[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Oct 13 08:22:04 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
fb894ce7 by security tracker role at 2026-10-13T07:21:55+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,11 +1,651 @@
-CVE-2026-103658
+CVE-2026-9268 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
+ TODO: check
+CVE-2026-97691 (Convex is an open-source reactive database for application developers. ...)
+ TODO: check
+CVE-2026-97229 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-96893 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
+ TODO: check
+CVE-2026-96266 (IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by ...)
+ TODO: check
+CVE-2026-96265 (IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by ...)
+ TODO: check
+CVE-2026-96264 (IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by ...)
+ TODO: check
+CVE-2026-96263 (IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 thro ...)
+ TODO: check
+CVE-2026-96262 (IBM Power Systems FirmwareFW1060.00 through FW1060.81 is affected by a ...)
+ TODO: check
+CVE-2026-96261 (IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by ...)
+ TODO: check
+CVE-2026-96119 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attack ...)
+ TODO: check
+CVE-2026-96012 (IBM Db2 Mirror for i 7.4, 7.5, and 7.6is vulnerable to privilege escal ...)
+ TODO: check
+CVE-2026-95838 (containerd is an open-source container runtime. Prior to 1.7.35, 2.0.1 ...)
+ TODO: check
+CVE-2026-95837 (containerd is an open-source container runtime. From 2.1.0 until 2.2.7 ...)
+ TODO: check
+CVE-2026-93892 (IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a rem ...)
+ TODO: check
+CVE-2026-93891 (IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a rem ...)
+ TODO: check
+CVE-2026-93886 (IBM i 7.3, 7.4, 7.5, and 7.6could allow a remote authenticated attacke ...)
+ TODO: check
+CVE-2026-92883 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-92876 (IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 c ...)
+ TODO: check
+CVE-2026-92832 (IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local ...)
+ TODO: check
+CVE-2026-92528 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
+ TODO: check
+CVE-2026-92120 (OAuth1 Request Replay Attackvulnerability in Apache Allura. This is ...)
+ TODO: check
+CVE-2026-92119 (REST API Mass Assignmentvulnerability in Apache Allura. This issue ...)
+ TODO: check
+CVE-2026-92116 (OAuth1 callback validationvulnerability in Apache Allura. This issu ...)
+ TODO: check
+CVE-2026-90921 (IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker t ...)
+ TODO: check
+CVE-2026-90920 (IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker t ...)
+ TODO: check
+CVE-2026-90912 (IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attac ...)
+ TODO: check
+CVE-2026-90911 (IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker t ...)
+ TODO: check
+CVE-2026-89271 (The WP-BusinessDirectory WordPress plugin through 4.0.2 does not rest ...)
+ TODO: check
+CVE-2026-89269 (The WP Testimonials WordPress plugin through 1.4.13 does not properly ...)
+ TODO: check
+CVE-2026-89124 (Display Product Catalog Based on Customs Declaration application does ...)
+ TODO: check
+CVE-2026-89122 (SAP NetWeaver Enterprise Portal does not sufficiently validate input t ...)
+ TODO: check
+CVE-2026-89121 (SAP S/4HANA does not perform sufficient instance-level authorization c ...)
+ TODO: check
+CVE-2026-89120 (A regression caused by an API change in SAP ABAP Platform reintroduces ...)
+ TODO: check
+CVE-2026-89118 (SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to ...)
+ TODO: check
+CVE-2026-89117 (SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to ...)
+ TODO: check
+CVE-2026-89116 (The affected code used child_process.execSync with a shell string for ...)
+ TODO: check
+CVE-2026-89113 (SAP Commerce Cloud does not sufficiently validate certain user-supplie ...)
+ TODO: check
+CVE-2026-89112 (The admin API endpoint used to retrieve CLA signature records does not ...)
+ TODO: check
+CVE-2026-89111 (The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability aff ...)
+ TODO: check
+CVE-2026-89110 (SAP NetWeaver Visual Composer does not perform sufficient authorizatio ...)
+ TODO: check
+CVE-2026-89108 (SAP Manufacturing Integration and Intelligence does not sufficiently e ...)
+ TODO: check
+CVE-2026-89107 (SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficient ...)
+ TODO: check
+CVE-2026-89106 (SAP UI5 does not perform sufficient input validation under certain con ...)
+ TODO: check
+CVE-2026-89105 (The HybridTokenAuthenticator component of the SAP/cloud-security-servi ...)
+ TODO: check
+CVE-2026-87689 (The Metasploit Framework Web Service REST API (msf-ws) exposes the cre ...)
+ TODO: check
+CVE-2026-85529 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-85457 (IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated ...)
+ TODO: check
+CVE-2026-84418 (IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-mid ...)
+ TODO: check
+CVE-2026-84360 (Nginx UI is a web user interface for the Nginx web server. Prior to 2. ...)
