (Inefficient algorithmic complexity and a non-terminating loop in the M ...)
+ TODO: check
+CVE-2026-107576 (Inefficient algorithmic complexity in the inbound DKIM and ARC signatu ...)
+ TODO: check
+CVE-2026-107575 (Inefficient algorithmic complexity in the SPF macro expansion of Progr ...)
+ TODO: check
+CVE-2026-107574 (Inefficient algorithmic complexity in the JSON reader of Progressive R ...)
+ TODO: check
+CVE-2026-107573 (Incorrect default permissions in the Windows installer of Progressive ...)
+ TODO: check
+CVE-2026-107572 (Inefficient complexity in the Sieve filter evaluation of Progressive R ...)
+ TODO: check
+CVE-2026-107570 (heap OOB write in convert_file_from_to() via a crafted Content-Type he ...)
+ TODO: check
+CVE-2026-107565 (A flaw was found in luksmeta. A local attacker with administrative pri ...)
+ TODO: check
+CVE-2026-107510 (An authenticated high privilege user can inject arguments in troublesh ...)
+ TODO: check
+CVE-2026-107503 (Unvalidated environments URL allows OAuth authorization code + PKCE ve ...)
+ TODO: check
+CVE-2026-107466 (A flaw was found in flatpak-builder. This vulnerability allows an atta ...)
+ TODO: check
+CVE-2026-107406 (Memory overflow vulnerability leading to Remote Code Execution or Deni ...)
+ TODO: check
+CVE-2026-107399 (The Mechanize library is used for automating interaction with websites ...)
+ TODO: check
+CVE-2026-107397 (Indico is an event management system that uses Flask-Multipass, a mult ...)
+ TODO: check
+CVE-2026-107396 (Indico is an event management system that uses Flask-Multipass, a mult ...)
+ TODO: check
+CVE-2026-107395 (Indico is an event management system that uses Flask-Multipass, a mult ...)
+ TODO: check
+CVE-2026-107394 (Indico is an event management system that uses Flask-Multipass, a mult ...)
+ TODO: check
+CVE-2026-107393 (FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8. ...)
+ TODO: check
+CVE-2026-107392 (music-metadata is a metadata parser for audio and video media files. P ...)
+ TODO: check
+CVE-2026-107391 (music-metadata is a metadata parser for audio and video media files. I ...)
+ TODO: check
+CVE-2026-107390 (music-metadata is a metadata parser for audio and video media files. P ...)
+ TODO: check
+CVE-2026-107389 (music-metadata is a metadata parser for audio and video media files. P ...)
+ TODO: check
+CVE-2026-107388 (music-metadata is a metadata parser for audio and video media files. P ...)
+ TODO: check
+CVE-2026-107387 (music-metadata is a metadata parser for audio and video media files. P ...)
+ TODO: check
+CVE-2026-107386 (amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the fr ...)
+ TODO: check
+CVE-2026-107385 (MariaDB Connector/Node.js is used to connect applications developed on ...)
+ TODO: check
+CVE-2026-107384 (MariaDB Connector/Node.js is used to connect applications developed on ...)
+ TODO: check
+CVE-2026-107383 (MariaDB Connector/Node.js is used to connect applications developed on ...)
+ TODO: check
+CVE-2026-107382 (MariaDB Connector/Node.js is used to connect applications developed on ...)
+ TODO: check
+CVE-2026-107380 (savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitiz ...)
+ TODO: check
+CVE-2026-107379 (savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitiz ...)
+ TODO: check
+CVE-2026-107378 (CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Pr ...)
+ TODO: check
+CVE-2026-107377 (datamodel-code-generator generates Python data models from schema defi ...)
+ TODO: check
+CVE-2026-107376 (webonyx graphql-php is a PHP implementation of the GraphQL specificati ...)
+ TODO: check
+CVE-2026-107375 (JHipster is a development platform to quickly generate, develop, and d ...)
+ TODO: check
+CVE-2026-107362 (Malcolm file-upload component ships the upstream FilePond PHP server ( ...)
+ TODO: check
+CVE-2026-107361 (The Arkime live capture service (arkime-live) in Malcolm runs with net ...)
