[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 15 08:14:03 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
72ba1f9b by security tracker role at 2026-10-15T07:13:54+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,379 @@
+CVE-2026-96540 (An improper access control vulnerability has been identified in the So ...)
+ TODO: check
+CVE-2026-96537 (The Tutor LMS WordPress plugin before 4.1.1 does not perform a capabi ...)
+ TODO: check
+CVE-2026-93484 (Znuny through 7.3.6 constructs a ticket-search database query by direc ...)
+ TODO: check
+CVE-2026-93483 (In Znuny through 7.3.6, an attacker can bypass specific standard login ...)
+ TODO: check
+CVE-2026-92429 (The Rede Ita\xfa for WooCommerce WordPress plugin before 5.5.3 does no ...)
+ TODO: check
+CVE-2026-92428 (The Rede Ita\xfa for WooCommerce WordPress plugin before 5.5.3 does no ...)
+ TODO: check
+CVE-2026-88043 (The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-S ...)
+ TODO: check
+CVE-2026-86803 (The The Ocean Extra plugin for WordPress is vulnerable to arbitrary sh ...)
+ TODO: check
+CVE-2026-81534 (The Email Customizer for WooCommerce (Pro) plugin for WordPress is vul ...)
+ TODO: check
+CVE-2026-79822 (A security vulnerability inHPE NonStop TNS/X Native Inspect may cause ...)
+ TODO: check
+CVE-2026-79821 (A security vulnerability inHPE NonStop SOAP 4.0 may cause memory corr ...)
+ TODO: check
+CVE-2026-78087 (The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site ...)
+ TODO: check
+CVE-2026-78001 (The Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Edit ...)
+ TODO: check
+CVE-2026-77931 (MoviePilot through 3.1.5 contains a command injection vulnerability th ...)
+ TODO: check
+CVE-2026-77427 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-76668 (A security vulnerability inHPE NonStop Kernel may allow user space acc ...)
+ TODO: check
+CVE-2026-76667 (A security vulnerability inHPE NonStop EXPAND may result in out-of-bou ...)
+ TODO: check
+CVE-2026-76666 (A security vulnerability inHPE NonStop EXPAND may result in out-of-bou ...)
+ TODO: check
+CVE-2026-76665 (A security vulnerability inHPE NonStop EXPAND may cause out-of-bounds ...)
+ TODO: check
+CVE-2026-76664 (A security vulnerability inHPE NonStop EXPAND may result in out-of-bou ...)
+ TODO: check
+CVE-2026-76663 (A stack-based buffer overflow vulnerability inHPE NonStop TELSERV can ...)
+ TODO: check
+CVE-2026-76662 (A buffer overflow vulnerability inHPE NonStop TELSERV can cause memory ...)
+ TODO: check
+CVE-2026-76661 (A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write th ...)
+ TODO: check
+CVE-2026-76660 (A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write ...)
+ TODO: check
+CVE-2026-76659 (A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES c ...)
+ TODO: check
+CVE-2026-76656 (A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unaut ...)
+ TODO: check
+CVE-2026-76066 (IntentKit through 2.6.3 contains an authorization bypass vulnerability ...)
+ TODO: check
+CVE-2026-74920 (The Document Gallery WordPress plugin through 5.1.1 does not properly ...)
+ TODO: check
+CVE-2026-73799 (A security vulnerability inHPE NonStop SNMP Trap Multiplexer may cause ...)
+ TODO: check
+CVE-2026-71854 (OpenAEV is an open source platform allowing organizations to plan, sch ...)
+ TODO: check
+CVE-2026-69194 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-69193 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-69191 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-64856 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-62664 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-61844 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-61843 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-58100 (kqueue_fork_copy_knote() indexed into the child's file descriptor tabl ...)
+ TODO: check
+CVE-2026-58099 (When copying knotes from a parent kqueue to a child, the copy code did ...)
+ TODO: check
+CVE-2026-58098 (When semop(2) blocks waiting for a semaphore condition, it releases th ...)
+ TODO: check
+CVE-2026-57493 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-57492 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-57491 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-57490 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-57489 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-55684 (WeGIA is a web manager for charitable institutions. Prior to 3.8.6, th ...)
+ TODO: check
+CVE-2026-55683 (WeGIA is a web manager for charitable institutions. Prior to 3.8.6, th ...)