+ TODO: check
+CVE-2026-84321 (Nginx UI is a web user interface for the Nginx web server. Prior to 2. ...)
+ TODO: check
+CVE-2026-84320 (Nginx UI is a web user interface for the Nginx web server. Prior to 2. ...)
+ TODO: check
+CVE-2026-84319 (Nginx UI is a web user interface for the Nginx web server. Prior to 2. ...)
+ TODO: check
+CVE-2026-84318 (Nginx UI is a web user interface for the Nginx web server. From 2.0.0- ...)
+ TODO: check
+CVE-2026-84317 (Nginx UI is a web user interface for the Nginx web server. Prior to 2. ...)
+ TODO: check
+CVE-2026-84316 (Nginx UI is a web user interface for the Nginx web server. Prior to 2. ...)
+ TODO: check
+CVE-2026-84315 (Nginx UI is a web user interface for the Nginx web server. Prior to 2. ...)
+ TODO: check
+CVE-2026-84314 (Nginx UI is a web user interface for the Nginx web server. Prior to 2. ...)
+ TODO: check
+CVE-2026-84313 (Nginx UI is a web user interface for the Nginx web server. Prior to 2. ...)
+ TODO: check
+CVE-2026-84312 (Nginx UI is a web user interface for the Nginx web server. Prior to 2. ...)
+ TODO: check
+CVE-2026-84284 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-82632 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-82110 (IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authe ...)
+ TODO: check
+CVE-2026-82108 (IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authe ...)
+ TODO: check
+CVE-2026-82103 (IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authe ...)
+ TODO: check
+CVE-2026-82101 (IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authe ...)
+ TODO: check
+CVE-2026-82096 (IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authe ...)
+ TODO: check
+CVE-2026-81858 (IBM i 7.3, 7.4, 7.5, and 7.6could allow a remote authenticated attacke ...)
+ TODO: check
+CVE-2026-81839 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
+ TODO: check
+CVE-2026-7767 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-78673 (IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker t ...)
+ TODO: check
+CVE-2026-78335 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-76976 (Applications based on SAP GUI for HTML in SAP NetWeaver Application Se ...)
+ TODO: check
+CVE-2026-76975 (Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauth ...)
+ TODO: check
+CVE-2026-76972 (Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing ...)
+ TODO: check
+CVE-2026-75881 (IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 c ...)
+ TODO: check
+CVE-2026-75826 (Command injection in the backup function in Teltonika Networks RUTOS 7 ...)
+ TODO: check
+CVE-2026-75782 (IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local ...)
+ TODO: check
+CVE-2026-75621 (IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local ...)
+ TODO: check
+CVE-2026-75095 (IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote ...)
+ TODO: check
+CVE-2026-75076 (IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote ...)
+ TODO: check
+CVE-2026-75063 (IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated ...)
+ TODO: check
+CVE-2026-75061 (IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to t ...)
+ TODO: check
+CVE-2026-6567 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-5954 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-58462
+ REJECTED
+CVE-2026-58249 (SAP NetWeaver and SAP Web Dispatcher do not properly validate certain ...)
+ TODO: check
+CVE-2026-58242 (SAP Cloud Connector contains an improper authorization check, which co ...)
+ TODO: check
+CVE-2026-54870 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-54869 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-54868 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-54867 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-54459 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-53997 (Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 c ...)
+ TODO: check
+CVE-2026-53922 (odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by ...)
+ TODO: check
+CVE-2026-49484 (Code for IBM i is a Visual Studio Code extension for maintaining and c ...)
+ TODO: check
+CVE-2026-49483 (Code for IBMi is a Visual Studio Code extension for maintaining and co ...)
+ TODO: check
+CVE-2026-44828 (Qexo is an open source online editor for static blogs. From 4.0.0 unti ...)
+ TODO: check
+CVE-2026-41510 (OWASP Coraza WAF is a golang modsecurity compatible web application fi ...)
+ TODO: check
+CVE-2026-41508 (OWASP Coraza WAF is a golang modsecurity compatible web application fi ...)
+ TODO: check
+CVE-2026-41504 (OWASP Coraza WAF is a golang modsecurity compatible web application fi ...)
+ TODO: check
+CVE-2026-41210 (Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Ste ...)
+ TODO: check
+CVE-2026-35001 (OpenS100 through commit daa35b contains an integer overflow vulnerabil ...)
+ TODO: check
+CVE-2026-19938 (The Bluetooth host's ATT transmit path releases a buffer it does not o ...)
+ TODO: check
+CVE-2026-19937 (The Bluetooth Mesh Access layer delayable-message machinery in subsys/ ...)
+ TODO: check
+CVE-2026-19936 (The Bluetooth Mesh Access-layer delayable message queue in subsys/blue ...)
+ TODO: check
+CVE-2026-19627 (IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to r ...)
+ TODO: check
+CVE-2026-19622 (IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to b ...)
+ TODO: check
+CVE-2026-19620 (IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to g ...)