+ TODO: check
+CVE-2026-107337 (The Malcolm kiosk Flask application exposes a POST /script_call/<scrip ...)
+ TODO: check
+CVE-2026-107336 (Malcolm's front nginx reverse proxy defines a "Dashboards \u2192 Arkim ...)
+ TODO: check
+CVE-2026-107335 (Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforce ...)
+ TODO: check
+CVE-2026-107334 (Malcolm's nginx Lua role-based access control (RBAC) layer decides whe ...)
+ TODO: check
+CVE-2026-107333 (Malcolm's nginx based reverse proxy contains a URL path normalization ...)
+ TODO: check
+CVE-2026-107332 (Insecure file permissions in the CodeCatalyst connection handler in AW ...)
+ TODO: check
+CVE-2026-107325 (Improper validation of a BSON array length in the MongoDB Go Driver ca ...)
+ TODO: check
+CVE-2026-107324 (An integer overflow in BSON value-length handling in the MongoDB Go Dr ...)
+ TODO: check
+CVE-2026-107322 (An incomplete list of disallowed inputs in Amazon Agent Plugins for AW ...)
+ TODO: check
+CVE-2026-107318 (@fastify/reply-from is a Fastify plugin that forwards requests to an u ...)
+ TODO: check
+CVE-2026-107303 (JHipster is a development platform to quickly generate, develop, and d ...)
+ TODO: check
+CVE-2026-107302 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
+ TODO: check
+CVE-2026-107301 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
+ TODO: check
+CVE-2026-107300 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
+ TODO: check
+CVE-2026-107299 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
+ TODO: check
+CVE-2026-107298 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
+ TODO: check
+CVE-2026-107297 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
+ TODO: check
+CVE-2026-107296 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
+ TODO: check
+CVE-2026-107295 (Pydantic AI is a Python agent framework for building applications and ...)
+ TODO: check
+CVE-2026-107294 (Pydantic AI is a Python agent framework for building applications and ...)
+ TODO: check
+CVE-2026-107293 (Pydantic AI is a Python agent framework for building applications and ...)
+ TODO: check
+CVE-2026-107292 (Pydantic AI is a Python agent framework for building applications and ...)
+ TODO: check
+CVE-2026-107291 (Pydantic AI is a Python agent framework for building applications and ...)
+ TODO: check
+CVE-2026-107290 (Pydantic AI is a Python agent framework for building applications and ...)
+ TODO: check
+CVE-2026-107289 (Pydantic AI is a Python agent framework for building applications and ...)
+ TODO: check
+CVE-2026-107288 (Pydantic AI is a Python agent framework for building applications and ...)
+ TODO: check
+CVE-2026-107287 (Pydantic AI is a Python agent framework for building applications and ...)
+ TODO: check
+CVE-2026-107286 (Pydantic AI is a Python agent framework for building applications and ...)
+ TODO: check
+CVE-2026-107275 (@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. ...)
+ TODO: check
+CVE-2026-106611 (Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator ...)
+ TODO: check
+CVE-2026-106603 (Authorization Bypass Through User-Controlled Key vulnerability in Grou ...)
+ TODO: check
+CVE-2026-106600 (Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP g ...)
+ TODO: check
+CVE-2026-106596 (Missing Authorization vulnerability in Visual Composer Visual Composer ...)
+ TODO: check
+CVE-2026-106438 (An incorrect calculation in Decimal128 string parsing in the MongoDB C ...)
+ TODO: check
+CVE-2026-106437 (The BSON buffer-reservation API in the MongoDB C Driver can record a l ...)
+ TODO: check
+CVE-2026-106436 (The BSON encoder in the MongoDB PHP Driver does not check some return ...)
+ TODO: check
+CVE-2026-106435 (The MongoDB Python Driver's binary accelerator can read outside a buff ...)
+ TODO: check
+CVE-2026-106434 (The explicit decryption component of MongoDB libmongocrypt can return ...)
+ TODO: check
+CVE-2026-106433 (Improper state management in MongoDB libmongocrypt can cause provider- ...)
