[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 16 08:25:06 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
4309abf2 by security tracker role at 2026-10-16T07:14:14+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,4 +1,540 @@
-CVE-2026-104715
+CVE-2026-97640 (The WPConsent \u2013 Cookie Banner & Cookie Consent for Privacy Compli ...)
+ TODO: check
+CVE-2026-97339 (The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is ...)
+ TODO: check
+CVE-2026-97296 (Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc G ...)
+ TODO: check
+CVE-2026-96806 (The Apache Airflow Keycloak auth manager did not end the session on lo ...)
+ TODO: check
+CVE-2026-96570 (The Schema & Structured Data for WP & AMP plugin for WordPress is vuln ...)
+ TODO: check
+CVE-2026-96562 (The The Broken Link Checker plugin for WordPress is vulnerable to arbi ...)
+ TODO: check
+CVE-2026-96339 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-95809 (The Opti-Behavior \u2013 Self-Hosted Heatmaps, Session Recordings, Fun ...)
+ TODO: check
+CVE-2026-95686 (The Opti-Behavior \u2013 Self-Hosted Heatmaps, Session Recordings, Fun ...)
+ TODO: check
+CVE-2026-94388 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-94169 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
+ TODO: check
+CVE-2026-94135 (The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger ...)
+ TODO: check
+CVE-2026-94134 (The Apache Airflow SSH provider hook disables SSH host-key verificatio ...)
+ TODO: check
+CVE-2026-93953 (The Backuply \u2013 Backup, Restore, Migrate and Clone plugin for Word ...)
+ TODO: check
+CVE-2026-93767 (The Tainacan plugin for WordPress is vulnerable to Directory Traversal ...)
+ TODO: check
+CVE-2026-93535 (The Dark Mode \u2013 Improve Accessibility with AI Powered Dark Theme ...)
+ TODO: check
+CVE-2026-92777 (A potential vulnerability was reported in some Lenovo Tablets that cou ...)
+ TODO: check
+CVE-2026-92629 (A potential improper authorization vulnerability was reported in Lenov ...)
+ TODO: check
+CVE-2026-92553 (The YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking & Reports pl ...)
+ TODO: check
+CVE-2026-92427 (The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does ...)
+ TODO: check
+CVE-2026-92228 (The Apache Airflow Keycloak provider's multi-team provisioning (`_atta ...)
+ TODO: check
+CVE-2026-92115 (The WP Photo Album Plus plugin for WordPress is vulnerable to authenti ...)
+ TODO: check
+CVE-2026-91833 (The WX Subscribe \u5fae\u4fe1\u652f\u4ed8\u4ed8\u8d39\u8ba2\u9605 Wor ...)
+ TODO: check
+CVE-2026-91830 (The Subscribe to Comments WordPress plugin before 2.3.3 does not sign ...)
+ TODO: check
+CVE-2026-8311
+ REJECTED
+CVE-2026-89280 (The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2 ...)
+ TODO: check
+CVE-2026-89079 (The Theme My Login plugin for WordPress is vulnerable to privilege esc ...)
+ TODO: check
+CVE-2026-89062 (A potential out-of-bounds write vulnerability was reported in the Leno ...)
+ TODO: check
+CVE-2026-89057 (A potential authentication bypass vulnerability was reported in some L ...)
+ TODO: check
+CVE-2026-89051 (The WP Ghost (Hide My WP Ghost) \u2013 Security & Firewall plugin for ...)
+ TODO: check
+CVE-2026-88963 (The Tutor LMS \u2013 eLearning and online course solution plugin for W ...)
+ TODO: check
+CVE-2026-85659 (The PilotPress plugin for WordPress is vulnerable to Privilege Escalat ...)
+ TODO: check
+CVE-2026-84823 (A flaw was found in WildFly. A user with the `Monitor` role, which is ...)
+ TODO: check
+CVE-2026-77829 (The Cooked \u2013 Recipe Management plugin for WordPress is vulnerable ...)
+ TODO: check
+CVE-2026-75941 (A potential vulnerability was reported in the Lenovo Legion Zone appli ...)
+ TODO: check
+CVE-2026-74923 (The Document Gallery WordPress plugin through 5.1.1 does not perform a ...)
+ TODO: check
+CVE-2026-5819
+ REJECTED
+CVE-2026-45165 (An authorization flaw in Idira Conjur version 13.9.0 allows an authent ...)
