[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Oct 10 08:12:58 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
96f3b0f1 by security tracker role at 2026-10-10T07:12:51+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,277 @@
+CVE-2026-9696 (The Download Manager plugin for WordPress is vulnerable to Stored Cros ...)
+ TODO: check
+CVE-2026-97670 (The Avada (Fusion) Builder plugin for WordPress is vulnerable to autho ...)
+ TODO: check
+CVE-2026-97643 (The GiveWP \u2013 Donation Plugin and Fundraising Platform plugin for ...)
+ TODO: check
+CVE-2026-97630 (The FV Flowplayer Video Player plugin for WordPress is vulnerable to S ...)
+ TODO: check
+CVE-2026-97348 (The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Di ...)
+ TODO: check
+CVE-2026-96840 (The Post Grid Gutenberg Blocks \u2013 PostX plugin for WordPress is vu ...)
+ TODO: check
+CVE-2026-96743 (The Table Field Add-on for ACF and SCF plugin for WordPress is vulnera ...)
+ TODO: check
+CVE-2026-96682 (The Presto Player plugin for WordPress is vulnerable to Stored Cross-S ...)
+ TODO: check
+CVE-2026-96667 (The Real Estate Manager \u2013 Property Listing and Agent Management p ...)
+ TODO: check
+CVE-2026-96648 (The Data Tables Generator by Supsystic plugin for WordPress is vulnera ...)
+ TODO: check
+CVE-2026-96574 (The User Frontend \u2013 Membership, User Registration, User Profile, ...)
+ TODO: check
+CVE-2026-96572 (The WP Meteor Website Speed Optimization Addon plugin for WordPress is ...)
+ TODO: check
+CVE-2026-96558 (The Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker plug ...)
+ TODO: check
+CVE-2026-95684 (The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vuln ...)
+ TODO: check
+CVE-2026-94589 (The Extensions For CF7 (Contact form 7 Database, Conditional Fields an ...)
+ TODO: check
+CVE-2026-94538 (The WP File Download plugin for WordPress is vulnerable to authorizati ...)
+ TODO: check
+CVE-2026-94421 (The Church Admin plugin for WordPress is vulnerable to Stored Cross-Si ...)
+ TODO: check
+CVE-2026-94375 (The Order Export & Order Import for WooCommerce plugin for WordPress i ...)
+ TODO: check
+CVE-2026-94257 (The SMS Alert WordPress plugin before 4.0.1 does not bind the account ...)
+ TODO: check
+CVE-2026-94256 (The SMS Alert WordPress plugin before 4.0.1 does not verify that the ...)
+ TODO: check
+CVE-2026-93883 (The Advanced Classifieds & Directory Pro plugin for WordPress is vulne ...)
+ TODO: check
+CVE-2026-93775 (The Podlove Podcast Publisher plugin for WordPress is vulnerable to St ...)
+ TODO: check
+CVE-2026-92975 (The Groundhogg \u2014 CRM, Newsletters, and Marketing Automation plugi ...)
+ TODO: check
+CVE-2026-92705 (Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3. ...)
+ TODO: check
+CVE-2026-91862 (The Getwid \u2013 Gutenberg Blocks plugin for WordPress is vulnerable ...)
+ TODO: check
+CVE-2026-91050 (The Appointment Booking Plugin \u2013 LatePoint | Calendar & Schedulin ...)
+ TODO: check
+CVE-2026-89301 (The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress ...)
+ TODO: check
+CVE-2026-89100 (The Payment Plugins for Stripe WooCommerce plugin for WordPress is vul ...)
+ TODO: check
+CVE-2026-87869 (The Filter Everything \u2014 WordPress & WooCommerce Filters plugin fo ...)
+ TODO: check
+CVE-2026-87781 (The LTL Freight Quotes WordPress plugin before 4.2.19 does not saniti ...)
+ TODO: check
+CVE-2026-87780 (The LTL Freight Quotes WordPress plugin before 4.2.19 does not saniti ...)
+ TODO: check
+CVE-2026-85571 (The Tutor LMS WordPress plugin before 4.1.1 does not verify that the ...)
