[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sun Oct 11 20:14:20 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ff84d72f by security tracker role at 2026-10-11T19:14:12+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,273 @@
+CVE-2026-59508 (Improper neutralization of special elements used in an SQL command ('S ...)
+ TODO: check
+CVE-2026-19935 (The Bluetooth LE host queues received L2CAP connection-oriented channe ...)
+ TODO: check
+CVE-2026-19740 (The Link Layer Control Procedure (LLCP) implementation of the Zephyr s ...)
+ TODO: check
+CVE-2026-19739 (The Bluetooth Link Layer control procedure code in subsys/bluetooth/co ...)
+ TODO: check
+CVE-2026-19738 (The Bluetooth Link Layer Control Procedure (LLCP) implementation for C ...)
+ TODO: check
+CVE-2026-19737 (i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the req ...)
+ TODO: check
+CVE-2026-19736 (The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng. ...)
+ TODO: check
+CVE-2026-19735 (The RFC 6528 initial-sequence-number implementation in subsys/net/ip/t ...)
+ TODO: check
+CVE-2026-19669 (The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vr ...)
+ TODO: check
+CVE-2026-19577 (net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nex ...)
+ TODO: check
+CVE-2026-19576 (The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the ...)
+ TODO: check
+CVE-2026-18418 (The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy ...)
+ TODO: check
+CVE-2026-108925 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
+ TODO: check
+CVE-2026-108913 (omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via ...)
+ TODO: check
+CVE-2026-108905 (pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded ...)
+ TODO: check
+CVE-2026-108904 (pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an informati ...)
+ TODO: check
+CVE-2026-108903 (pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA by ...)
+ TODO: check
+CVE-2026-108902 (pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path trave ...)
+ TODO: check
+CVE-2026-108891 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108888 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108887 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108886 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108885 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108884 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108883 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108882 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108881 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108880 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108879 (JeecgBoot through 3.9.5 contains an insecure direct object reference v ...)
+ TODO: check
+CVE-2026-108878 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108877 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108876 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108875 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108874 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108873 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108872 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108871 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108870 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108869 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108868 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108867 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108866 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108865 (AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerab ...)
+ TODO: check
+CVE-2026-108864 (iFlytek Astron Agent through 1.1.2 contains an insecure direct object ...)
+ TODO: check
+CVE-2026-108863 (Katanemo Plano through 0.4.37 contains a missing authentication vulner ...)
+ TODO: check
+CVE-2026-108862 (APIPark through 1.9.7-beta contains an insecure direct object referenc ...)
+ TODO: check
+CVE-2026-108861 (Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulner ...)
+ TODO: check
+CVE-2026-108860 (BotSharp through 5.2.0 contains an authentication bypass vulnerability ...)
+ TODO: check
+CVE-2026-108859 (mcp-go through 1.2.1 contains a denial of service vulnerability in Str ...)
+ TODO: check
+CVE-2026-108858 (Predibase LoRAX through 0.12.1 contains a sensitive information exposu ...)
+ TODO: check
+CVE-2026-108857 (Hugging Face Text Embeddings Inference through 1.9.4 contains a cleart ...)
+ TODO: check
+CVE-2026-108856 (UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerab ...)
+ TODO: check
+CVE-2026-108855 (UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerab ...)
+ TODO: check
+CVE-2026-108854 (Wanwu before 0.6.3 contains an insecure direct object reference vulner ...)
+ TODO: check
+CVE-2026-108853 (UnicomAI Wanwu before 0.6.3 contains an insecure direct object referen ...)
+ TODO: check
+CVE-2026-108852 (Deep Chat through 2.5.1 contains a cross-site scripting vulnerability ...)
+ TODO: check
+CVE-2026-108851 (phpMyFAQ through 4.1.10 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108850 (Company Research Agent through 2.2.0 contains a server-side request fo ...)
+ TODO: check
+CVE-2026-108839 (thClaws through 0.141.0 contains a link-following vulnerability in the ...)
+ TODO: check
+CVE-2026-108768 (A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affec ...)
+ TODO: check
+CVE-2026-108760 (LlamaFarm through 0.0.34 contains an insecure default configuration th ...)
+ TODO: check
+CVE-2026-108759 (mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability ...)
