[Git][security-tracker-team/security-tracker][master] bugnums
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Wed Oct 14 15:36:29 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
b7562917 by Moritz Muehlenhoff at 2026-10-14T16:36:08+02:00
bugnums
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -579,7 +579,7 @@ CVE-2026-94512 (Heap-based buffer overflow in SQL Server allows an authorized at
CVE-2026-94506 (Out-of-bounds read in Microsoft Office Access allows an unauthorized a ...)
NOT-FOR-US: Microsoft
CVE-2026-94453 (Libreswan's pluto daemon has a use-after-free vulnerability when a cli ...)
- - libreswan <unfixed>
+ - libreswan <unfixed> (bug #1150899)
NOTE: https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt
NOTE: https://libreswan.org/security/CVE-2026-94453/
CVE-2026-94377 (The Verified Reviews (Avis V\xe9rifi\xe9s) plugin for WordPress is vul ...)
@@ -1953,15 +1953,15 @@ CVE-2026-77816 (IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0
CVE-2026-77496 (Heap-based buffer overflow in Windows Imaging Component allows an unau ...)
NOT-FOR-US: Microsoft
CVE-2026-77207 (Libreswan has a null pointer dereference bug in the PKCS#7 handling co ...)
- - libreswan <unfixed>
+ - libreswan <unfixed> (bug #1150899)
NOTE: https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt
NOTE: https://libreswan.org/security/CVE-2026-77207/
CVE-2026-77206 (Libreswan's IKEv2 state machine has a null pointer dereference bug in ...)
- - libreswan <unfixed>
+ - libreswan <unfixed> (bug #1150899)
NOTE: https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt
NOTE: https://libreswan.org/security/CVE-2026-77206/
CVE-2026-77205 (Libreswan in FIPS mode has a vulnerability where badly formed received ...)
- - libreswan <unfixed>
+ - libreswan <unfixed> (bug #1150899)
NOTE: https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt
NOTE: https://libreswan.org/security/CVE-2026-77205/
CVE-2026-77114 (The Document Gallery plugin for WordPress is vulnerable to Stored Cros ...)
@@ -4053,12 +4053,12 @@ CVE-2026-52394 (DeepSeek V4 is vulnerable to Incorrect Access Control via a craf
CVE-2026-4869 (A potential privilege escalation issue was identified in InstallShield ...)
NOT-FOR-US: InstallShield
CVE-2026-49265 (OAuthLib is an implementation of the OAuth request-signing logic for P ...)
- - python-oauthlib <unfixed>
+ - python-oauthlib <unfixed> (bug #1150908)
NOTE: https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv
NOTE: https://github.com/oauthlib/oauthlib/pull/963
NOTE: https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0 (v4.0.0)
CVE-2026-49264 (OAuthLib is an implementation of the OAuth request-signing logic for P ...)
- - python-oauthlib <unfixed>
+ - python-oauthlib <unfixed> (bug #1150908)
NOTE: https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v
NOTE: https://github.com/oauthlib/oauthlib/pull/951
NOTE: https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c (v4.0.0)
@@ -4253,7 +4253,7 @@ CVE-2026-110025 (A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3.
CVE-2026-10759 (A flaw in Portal for ArcGIS could allow LDAP injection through adminis ...)
NOT-FOR-US: Esri
CVE-2026-109976 (A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-s ...)
- - clevis <unfixed>
+ - clevis <unfixed> (bug #1150905)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2550375
CVE-2026-109967 (yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulner ...)
NOT-FOR-US: yt-dlp-web-ui
@@ -4281,7 +4281,7 @@ CVE-2026-109958 (EspoCRM 4.0.0 before 10.0.7 contains an improper access control
CVE-2026-109957 (EspoCRM before 10.0.7 contains an insecure direct object reference vul ...)
NOT-FOR-US: EspoCRM
CVE-2026-109956 (NLTK through 3.10.3 contains a path traversal vulnerability in WekaCla ...)