+ TODO: check
+CVE-2026-36436 (An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credenti ...)
+ TODO: check
+CVE-2026-2937
+ REJECTED
+CVE-2026-19867 (Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11 ...)
+ TODO: check
+CVE-2026-19798 (The Wp Map Block plugin for WordPress is vulnerable to unauthorized mo ...)
+ TODO: check
+CVE-2026-19603 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7 ...)
+ TODO: check
+CVE-2026-19601 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7 ...)
+ TODO: check
+CVE-2026-19541 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7 ...)
+ TODO: check
+CVE-2026-18795 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11 ...)
+ TODO: check
+CVE-2026-18551 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11 ...)
+ TODO: check
+CVE-2026-16755 (A potential vulnerability was reported in Lenovo Smart Camera C33, dis ...)
+ TODO: check
+CVE-2026-16754 (A potential improper certificate validation vulnerability was reported ...)
+ TODO: check
+CVE-2026-15222 (The The User Registration & Membership \u2013 Free & Paid Memberships, ...)
+ TODO: check
+CVE-2026-12272 (The Lightweight Cookie Notice \u2013 Cookie Banner for Cookie Consent ...)
+ TODO: check
+CVE-2026-111458 (The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates ...)
+ TODO: check
+CVE-2026-111451 (Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes cal ...)
+ TODO: check
+CVE-2026-111450 (Wheels through 4.1.1 derives its default production error-email addres ...)
+ TODO: check
+CVE-2026-111449 (Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allow ...)
+ TODO: check
+CVE-2026-111448 (Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-c ...)
+ TODO: check
+CVE-2026-111447 (Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted ...)
+ TODO: check
+CVE-2026-111446 (Wheels 4.0.0 through 4.1.2 exposes password-less development tools und ...)
+ TODO: check
+CVE-2026-111445 (Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope condit ...)
+ TODO: check
+CVE-2026-111444 (Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backsl ...)
+ TODO: check
+CVE-2026-111443 (Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a req ...)
+ TODO: check
+CVE-2026-111442 (Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does n ...)
+ TODO: check
+CVE-2026-111389 (Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before ...)
+ TODO: check
+CVE-2026-111388 (Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enfo ...)
+ TODO: check
+CVE-2026-111387 (Nezha from 2.2.5 before 2.3.15 contains an information disclosure vuln ...)
+ TODO: check
+CVE-2026-111386 (Nezha from 1.7.0 before 2.3.15 contains an information disclosure vuln ...)
+ TODO: check
+CVE-2026-111385 (Nezha from 2.1.0 before 2.3.15 contains a host header injection vulner ...)
+ TODO: check
+CVE-2026-111384 (Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability i ...)
+ TODO: check
+CVE-2026-111383 (Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnera ...)
+ TODO: check
+CVE-2026-111382 (FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write ...)
+ TODO: check
+CVE-2026-111381 (FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in ...)
+ TODO: check
+CVE-2026-111380 (FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the ...)
+ TODO: check
+CVE-2026-111379 (FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in ...)
+ TODO: check
+CVE-2026-111378 (FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource con ...)
+ TODO: check
+CVE-2026-111377 (FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vuln ...)
+ TODO: check
+CVE-2026-111376 (FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read v ...)
+ TODO: check
+CVE-2026-111375 (FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulner ...)
+ TODO: check
+CVE-2026-111374 (FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulne ...)
+ TODO: check
+CVE-2026-111373 (FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerabilit ...)
+ TODO: check
+CVE-2026-111369 (ClassroomIO through 1.0.0 contains an incorrect authorization vulnerab ...)
+ TODO: check
+CVE-2026-111368 (ClassroomIO through 1.0.0 contains an insecure direct object reference ...)
+ TODO: check
+CVE-2026-111367 (BillionMail through 4.9 contains a hard-coded cryptographic key vulner ...)
+ TODO: check
+CVE-2026-111366 (cool-admin-midway through 8.0.0 contains an authorization bypass vulne ...)
+ TODO: check
+CVE-2026-111365 (cool-admin-midway through 8.0.0 contains an authorization bypass vulne ...)
+ TODO: check
+CVE-2026-111364 (MinDoc through 2.2-beta.2 contains an insecure direct object reference ...)
+ TODO: check
+CVE-2026-111363 (BISHENG through 3.0.0-beta4 contains an insecure direct object referen ...)