+ TODO: check
+CVE-2026-18541 (IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site ...)
+ TODO: check
+CVE-2026-18537 (IBM Maximo Application Suite - Location Service for Esri Component 9.2 ...)
+ TODO: check
+CVE-2026-18533 (IBM Maximo Application Suite - Location Service for Esri Component 9.2 ...)
+ TODO: check
+CVE-2026-18529 (IBM Maximo Application Suite - Location Service for Esri Component 9.2 ...)
+ TODO: check
+CVE-2026-18517 (IBM Maximo Application Suite - Location Service for Esri Component 9.2 ...)
+ TODO: check
+CVE-2026-18513 (IBM Maximo Application Suite - Location Service for Esri Component 9.2 ...)
+ TODO: check
+CVE-2026-18343 (IBM i 7.3, 7.4, 7.5, and 7.6could allow a local attacker to modify the ...)
+ TODO: check
+CVE-2026-18318 (IBM i 7.3, 7.4, 7.5, and 7.6could allow a remote attacker to perform b ...)
+ TODO: check
+CVE-2026-17487 (IBM i 7.3, 7.4, 7.5, and 7.6could allow a remote attacker to enumerate ...)
+ TODO: check
+CVE-2026-17484 (IBM i 7.3, 7.4, 7.5, and 7.6could allow a local attacker to cause a de ...)
+ TODO: check
+CVE-2026-17475 (IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated ...)
+ TODO: check
+CVE-2026-16678 (IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 thro ...)
+ TODO: check
+CVE-2026-16301 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-16275 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-14814 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-14552 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-14210 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-109786 (In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (conf ...)
+ TODO: check
+CVE-2026-109758 (Perforce Helix Authentication Service (HAS) deployments that retain th ...)
+ TODO: check
+CVE-2026-109675 (Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f co ...)
+ TODO: check
+CVE-2026-109674 (Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL i ...)
+ TODO: check
+CVE-2026-109673 (Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stor ...)
+ TODO: check
+CVE-2026-109672 (Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a miss ...)
+ TODO: check
+CVE-2026-109671 (Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stor ...)
+ TODO: check
+CVE-2026-109670 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stor ...)
+ TODO: check
+CVE-2026-109669 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a miss ...)
+ TODO: check
+CVE-2026-109668 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a miss ...)
+ TODO: check
+CVE-2026-109667 (Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a priv ...)
+ TODO: check
+CVE-2026-109666 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a miss ...)
+ TODO: check
+CVE-2026-109665 (Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a miss ...)
+ TODO: check
+CVE-2026-109664 (Frappe ERPNext before 15.112.0 contains a missing authorization vulner ...)
+ TODO: check
+CVE-2026-109663 (Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL ...)
+ TODO: check
+CVE-2026-109662 (Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stor ...)
+ TODO: check
+CVE-2026-109661 (Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a miss ...)
+ TODO: check
+CVE-2026-109660 (Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain end ...)
+ TODO: check
+CVE-2026-109659 (Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a miss ...)
+ TODO: check
+CVE-2026-109658 (Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a miss ...)
+ TODO: check
+CVE-2026-109657 (Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site script ...)
+ TODO: check
+CVE-2026-109656 (Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a miss ...)
+ TODO: check
+CVE-2026-109655 (Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a miss ...)
+ TODO: check
+CVE-2026-109654 (Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a miss ...)
+ TODO: check
+CVE-2026-109653 (Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stor ...)
+ TODO: check
+CVE-2026-109652 (Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a serv ...)
+ TODO: check
+CVE-2026-109651 (Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a serv ...)
+ TODO: check
+CVE-2026-109650 (Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a miss ...)
+ TODO: check
+CVE-2026-109649 (Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL ...)
+ TODO: check
+CVE-2026-109648 (Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL ...)
+ TODO: check
+CVE-2026-109647 (Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL ...)
+ TODO: check
+CVE-2026-109646 (Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL ...)
+ TODO: check
+CVE-2026-109645 (Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a miss ...)
+ TODO: check
+CVE-2026-109644 (Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a miss ...)
+ TODO: check
+CVE-2026-109643 (Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a miss ...)
+ TODO: check
+CVE-2026-109642 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a miss ...)
+ TODO: check
+CVE-2026-109641 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a miss ...)
+ TODO: check
+CVE-2026-109640 (Frappe ERPNext before 16.22.0 contains a missing authorization vulnera ...)
+ TODO: check
+CVE-2026-109639 (Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL ...)
+ TODO: check
+CVE-2026-109638 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL ...)
+ TODO: check
+CVE-2026-109637 (Frappe ERPNext before 16.14.0 contains a missing authorization vulnera ...)
+ TODO: check
+CVE-2026-109636 (Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a miss ...)
+ TODO: check
+CVE-2026-109635 (Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a miss ...)
+ TODO: check
+CVE-2026-109634 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL ...)
+ TODO: check
+CVE-2026-109633 (Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stor ...)
+ TODO: check
+CVE-2026-109632 (Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a miss ...)
