[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Sat Oct 10 20:15:49 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0a1bfd25 by security tracker role at 2026-10-10T19:15:32+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,15 +1,229 @@
-CVE-2026-107794
+CVE-2026-97396 (The Email Marketing for WordPress and WooCommerce \u2013 Retainful plu ...)
+	TODO: check
+CVE-2026-97340 (The Avada | Website Builder For WordPress & WooCommerce theme for Word ...)
+	TODO: check
+CVE-2026-97264 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-97263 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-96765 (The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGI ...)
+	TODO: check
+CVE-2026-96662 (The Appointment Booking Plugin \u2013 LatePoint | Calendar & Schedulin ...)
+	TODO: check
+CVE-2026-96653 (The WP Directory Kit plugin for WordPress is vulnerable to time-based  ...)
+	TODO: check
+CVE-2026-96563 (The Motors \u2013 Car Dealership & Classified Listings Plugin plugin f ...)
+	TODO: check
+CVE-2026-96341 (Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator fo ...)
+	TODO: check
+CVE-2026-96278 (The WP Photo Album Plus plugin for WordPress is vulnerable to Stored C ...)
+	TODO: check
+CVE-2026-94676 (Deserialization of Untrusted Data vulnerability in Tainacan Community  ...)
+	TODO: check
+CVE-2026-94590 (Improper Verification of Source of a Communication Channel vulnerabili ...)
+	TODO: check
+CVE-2026-94160 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-93951 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-93950 (Missing Authorization vulnerability in StylemixThemes Motors motors al ...)
+	TODO: check
+CVE-2026-93949 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
+	TODO: check
+CVE-2026-93945 (Deserialization of Untrusted Data vulnerability in Axiomthemes Balance ...)
+	TODO: check
+CVE-2026-93944 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Came ...)
+	TODO: check
+CVE-2026-93943 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Conv ...)
+	TODO: check
+CVE-2026-93942 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwel ...)
+	TODO: check
+CVE-2026-93941 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Edem ...)
+	TODO: check
+CVE-2026-93940 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Gree ...)
+	TODO: check
+CVE-2026-93938 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogw ...)
+	TODO: check
+CVE-2026-93937 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygi ...)
+	TODO: check
+CVE-2026-93936 (Deserialization of Untrusted Data vulnerability in ThemeREX Group IPha ...)
+	TODO: check
+CVE-2026-93935 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Let' ...)
+	TODO: check
+CVE-2026-93934 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Part ...)
+	TODO: check
+CVE-2026-93933 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosa ...)
+	TODO: check
+CVE-2026-93932 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Smar ...)
+	TODO: check
+CVE-2026-93931 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Smas ...)
+	TODO: check
+CVE-2026-93930 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Tant ...)
+	TODO: check
+CVE-2026-93929 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Trav ...)
+	TODO: check
+CVE-2026-93927 (Deserialization of Untrusted Data vulnerability in Axiomthemes Veto ve ...)
+	TODO: check
+CVE-2026-93746 (The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes  ...)
+	TODO: check
+CVE-2026-91136 (The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Rea ...)
+	TODO: check
+CVE-2026-66435 (Insertion of Sensitive Information Into Sent Data vulnerability in Dev ...)
+	TODO: check
+CVE-2026-62046 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Gute ...)
+	TODO: check
+CVE-2026-62045 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Book ...)
+	TODO: check
+CVE-2026-62044 (Deserialization of Untrusted Data vulnerability in bPlugins Super Vide ...)
+	TODO: check
+CVE-2026-57806 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-4791 (The PeproDev Ultimate Profile Solutions plugin for WordPress is vulner ...)
+	TODO: check
+CVE-2026-108600 (open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contain ...)
+	TODO: check
+CVE-2026-108599 (phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerab ...)
+	TODO: check
+CVE-2026-108598 (Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in Vt ...)
+	TODO: check
+CVE-2026-108597 (Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar  ...)
+	TODO: check
+CVE-2026-108596 (OpenLIT 2.1.0 contains an authorization bypass vulnerability that allo ...)