+ TODO: check
+CVE-2026-55682 (WeGIA is a web manager for charitable institutions. Prior to 3.8.6, th ...)
+ TODO: check
+CVE-2026-55681 (WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an ...)
+ TODO: check
+CVE-2026-55680 (WeGIA is a web manager for charitable institutions. Prior to 3.8.6, un ...)
+ TODO: check
+CVE-2026-55679 (WeGIA is a web manager for charitable institutions. Prior to 3.8.6, th ...)
+ TODO: check
+CVE-2026-55498 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-55387 (InvoiceShelf is an open-source web & mobile app that helps track expen ...)
+ TODO: check
+CVE-2026-55386 (InvoiceShelf is an open-source web & mobile app that helps track expen ...)
+ TODO: check
+CVE-2026-55385 (InvoiceShelf is an open-source web & mobile app that helps track expen ...)
+ TODO: check
+CVE-2026-55384 (InvoiceShelf is an open-source web & mobile app that helps track expen ...)
+ TODO: check
+CVE-2026-55383 (InvoiceShelf is an open-source web & mobile app that helps track expen ...)
+ TODO: check
+CVE-2026-55382 (InvoiceShelf is an open-source web & mobile app that helps track expen ...)
+ TODO: check
+CVE-2026-55381 (InvoiceShelf is an open-source web & mobile app that helps track expen ...)
+ TODO: check
+CVE-2026-54703 (Markdown Preview Enhanced is a Markdown preview extension for Visual S ...)
+ TODO: check
+CVE-2026-54702 (Markdown Preview Enhanced is a Markdown preview extension for Visual S ...)
+ TODO: check
+CVE-2026-54701 (Markdown Preview Enhanced is a Markdown preview extension for Visual S ...)
+ TODO: check
+CVE-2026-54566 (Markdown Preview Enhanced is a Markdown preview extension for Visual S ...)
+ TODO: check
+CVE-2026-3712 (The PhastPress plugin for WordPress is vulnerable to Server-Side Reque ...)
+ TODO: check
+CVE-2026-18586 (The Premium Packages \u2013 Sell Digital Products Securely plugin for ...)
+ TODO: check
+CVE-2026-18557 (The Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery plugin ...)
+ TODO: check
+CVE-2026-18548 (The Groundhogg \u2014 CRM, Newsletters, and Marketing Automation plugi ...)
+ TODO: check
+CVE-2026-17031 (The Checkout Field Manager (Checkout Manager) for WooCommerce plugin f ...)
+ TODO: check
+CVE-2026-17001 (The Import and export users and customers plugin for WordPress is vuln ...)
+ TODO: check
+CVE-2026-15180 (The Tracking Code Manager plugin for WordPress is vulnerable to Reflec ...)
+ TODO: check
+CVE-2026-15090 (The Link Library plugin for WordPress is vulnerable to time-based SQL ...)
+ TODO: check
+CVE-2026-14572 (The Kirki \u2013 Freeform Page Builder, Website Builder & Customizer p ...)
+ TODO: check
+CVE-2026-11905 (The Elementor Website Builder \u2013 more than just a page builder plu ...)
+ TODO: check
+CVE-2026-110934 (Improper validation of array index vulnerability in Samsung Open Sourc ...)
+ TODO: check
+CVE-2026-110933 (Uncaught exception vulnerability in Samsung Open Source Vyond allows I ...)
+ TODO: check
+CVE-2026-110926 (A flaw was found in OpenSSH. When compression is negotiated, channels ...)
+ TODO: check
+CVE-2026-110925 (A flaw was found in OpenSSH. A username entered on the ssh command lin ...)
+ TODO: check
+CVE-2026-110923 (A flaw was found in OpenSSH. During an sftp copy, a malicious server c ...)
+ TODO: check
+CVE-2026-110912 (In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers ...)
+ TODO: check
+CVE-2026-110911 (Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied q ...)
+ TODO: check
+CVE-2026-110909 (Wheels CLI through 4.1.0 does not verify that the local development se ...)
+ TODO: check
+CVE-2026-110908 (Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revis ...)
+ TODO: check
+CVE-2026-110907 (Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishan ...)
+ TODO: check
+CVE-2026-110904 (ApostropheCMS before 4.33.0 allows authentication bypass for REST API ...)
+ TODO: check
+CVE-2026-110873 (Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulner ...)
+ TODO: check
+CVE-2026-110872 (Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity d ...)