+ TODO: check
+CVE-2026-109631 (Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL ...)
+ TODO: check
+CVE-2026-109630 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a miss ...)
+ TODO: check
+CVE-2026-109629 (Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a miss ...)
+ TODO: check
+CVE-2026-109628 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a miss ...)
+ TODO: check
+CVE-2026-109627 (Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a miss ...)
+ TODO: check
+CVE-2026-109626 (Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability ...)
+ TODO: check
+CVE-2026-109625 (Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a miss ...)
+ TODO: check
+CVE-2026-109624 (Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a miss ...)
+ TODO: check
+CVE-2026-109623 (Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a miss ...)
+ TODO: check
+CVE-2026-109622 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a miss ...)
+ TODO: check
+CVE-2026-109621 (Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an aut ...)
+ TODO: check
+CVE-2026-109617 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a miss ...)
+ TODO: check
+CVE-2026-109616 (Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a miss ...)
+ TODO: check
+CVE-2026-109615 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a miss ...)
+ TODO: check
+CVE-2026-109614 (Frappe ERPNext before 16.34.0 contains a missing authorization vulnera ...)
+ TODO: check
+CVE-2026-109613 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a miss ...)
+ TODO: check
+CVE-2026-109612 (Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stor ...)
+ TODO: check
+CVE-2026-109611 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a miss ...)
+ TODO: check
+CVE-2026-109610 (Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a miss ...)
+ TODO: check
+CVE-2026-109609 (Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL ...)
+ TODO: check
+CVE-2026-109608 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL ...)
+ TODO: check
+CVE-2026-109604 (Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stor ...)
+ TODO: check
+CVE-2026-109603 (Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies o ...)
+ TODO: check
+CVE-2026-109602 (Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross ...)
+ TODO: check
+CVE-2026-109601 (Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an a ...)
+ TODO: check
+CVE-2026-109600 (Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not chec ...)
+ TODO: check
+CVE-2026-109599 (Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing auth ...)
+ TODO: check
+CVE-2026-109598 (Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a mi ...)
+ TODO: check
+CVE-2026-109597 (Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripti ...)
+ TODO: check
+CVE-2026-109596 (Hugo from v0.162.0 before v0.167.0 contains an improper link resolutio ...)
+ TODO: check
+CVE-2026-109595 (Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerabil ...)
+ TODO: check
+CVE-2026-109575 (In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enter ...)
+ TODO: check
+CVE-2026-109574 (Hugo before v0.167.0 contains a path traversal vulnerability in css.Sa ...)
+ TODO: check
+CVE-2026-109573 (phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMy ...)
+ TODO: check
+CVE-2026-109572 (Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vu ...)
+ TODO: check
+CVE-2026-109571 (Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missin ...)
+ TODO: check
+CVE-2026-109570 (Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missin ...)
+ TODO: check
+CVE-2026-109569 (sandboxed.sh through 1.3.0 contains a container escape vulnerability t ...)
+ TODO: check
+CVE-2026-109568 (Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerab ...)
+ TODO: check
+CVE-2026-109567 (Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege ma ...)
+ TODO: check
+CVE-2026-109566 (Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials ...)
+ TODO: check
+CVE-2026-109565 (Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scri ...)
+ TODO: check
+CVE-2026-109564 (LearnHouse before 1.4.0 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-109563 (N3.js before 2.11.1 contains a regular expression denial of service vu ...)
+ TODO: check
+CVE-2026-109562 (SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulne ...)
+ TODO: check
+CVE-2026-109560 (Continue CLI (@continuedev/cli) through 1.5.47 contains a permission b ...)
+ TODO: check
+CVE-2026-109559 (EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlis ...)
+ TODO: check
+CVE-2026-109558 (EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting ...)
+ TODO: check
+CVE-2026-109557 (EdgeEver through 1.112.0 contains a stored cross-site scripting vulner ...)
+ TODO: check
+CVE-2026-109556 (EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code executi ...)
+ TODO: check
+CVE-2026-109427 (Telegram-Stremio through 5.1.0 contains a broken object-level authoriz ...)
+ TODO: check
+CVE-2026-109426 (Telegram-Stremio through 5.1.0 contains an insecure storage vulnerabil ...)
+ TODO: check
+CVE-2026-109425 (Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validati ...)
+ TODO: check
+CVE-2026-109424 (NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.3 ...)
+ TODO: check
+CVE-2026-109423 (NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.3 ...)
+ TODO: check
+CVE-2026-109422 (NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.3 ...)
+ TODO: check
+CVE-2026-109378 (SPIP before 4.4.18 contains a server-side request forgery vulnerabilit ...)
+ TODO: check
+CVE-2026-109377 (ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnera ...)
+ TODO: check
+CVE-2026-109376 (ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vu ...)
+ TODO: check
+CVE-2026-109375 (Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vuln ...)
+ TODO: check
+CVE-2026-109106 (A security flaw has been discovered in Polaris Office App 9.9.19 on An ...)