+ TODO: check
+CVE-2026-106432 (The BSON encoder in the MongoDB PHP Driver converts a string length to ...)
+ TODO: check
+CVE-2026-106431 (An off-by-one error in the BSON bulk document writer in the MongoDB C ...)
+ TODO: check
+CVE-2026-106430 (The MongoDB C++ Driver discards content after an embedded NUL byte in ...)
+ TODO: check
+CVE-2026-106429 (An integer underflow in the KMS endpoint-parsing logic of MongoDB libm ...)
+ TODO: check
+CVE-2026-106428 (An out-of-bounds read in SCRAM authentication response parsing in the ...)
+ TODO: check
+CVE-2026-106177 (A kernel buffer overflow vulnerability in HP Sure Click versions prior ...)
+ TODO: check
+CVE-2026-106126 (A command injection vulnerability in the Active Directory Events Liste ...)
+ TODO: check
+CVE-2026-106097 (The Code Snippets WordPress plugin before 3.10.0 does not sanitise and ...)
+ TODO: check
+CVE-2026-106095 (The Code Snippets WordPress plugin before 3.10.0 does not perform a ca ...)
+ TODO: check
+CVE-2026-105893 (Authorization Bypass Through User-Controlled Key vulnerability in Liqu ...)
+ TODO: check
+CVE-2026-105891 (Missing Authorization vulnerability in Liquid Web / StellarWP Event Ti ...)
+ TODO: check
+CVE-2026-105890 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-105888 (Missing Authorization vulnerability in Liquid Web / StellarWP Event Ti ...)
+ TODO: check
+CVE-2026-105887 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-105886 (Missing Authorization vulnerability in BdThemes Ultimate Post Kit ulti ...)
+ TODO: check
+CVE-2026-105878 (Missing Authorization vulnerability in YITH YITH WooCommerce Product B ...)
+ TODO: check
+CVE-2026-105833 (EspoCRM before 10.0.5 contains an insecure direct object reference vul ...)
+ TODO: check
+CVE-2026-105832 (EspoCRM before 10.0.6 contains an authentication bypass vulnerability ...)
+ TODO: check
+CVE-2026-105831 (EspoCRM before 10.0.6 contains a stored HTML injection vulnerability t ...)
+ TODO: check
+CVE-2026-105830 (league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time d ...)
+ TODO: check
+CVE-2026-105829 (League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scrip ...)
+ TODO: check
+CVE-2026-105828 (Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 cont ...)
+ TODO: check
+CVE-2026-105827 (ImageMagick before 7.1.2-30 and 6.9.13-55 contains an uncontrolled rec ...)
+ TODO: check
+CVE-2026-105826 (ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a securi ...)
+ TODO: check
+CVE-2026-105825 (ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a denial ...)
+ TODO: check
+CVE-2026-105824 (ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a use-af ...)
+ TODO: check
+CVE-2026-105823 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security ...)
+ TODO: check
+CVE-2026-105674 (TP-Link Tapo C325WB V2 generates the pre-shared key used by its local ...)
+ TODO: check
+CVE-2026-105673 (An unauthenticated denial-of-service vulnerability exists in Tapo C325 ...)
+ TODO: check
+CVE-2026-105672 (TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypas ...)
+ TODO: check
+CVE-2026-105570 (Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitiv ...)
+ TODO: check
+CVE-2026-105452 (Docker Sandboxes could forward a client-supplied credential alongside ...)
+ TODO: check
+CVE-2026-105436 (Deserialization of Untrusted Data vulnerability in MainWP MainWP Child ...)
+ TODO: check
+CVE-2026-105405 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains an inval ...)
+ TODO: check
+CVE-2026-105404 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a code i ...)
+ TODO: check
+CVE-2026-105403 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 allows a security ...)
+ TODO: check
+CVE-2026-105402 (ImageMagick before 7.1.2-31 contains a denial of service vulnerability ...)
+ TODO: check
+CVE-2026-105401 (ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerabil ...)
+ TODO: check
+CVE-2026-105400 (ImageMagick before 7.1.2-31 contains a resource leak vulnerability tha ...)