+	TODO: check
+CVE-2026-108595 (Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability th ...)
+	TODO: check
+CVE-2026-108594 (Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vu ...)
+	TODO: check
+CVE-2026-108593 (9router 0.4.1 through 0.5.99 contains a configuration injection vulner ...)
+	TODO: check
+CVE-2026-108592 (mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure v ...)
+	TODO: check
+CVE-2026-108591 (InnoShop 0.9.2 contains a local file disclosure vulnerability that all ...)
+	TODO: check
+CVE-2026-108586 (1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect a ...)
+	TODO: check
+CVE-2026-108585 (argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversa ...)
+	TODO: check
+CVE-2026-108583 (zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forger ...)
+	TODO: check
+CVE-2026-108582 (GenOffice through 0.11.505 contains an incorrect permissions vulnerabi ...)
+	TODO: check
+CVE-2026-108581 (TencentCloud Octop through 1.0.2b6 contains a missing authorization vu ...)
+	TODO: check
+CVE-2026-108580 (AniWorld Downloader before 5.3.0 contains an improper restriction of a ...)
+	TODO: check
+CVE-2026-108579 (OpenPanel through 2.3.0 contains a CSV formula injection vulnerability ...)
+	TODO: check
+CVE-2026-108555 (PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer. ...)
+	TODO: check
+CVE-2026-108554 (PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side reques ...)
+	TODO: check
+CVE-2026-108553 (OpenRefine through 3.10.1 contains a cross-site request forgery vulner ...)
+	TODO: check
+CVE-2026-108551 (openapi-typescript-codegen through 0.31.0 contains a code injection vu ...)
+	TODO: check
+CVE-2026-108550 (SkillHub before 0.2.22 contains an incorrect authorization vulnerabili ...)
+	TODO: check
+CVE-2026-108549 (cc-connect through 1.5.0 contains a missing authentication vulnerabili ...)
+	TODO: check
+CVE-2026-108548 (AstronRPA through 1.1.6 contains an authentication bypass vulnerabilit ...)
+	TODO: check
+CVE-2026-108547 (AstronRPA through 1.1.6 contains a missing tenant authorization check  ...)
+	TODO: check
+CVE-2026-108546 (Spotweb through 1.5.8 contains an OS command injection vulnerability i ...)
+	TODO: check
+CVE-2026-108545 (SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulner ...)
+	TODO: check
+CVE-2026-108506 (ZTE Z80 Ultra's system interfaces do not have robust invocation authen ...)
+	TODO: check
+CVE-2026-108505 (ZTE Z80 Ultra has a local information disclosure vulnerability. Third- ...)
+	TODO: check
+CVE-2026-108504 (ZTE Z80 Ultra has an unauthorized information disclosure vulnerability ...)
+	TODO: check
+CVE-2026-108165 (Immich through 3.3.1 contains a missing authorization vulnerability in ...)
+	TODO: check
+CVE-2026-108164 (Open Source Social Network (OSSN) through 10.1 contains an insecure di ...)
+	TODO: check
+CVE-2026-108163 (Pingvin Share X before 1.22.0 contains an ineffective rate limiting vu ...)
+	TODO: check
+CVE-2026-108162 (Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerabili ...)
+	TODO: check
+CVE-2026-108161 (FusionPBX through 5.6.5 contains an OS command injection vulnerability ...)
+	TODO: check
+CVE-2026-108115 (Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forge ...)
+	TODO: check
+CVE-2026-108114 (Strapi 5.47.0 through 5.57.0 contains an improper authorization vulner ...)
+	TODO: check
+CVE-2026-107657 (The HivePress \u2013 Business Directory, Listings & Classified Ads Plu ...)
+	TODO: check
+CVE-2026-106610 (Incorrect Privilege Assignment vulnerability in miniOrange miniorange  ...)
+	TODO: check
+CVE-2026-106609 (Missing Authorization vulnerability in Web Impian Bayarcash WooCommerc ...)
+	TODO: check
+CVE-2026-106608 (Incorrect Privilege Assignment vulnerability in Automattic WooCommerce ...)