+ TODO: check
+CVE-2026-111359 (CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference ...)
+ TODO: check
+CVE-2026-111358 (SendPortal sendportal-core through 4.0.1 contains an authorization byp ...)
+ TODO: check
+CVE-2026-111357 (Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsin ...)
+ TODO: check
+CVE-2026-111356 (MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-d ...)
+ TODO: check
+CVE-2026-111355 (zhontai Admin.Core through 10.1.0 contains an authorization bypass vul ...)
+ TODO: check
+CVE-2026-111354 (crmeb_java through 3.1 contains an authorization bypass vulnerability ...)
+ TODO: check
+CVE-2026-111353 (Peppermint through 0.5.5 contains a missing authorization vulnerabilit ...)
+ TODO: check
+CVE-2026-111352 (ThinkCMF through 8.0.1 contains an incorrect authorization vulnerabili ...)
+ TODO: check
+CVE-2026-111351 (metasfresh through 5.175 contains a missing record-level authorization ...)
+ TODO: check
+CVE-2026-111350 (Papermark through 0.22.0 contains a missing authorization vulnerabilit ...)
+ TODO: check
+CVE-2026-111349 (Craftplan through 0.7.5 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-111348 (Likeshop through 3.5.1 contains an insecure direct object reference vu ...)
+ TODO: check
+CVE-2026-111347 (go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, publi ...)
+ TODO: check
+CVE-2026-111346 (ZenTao PMS through 22.6 contains an authorization bypass vulnerability ...)
+ TODO: check
+CVE-2026-111345 (Trudesk through 1.2.11 contains an authorization bypass vulnerability ...)
+ TODO: check
+CVE-2026-111344 (APITable through 1.14.0-beta contains an authorization bypass vulnerab ...)
+ TODO: check
+CVE-2026-111343 (pig through 4.1.1 contains a missing authorization vulnerability in Sy ...)
+ TODO: check
+CVE-2026-111332 (OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulne ...)
+ TODO: check
+CVE-2026-111331 (Dokploy through 0.30.8 contains a cross-organization authorization byp ...)
+ TODO: check
+CVE-2026-111330 (JuggleIM im-server through 1.8.16 contains a weak password hashing vul ...)
+ TODO: check
+CVE-2026-111329 (JuggleIM im-server through 1.8.16 ships default administrator credenti ...)
+ TODO: check
+CVE-2026-111324 (rustdesk-api through 2.7 contains an authorization bypass vulnerabilit ...)
+ TODO: check
+CVE-2026-111323 (RedAmon through 7.0.1 contains an unauthenticated server-side request ...)
+ TODO: check
+CVE-2026-111322 (Archon 0.2.13 through 0.11.1 contains a missing authentication vulnera ...)
+ TODO: check
+CVE-2026-111321 (TaskingAI through 0.3.0 contains a server-side request forgery vulnera ...)
+ TODO: check
+CVE-2026-111320 (ValueCell through 0.1.20 contains an unauthenticated server-side reque ...)
+ TODO: check
+CVE-2026-111313 (JobOps through 0.13.1 contains a server-side request forgery vulnerabi ...)
+ TODO: check
+CVE-2026-111312 (OpenHealth through 0.2.0 contains a missing authentication and authori ...)
+ TODO: check
+CVE-2026-111284 (Aureus ERP through 1.6.0 contains a stored cross-site scripting vulner ...)
+ TODO: check
+CVE-2026-111283 (BMC Helix Network Management on-prem before 26.3.01 contains an authen ...)
+ TODO: check
+CVE-2026-111282 (Driftregion iso14229 before 0.10.1 contains an integer wraparound in H ...)
+ TODO: check
+CVE-2026-111281 (Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 co ...)
+ TODO: check
+CVE-2026-111280 (snap7 through 1.4.3 contains an out-of-bounds write vulnerability in T ...)
+ TODO: check
+CVE-2026-111279 (Dragonfly through 2.0.2 contains an unbounded memory allocation vulner ...)
+ TODO: check
+CVE-2026-111278 (NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that al ...)
+ TODO: check
+CVE-2026-111277 (NivoCart through 2.5.1 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-111275 (nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and ...)
+ TODO: check
+CVE-2026-111274 (unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_pa ...)
+ TODO: check
+CVE-2026-111273 (unarr through 1.1.1 contains an off-by-one heap-based buffer overflow ...)
+ TODO: check
+CVE-2026-111272 (LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibR ...)