+ TODO: check
+CVE-2026-83526 (The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File U ...)
+ TODO: check
+CVE-2026-78797 (An issue in iStoreOS istoreos-24.10.7 and before allows a remote attac ...)
+ TODO: check
+CVE-2026-78068 (The Table Field Add-on for ACF and SCF plugin for WordPress is vulnera ...)
+ TODO: check
+CVE-2026-77183 (The FooSales \u2013 Point of Sale (POS) for WooCommerce plugin for Wor ...)
+ TODO: check
+CVE-2026-6723 (The Appointment Booking Calendar \u2014 Simply Schedule Appointments B ...)
+ TODO: check
+CVE-2026-6243 (The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to ...)
+ TODO: check
+CVE-2026-62376 (Vikunja is an open-source self-hosted task management platform. Versio ...)
+ TODO: check
+CVE-2026-62367 (Vikunja is an open-source self-hosted task management platform. In ver ...)
+ TODO: check
+CVE-2026-5727 (The Hello Plus plugin for WordPress is vulnerable to authorization byp ...)
+ TODO: check
+CVE-2026-5725 (The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cr ...)
+ TODO: check
+CVE-2026-57458 (Vikunja is an open-source self-hosted task management platform. In ver ...)
+ TODO: check
+CVE-2026-3717 (The CV Builder \u2013 Professional Resume Builder SaaS plugin for Word ...)
+ TODO: check
+CVE-2026-22061 (Trident versions v25.02.1 through v26.06.1 are susceptible to a vulner ...)
+ TODO: check
+CVE-2026-18558 (The Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Fi ...)
+ TODO: check
+CVE-2026-18524
+ REJECTED
+CVE-2026-18496 (The Booking Calendar plugin for WordPress is vulnerable to Sensitive I ...)
+ TODO: check
+CVE-2026-17025 (The Graphene theme for WordPress is vulnerable to Stored Cross-Site Sc ...)
+ TODO: check
+CVE-2026-16776 (The MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by So ...)
+ TODO: check
+CVE-2026-16681
+ REJECTED
+CVE-2026-15178 (The Fluent Forms plugin for WordPress is vulnerable to authorization b ...)
+ TODO: check
+CVE-2026-14882 (The Brizy \u2013 Page Builder plugin for WordPress is vulnerable to St ...)
+ TODO: check
+CVE-2026-14877 (The Data Tables Generator by Supsystic plugin for WordPress is vulnera ...)
+ TODO: check
+CVE-2026-14379 (The GamiPress \u2013 Gamification plugin to reward points, achievement ...)
+ TODO: check
+CVE-2026-14335 (The Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions ...)
+ TODO: check
+CVE-2026-12626 (The Online Scheduling and Appointment Booking System \u2013 Bookly plu ...)
+ TODO: check
+CVE-2026-12054 (The Download Manager plugin for WordPress is vulnerable to Reflected C ...)
+ TODO: check
+CVE-2026-108503 (ZTE Z80 Ultra has an interface permission validation vulnerability. Th ...)
+ TODO: check
+CVE-2026-108502 (ZTE Z80 Ultra contains an information disclosure vulnerability, throug ...)
+ TODO: check
+CVE-2026-108501 (ZTE Z80 Ultra has a system interface permission verification defect. T ...)
+ TODO: check
+CVE-2026-108474 (In JetBrains Exposed before 1.5.1 sQL injection was possible via unesc ...)
+ TODO: check
+CVE-2026-108269 (Remote Attestation TLS Clients provides multi-language utilities for v ...)
+ TODO: check
+CVE-2026-108268 (Enclave OS Virtual runs container workloads inside confidential virtua ...)
+ TODO: check
+CVE-2026-108267 (Privasys Go is a maintained fork of the Go programming language that a ...)
+ TODO: check
+CVE-2026-108266 (Privasys rustls is a maintained fork of the rustls TLS library that ad ...)
+ TODO: check
+CVE-2026-108265 (Enclave OS Mini is a Rust-based runtime for confidential applications ...)
+ TODO: check
+CVE-2026-108264 (Wizarr is an advanced user invitation and management system for Jellyf ...)