- - nltk <unfixed>
+ - nltk <unfixed> (bug #1150904)
NOTE: https://github.com/nltk/nltk/security/advisories/GHSA-j456-xh4h-cpf2
NOTE: https://github.com/nltk/nltk/pull/3863
NOTE: https://github.com/nltk/nltk/commit/6a17606293fe9d3ea1006f99dd3fed2e2b25d519
@@ -4360,7 +4360,7 @@ CVE-2026-109896 (Missing Authorization vulnerability in WP Chill Download Monito
CVE-2026-109890 (Missing Authorization vulnerability in LeapWorx Premium Addons for Ele ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-109854 (A flaw was found in m17n-lib. An attacker who supplies crafted input t ...)
- - m17n-lib <unfixed>
+ - m17n-lib <unfixed> (bug #1150903)
[trixie] - m17n-lib <no-dsa> (Minor issue)
NOTE: https://lists.gnu.org/archive/html/m17n-list/2026-10/msg00001.html
NOTE: https://cgit.git.savannah.nongnu.org/cgit/m17n/m17n-lib.git/commit/?id=f3b85087f90189f91c04ba1b62c5f0b879ff2b20
@@ -4584,7 +4584,7 @@ CVE-2026-106034 (A Path Traversal vulnerability in Ivanti Xtraction before versi
CVE-2026-105881 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-105460 (A flaw was found in BlueZ. An out-of-bounds read vulnerability exists ...)
- - bluez <unfixed>
+ - bluez <unfixed> (bug #1150900)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2545923
CVE-2026-105445 (An Incorrect Privilege Assignment vulnerability in Docker Hub's accoun ...)
TODO: check
@@ -4669,7 +4669,7 @@ CVE-2026-102832 (JupyterLab is an extensible environment for interactive and rep
- jupyterlab <not-affected> (Vulnerable code introduced later in 4.5.7)
NOTE: https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-jwrc-gm9j-263p
CVE-2026-102734 (asteval is a Python expression evaluator designed for restricted execu ...)
- - python-asteval <unfixed>
+ - python-asteval <unfixed> (bug #1150909)
NOTE: https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx
NOTE: https://github.com/lmfit/asteval/pull/153
NOTE: Fixed by (merge): https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4 (1.0.9)
@@ -4699,7 +4699,7 @@ CVE-2026-102073 (A vulnerability has been identified in APOGEE MBC (PPC) (BACnet
CVE-2026-102007 (The Bit integrations \u2013 Form Integration, Webhook, Spreadsheets, C ...)
NOT-FOR-US: WordPress plugin
CVE-2026-101899 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
- - node-axios <unfixed>
+ - node-axios <unfixed> (bug #1150906)
[trixie] - node-axios <not-affected> (Vulnerable code not present, introduced in 1.15)
[bookworm] - node-axios <not-affected> (Vulnerable code not present, introduced in 1.15)
NOTE: https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx
@@ -6673,9 +6673,9 @@ CVE-2026-105283 (Generation of Error Message Containing Sensitive Information vu
CVE-2026-105280 (Improper Validation of Integrity Check Value vulnerability in hexpm he ...)
TODO: check
CVE-2026-105274 (Improper Handling of Highly Compressed Data (Data Amplification) vulne ...)
- - rebar3 <unfixed>
+ - rebar3 <unfixed> (bug #1150901)
[trixie] - rebar3 <no-dsa> (Minor issue)
- - erlang-hex <unfixed>
+ - erlang-hex <unfixed> (bug #1150902)
[trixie] - erlang-hex <not-affected> (Vulnerable code not present)
[bookworm] - erlang-hex <not-affected> (Vulnerable code not present)
NOTE: https://github.com/hexpm/hex_core/security/advisories/GHSA-7c4r-cgf9-9jmq
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b756291721f4af44462a30affcf0184504e5ee2f
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b756291721f4af44462a30affcf0184504e5ee2f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261014/dac51c3e/attachment.htm>
More information about the debian-security-tracker-commits
mailing list