+ TODO: check
+CVE-2026-108975 (A security flaw has been discovered in SourceCodester Library Manageme ...)
+ TODO: check
+CVE-2026-108974 (A vulnerability was identified in SourceCodester E-Learning System 1.0 ...)
+ TODO: check
+CVE-2026-108973 (A vulnerability was determined in SourceCodester Contact Tracing Syste ...)
+ TODO: check
+CVE-2026-108972 (A vulnerability was found in SourceCodester Human Resource Management ...)
+ TODO: check
+CVE-2026-108971 (A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the fun ...)
+ TODO: check
+CVE-2026-108970 (A vulnerability was detected in itsmeravitejak Online-Examination-Syst ...)
+ TODO: check
+CVE-2026-108969 (A security vulnerability has been detected in itsmeravitejak Online-Ex ...)
+ TODO: check
+CVE-2026-108968 (A weakness has been identified in SourceCodester Performance Indicator ...)
+ TODO: check
+CVE-2026-108967 (A security flaw has been discovered in SourceCodester Performance Indi ...)
+ TODO: check
+CVE-2026-108966 (A vulnerability was identified in SourceCodester Performance Indicator ...)
+ TODO: check
+CVE-2026-108965 (A vulnerability was determined in SourceCodester Performance Indicator ...)
+ TODO: check
+CVE-2026-108964 (A vulnerability was found in SourceCodester Performance Indicator Syst ...)
+ TODO: check
+CVE-2026-108962 (A vulnerability has been found in storyicon comfyui_segment_anything u ...)
+ TODO: check
+CVE-2026-108961 (A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by ...)
+ TODO: check
+CVE-2026-108960 (A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c ...)
+ TODO: check
+CVE-2026-108959 (A security vulnerability has been detected in itsourcecode Online Cake ...)
+ TODO: check
+CVE-2026-108958 (A weakness has been identified in TensorLayer up to 2.2.4. This affect ...)
+ TODO: check
+CVE-2026-108957 (A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up ...)
+ TODO: check
+CVE-2026-108956 (A vulnerability was identified in code-projects Online Reviewer System ...)
+ TODO: check
+CVE-2026-108955 (A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d6990 ...)
+ TODO: check
+CVE-2026-108954 (A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This iss ...)
+ TODO: check
+CVE-2026-108948 (A vulnerability has been found in code-projects Online Reviewer System ...)
+ TODO: check
+CVE-2026-108947 (A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. ...)
+ TODO: check
+CVE-2026-108945 (A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac ...)
+ TODO: check
+CVE-2026-108944 (A security vulnerability has been detected in repository RAE up to a4d ...)
+ TODO: check
+CVE-2026-108943 (A weakness has been identified in ModelTC LightX2V up to 0.5.0. Affect ...)
+ TODO: check
+CVE-2026-108942 (A security flaw has been discovered in philz1337x clarity-upscaler up ...)
+ TODO: check
+CVE-2026-108941 (A vulnerability was identified in Linketic CityGaussian up to 2.0. Thi ...)
+ TODO: check
+CVE-2026-108940 (A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The ...)
+ TODO: check
+CVE-2026-108939 (A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. ...)
+ TODO: check
+CVE-2026-108938 (A flaw has been found in code-projects Matrimonial System 1.0. This is ...)
+ TODO: check
+CVE-2026-108937 (A vulnerability was detected in code-projects Online Ticket Reservatio ...)
+ TODO: check
+CVE-2026-108936 (A security vulnerability has been detected in Edimax BR-6208AC 1.32. T ...)
+ TODO: check
+CVE-2026-108935 (A weakness has been identified in Edimax BR-6208AC 1.32. Affected by t ...)
+ TODO: check
+CVE-2026-108934 (A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected ...)
+ TODO: check
+CVE-2026-108933 (A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is a ...)
+ TODO: check
+CVE-2026-108932 (A vulnerability was determined in Netcore NR268 1.7.121109. This impac ...)
+ TODO: check
+CVE-2026-108931 (A vulnerability was found in Netcore NR268 1.7.121109. This affects th ...)
+ TODO: check
+CVE-2026-108930 (A vulnerability has been found in Netcore NR268 1.7.121109. The impact ...)
+ TODO: check
+CVE-2026-108929 (A flaw has been found in Netcore NR268 1.7.121109. The affected elemen ...)
+ TODO: check
+CVE-2026-108928 (A security vulnerability has been detected in itsourcecode Online Admi ...)
+ TODO: check
+CVE-2026-108927 (A weakness has been identified in itsourcecode Baptism Information Man ...)
+ TODO: check
+CVE-2026-108926 (A security flaw has been discovered in itsourcecode Baptism Informatio ...)
+ TODO: check
+CVE-2026-108924 (A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Af ...)
+ TODO: check
+CVE-2026-108923 (A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. A ...)