+ TODO: check
+CVE-2026-111271 (libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vu ...)
+ TODO: check
+CVE-2026-111270 (libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write i ...)
+ TODO: check
+CVE-2026-111269 (libical through 4.0.6 contains a heap-based out-of-bounds read in ical ...)
+ TODO: check
+CVE-2026-111237 (A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fe ...)
+ TODO: check
+CVE-2026-111212 (A security flaw has been discovered in ImprintLab Medical-SAM-Adapter ...)
+ TODO: check
+CVE-2026-111210 (A vulnerability was determined in bitcoinj up to 0.17. Affected is the ...)
+ TODO: check
+CVE-2026-111178 (The WP Booking System \u2013 Booking Calendar plugin for WordPress is ...)
+ TODO: check
+CVE-2026-111122 (The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Ba ...)
+ TODO: check
+CVE-2026-111114 (The Nexter Extension \u2013 Security, Performance, Code Snippets & Sit ...)
+ TODO: check
+CVE-2026-111106 (The Mail Mint plugin for WordPress is vulnerable to SQL Injection via ...)
+ TODO: check
+CVE-2026-111069 (The GeoDirectory \u2013 WP Business Directory Plugin and Classified Li ...)
+ TODO: check
+CVE-2026-110922 (Use after free in Prerender in Google Chrome prior to 155.0.8059.84 al ...)
+ TODO: check
+CVE-2026-110921 (Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a ...)
+ TODO: check
+CVE-2026-110920 (Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowe ...)
+ TODO: check
+CVE-2026-110919 (Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a ...)
+ TODO: check
+CVE-2026-110918 (Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allo ...)
+ TODO: check
+CVE-2026-110917 (Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allow ...)
+ TODO: check
+CVE-2026-110916 (Improper input validation in Desktop in Google Chrome prior to 155.0.8 ...)
+ TODO: check
+CVE-2026-110915 (Use after free in Compositing in Google Chrome prior to 155.0.8059.84 ...)
+ TODO: check
+CVE-2026-110914 (Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 a ...)
+ TODO: check
+CVE-2026-110913 (Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allow ...)
+ TODO: check
+CVE-2026-110721 (The NotificationX plugin for WordPress is vulnerable to Missing Author ...)
+ TODO: check
+CVE-2026-110701 (The CP Multi View Events Calendar plugin for WordPress is vulnerable t ...)
+ TODO: check
+CVE-2026-110664 (The Premium Packages \u2013 Sell Digital Products Securely plugin for ...)
+ TODO: check
+CVE-2026-110590 (The Klarna for WooCommerce plugin for WordPress is vulnerable to autho ...)
+ TODO: check
+CVE-2026-110366 (Missing Authorization vulnerability in Gemini Labs Site Reviews site-r ...)
+ TODO: check
+CVE-2026-110290 (The WebberZone Top 10 \u2014 Popular Posts plugin for WordPress is vul ...)
+ TODO: check
+CVE-2026-110252 (The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to S ...)
+ TODO: check
+CVE-2026-110191 (The Product Delivery Date for WooCommerce WordPress plugin before 3.3 ...)
+ TODO: check
+CVE-2026-110179 (The affiliate-toolkit WordPress plugin before 3.8.9 does not validate ...)
+ TODO: check
+CVE-2026-110135 (The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 doe ...)
+ TODO: check
+CVE-2026-110039 (The Smush WordPress plugin before 4.3.4 does not restrict changes to ...)
+ TODO: check
+CVE-2026-110019 (The Bulk Page Generator \u2013 LPagery plugin for WordPress is vulnera ...)
+ TODO: check
+CVE-2026-110017 (The Quick PayPal Payments: Payment Button & Form plugin for WordPress ...)
+ TODO: check
+CVE-2026-110015 (The Salon Booking System WordPress plugin before 10.31.9 does not cor ...)
+ TODO: check
+CVE-2026-110014 (The Salon Booking System WordPress plugin before 10.31.9 does not pro ...)
+ TODO: check
+CVE-2026-110013 (The Salon Booking System WordPress plugin before 10.31.9 does not gen ...)
+ TODO: check
+CVE-2026-110012 (The Salon Booking System WordPress plugin before 10.31.3 does not res ...)
+ TODO: check
+CVE-2026-109998 (The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site ...)
+ TODO: check
+CVE-2026-109990 (The Flying Scripts: Delay JavaScript to Improve Site Speed & Performan ...)