+ TODO: check
+CVE-2026-108758 (Easy!Appointments through 1.6.0 contains an authorization bypass vulne ...)
+ TODO: check
+CVE-2026-108757 (Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missi ...)
+ TODO: check
+CVE-2026-108756 (Abilityai Trinity through 0.9.5 contains a missing authorization vulne ...)
+ TODO: check
+CVE-2026-108755 (Hatchet through 0.110.5 contains an allocation of resources without li ...)
+ TODO: check
+CVE-2026-108754 (GPT-Load through 1.4.11 contains a cleartext logging vulnerability tha ...)
+ TODO: check
+CVE-2026-108753 (Agnaistic agnai through 1.0.555 contains a hard-coded credentials vuln ...)
+ TODO: check
+CVE-2026-108752 (JupyterHub through 6.0.1 contains an identifier collision vulnerabilit ...)
+ TODO: check
+CVE-2026-108751 (MoAI-ADK through 3.1.2 contains an improper link resolution vulnerabil ...)
+ TODO: check
+CVE-2026-108750 (OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerab ...)
+ TODO: check
+CVE-2026-108749 (docling-serve 1.14.0 through 1.36.0 contains a missing authentication ...)
+ TODO: check
+CVE-2026-108748 (Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of ...)
+ TODO: check
+CVE-2026-108747 (Lightdash through 2.556.0 contains an authorization bypass vulnerabili ...)
+ TODO: check
+CVE-2026-108746 (Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnera ...)
+ TODO: check
+CVE-2026-108745 (CloudBeaver through 25.3.5 contains a missing authorization vulnerabil ...)
+ TODO: check
+CVE-2026-108744 (pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnera ...)
+ TODO: check
+CVE-2026-108742 (CloudBeaver through 25.3.5 contains a missing authorization vulnerabil ...)
+ TODO: check
+CVE-2026-108741 (Shepherd (shepherd-ai) through 0.3.1 contains a server-side request fo ...)
+ TODO: check
+CVE-2026-108740 (GoatCounter through 2.7.0 contains a mass assignment privilege escalat ...)
+ TODO: check
+CVE-2026-108739 (OpenAgents Workspace backend through launcher-v1.0.17 contains an info ...)
+ TODO: check
+CVE-2026-108738 (Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulne ...)
+ TODO: check
+CVE-2026-108737 (Traccar through 6.16.0 contains a weak password recovery vulnerability ...)
+ TODO: check
+CVE-2026-108736 (Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulne ...)
+ TODO: check
+CVE-2026-108735 (Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vu ...)
+ TODO: check
+CVE-2026-108734 (Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vuln ...)
+ TODO: check
+CVE-2026-108733 (Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases ...)
+ TODO: check
+CVE-2026-108732 (Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases ...)
+ TODO: check
+CVE-2026-108731 (Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerabili ...)
+ TODO: check
+CVE-2026-108730 (Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerabili ...)
+ TODO: check
+CVE-2026-108729 (Corteza through 2024.9.10 contains an incorrect authorization vulnerab ...)
+ TODO: check
+CVE-2026-108728 (Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnera ...)
+ TODO: check
+CVE-2026-108727 (EdgeEver through 1.108.0 contains a missing authorization vulnerabilit ...)
+ TODO: check
+CVE-2026-108726 (GLPI through 12.0.0 contains a missing authorization vulnerability in ...)
+ TODO: check
+CVE-2026-108725 (Cheshire Cat AI core through 2.0.23 contains a stored cross-site scrip ...)
+ TODO: check
+CVE-2026-108724 (Sylius through 2.3.0 contains an authorization bypass vulnerability th ...)
+ TODO: check
+CVE-2026-108723 (answer-me-with-html through 0.5.0 contains a link following vulnerabil ...)
+ TODO: check
+CVE-2026-108722 (open-computer-use through commit 610bac8 contains a stored cross-site ...)
+ TODO: check
+CVE-2026-108721 (Open Computer Use through 1.0.0 on macOS contains an improper case sen ...)
+ TODO: check
+CVE-2026-108720 (phpIPAM through 1.8.3 contains a missing authorization vulnerability t ...)
+ TODO: check
+CVE-2026-108719 (LLMGateway through 1.20.0 contains a blind server-side request forgery ...)
+ TODO: check
+CVE-2026-108718 (Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerabil ...)