+ TODO: check
+CVE-2026-105399 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial ...)
+ TODO: check
+CVE-2026-105398 (ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerabil ...)
+ TODO: check
+CVE-2026-105331 (Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a u ...)
+ TODO: check
+CVE-2026-105275 (Satel Netco Design versions prior to v2.1.7 contains a relative path t ...)
+ TODO: check
+CVE-2026-105269 (Satel Netco Design versions prior to v2.1.7 contains a stored cross si ...)
+ TODO: check
+CVE-2026-105190 (The Easy Digital Downloads WordPress plugin before 3.7.1 does not cons ...)
+ TODO: check
+CVE-2026-105110 (OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox ...)
+ TODO: check
+CVE-2026-105079 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-105078 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-105076 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-104704 (Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS ...)
+ TODO: check
+CVE-2026-104671 (The TutorStarter WordPress theme before 4.0.4 does not respect the sit ...)
+ TODO: check
+CVE-2026-104660 (Missing authorization on COM objects in Progressive Robot hMailServer ...)
+ TODO: check
+CVE-2026-104659 (Missing Host header validation and missing throttling of failed admini ...)
+ TODO: check
+CVE-2026-104658 (The Linux live-update apply helper (hmailserver-update) of Progressive ...)
+ TODO: check
+CVE-2026-104634 (Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in S ...)
+ TODO: check
+CVE-2026-104628 (Satel Netco Design versions prior to v2.1.7 contains an inefficient re ...)
+ TODO: check
+CVE-2026-104078 (Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability ...)
+ TODO: check
+CVE-2026-104077 (Obsidian Desktop before 1.14.0 contains a remote code execution vulner ...)
+ TODO: check
+CVE-2026-104076 (TVU Networks Receiver/Transceiver devices running firmware before vers ...)
+ TODO: check
+CVE-2026-104075 (TVU Networks Receiver/Transceiver devices running firmware before vers ...)
+ TODO: check
+CVE-2026-103663 (Ollama is vulnerable to path traversal in the `/api/pull` endpoint due ...)
+ TODO: check
+CVE-2026-103649 (Missing network timeouts in the Linux builds of Progressive Robot hMai ...)
+ TODO: check
+CVE-2026-103647 (Cross-site scripting in the webmail of Progressive Robot hMailServer 6 ...)
+ TODO: check
+CVE-2026-103517 (The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 d ...)
+ TODO: check
+CVE-2026-103072 (Missing Authorization vulnerability in VillaTheme VillaTheme Core vill ...)
+ TODO: check
+CVE-2026-103070 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-103011 (Heap-based buffer overflow in the legacy Blowfish encryption routine ( ...)
+ TODO: check
+CVE-2026-103010 (Heap-based buffer overflow in the legacy Blowfish decryption routine ( ...)
+ TODO: check
+CVE-2026-102784 (Joomla Extension - balbooa.com - CSRF in language installation feature ...)
+ TODO: check
+CVE-2026-102783 (Joomla Extension - balbooa.com - Path Traversal in image preview Gridb ...)
+ TODO: check
+CVE-2026-102368 (Affected Tapo device firmware stores device-specific cryptographic mat ...)
+ TODO: check
+CVE-2026-101998 (Docker Sandboxes could fail open while masking credentials in protecte ...)
+ TODO: check
+CVE-2026-101028 (Incorrect Authorization vulnerability in ash-project ash allows an act ...)
+ TODO: check
+CVE-2026-101024 (Satel Netco Design versions prior to v2.1.7 contains a relative path t ...)
+ TODO: check
+CVE-2026-100197
+ REJECTED
+CVE-2025-71428 (Jivejdon through 5.0 contains a sql injection vulnerability in Account ...)
+ TODO: check
+CVE-2025-15700 (The AWP Classifieds WordPress plugin before 4.4.9 does not validate th ...)
+ TODO: check
+CVE-2026-97147 (In OpenStack Mistral through 23.0.0, several of the v2 API write paths ...)