+ TODO: check
+CVE-2026-108362 (Privasys Remote Attestation TLS Clients provides multi-language utilit ...)
+ TODO: check
+CVE-2026-108361 (Privasys Remote Attestation TLS Clients provides multi-language utilit ...)
+ TODO: check
+CVE-2026-106495 (Backstage is an open framework for building developer portals. Prior t ...)
+ TODO: check
+CVE-2026-105458 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
+ TODO: check
+CVE-2026-105052 (IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow ...)
+ TODO: check
+CVE-2026-104774 (OWASP Coraza WAF is a golang modsecurity compatible web application fi ...)
+ TODO: check
+CVE-2026-104661 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
+ TODO: check
+CVE-2026-104364 (IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5could allow a ...)
+ TODO: check
+CVE-2026-104332 (IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5is vulnerable ...)
+ TODO: check
+CVE-2026-104140 (QGIS is a free, open source, cross-platform geographic information sys ...)
+ TODO: check
+CVE-2026-103549 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-103316 (The macOS version of the DigiD app is not signed with Hardened Runtime ...)
+ TODO: check
+CVE-2026-102627 (IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a rem ...)
+ TODO: check
+CVE-2026-102596 (Nango is an open-source platform for connecting agents and products to ...)
+ TODO: check
+CVE-2026-102539 (Super Productivity is an advanced todo list app with integrated timebo ...)
+ TODO: check
+CVE-2026-101168 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-100755 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2026-100104 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
+ TODO: check
+CVE-2025-71432 (Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a refle ...)
+ TODO: check
+CVE-2025-71431 (Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injecti ...)
+ TODO: check
+CVE-2025-71430 (Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross ...)
+ TODO: check
+CVE-2025-71429 (GPT-SoVITS through 20250606v2pro contains an OS command injection vuln ...)
+ TODO: check
+CVE-2025-27902 (IBM DB2 Recovery Expert for Linux, UNIX and Windows5.5 IF 2 uses a web ...)
+ TODO: check
+CVE-2025-27897 (IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulner ...)
+ TODO: check
+CVE-2025-27896 (IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulner ...)
+ TODO: check
+CVE-2025-27895 (IBMDB2 Recovery Expert for Linux, UNIX and Windows5.5 IF 2is vulnerabl ...)
+ TODO: check
+CVE-2024-58391 (Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scr ...)
+ TODO: check
+CVE-2024-58390 (Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper pri ...)
+ TODO: check
+CVE-2024-58389 (HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulner ...)
+ TODO: check
+CVE-2023-54412 (Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper acc ...)
+ TODO: check
+CVE-2023-54411 (Frappe framework before 13.32.0 uses weak authentication for print vie ...)
+ TODO: check
+CVE-2023-54410 (Frappe before 13.22.0 contains an improper authorization vulnerability ...)
+ TODO: check
+CVE-2023-54409 (Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site sc ...)
+ TODO: check
+CVE-2023-54408 (Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injecti ...)
+ TODO: check
+CVE-2023-54407 (Frappe 14.x before 14.45.0 contains an information disclosure vulnerab ...)
+ TODO: check
+CVE-2023-54406 (Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw w ...)
+ TODO: check
+CVE-2022-51020 (Flower before 2.2.0 contains a cross-site request forgery vulnerabilit ...)
+ TODO: check
+CVE-2021-48012 (fast-toml through 0.5.4 contains a prototype pollution vulnerability t ...)
+ TODO: check
+CVE-2021-48011 (Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability tha ...)
+ TODO: check
+CVE-2021-48009
+ REJECTED
+CVE-2020-37280 (cbor-sync through 1.0.4 contains a resource exhaustion vulnerability i ...)
+ TODO: check
+CVE-2020-37279 (easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vu ...)
+ TODO: check
+CVE-2026-103658 (GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a ...)
- aspell <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2550001
-CVE-2026-109379
+CVE-2026-109379 (Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerabi ...)
NOT-FOR-US: Cockpit CMS
-CVE-2026-109380
+CVE-2026-109380 (modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerabil ...)
NOT-FOR-US: modern-tar
-CVE-2026-109561
+CVE-2026-109561 (goose from 1.28.0 before 1.44.0 contains an authorization bypass vulne ...)
NOT-FOR-US: Goose
CVE-2026-93879
- libhibernate-validator-java <unfixed>
@@ -1742,9 +2382,9 @@ CVE-2026-42702 (Unauthenticated Cross Site Scripting (XSS) in Tutor LMS <= 4.1.0
NOT-FOR-US: WordPress plugin or theme
CVE-2026-42699 (Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 ver ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-42697 (Unauthenticated Cross Site Scripting (XSS) in Social Share Icons & Soc ...)
+CVE-2026-42697 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-42696 (Unauthenticated Remote Code Execution (RCE) in SiteVault \u2013 Backup ...)
+CVE-2026-42696 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-42693 (Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions ...)