+ TODO: check
+CVE-2026-110871 (Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vuln ...)
+ TODO: check
+CVE-2026-110870 (Nodemailer from 3.0.0 before 10.0.13 contains an improper input valida ...)
+ TODO: check
+CVE-2026-110869 (Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of ser ...)
+ TODO: check
+CVE-2026-110868 (Renovate before 44.79.0 contains a server-side request forgery vulnera ...)
+ TODO: check
+CVE-2026-110867 (Renovate before 44.60.1 contains an allowlist bypass vulnerability tha ...)
+ TODO: check
+CVE-2026-110866 (Renovate before 44.61.3 contains a protection mechanism bypass vulnera ...)
+ TODO: check
+CVE-2026-110865 (Renovate before 44.60.1 contains an allowlist bypass vulnerability tha ...)
+ TODO: check
+CVE-2026-110864 (Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication ...)
+ TODO: check
+CVE-2026-110863 (Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an ...)
+ TODO: check
+CVE-2026-110862 (Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication ...)
+ TODO: check
+CVE-2026-110861 (Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 b ...)
+ TODO: check
+CVE-2026-110860 (GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw i ...)
+ TODO: check
+CVE-2026-110859 (GitPython before 3.2.0 contains an argument injection vulnerability in ...)
+ TODO: check
+CVE-2026-110858 (GitPython from 3.1.30 before 3.2.0 contains a remote code execution vu ...)
+ TODO: check
+CVE-2026-110857 (GitPython before 3.2.0 contains a remote code execution vulnerability ...)
+ TODO: check
+CVE-2026-110856 (GitPython before 3.2.0 contains a regular expression denial of service ...)
+ TODO: check
+CVE-2026-110855 (GitPython before 3.2.0 contains an information disclosure vulnerabilit ...)
+ TODO: check
+CVE-2026-110854 (Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not ha ...)
+ TODO: check
+CVE-2026-110853 (n8n before 1.123.83 contains an authorization bypass vulnerability tha ...)
+ TODO: check
+CVE-2026-110852 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 conta ...)
+ TODO: check
+CVE-2026-110851 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization b ...)
+ TODO: check
+CVE-2026-110850 (n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credentia ...)
+ TODO: check
+CVE-2026-110849 (n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site s ...)
+ TODO: check
+CVE-2026-110848 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 conta ...)
+ TODO: check
+CVE-2026-110847 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 conta ...)
+ TODO: check
+CVE-2026-110846 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass ...)
+ TODO: check
+CVE-2026-110845 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 conta ...)
+ TODO: check
+CVE-2026-110844 (n8n before 1.123.83 contains an authorization bypass vulnerability tha ...)
+ TODO: check
+CVE-2026-110843 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled re ...)
+ TODO: check
+CVE-2026-110842 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollut ...)
+ TODO: check
+CVE-2026-110841 (n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the a ...)
+ TODO: check
+CVE-2026-110840 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection v ...)
+ TODO: check
+CVE-2026-110839 (FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON ...)
+ TODO: check
+CVE-2026-110838 (FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs d ...)
+ TODO: check
+CVE-2026-110837 (FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP ...)
+ TODO: check
+CVE-2026-110836 (FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerabili ...)
+ TODO: check
+CVE-2026-110835 (FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy ...)
+ TODO: check
+CVE-2026-110834 (FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference v ...)
+ TODO: check
+CVE-2026-110833 (FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or ...)
+ TODO: check
+CVE-2026-110832 (FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerab ...)
+ TODO: check
+CVE-2026-110831 (FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention fla ...)
+ TODO: check
+CVE-2026-110830 (FreeRDP before 3.32.0 fails to close prior serial handles in serial_pr ...)
+ TODO: check
+CVE-2026-110829 (FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer deref ...)
+ TODO: check
+CVE-2026-110816 (### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `Type ...)
+ TODO: check
+CVE-2026-110810 (A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This ...)
+ TODO: check
+CVE-2026-110809 (A security vulnerability has been detected in sgl-project SGLang up to ...)
+ TODO: check
+CVE-2026-110807 (A weakness has been identified in sgl-project SGLang up to 0.5.19. Aff ...)
+ TODO: check
+CVE-2026-110698 (A security vulnerability has been detected in Praat up to 7.0.02. Affe ...)
+ TODO: check
+CVE-2026-110696 (A weakness has been identified in itsmeravitejak Online-Examination-Sy ...)