- mistral <unfixed> (bug #1150346)
NOTE: https://launchpad.net/bugs/2160267
NOTE: https://security.openstack.org/ossa/OSSA-2026-044.html
-CVE-2026-93861
+CVE-2026-93861 (In OpenStack Mistral through 23.0.0, the workflow membership API lets ...)
- mistral <unfixed> (bug #1150346)
NOTE: https://launchpad.net/bugs/2161277
NOTE: https://security.openstack.org/ossa/OSSA-2026-044.html
-CVE-2026-93858
+CVE-2026-93858 (In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes ...)
- mistral <unfixed> (bug #1150346)
NOTE: https://launchpad.net/bugs/2162100
NOTE: https://security.openstack.org/ossa/OSSA-2026-044.html
-CVE-2026-93860
+CVE-2026-93860 (In OpenStack Mistral through 23.0.0, the /v2/maintenance API controlle ...)
- mistral <unfixed> (bug #1150346)
NOTE: https://launchpad.net/bugs/2162789
NOTE: https://security.openstack.org/ossa/OSSA-2026-044.html
@@ -22,7 +872,7 @@ CVE-2026-105516
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2545962
CVE-2026-103871
NOT-FOR-US: Pulp (Red Hat)
-CVE-2026-97032
+CVE-2026-97032 (HTTP/2 servers could end up crashing due to inadvertently modifying it ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -34,7 +884,7 @@ CVE-2026-97032
NOTE: Fixed by: https://github.com/golang/go/commit/12acaf3086437e140e2dd3b7d2c30fdd633c5fe0 (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/6e049521882c944afc1e519a83971ec421dc2974 (go1.26.9)
NOTE: Fixed by: https://github.com/golang/net/commit/18ece0ce30bc35fa81fe72028bf309bb3ff3f4a5 (v0.60.0)
-CVE-2026-78659
+CVE-2026-78659 (When "Trailer" headers are sent by a client, the HTTP server internall ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -46,7 +896,7 @@ CVE-2026-78659
NOTE: Fixed by: https://github.com/golang/go/commit/cbb0fb8b51cba866018b8a0fb4b5458f16c5c80b (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/6e049521882c944afc1e519a83971ec421dc2974 (go1.26.9)
NOTE: Fixed by: https://github.com/golang/net/commit/57f4235f83712a299328015548240512213a3852 (v0.60.0)
-CVE-2026-97031
+CVE-2026-97031 (Multiple ECH outer extension references are not permitted under RFC 98 ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -56,7 +906,7 @@ CVE-2026-97031
NOTE: https://github.com/golang/go/issues/81855
NOTE: Fixed by: https://github.com/golang/go/commit/f022e61963529d5e691f0e42a87fd5b520f01636 (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/eb1bf6e0c4f68b23409483b156e1455696508c6e (go1.26.9)
-CVE-2026-94444
+CVE-2026-94444 (Previously, a user operating inside of a malicious Go project that def ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -66,7 +916,7 @@ CVE-2026-94444
NOTE: https://github.com/golang/go/issues/81833
NOTE: Fixed by: https://github.com/golang/go/commit/1e4f1fec6fb468a23979823b8c3cbec5c8fca1af (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/5fa9de469645f7c45afe3bca767b929f5226bb1c (go1.26.9)
-CVE-2026-94447
+CVE-2026-94447 (Previously, a user operating inside of a malicious Go project that def ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -76,7 +926,7 @@ CVE-2026-94447
NOTE: https://github.com/golang/go/issues/81834
NOTE: Fixed by: https://github.com/golang/go/commit/68fa7699a27d745f90bf8630202e1a415d1b0769 (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/7325b729f07c7ff255b9b5e3f427234ebd21ac47 (go1.26.9)
-CVE-2026-94448
+CVE-2026-94448 (When a JavaScript template literal contains consecutive expressions, t ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -86,7 +936,7 @@ CVE-2026-94448
NOTE: https://github.com/golang/go/issues/81821
NOTE: Fixed by: https://github.com/golang/go/commit/b26d150e6985f804826f4fcb1aa33aa81e700b52 (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/e59c03e695f2eaa26e308f756c83773afb034e47 (go1.26.9)