+ TODO: check
+CVE-2026-108263 (Astron Agent is an agentic workflow platform for building and running ...)
+ TODO: check
+CVE-2026-108261 (Tina is a headless content management system. Prior to tinacms 3.14.0 ...)
+ TODO: check
+CVE-2026-108260 (Tina is a headless content management system. Prior to 0.2.1, the tina ...)
+ TODO: check
+CVE-2026-108259 (Tina is a headless content management system. Prior to 3.0.0, @tinacms ...)
+ TODO: check
+CVE-2026-108258 (Shiny for Python is a framework for building interactive web applicati ...)
+ TODO: check
+CVE-2026-107857 (Mindwtr is a free offline-first task management application for deskto ...)
+ TODO: check
+CVE-2026-107856 (CiviForm simplifies applications for government benefits programs by r ...)
+ TODO: check
+CVE-2026-107854 (Jexactyl is a customisable game management panel and billing system. F ...)
+ TODO: check
+CVE-2026-107852 (Jexactyl is a customisable game management panel and billing system. P ...)
+ TODO: check
+CVE-2026-107851 (Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAc ...)
+ TODO: check
+CVE-2026-107850 (Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bu ...)
+ TODO: check
+CVE-2026-107848 (Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7. ...)
+ TODO: check
+CVE-2026-107845 (Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7. ...)
+ TODO: check
+CVE-2026-107844 (Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7. ...)
+ TODO: check
+CVE-2026-107843 (Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7. ...)
+ TODO: check
+CVE-2026-107842 (Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7. ...)
+ TODO: check
+CVE-2026-107742 (The 10Web Booster \u2013 Website speed optimization, Cache & Page Spee ...)
+ TODO: check
+CVE-2026-107712 (The WP Booking System \u2013 Booking Calendar plugin for WordPress is ...)
+ TODO: check
+CVE-2026-107645 (The Blocksy Companion plugin for WordPress is vulnerable to privilege ...)
+ TODO: check
+CVE-2026-107323 (The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitiz ...)
+ TODO: check
+CVE-2026-107321 (The W3 Total Cache WordPress plugin before 2.10.6 does not confine a m ...)
+ TODO: check
+CVE-2026-107120 (The Contest Gallery WordPress plugin before 33.0.1 does not limit the ...)
+ TODO: check
+CVE-2026-105995 (The Booking Package WordPress plugin before 1.7.30 does not perform au ...)
+ TODO: check
+CVE-2026-105990 (The Accept PayPal Payments using Contact Form 7 WordPress plugin befor ...)
+ TODO: check
+CVE-2026-105989 (The Accept PayPal Payments using Contact Form 7 WordPress plugin befor ...)
+ TODO: check
+CVE-2026-105977 (The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not p ...)
+ TODO: check
+CVE-2026-105976 (The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not p ...)
+ TODO: check
+CVE-2026-104993 (The GeoDirectory \u2013 WP Business Directory Plugin and Classified Li ...)
+ TODO: check
+CVE-2026-104915 (The Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLea ...)
+ TODO: check
+CVE-2026-104899 (The GeoDirectory \u2013 WP Business Directory Plugin and Classified Li ...)
+ TODO: check
+CVE-2026-104898 (The Online Scheduling and Appointment Booking System \u2013 Bookly plu ...)
+ TODO: check
+CVE-2026-104801 (The PPOM \u2013 Product Addons & Custom Fields for WooCommerce plugin ...)
+ TODO: check
+CVE-2026-104797 (The Advanced Form Integration \u2014 Connect Forms to 300+ Apps plugin ...)
+ TODO: check
+CVE-2026-104766 (The Appointment Booking Plugin \u2013 LatePoint | Calendar & Schedulin ...)
+ TODO: check
+CVE-2026-104763 (The Post Export Import with Media plugin for WordPress is vulnerable t ...)
+ TODO: check
+CVE-2026-104762 (The Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor pl ...)
+ TODO: check
+CVE-2026-104758
+ REJECTED
+CVE-2026-104754 (The Rank Math SEO WordPress plugin before 1.0.280 does not escape a s ...)