+ TODO: check
+CVE-2026-110695 (A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affec ...)
+ TODO: check
+CVE-2026-110694 (A vulnerability has been found in OAID Tengine up to 1.12.0. This vuln ...)
+ TODO: check
+CVE-2026-110689 (A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. ...)
+ TODO: check
+CVE-2026-110679 (A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impa ...)
+ TODO: check
+CVE-2026-110670 (A vulnerability was found in cemtan sar2html 4.0.0. The affected eleme ...)
+ TODO: check
+CVE-2026-110669 (A security vulnerability has been detected in cemtan sar2html 4.0.0. T ...)
+ TODO: check
+CVE-2026-110668 (A weakness has been identified in cemtan sar2html 4.0.0. Affected by t ...)
+ TODO: check
+CVE-2026-110310 (A remote user who can read encrypted objects in the S3 bucket can forc ...)
+ TODO: check
+CVE-2026-109430 (Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entit ...)
+ TODO: check
+CVE-2026-109145 (The User Rights Access Manager WordPress plugin through 1.1.3 does not ...)
+ TODO: check
+CVE-2026-108587 (The 10Web Booster \u2013 Website speed optimization, Cache & Page Spee ...)
+ TODO: check
+CVE-2026-108337 (An administrator could retrieve the password reset code for any user a ...)
+ TODO: check
+CVE-2026-108336 (When the default self-signed certificate is used, an attacker could ga ...)
+ TODO: check
+CVE-2026-108335 (When the password reset functionality is enabled, and email is configu ...)
+ TODO: check
+CVE-2026-107795 (Omada Controller's MSP and OpenAPI certificate/private-key management ...)
+ TODO: check
+CVE-2026-106485
+ REJECTED
+CVE-2026-106068
+ REJECTED
+CVE-2026-106031 (The Spin Wheel WordPress plugin before 2.2.1 does not verify that a v ...)
+ TODO: check
+CVE-2026-106006
+ REJECTED
+CVE-2026-105627
+ REJECTED
+CVE-2026-104643 (The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does no ...)
+ TODO: check
+CVE-2026-104110 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-104109 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-104108 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-104107 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-104106 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-104105 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-103988 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-103977 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
+ TODO: check
+CVE-2026-103324 (The Cardinity Payment Gateway for WooCommerce WordPress plugin before ...)
+ TODO: check
+CVE-2026-103304 (The eaSYNC Booking WordPress plugin before 1.3.31 does not perform au ...)
+ TODO: check
+CVE-2026-102986 (Plane is an open-source project management tool. In 1.3.1 and earlier, ...)
+ TODO: check
+CVE-2026-102985 (Plane is an open-source project management tool. In 1.3.1 and earlier, ...)
+ TODO: check
+CVE-2026-102980 (Plane is an open-source project management tool. Prior to 1.4.0, PageV ...)
+ TODO: check
+CVE-2026-102298 (In Omada Controller MSP mode, the user-confirmation endpoint fails to ...)
+ TODO: check
+CVE-2026-101306 (SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH ...)
+ TODO: check
+CVE-2026-101305 (renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory argume ...)
+ TODO: check
+CVE-2026-101304 (When fdescfs(4) was mounted in a jail with the "nodup" option, opening ...)
+ TODO: check
+CVE-2026-101302 (TLS 1.3 embeds the actual record type as the last non-zero byte of the ...)
+ TODO: check
+CVE-2026-100232 (Post-authentication Improper Neutralization of Special Elements used i ...)
+ TODO: check
+CVE-2026-0993 (SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer ove ...)
+ TODO: check
+CVE-2026-0321 (Denial of service vulnerabilities in Palo Alto Networks PAN-OS\xae sof ...)
+ TODO: check
+CVE-2026-0320 (A command injection vulnerability in Palo Alto Networks PAN-OS\xae sof ...)
+ TODO: check
+CVE-2026-0319 (An improper input handling vulnerability in the GlobalProtect\u2122 ga ...)
+ TODO: check
+CVE-2026-0318 (A stack-based buffer overflow vulnerability in the log processing func ...)
+ TODO: check
+CVE-2026-0317 (A denial of service vulnerability in Palo Alto Networks PAN-OS softwar ...)
+ TODO: check
+CVE-2026-0316 (A stored cross-site scripting (XSS) vulnerability in Palo Alto Network ...)
