[Git][security-tracker-team/security-tracker][master] bugnums

Moritz Muehlenhoff (@jmm) jmm at debian.org
Wed Oct 14 22:39:59 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
cec43dc0 by Moritz Muehlenhoff at 2026-10-14T23:36:35+02:00
bugnums

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -5077,15 +5077,15 @@ CVE-2026-95122 (mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in
 CVE-2026-95121 (An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code v ...)
 	- mp4v2 <removed>
 CVE-2026-95117 (Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows  ...)
-	- jsmn <unfixed>
+	- jsmn <unfixed> (bug #1150931)
 	NOTE: https://github.com/zserge/jsmn/issues/249
 	NOTE: https://github.com/zserge/jsmn/pull/250
 CVE-2026-95115 (Buffer Overflow vulnerability in libwebsockets main 106d542c allows a  ...)
-	- libwebsockets <unfixed>
+	- libwebsockets <unfixed> (bug #1150938)
 	NOTE: https://github.com/warmcat/libwebsockets/issues/3663
 	NOTE: https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a
 CVE-2026-95114 (libwebsockets contains an out-of-bounds read vulnerability in the LEJP ...)
-	- libwebsockets <unfixed>
+	- libwebsockets <unfixed> (bug #1150938)
 	NOTE: https://github.com/warmcat/libwebsockets/issues/3664
 	NOTE: https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a
 CVE-2026-94410 (A low privileged remote attacker is able to view a list of roles that  ...)
@@ -5147,12 +5147,12 @@ CVE-2026-89196 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All v
 CVE-2026-89097 (The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for WordPress i ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-88838 (A flaw was found in BusyBox's mount utility. A non-root user can bypas ...)
-	- busybox <unfixed>
+	- busybox <unfixed> (bug #1150940)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531352
 CVE-2026-88836
 	REJECTED
 CVE-2026-88834 (A flaw was found in BusyBox's httpd web server. When configured with s ...)
-	- busybox <unfixed>
+	- busybox <unfixed> (bug #1150941)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531348
 CVE-2026-88833 (A flaw was found in BusyBox's udhcpc DHCP client. When processing raw  ...)
 	- busybox <unfixed>
@@ -5404,7 +5404,7 @@ CVE-2026-110239 (Rapyd Admin before 9.20.0 contains a stored cross-site scriptin
 CVE-2026-110238 (Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass  ...)
 	NOT-FOR-US: Rapyd Admin
 CVE-2026-110237 (Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the s ...)
-	- vifm <unfixed>
+	- vifm <unfixed> (bug #1150939)
 CVE-2026-110236 (KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection v ...)
 	- dolphin <unfixed>
 	NOTE: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJCMaGsizg
@@ -7039,7 +7039,7 @@ CVE-2026-109565 (Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-si
 CVE-2026-109564 (LearnHouse before 1.4.0 contains a missing authorization vulnerability ...)
 	NOT-FOR-US: LearnHouse
 CVE-2026-109563 (N3.js before 2.11.1 contains a regular expression denial of service vu ...)
-	- node-n3 <unfixed>
+	- node-n3 <unfixed> (bug #1150935)
 	NOTE: https://github.com/rdfjs/N3.js/pull/760
 	NOTE: Fixed by: https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d (v2.11.1)
 CVE-2026-109562 (SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulne ...)
@@ -7059,7 +7059,7 @@ CVE-2026-109427 (Telegram-Stremio through 5.1.0 contains a broken object-level a
 CVE-2026-109426 (Telegram-Stremio through 5.1.0 contains an insecure storage vulnerabil ...)
 	NOT-FOR-US: Telegram-Stremio
 CVE-2026-109425 (Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validati ...)
-	- golang-github-tink-crypto-tink-go <unfixed>
+	- golang-github-tink-crypto-tink-go <unfixed> (bug #1150934)
 	NOTE: https://github.com/tink-crypto/tink-go/issues/68
 CVE-2026-109424 (NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.3 ...)
 	NOT-FOR-US: NetEase Cloud Music client for Windows
@@ -7907,9 +7907,11 @@ CVE-2026-108835 (A flaw has been found in Yungengxin Yun Jia Security Guard up t
 CVE-2026-108834 (A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This  ...)
 	NOT-FOR-US: Cairo-dock Glx-Dock
 CVE-2026-108831 (A security vulnerability has been detected in meetecho janus-gateway u ...)
-	- janus <unfixed>
+	- janus <unfixed> (unimportant)
+	NOTE: Only affects demo application
 CVE-2026-108830 (A weakness has been identified in meetecho janus-gateway up to 1.4.2.  ...)
-	- janus <unfixed>
+	- janus <unfixed> (bug #1150933)
+	NOTE: https://github.com/meetecho/janus-gateway/commit/27c0d1af888153e818675b56a4e6267f62d57097
 CVE-2026-108829 (A security flaw has been discovered in Zen Cart up to 2.2.2. Affected  ...)
 	NOT-FOR-US: Zen Cart
 CVE-2026-108828 (A vulnerability was identified in Zen Cart 2.2.2. Affected by this vul ...)
@@ -7923,7 +7925,7 @@ CVE-2026-108825 (A vulnerability has been found in yangzongzhuan RuoYi up to 4.8
 CVE-2026-108824 (A flaw has been found in DataEase up to 3.0.0. The impacted element is ...)
 	NOT-FOR-US: DataEase
 CVE-2026-108822 (A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. The affect ...)
-	- kamailio <unfixed>
+	- kamailio <unfixed> (bug #1150937)
 	NOTE: https://github.com/kamailio/kamailio/pull/4905
 	NOTE: Fixed by: https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21
 CVE-2026-108821 (A security vulnerability has been detected in Tencent WeKnora up to 0. ...)
@@ -7969,7 +7971,7 @@ CVE-2026-108475 (Missing Authorization vulnerability in VideoWhisper.com Broadca
 CVE-2026-108168 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-108094 (A use-after-free flaw was found in mutter in the Wayland color-managem ...)
-	- mutter <unfixed>
+	- mutter <unfixed> (bug #1150932)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2549511
 	NOTE: https://gitlab.gnome.org/GNOME/mutter/-/issues/5025
 	NOTE: https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/5313
@@ -8000,7 +8002,7 @@ CVE-2026-107418 (Missing Authorization vulnerability in Arraytics Booktics bookt
 CVE-2026-107248 (Thelia 3.0.0's back-office Email/Messages feature contains a server\u2 ...)
 	NOT-FOR-US: Thelia
 CVE-2026-107226 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- async-http-client <unfixed> (bug #1150936)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-p2jm-6hj6-9rjg
 	NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1 (async-http-client-project-3.0.14)
 CVE-2026-106605 (Improper Validation of Specified Quantity in Input vulnerability in WP ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cec43dc02a5960ce3bb8917e6f4c8df854e696bf

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cec43dc02a5960ce3bb8917e6f4c8df854e696bf
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261014/1a584431/attachment.htm>

More information about the debian-security-tracker-commits mailing list