+ TODO: check
+CVE-2026-108717 (Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vuln ...)
+ TODO: check
+CVE-2026-108716 (mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vuln ...)
+ TODO: check
+CVE-2026-108715 (LibreNMS through 26.9.1.1 contains an authorization bypass vulnerabili ...)
+ TODO: check
+CVE-2026-108714 (MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocati ...)
+ TODO: check
+CVE-2026-108713 (SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing auth ...)
+ TODO: check
+CVE-2026-108712 (SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vu ...)
+ TODO: check
+CVE-2026-108711 (Plastic Labs Honcho through 3.3.0 contains an incorrect authorization ...)
+ TODO: check
+CVE-2026-108710 (NornicDB through 1.4.1 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-108699 (hyper-mcp through 0.8.3 contains an improper signature verification vu ...)
+ TODO: check
+CVE-2026-108698 (hyper-mcp through 0.8.3 contains a signature verification bypass vulne ...)
+ TODO: check
+CVE-2026-108697 (CoreShop through 2026.2.2 contains a missing authorization vulnerabili ...)
+ TODO: check
+CVE-2026-108684 (A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affe ...)
+ TODO: check
+CVE-2026-108683 (A security vulnerability has been detected in zhayujie CowAgent up to ...)
+ TODO: check
+CVE-2026-108682 (A weakness has been identified in zhayujie CowAgent up to 2.1.6. The a ...)
+ TODO: check
+CVE-2026-108681 (A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. ...)
+ TODO: check
+CVE-2026-108584 (A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. T ...)
+ TODO: check
+CVE-2026-108578 (A vulnerability was identified in Neterbit NW-431F 20250715. Impacted ...)
+ TODO: check
+CVE-2026-108577 (A vulnerability was determined in Konstanty Bialkowski libmodplug up t ...)
+ TODO: check
+CVE-2026-108576 (A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerabili ...)
+ TODO: check
+CVE-2026-108575 (A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This a ...)
+ TODO: check
+CVE-2026-108574 (A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by thi ...)
+ TODO: check
+CVE-2026-108573 (A vulnerability was detected in Open Asset Import Library Assimp up to ...)
+ TODO: check
+CVE-2026-108572 (A security vulnerability has been detected in Casdoor up to 3.164.0/4. ...)
+ TODO: check
+CVE-2026-108571 (A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. T ...)
+ TODO: check
+CVE-2026-108570 (A security flaw has been discovered in Furion .NET Framework up to 4.9 ...)
+ TODO: check
+CVE-2026-108569 (A vulnerability was identified in Furion .NET Framework up to 4.9.9.92 ...)
+ TODO: check
+CVE-2026-108568 (A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The ...)
+ TODO: check
+CVE-2026-108567 (A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted ...)
+ TODO: check
+CVE-2026-108566 (A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This ...)
+ TODO: check
+CVE-2026-108544 (A vulnerability was identified in Lippu Docx Reader Office Viewer App ...)
+ TODO: check
+CVE-2026-108543 (A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by ...)
+ TODO: check
+CVE-2026-108542 (A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by ...)
+ TODO: check
+CVE-2026-107761 (Several Postiz endpoints return the complete database row of the recor ...)
+ TODO: check
CVE-2026-97853 (Memory Allocation with Excessive Size Value vulnerability in ericmj de ...)
NOT-FOR-US: decimal Elixir library
CVE-2026-97183 (The WP-Invoice WordPress plugin through 4.3.1 does not perform capabi ...)
@@ -63081,11 +63351,13 @@ CVE-2026-71485 (Centrifugo is an open-source scalable real-time messaging server
CVE-2026-70656 (Checkmate is an open-source, self-hosted tool designed to track and mo ...)
NOT-FOR-US: Checkmate
CVE-2026-70654 (libvips is a fast image processing library with low memory needs. Prio ...)
+ {DSA-6552-1}
- vips 8.18.3-1
NOTE: https://github.com/libvips/libvips/security/advisories/GHSA-rjmm-3qch-m9rg
NOTE: https://github.com/libvips/libvips/pull/5038
NOTE: Fixed by: https://github.com/libvips/libvips/commit/80e021c6cdda0f80b756c2109d99839c94c03258 (v8.18.3-rc1)
CVE-2026-70653 (libvips is a fast image processing library with low memory needs. Prio ...)