+ TODO: check
+CVE-2026-0315 (A local privilege escalation vulnerability in the Palo Alto Networks G ...)
+ TODO: check
+CVE-2026-0314 (A type confusion vulnerability in Palo Alto Networks GlobalProtect\u21 ...)
+ TODO: check
+CVE-2026-0313 (A command injection vulnerability in Palo Alto Networks Cortex XSOAR a ...)
+ TODO: check
+CVE-2026-0312 (Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma ...)
+ TODO: check
+CVE-2026-0311 (A server-side request forgery vulnerability in Palo Alto Networks Chec ...)
+ TODO: check
+CVE-2025-29895 (A NULL pointer dereference vulnerability has been reported to affect Q ...)
+ TODO: check
CVE-2026-XXXX [BUG/MAJOR: mux-h2: properly handle short reads on PING frames]
- haproxy 3.2.26-1
NOTE: Fixed by: https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=dc338d875ec907f18143ee369552658b750b7297 (v3.2.16)
@@ -379,7 +755,7 @@ CVE-2026-110761 (ILIAS before 9.24, 10.12, and 11.5 contains a PHP object inject
TODO: check
CVE-2026-110736 (Godot Engine through 4.7.2 has an out-of-bounds read in the optimized ...)
TODO: check
-CVE-2026-110735 (Godot Engine through 4.7.2 has a heap out-of-bounds write exists in th ...)
+CVE-2026-110735 (Godot Engine through 4.7.2 has a heap out-of-bounds write in the binar ...)
TODO: check
CVE-2026-110734 (Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radia ...)
TODO: check
@@ -35331,7 +35707,7 @@ CVE-2026-57847
REJECTED
CVE-2026-57846
REJECTED
-CVE-2026-55946 (Improper neutralization of special elements used in a command ('comman ...)
+CVE-2026-55946 (Ai command injection in Microsoft Copilot allows an unauthorized attac ...)
NOT-FOR-US: Microsoft
CVE-2026-54918 (NetBox Device Type Library is a collection of community-sourced device ...)
NOT-FOR-US: NetBox Device Type Library
@@ -53055,7 +53431,7 @@ CVE-2026-78462 (Authorization bypass through user-controlled key in Visual Studi
NOT-FOR-US: Microsoft
CVE-2026-78461 (Improper limitation of a pathname to a restricted directory ('path tra ...)
NOT-FOR-US: Microsoft
-CVE-2026-78457 (Use after free in Windows Security Health Service allows an authorized ...)
+CVE-2026-78457 (Use after free in Windows Security App allows an authorized attacker t ...)
NOT-FOR-US: Microsoft
CVE-2026-78456 (Heap-based buffer overflow in SQL Server allows an authorized attacker ...)
NOT-FOR-US: Microsoft
@@ -53470,7 +53846,7 @@ CVE-2026-72927 (Heap-based buffer overflow in Winsock allows an authorized attac
NOT-FOR-US: Microsoft
CVE-2026-72926 (Use after free in Windows Internet Connection Sharing (ICS) allows an ...)
NOT-FOR-US: Microsoft
-CVE-2026-72923 (In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and ...)
+CVE-2026-72923 (The OpenAPI.NET SDK contains a useful object model for OpenAPI documen ...)
NOT-FOR-US: Microsoft
CVE-2026-71377 (Command Argument Injection Vulnerability in Cosminexus Component Conta ...)
NOT-FOR-US: Hitachi
@@ -138493,7 +138869,7 @@ CVE-2025-60223 (Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbo
NOT-FOR-US: WordPress plugin or theme
CVE-2025-60218 (Subscriber Arbitrary File Upload in PT Luxa Addons <= 1.2.2 versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2025-60205 (Unauthenticated PHP Object Injection in ThemeREX Addons <= 2.36.1.1 ve ...)
+CVE-2025-60205 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Them ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-59872 (HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerabili ...)
NOT-FOR-US: HCL
@@ -143212,7 +143588,7 @@ CVE-2025-66273 (A command injection vulnerability has been reported to affect se
NOT-FOR-US: QNAP
CVE-2025-62851 (A path traversal vulnerability has been reported to affect License Cen ...)
NOT-FOR-US: QNAP
-CVE-2025-62850 (A NULL pointer dereference vulnerability has been reported to affect s ...)