NOT-FOR-US: WordPress plugin or theme
@@ -6024,7 +6664,8 @@ CVE-2026-67269 (Dell Container Storage Modules (CSM) Operator, versions prior to
CVE-2026-66666 (Insertion of Sensitive Information Into Sent Data vulnerability in Aut ...)
- wordpress <unfixed> (bug #1150336)
NOTE: https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/
-CVE-2026-66588 (Unauthenticated Broken Access Control in The7 <= 14.2.2 versions.)
+CVE-2026-66588
+ REJECTED
NOT-FOR-US: WordPress plugin or theme
CVE-2026-63697 (Dell System Update, versions prior to 2.3.0.0, contains an Improper Ce ...)
NOT-FOR-US: Dell / EMC
@@ -17187,7 +17828,7 @@ CVE-2026-103111 (PCRE2 before 10.49, when there is an attacker-controlled regula
- pcre2 10.48-3.1 (bug #1149217)
NOTE: https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m
NOTE: Fixed by: https://github.com/PCRE2Project/pcre2/commit/2b4038298072684b0fae29b15bedfb1a75bda46d (pcre2-10.49)
-CVE-2026-109240 [GHSA-9qqc-m43j-g4r2]
+CVE-2026-109240 (FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerabil ...)
- freerdp3 3.32.1+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9qqc-m43j-g4r2
@@ -20806,7 +21447,8 @@ CVE-2026-97059 (DCMTK through 3.7.0 contains a heap over-read vulnerability in C
NOTE: https://support.dcmtk.org/redmine/issues/1281
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1
-CVE-2026-97058 (sprintf-js through 1.1.3 passes unbounded precision specifiers to toFi ...)
+CVE-2026-97058
+ REJECTED
NOT-FOR-US: sprintf-js
CVE-2026-97057 (redis-parser through 3.0.0 fails to validate the multi-bulk length val ...)
NOT-FOR-US: Node redis-parser
@@ -22391,6 +23033,7 @@ CVE-2026-96892 (A flaw has been found in Edimax BR-6428nC 1.16. The impacted ele
CVE-2026-96891 (A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is ...)
NOT-FOR-US: D-Link
CVE-2026-96889 (A flaw was found in librsvg. When processing an SVG document containin ...)
+ {DSA-6555-1}
- librsvg 2.63.2+dfsg-1 (bug #1148902)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2539279
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0305.html
@@ -23711,11 +24354,11 @@ CVE-2026-XXXX [GHSA-cq4m-gwc5-w8rc]
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cq4m-gwc5-w8rc
-CVE-2026-109243 [GHSA-q9p9-j22r-577p]
+CVE-2026-109243 (FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assi ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q9p9-j22r-577p
-CVE-2026-109244 [GHSA-2jfv-j3wx-5cg4]
+CVE-2026-109244 (FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulne ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2jfv-j3wx-5cg4
@@ -23791,31 +24434,31 @@ CVE-2026-XXXX [GHSA-jhxw-3hj9-9hqh]
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jhxw-3hj9-9hqh
-CVE-2026-109245 [GHSA-h44v-39x6-9xvg]
+CVE-2026-109245 (FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validatio ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h44v-39x6-9xvg
-CVE-2026-109246 [GHSA-6vjv-4hm3-6698]
+CVE-2026-109246 (FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the f ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6vjv-4hm3-6698
-CVE-2026-109247 [GHSA-c3rh-2hv6-7hf2]
+CVE-2026-109247 (FreeRDP before 3.32.0 contains a path traversal vulnerability in conve ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c3rh-2hv6-7hf2
-CVE-2026-109248 [GHSA-jp2r-gm4v-wvq2]
+CVE-2026-109248 (FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jp2r-gm4v-wvq2
-CVE-2026-109249 [GHSA-gvq8-v2fm-ffxv]
+CVE-2026-109249 (FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in free ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gvq8-v2fm-ffxv
-CVE-2026-109250 [GHSA-jhv5-m83m-hxhq]
+CVE-2026-109250 (FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerabil ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jhv5-m83m-hxhq
-CVE-2026-109251 [GHSA-grvc-qhhp-7h6m]
+CVE-2026-109251 (FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geom ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-grvc-qhhp-7h6m
@@ -23827,19 +24470,19 @@ CVE-2026-XXXX [GHSA-945c-qq5h-jqwp]
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-945c-qq5h-jqwp
-CVE-2026-109252 [GHSA-93g7-296p-j77j]
+CVE-2026-109252 (FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference v ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-93g7-296p-j77j
-CVE-2026-109253 [GHSA-6rj3-rf6g-3vw5]
+CVE-2026-109253 (FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulner ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6rj3-rf6g-3vw5
-CVE-2026-109256 [GHSA-wf3x-658c-52m5]
+CVE-2026-109256 (FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the W ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wf3x-658c-52m5
-CVE-2026-109257 [GHSA-2hhg-8xx6-v73w]
+CVE-2026-109257 (FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_cont ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2hhg-8xx6-v73w
@@ -23851,11 +24494,11 @@ CVE-2026-XXXX [GHSA-72qv-gcph-rfwf]
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72qv-gcph-rfwf
-CVE-2026-109254 [GHSA-vqxm-9w7c-hvvx]
+CVE-2026-109254 (FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vqxm-9w7c-hvvx
-CVE-2026-109255 [GHSA-hxw3-57rq-3v4m]
+CVE-2026-109255 (FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerabili ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hxw3-57rq-3v4m
@@ -23863,11 +24506,11 @@ CVE-2026-XXXX [GHSA-f4pf-pgp4-f2r3]
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f4pf-pgp4-f2r3
-CVE-2026-109242 [GHSA-4mpr-hmqx-83q8]
+CVE-2026-109242 (FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized hea ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4mpr-hmqx-83q8
-CVE-2026-109241 [GHSA-x7v7-9jp5-wqj2]
+CVE-2026-109241 (FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerabilit ...)