+ {DSA-6552-1}
- vips 8.18.3-1
NOTE: https://github.com/libvips/libvips/security/advisories/GHSA-fh99-55jf-5hj3
NOTE: https://github.com/libvips/libvips/pull/5037
@@ -63096,6 +63368,7 @@ CVE-2026-70652 (libvips is a fast image processing library with low memory needs
NOTE: https://github.com/libvips/libvips/pull/5039
NOTE: Fixed by: https://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8 (v8.18.3-rc1)
CVE-2026-70651 (libvips is a fast image processing library with low memory needs. Prio ...)
+ {DSA-6552-1}
- vips 8.18.3-1
NOTE: https://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4
NOTE: https://github.com/libvips/libvips/pull/5040
@@ -63125,6 +63398,7 @@ CVE-2026-69419 (Integer overflow or wraparound in Azure Data Manager for Energy
CVE-2026-69400 (Improper limitation of a pathname to a restricted directory ('path tra ...)
NOT-FOR-US: Microsoft
CVE-2026-69242 (libvips is a fast image processing library with low memory needs. Prio ...)
+ {DSA-6552-1}
- vips 8.18.3-1
NOTE: https://github.com/libvips/libvips/security/advisories/GHSA-9rwc-f68v-4482
NOTE: https://github.com/libvips/libvips/pull/5012
@@ -102825,11 +103099,13 @@ CVE-2026-39878 (Chamilo LMS versions 1.11.38 and earlier contain a stored cross-
CVE-2026-39385 (Frappe LMS is an open source learning management system. In version 2. ...)
NOT-FOR-US: Frappe LMS
CVE-2026-35591 (libvips is a fast image processing library with low memory needs. The ...)
+ {DSA-6552-1}
- vips 8.18.2-1
NOTE: https://github.com/libvips/libvips/security/advisories/GHSA-523x-vhfw-6r76
NOTE: https://github.com/libvips/libvips/pull/4973
NOTE: Fixed by: https://github.com/libvips/libvips/commit/df044e409a0db77c980fa1a9f86a13fbfb2dc8fe (v8.18.2)
CVE-2026-35590 (libvips is a fast image processing library with low memory needs. The ...)
+ {DSA-6552-1}
- vips 8.18.2-1
NOTE: https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm
NOTE: https://github.com/libvips/libvips/pull/4972
@@ -102843,11 +103119,13 @@ CVE-2026-35048 (The Piwigo installer in versions 16.3.0 and earlier accepts POST
CVE-2026-34239 (Chamilo version 1.11.40 and earlier are vulnerable to authenticated re ...)
NOT-FOR-US: Chamilo LMS
CVE-2026-33328 (libvips is a fast image processing library with low memory needs. On 3 ...)
+ {DSA-6552-1}
- vips 8.18.1-1
NOTE: https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7
NOTE: https://github.com/libvips/libvips/pull/4935
NOTE: Fixed by: https://github.com/libvips/libvips/commit/9b633e45abfcf1fc4c84847007c81805193c0969 (v8.18.1)
CVE-2026-33327 (libvips is a fast image processing library with low memory needs. The ...)
+ {DSA-6552-1}
- vips 8.18.1-1
NOTE: https://github.com/libvips/libvips/security/advisories/GHSA-2fcj-gj27-279x
NOTE: https://github.com/libvips/libvips/pull/4934
@@ -256937,6 +257215,7 @@ CVE-2025-59940 (mkdocs-include-markdown-plugin is an Mkdocs Markdown includer pl
CVE-2025-59937 (go-mail is a comprehensive library for sending mails with Go. In versi ...)
NOT-FOR-US: go-mail
CVE-2025-59933 (libvips is a demand-driven, horizontally threaded image processing lib ...)
+ {DSA-6552-1}
- vips 8.17.3-1 (bug #1117049)
[bookworm] - vips <ignored> (Minor issue)
[bullseye] - vips <postponed> (minor issue; low impact, workaround exists)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ff84d72f9acf148dd1e62b319fdf56e48f64b5b3
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ff84d72f9acf148dd1e62b319fdf56e48f64b5b3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261011/7c382c8f/attachment.htm>
More information about the debian-security-tracker-commits
mailing list