+ TODO: check
+CVE-2026-104753 (The Rank Math SEO WordPress plugin before 1.0.280 does not properly s ...)
+ TODO: check
+CVE-2026-104752 (The Rank Math SEO WordPress plugin before 1.0.280 does not correctly ...)
+ TODO: check
+CVE-2026-104742 (The AI Puffer \u2013 Chat. Create. Automate. (formerly AI Power) plugi ...)
+ TODO: check
+CVE-2026-104741 (The AI Puffer \u2013 Chat. Create. Automate. (formerly AI Power) plugi ...)
+ TODO: check
+CVE-2026-104735 (The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & ...)
+ TODO: check
+CVE-2026-104732 (The Advanced IP Blocker plugin for WordPress is vulnerable to Authenti ...)
+ TODO: check
+CVE-2026-104725 (The Groundhogg \u2014 CRM, Newsletters, and Marketing Automation plugi ...)
+ TODO: check
+CVE-2026-104724 (The FireBox \u2013 WooCommerce Popup Builder, Exit Intent Popup, Email ...)
+ TODO: check
+CVE-2026-104723 (The LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes p ...)
+ TODO: check
+CVE-2026-104023 (The Smart Popup by Supsystic plugin for WordPress is vulnerable to gen ...)
+ TODO: check
+CVE-2026-104022 (The Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLea ...)
+ TODO: check
+CVE-2026-104021 (The Fastcache by Host.it plugin for WordPress is vulnerable to Code In ...)
+ TODO: check
+CVE-2026-104006 (The SpeedyCache \u2013 Cache, Optimization, Performance plugin for Wor ...)
+ TODO: check
+CVE-2026-103998 (The Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact For ...)
+ TODO: check
+CVE-2026-103964 (The Download Manager plugin for WordPress is vulnerable to Sensitive I ...)
+ TODO: check
+CVE-2026-103912 (The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordP ...)
+ TODO: check
+CVE-2026-103897 (The Responsive Lightbox & Gallery plugin for WordPress is vulnerable t ...)
+ TODO: check
+CVE-2026-103889 (The 3D Product configurator for WooCommerce plugin for WordPress is vu ...)
+ TODO: check
+CVE-2026-103755
+ REJECTED
+CVE-2026-103520 (The HivePress \u2013 Business Directory, Listings & Classified Ads Plu ...)
+ TODO: check
+CVE-2026-103482 (The Simple Newsletter Plugin \u2013 Noptin plugin for WordPress is vul ...)
+ TODO: check
+CVE-2026-103427 (The Simple Membership plugin for WordPress is vulnerable to Stored Cro ...)
+ TODO: check
+CVE-2026-103424 (The Anti-Spam by CleanTalk \u2013 Spam Protection Without CAPTCHA plug ...)
+ TODO: check
+CVE-2026-103365 (The Bookly \u2013 Online Scheduling and Appointment Booking System plu ...)
+ TODO: check
+CVE-2026-102402 (The Team \u2013 Team Members Showcase Plugin plugin for WordPress is v ...)
+ TODO: check
+CVE-2026-102401 (The Download Manager plugin for WordPress is vulnerable to Stored Cros ...)
+ TODO: check
+CVE-2026-101947 (ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell co ...)
+ TODO: check
+CVE-2026-101324 (The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Co ...)
+ TODO: check
+CVE-2026-100196 (The LazyLoad Plugin \u2013 Lazy Load Images, Videos, and Iframes plugi ...)
+ TODO: check
+CVE-2026-100161 (The Photo Reviews for WooCommerce plugin for WordPress is vulnerable t ...)
+ TODO: check
+CVE-2025-8457
+ REJECTED
CVE-2026-97791 (In Apache CXF, STSTokenValidator checks whether a SAML assertion is si ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-97468 (Apache CXF's STSTokenValidator and Security Token Service (STS) cached ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/96f3b0f192fd9bc0499417b4c07ca12e6d1fec5d
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/96f3b0f192fd9bc0499417b4c07ca12e6d1fec5d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261010/e6632cfa/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list