-CVE-2026-97030
+CVE-2026-97030 (A trusted template author may have previously written a valid template ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -96,7 +946,7 @@ CVE-2026-97030
NOTE: https://github.com/golang/go/issues/81823
NOTE: Fixed by: https://github.com/golang/go/commit/6e2cfab0a1c1683c52f9e09270627b0c4e6446e3 (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/5d84f6f08caf63b5f1300930368756bd34955f4a (go1.26.9)
-CVE-2026-94440
+CVE-2026-94440 (Parsing a multipart form can bypass memory limits and read an arbitrar ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -106,7 +956,7 @@ CVE-2026-94440
NOTE: https://github.com/golang/go/issues/81741
NOTE: Fixed by: https://github.com/golang/go/commit/7c79b50a74b6d1aa4269b1827dda7d81f3717f9d (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/d7a7aa8e6781ddf8dce12adf60a813d957d4763e (go1.26.9)
-CVE-2026-56866
+CVE-2026-56866 (When http.Transport sends an HTTP/1 CONNECT request with a non-empty R ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -116,7 +966,7 @@ CVE-2026-56866
NOTE: https://github.com/golang/go/issues/81740
NOTE: Fixed by: https://github.com/golang/go/commit/76875df0f3425f69e4dc2c439040a248b6107854 (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/3fe1aac0ce941cb16b0ec5d489827cf1c58197c4 (go1.26.9)
-CVE-2026-94439
+CVE-2026-94439 (When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -126,7 +976,7 @@ CVE-2026-94439
NOTE: https://github.com/golang/go/issues/81744
NOTE: Fixed by: https://github.com/golang/go/commit/e92229e24a387cc006a750af176b07a459ba71a1 (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/087de1ff08ea620ac2f6ae26c939454cb793883a (go1.26.9)
-CVE-2026-78669
+CVE-2026-78669 (A malicious HTTP/2 peer can cause excessive CPU consumption in the cli ...)
- golang-1.27 1.27.2-1
- golang-1.26 <unfixed>
- golang-1.25 <removed>
@@ -138,7 +988,7 @@ CVE-2026-78669
NOTE: Fixed by: https://github.com/golang/go/commit/1d58cdaa1069e259b60c324ec77472f09f23d92e (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/6e049521882c944afc1e519a83971ec421dc2974 (go1.26.9)
NOTE: Fixed by: https://github.com/golang/net/commit/cc7d34fd2dd5864bcafe3e5e0a84919240be98c0 (v0.60.0)
-CVE-2026-78660
+CVE-2026-78660 (Historically, we have been rather lax about malformed framing-related ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -149,7 +999,7 @@ CVE-2026-78660
NOTE: https://github.com/golang/go/issues/81115
NOTE: Fixed by: https://github.com/golang/go/commit/072779d81582543bf2872c259e0c6cceea728de4 (go1.27.2)
NOTE: Fixed by: https://github.com/golang/net/commit/28247830e9fb37184c6be718f483a0c7d0949022 (v0.60.0)
-CVE-2026-56857
+CVE-2026-56857 (On Windows, when the target of Root.Mkdir or Root.MkdirAll is a juncti ...)
- golang-1.27 <not-affected> (Only affects Go on Windows)
- golang-1.26 <not-affected> (Only affects Go on Windows)
- golang-1.25 <not-affected> (Only affects Go on Windows)
@@ -157,7 +1007,7 @@ CVE-2026-56857
- golang-1.19 <not-affected> (Only affects Go on Windows)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81739
-CVE-2026-78667
+CVE-2026-78667 (When parsing a Range header containing a large number of small ranges, ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -167,7 +1017,7 @@ CVE-2026-78667
NOTE: https://github.com/golang/go/issues/81858
NOTE: Fixed by: https://github.com/golang/go/commit/ababc3cd873d8acce1777268aa7a817e6b672028 (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/eb25b4e532c5a01f99ef860ec66743a8783f992b (go1.26.9)
-CVE-2026-78663
+CVE-2026-78663 (The HTTP/2 server can refund connection-level flow control twice for t ...)