- freerdp3 3.32.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v7-9jp5-wqj2
@@ -39453,6 +40096,7 @@ CVE-2026-90461 (OpenStack Ironic through 38.0.0 may send a username and password
NOTE: https://bugs.launchpad.net/ironic/+bug/2162816
NOTE: https://docs.openstack.org/security-notes/OSSN-0110.html
CVE-2026-90460 (An issue was discovered in OpenStack Keystone before 29.0.3. Tokens ob ...)
+ {DSA-6554-1}
- keystone 2:30.0.0~rc1-1 (bug #1149956; bug #1149303)
[bookworm] - keystone <postponed> (Minor issue)
NOTE: https://bugs.launchpad.net/keystone/+bug/2159643
@@ -59609,9 +60253,11 @@ CVE-2026-51106 (An issue in TokTok qTox v1.18.4 allows a local attacker to cause
CVE-2026-48786 (Fleet is an open-source device management platform built on osquery. I ...)
NOT-FOR-US: Fleet
CVE-2026-48549 (Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSR ...)
+ {DSA-6556-1}
- nagios4 4.5.14+ds-1 (bug #1145888)
NOTE: Fixed by: https://github.com/NagiosEnterprises/nagioscore/commit/02aba584656eb10c2ff83a696b166f4bc7dd1304 (nagios-4.5.13)
CVE-2026-48548 (Nagios Core before 4.5.12 contains a cross-site request forgery vulner ...)
+ {DSA-6308-1}
- nagios4 4.5.12+ds-1 (bug #1136340)
[trixie] - nagios4 4.4.6-4.1+deb13u1
[bookworm] - nagios4 4.4.6-4+deb12u1
@@ -79951,18 +80597,23 @@ CVE-2026-49349 (regclient is a Docker and OCI Registry Client in Go. Prior to ve
CVE-2026-49262 (In the Aimeos Pagible content management system prior to version 0.10. ...)
NOT-FOR-US: Aimeos Pagible content management system
CVE-2026-48554 (Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable ...)
+ {DSA-6556-1}
- nagios4 4.5.14+ds-1 (bug #1144495)
NOTE: Fixed by: https://github.com/NagiosEnterprises/nagioscore/commit/1d1f65390dae0bdff05da4ccba4b2db58c0f0d8e (nagios-4.5.14)
CVE-2026-48553 (Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable ...)
+ {DSA-6556-1}
- nagios4 4.5.14+ds-1 (bug #1144495)
NOTE: Fixed by: https://github.com/NagiosEnterprises/nagioscore/commit/0b68220529d461c9fba198a904049ea332bdb1da (nagios-4.5.13)
CVE-2026-48552 (Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable ...)
+ {DSA-6556-1}
- nagios4 4.5.14+ds-1 (bug #1144495)
NOTE: Fixed by: https://github.com/NagiosEnterprises/nagioscore/commit/acd2365e816dda4a8dce61709f8d3a3b4ab04a6f (nagios-4.5.14)
CVE-2026-48551 (Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cros ...)
+ {DSA-6556-1}
- nagios4 4.5.14+ds-1 (bug #1144495)
NOTE: Fixed by: https://github.com/NagiosEnterprises/nagioscore/commit/bcd4c2a4b5dfe51bdb2b227af8945ad8751a820d (nagios-4.5.14)
CVE-2026-48550 (Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable ...)
+ {DSA-6556-1}
- nagios4 4.5.14+ds-1 (bug #1144495)
NOTE: Fixed by: https://github.com/NagiosEnterprises/nagioscore/commit/acd2365e816dda4a8dce61709f8d3a3b4ab04a6f (nagios-4.5.14)
CVE-2026-47234 (Admidio is an open-source user management solution. Prior to version 5 ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fb894ce7ec5c0c8a1b75d3d43215a3c24932415e
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fb894ce7ec5c0c8a1b75d3d43215a3c24932415e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261013/6601b4a5/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list