+ TODO: check
+CVE-2026-109982 (The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2 ...)
+ TODO: check
+CVE-2026-109813 (A hard-coded cryptographic key vulnerability exists in the `/usr/bin/s ...)
+ TODO: check
+CVE-2026-109812 (A missing authorization vulnerability exists in the internal API `/api ...)
+ TODO: check
+CVE-2026-109515 (The MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailch ...)
+ TODO: check
+CVE-2026-109513 (The NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sa ...)
+ TODO: check
+CVE-2026-109512 (The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site ...)
+ TODO: check
+CVE-2026-109468 (Allocation of resources without limits or throttling in ASP.NET Core a ...)
+ TODO: check
+CVE-2026-109447 (The User Profile Builder \u2013 Beautiful User Registration Forms, Use ...)
+ TODO: check
+CVE-2026-109414 (The Vitepos \u2013 Point of Sale (POS) for WooCommerce plugin for Word ...)
+ TODO: check
+CVE-2026-109401 (The WP Mail Logging plugin for WordPress is vulnerable to Sensitive In ...)
+ TODO: check
+CVE-2026-109400 (The InstaWP Connect \u2013 1-click WP Staging & Migration plugin for W ...)
+ TODO: check
+CVE-2026-109388 (The HivePress \u2013 Business Directory, Listings & Classified Ads Plu ...)
+ TODO: check
+CVE-2026-109382 (The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to ...)
+ TODO: check
+CVE-2026-109232 (The Salon Booking System \u2013 Appointment Booking for Salons, Barber ...)
+ TODO: check
+CVE-2026-109221 (The Groundhogg \u2014 CRM, Newsletters, and Marketing Automation plugi ...)
+ TODO: check
+CVE-2026-109219 (The Mang Board plugin for WordPress is vulnerable to Arbitrary File Up ...)
+ TODO: check
+CVE-2026-109207 (The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & ...)
+ TODO: check
+CVE-2026-109193 (The HivePress \u2013 Business Directory, Listings & Classified Ads Plu ...)
+ TODO: check
+CVE-2026-109191 (The Image Hub \u2013 Free Images from Unsplash, Pixabay, Pexels, Openv ...)
+ TODO: check
+CVE-2026-108455 (Out-of-bounds read in Microsoft Office PowerPoint allows an unauthoriz ...)
+ TODO: check
+CVE-2026-108454 (Buffer over-read in Microsoft Office PowerPoint allows an unauthorized ...)
+ TODO: check
+CVE-2026-108453 (Out-of-bounds read in Microsoft Office PowerPoint allows an unauthoriz ...)
+ TODO: check
+CVE-2026-108452 (Improper limitation of a pathname to a restricted directory ('path tra ...)
+ TODO: check
+CVE-2026-108451 (Numeric truncation error in Microsoft Office Word allows an unauthoriz ...)
+ TODO: check
+CVE-2026-108450 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
+ TODO: check
+CVE-2026-108449 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
+ TODO: check
+CVE-2026-108448 (Heap-based buffer overflow in Microsoft Office Outlook allows an unaut ...)
+ TODO: check
+CVE-2026-108447 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
+ TODO: check
+CVE-2026-108446 (Use after free in Microsoft Office Excel allows an unauthorized attack ...)
+ TODO: check
+CVE-2026-108445 (Stack-based buffer overflow in Microsoft Office Word allows an unautho ...)
+ TODO: check
+CVE-2026-108444 (Heap-based buffer overflow in Microsoft Office allows an unauthorized ...)
+ TODO: check
+CVE-2026-108443 (Off-by-one error in Microsoft Office Word allows an unauthorized attac ...)
+ TODO: check
+CVE-2026-108442 (Use after free in Microsoft Office Word allows an unauthorized attacke ...)
+ TODO: check
+CVE-2026-108441 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
+ TODO: check
+CVE-2026-108440 (Stack-based buffer overflow in Microsoft Office Word allows an unautho ...)
+ TODO: check
+CVE-2026-108439 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
+ TODO: check
+CVE-2026-108438 (Use after free in Microsoft Office Word allows an unauthorized attacke ...)
+ TODO: check
+CVE-2026-108437 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
+ TODO: check
+CVE-2026-108436 (Out-of-bounds read in Microsoft Office Word allows an unauthorized att ...)