- golang-1.27 1.27.2-1
- golang-1.26 <unfixed>
- golang-1.25 <removed>
@@ -1945,7 +2795,7 @@ CVE-2026-39792 (Unauthenticated Arbitrary File Deletion in Simple File List <= 6
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39791 (Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-39790 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.6 vers ...)
+CVE-2026-39790 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39788 (Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versio ...)
NOT-FOR-US: WordPress plugin or theme
@@ -3711,7 +4561,7 @@ CVE-2026-39789 (Unauthenticated Broken Access Control in Fluent Affiliate Pro <=
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39760 (Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-39723 (Unauthenticated Broken Access Control in Morning for WooCommerce <= 2. ...)
+CVE-2026-39723 (Missing Authorization vulnerability in Green Invoice Morning for WooCo ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39599 (Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 ...)
NOT-FOR-US: WordPress plugin or theme
@@ -5237,7 +6087,7 @@ CVE-2026-96990 (Allocation of Resources Without Limits or Throttling vulnerabili
- thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/hrgcqlms4ksrz4qkqdjwoxxggdty7dgh
NOTE: Erlang bindings not built in Debian
-CVE-2026-96940 (Weak authorization in Microsoft Exchange Server allows an authenticate ...)
+CVE-2026-96940 (An elevation of privilege vulnerability exists when Microsoft Exchange ...)
NOT-FOR-US: Microsoft
CVE-2026-96871 (The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site ...)
NOT-FOR-US: WordPress plugin
@@ -9817,7 +10667,7 @@ CVE-2026-102509 (Memory Allocation with Excessive Size Value, Allocation of Reso
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-102508 (Improper Verification of Cryptographic Signature and Improper Certific ...)
NOT-FOR-US: Apache software not packaged in Debian
-CVE-2026-102490 (All versions of Zammad including the latest alpha enable the local zam ...)
+CVE-2026-102490 (Zammad packages built with packager.io (DEB and RPM) could have allowe ...)
- zammad <itp> (bug #841355)
CVE-2026-102489 (Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnera ...)
- zammad <itp> (bug #841355)
@@ -46645,6 +47495,7 @@ CVE-2026-85155 (WWBN AVideo contains a SQL injection vulnerability in the sort c
CVE-2026-85154 (WWBN AVideo contains an authentication failure vulnerability where the ...)
NOT-FOR-US: WWBN AVideo
CVE-2026-85150 (A NULL pointer dereference flaw was found in GStreamer's RTSP support ...)
+ {DLA-4828-1}
- gst-plugins-base1.0 1.28.7-1
[trixie] - gst-plugins-base1.0 <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2527936
@@ -61432,7 +62283,7 @@ CVE-2026-18298 (GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Cod
NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/b399811826a352da6d90a1fd6c230cfdbc1e7b56 (1.28.5)
NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/96173accdbd4970c7b6aeb7d5c3890104c4bd263 (1.28.5)
CVE-2026-18297 (GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Exe ...)
- {DSA-6489-1}
+ {DSA-6489-1 DLA-4828-1}
- gst-plugins-base1.0 1.28.5-1
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0053.html
NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12044
@@ -85002,7 +85853,7 @@ CVE-2026-15920 (An issue was discovered in Django 5.2 before 5.2.17 and 6.0 befo
- python-django 3:5.2.17-1 (bug #1143611)
NOTE: https://www.djangoproject.com/weblog/2026/aug/04/security-releases/
NOTE: Fixed by: https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349 (5.2.17)
-CVE-2026-15830 (An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0 ...)
+CVE-2026-15830 (An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2. ...)
- python-django 3:5.2.17-1 (bug #1143611)
[bookworm] - python-django <ignored> (Invasive fix; too difficult to backport; affects only GeoSpatial component)
[bullseye] - python-django <ignored> (Invasive fix; too difficult to backport; affects only GeoSpatial component)
@@ -87652,7 +88503,7 @@ CVE-2026-56846 (A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained head
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http2-retained-headers-can-bypass-maxsessionmemory-limits-cve-2026-56846---high
NOTE: Fixed by: https://github.com/nodejs/node/commit/f14d78b9e0201bfe0291f2b0dc4b5d88c70cc28e (v22.23.2)
CVE-2026-66066 (Action Pack is a framework for handling and responding to web requests ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.2+dfsg-1 (bug #1143080)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
NOTE: Fixed by: https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a (v7.2.3.2)
@@ -173509,7 +174360,7 @@ CVE-2026-39680 (Missing Authorization vulnerability in MWP Development Diet Calo
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39679 (Improper Control of Filename for Include/Require Statement in PHP Prog ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-39678 (Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking Sys ...)