+	TODO: check
+CVE-2026-106606 (Deserialization of Untrusted Data vulnerability in YITH YITH WooCommer ...)
+	TODO: check
+CVE-2026-106139 (In Progress\xae Kendo UI for Vue (@progress/kendo-vue-charts) starting ...)
+	TODO: check
+CVE-2026-106138 (In Progress\xae KendoReact (@progress/kendo-react-charts) starting wit ...)
+	TODO: check
+CVE-2026-105892 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
+	TODO: check
+CVE-2026-105889 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+	TODO: check
+CVE-2026-105885 (Deserialization of Untrusted Data vulnerability in 10Web Slider by 10W ...)
+	TODO: check
+CVE-2026-104803 (The WPCOM Member plugin for WordPress is vulnerable to Authentication  ...)
+	TODO: check
+CVE-2026-104759 (The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGI ...)
+	TODO: check
+CVE-2026-104728 (The AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webh ...)
+	TODO: check
+CVE-2026-104722 (The Listdom: AI-powered Business Directory with Classifieds Ads Listin ...)
+	TODO: check
+CVE-2026-104398 (Deserialization of Untrusted Data vulnerability in VillaTheme AFFI \u2 ...)
+	TODO: check
+CVE-2026-103636 (Out-of-bounds read in the VarOpt union deserialization of Apache DataS ...)
+	TODO: check
+CVE-2026-103635 (Out-of-bounds read in the compact Theta sketch deserialization of Apac ...)
+	TODO: check
+CVE-2026-103513 (Out-of-bounds read and write in the CPC sketch deserialization of Apac ...)
+	TODO: check
+CVE-2026-103501 (Heap buffer overflow in the HLL sketch deserialization of Apache DataS ...)
+	TODO: check
+CVE-2026-103478 (The Premium Packages \u2013 Sell Digital Products Securely plugin for  ...)
+	TODO: check
+CVE-2026-103357 (Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-c ...)
+	TODO: check
+CVE-2026-103071 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
+	TODO: check
+CVE-2026-102774 (The SureDash \u2013 Community, Courses & Member Dashboard plugin for W ...)
+	TODO: check
+CVE-2026-102388 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-102291 (The Kirki \u2013 Freeform Page Builder, Website Builder & Customizer p ...)
+	TODO: check
+CVE-2026-101921 (The WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, ...)
+	TODO: check
+CVE-2026-101920 (The Molongui Authorship \u2013 Author Boxes, Guest Authors & Co-Author ...)
+	TODO: check
+CVE-2026-100178 (The WPAdverts \u2013 Classifieds Plugin plugin for WordPress is vulner ...)
+	TODO: check
+CVE-2026-100147 (The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout plugin fo ...)
+	TODO: check
+CVE-2026-107794 (ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a ...)
 	- libextutils-typemaps-default-perl 1.07-1 (bug #1150541)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44246012/
 	NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=91213
 	NOTE: Fixed by: https://github.com/tsee/extutils-typemap-default/commit/10f45bf0d00d3140499755c2ad49f8bf435851ac (ExtUtils-Typemaps-Default-1.07)
 	NOTE: Fixed by: https://github.com/tsee/extutils-typemap-default/commit/3e6602d8a9db424e5842e001554bf268797e4de1 (ExtUtils-Typemaps-Default-1.07)
-CVE-2013-10076
+CVE-2013-10076 (ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate ...)
 	- libextutils-typemaps-default-perl 1.05-1
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44246011/
 	NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=91213
 	NOTE: Fixed by: https://github.com/tsee/extutils-typemap-default/commit/0eb696b75afcfedbf87a72e11d44d98110863934 (ExtUtils-Typemaps-Default-1.05)
-CVE-2026-107373
+CVE-2026-107373 (ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_ST ...)
 	- libextutils-typemaps-default-perl 1.07-1 (bug #1150541)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44245994/
 	NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=94110
@@ -3553,6 +3767,7 @@ CVE-2026-101331 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote auth
 CVE-2026-101329 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
 	NOT-FOR-US: IBM
 CVE-2026-101258 (A flaw was found in Ghostscript. When Ghostscript renders a crafted Po ...)