+CVE-2025-62850 (A NULL pointer dereference vulnerability has been reported to affect Q ...)
NOT-FOR-US: QNAP
CVE-2025-59382 (QTS, QuTS hero, QuTScloud are not affected. We have already fixed the ...)
NOT-FOR-US: QNAP
@@ -176981,7 +177357,7 @@ CVE-2026-25775 (A vulnerability inSenseLiveX3050\u2019s remote management servic
NOT-FOR-US: SenseLive
CVE-2026-25720 (A vulnerability exists inSenseLive X3050\u2019s web management interf ...)
NOT-FOR-US: SenseLive
-CVE-2026-24303 (Improper access control in Microsoft Partner Center allows an authoriz ...)
+CVE-2026-24303 (Improper certificate validation in Microsoft Partner Center allows an ...)
NOT-FOR-US: Microsoft
CVE-2026-1952 (Delta Electronics AS320T has denial of service via the undocumented su ...)
NOT-FOR-US: Delta Electronics
@@ -182054,7 +182430,7 @@ CVE-2026-33095 (Use after free in Microsoft Office Word allows an unauthorized a
NOT-FOR-US: Microsoft
CVE-2026-32226 (Concurrent execution using shared resource with improper synchronizati ...)
NOT-FOR-US: Microsoft
-CVE-2026-32225 (Protection mechanism failure in Windows Shell allows an unauthorized a ...)
+CVE-2026-32225 (Improper neutralization of special elements used in a command ('comman ...)
NOT-FOR-US: Microsoft
CVE-2026-32224 (Use after free in Windows Server Update Service allows an authorized a ...)
NOT-FOR-US: Microsoft
@@ -190112,7 +190488,7 @@ CVE-2026-4819 (In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit lo
NOT-FOR-US: Search Guard FLX
CVE-2026-4818 (In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an i ...)
NOT-FOR-US: Search Guard FLX
-CVE-2026-4800 (Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHS ...)
+CVE-2026-4800 (The fix for CVE-2021-23337 added validation for the variable option in ...)
{DLA-4820-1 DLA-4663-1}
- node-lodash 4.18.1+dfsg-1 (bug #1132500)
[trixie] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
@@ -190519,7 +190895,7 @@ CVE-2026-30277 (An arbitrary file overwrite vulnerability in PDF Reader App : TA
NOT-FOR-US: TA/UTAX Mobile Print
CVE-2026-30276 (An arbitrary file overwrite vulnerability in DeftPDF Document Translat ...)
NOT-FOR-US: DeftPDF
-CVE-2026-2950 (Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototy ...)
+CVE-2026-2950 (The _.unset and _.omit functions in Lodash are vulnerable to prototype ...)
{DLA-4820-1 DLA-4663-1}
- node-lodash 4.18.1+dfsg-1
[trixie] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
@@ -218073,7 +218449,7 @@ CVE-2026-22224 (A command injection vulnerability may be exploited after the adm
NOT-FOR-US: TP-Link
CVE-2026-22223 (An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and ...)
NOT-FOR-US: TP-Link
-CVE-2026-22222 (An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web ...)
+CVE-2026-22222 (An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and ...)
NOT-FOR-US: TP-Link
CVE-2026-22221 (An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn ...)
NOT-FOR-US: TP-Link
@@ -222529,7 +222905,7 @@ CVE-2025-13878 (Malformed BRID/HHIT records can cause `named` to terminate unexp
NOTE: Fixed by: https://gitlab.isc.org/isc-projects/bind9/-/commit/d556bde1231edf81427d577e35f48f764b6a37b8 (v9.18.44)
NOTE: Fixed by: https://gitlab.isc.org/isc-projects/bind9/-/commit/d4c0d617015625330f08a3f86a10a533cec0f6ec (v9.20.18)
NOTE: Fixed by: https://gitlab.isc.org/isc-projects/bind9/-/commit/7bf83f69a80bdc6094c2adee3595e28b1b3e19ea (v9.21.17)
-CVE-2025-13465 (Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype poll ...)
+CVE-2025-13465 (The _.unset and _.omit functions in Lodash are vulnerable to prototype ...)
{DLA-4820-1 DLA-4663-1}
- node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-10 (bug #1126265)
[trixie] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72ba1f9ba9a6afb66cda0e2b17b85f219136b2e9
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72ba1f9ba9a6afb66cda0e2b17b85f219136b2e9
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261015/47924954/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list