+CVE-2026-39678 (Missing Authorization vulnerability in Pinpoint Booking System Pinpoin ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39677 (Improper Control of Filename for Include/Require Statement in PHP Prog ...)
NOT-FOR-US: WordPress plugin or theme
@@ -183671,7 +184522,7 @@ CVE-2026-33241 (Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's
CVE-2026-33211 (Tekton Pipelines project provides k8s-style resources for declaring CI ...)
NOT-FOR-US: Tekton Pipelines project
CVE-2026-33202 (Active Storage allows users to attach cloud and local files in Rails a ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, path traversal in unlikely scenario)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
@@ -183679,7 +184530,7 @@ CVE-2026-33202 (Active Storage allows users to attach cloud and local files in R
NOTE: Fixed by: https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf (v8.0.4.1)
NOTE: Fixed by: https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82 (v7.2.3.1)
CVE-2026-33195 (Active Storage allows users to attach cloud and local files in Rails a ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, path traversal in unlikely scenario)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87
@@ -183687,7 +184538,7 @@ CVE-2026-33195 (Active Storage allows users to attach cloud and local files in R
NOTE: Fixed by: https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348 (v8.0.4.1)
NOTE: Fixed by: https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c (v7.2.3.1)
CVE-2026-33176 (Active Support is a toolkit of support libraries and Ruby core extensi ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, DoS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
@@ -183704,7 +184555,7 @@ CVE-2026-33174 (Active Storage allows users to attach cloud and local files in R
NOTE: Fixed by: https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5 (v8.0.4.1)
NOTE: Fixed by: https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b (v7.2.3.1)
CVE-2026-33173 (Active Storage allows users to attach cloud and local files in Rails a ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, automatic content type bypass)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
@@ -183712,7 +184563,7 @@ CVE-2026-33173 (Active Storage allows users to attach cloud and local files in R
NOTE: Fixed by: https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e (v8.0.4.1)
NOTE: Fixed by: https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53 (v7.2.3.1)
CVE-2026-33170 (Active Support is a toolkit of support libraries and Ruby core extensi ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, XSS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v
@@ -183720,7 +184571,7 @@ CVE-2026-33170 (Active Support is a toolkit of support libraries and Ruby core e
NOTE: Fixed by: https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db (v8.0.4.1)
NOTE: Fixed by: https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb (v7.2.3.1)
CVE-2026-33169 (Active Support is a toolkit of support libraries and Ruby core extensi ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, DoS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
@@ -183728,7 +184579,7 @@ CVE-2026-33169 (Active Support is a toolkit of support libraries and Ruby core e
NOTE: Fixed by: https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11 (v8.0.4.1)
NOTE: Fixed by: https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974 (v7.2.3.1)
CVE-2026-33168 (Action View provides conventions and helpers for building web pages wi ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, XSS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq
@@ -298497,7 +299348,7 @@ CVE-2025-2527 (Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to
CVE-2025-26481 (Dell PowerScale OneFS, versions 9.4.0.0 through 9.9.0.0, contains an u ...)
NOT-FOR-US: Dell / EMC
CVE-2025-1647 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
- {DLA-4204-1}
+ {DLA-4830-1 DLA-4204-1}
- twitter-bootstrap4 <not-affected> (Only affects 3.x)
- twitter-bootstrap3 3.4.1+dfsg-5 (bug #1105899)
NOTE: https://www.herodevs.com/vulnerability-directory/cve-2025-1647
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/54bf67fe60b8ab252307d3d1fb99aae2213cb528
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/54bf67fe60b8ab252307d3d1fb99aae2213cb528
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/d35a4bfa/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list