+	{DSA-6550-1}
 	- ghostscript 10.08.0~dfsg-1
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2542396
 	NOTE: https://github.com/v12-security/pocs/tree/main/ghostscript
@@ -11662,6 +11877,7 @@ CVE-2026-103229 (A vulnerability was found in AdithyaYelloju Restaurant-Manageme
 CVE-2026-103227 (A weakness has been identified in GPAC up to 26.07.0. Affected by this ...)
 	- gpac <removed>
 CVE-2026-103226 (A vulnerability was identified in Artifex Ghostscript up to 10.09.0. A ...)
+	{DSA-6550-1}
 	- ghostscript 10.08.0~dfsg-1
 	NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=709672
 	NOTE: Fixed by: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=cbdc86cc7a95c792baae3a15c7acf59b95fbcd5c (ghostpdl-10.08.0)
@@ -15524,10 +15740,10 @@ CVE-2026-100312 (A security flaw has been discovered in mathurvishal CloudClassr
 	NOT-FOR-US: mathurvishal CloudClassroom-PHP-Project
 CVE-2026-100311 (A vulnerability was identified in mathurvishal CloudClassroom-PHP-Proj ...)
 	NOT-FOR-US: mathurvishal CloudClassroom-PHP-Project
-CVE-2026-105830 [GHSA-3q6v-r5mr-hxv8: Fix quadratic-time table start detection on long paragraphs]
+CVE-2026-105830 (league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time d ...)
 	- php-league-commonmark 2.10.3-1
 	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-3q6v-r5mr-hxv8
-CVE-2026-105829 [GHSA-97jj-33gv-5xf9: Escape disallowed raw HTML tags that end the rendered output]
+CVE-2026-105829 (League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scrip ...)
 	- php-league-commonmark 2.10.3-1
 	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-97jj-33gv-5xf9
 CVE-2026-98163 (In the Linux kernel, the following vulnerability has been resolved:  c ...)
@@ -274688,9 +274904,9 @@ CVE-2025-8789 (A vulnerability was found in Portabilis i-Educar up to 2.9.0. It
 	NOT-FOR-US: Portabilis
 CVE-2025-8788 (A vulnerability was found in Portabilis i-Diario up to 1.5.0 and class ...)
 	NOT-FOR-US: Portabilis
-CVE-2025-8787 (A vulnerability has been found in Portabilis i-Diario up to 1.5.0 and  ...)
+CVE-2025-8787 (A security flaw has been discovered in Portabilis i-Diario up to 1.5.0 ...)
 	NOT-FOR-US: Portabilis
-CVE-2025-8786 (A vulnerability, which was classified as problematic, was found in Por ...)
+CVE-2025-8786 (A vulnerability was identified in Portabilis i-Diario up to 1.5.0. Imp ...)
 	NOT-FOR-US: Portabilis
 CVE-2025-8785 (A vulnerability, which was classified as problematic, has been found i ...)
 	NOT-FOR-US: Portabilis
@@ -276221,7 +276437,7 @@ CVE-2025-8513 (A vulnerability, which was classified as problematic, was found i
 	NOT-FOR-US: Caixin News App
 CVE-2025-8512 (A vulnerability, which was classified as problematic, has been found i ...)
 	NOT-FOR-US: TVB Big Big Shop App
-CVE-2025-8511 (A vulnerability classified as problematic was found in Portabilis i-Di ...)
+CVE-2025-8511 (A vulnerability was found in Portabilis i-Diario 1.5.0. Impacted is an ...)
 	NOT-FOR-US: Portabilis
 CVE-2025-8510 (A vulnerability classified as problematic has been found in Portabilis ...)
 	NOT-FOR-US: Portabilis



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0a1bfd2556bc09b05bef5de39db9333e048d3ac0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0a1bfd2556bc09b05bef5de39db9333e048d3ac0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261010/3b1cb75c/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list