+ TODO: check
+CVE-2026-108435 (Untrusted pointer dereference in Microsoft Office Word allows an unaut ...)
+ TODO: check
+CVE-2026-108434 (Out-of-bounds read in Microsoft Office Word allows an unauthorized att ...)
+ TODO: check
+CVE-2026-108433 (Reliance on untrusted inputs in a security decision in Microsoft Offic ...)
+ TODO: check
+CVE-2026-108432 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
+ TODO: check
+CVE-2026-108431 (Stack-based buffer overflow in Microsoft Office Word allows an unautho ...)
+ TODO: check
+CVE-2026-108430 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
+ TODO: check
+CVE-2026-108429 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
+ TODO: check
+CVE-2026-108428 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
+ TODO: check
+CVE-2026-108427 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
+ TODO: check
+CVE-2026-108426 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
+ TODO: check
+CVE-2026-108126 (temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to ...)
+ TODO: check
+CVE-2026-107770 (The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is ...)
+ TODO: check
+CVE-2026-107768 (The TranslatePress \u2013 Translate Multilingual sites with AI Transla ...)
+ TODO: check
+CVE-2026-107764 (The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Ba ...)
+ TODO: check
+CVE-2026-107758 (The Colibri Page Builder plugin for WordPress is vulnerable to Stored ...)
+ TODO: check
+CVE-2026-107748 (The User Profile Builder \u2013 Beautiful User Registration Forms, Use ...)
+ TODO: check
+CVE-2026-107746 (The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout plugin fo ...)
+ TODO: check
+CVE-2026-107659 (The Modula Image Gallery \u2013 Photo Grid & Video Gallery plugin for ...)
+ TODO: check
+CVE-2026-107646 (The HUSKY \u2013 Products Filter for WooCommerce Professional plugin f ...)
+ TODO: check
+CVE-2026-107316
+ REJECTED
+CVE-2026-107172
+ REJECTED
+CVE-2026-106708 (XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forge ...)
+ TODO: check
+CVE-2026-106700 (ELADMIN v2.7 and earlier contains an improper access control vulnerabi ...)
+ TODO: check
+CVE-2026-105974 (The Visual Form Builder WordPress plugin through 3.1 does not perform ...)
+ TODO: check
+CVE-2026-105973 (The Visual Form Builder WordPress plugin through 3.1 does not perform ...)
+ TODO: check
+CVE-2026-105228 (This vulnerability allows remote attackers to disclose sensitive infor ...)
+ TODO: check
+CVE-2026-105227 (This vulnerability allows remote attackers to disclose sensitive infor ...)
+ TODO: check
+CVE-2026-105040 (The EnergizeLab Eilik NestJS auth service accepts a user-controlled us ...)
+ TODO: check
+CVE-2026-105039 (EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1. ...)
+ TODO: check
+CVE-2026-105038 (The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling se ...)
+ TODO: check
+CVE-2026-105037 (EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1. ...)
+ TODO: check
+CVE-2026-105036 (EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_2026 ...)
+ TODO: check
+CVE-2026-105035 (The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN b ...)
+ TODO: check
+CVE-2026-105034 (The EnergizeLab Eilik NestJS auth service issues device tokens for arb ...)
+ TODO: check
+CVE-2026-105033 (The EnergizeLab AI Station (RK3562) firmware image ships with default ...)
+ TODO: check
+CVE-2026-105032 (The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by t ...)
+ TODO: check
+CVE-2026-104932 (The Search Regex plugin for WordPress is vulnerable to PHP Object Inje ...)
+ TODO: check
+CVE-2026-104798 (The My Calendar \u2013 Accessible Event Manager plugin for WordPress i ...)
+ TODO: check
+CVE-2026-104769 (The Debloat \u2013 Remove Unused CSS, Optimize JS plugin for WordPress ...)
+ TODO: check
+CVE-2026-104755 (The WP Compress \u2013 Instant Performance & Speed Optimization plugin ...)
+ TODO: check
+CVE-2026-104745 (The Customer Email Verification for WooCommerce plugin for WordPress i ...)
+ TODO: check
+CVE-2026-104730 (The Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing f ...)
+ TODO: check
+CVE-2026-104198 (ZoneMinder is a free, open source closed-circuit television software a ...)
+ TODO: check
+CVE-2026-104001 (The The Slim SEO \u2013 AI SEO Plugin, Lightweight, Fast & Automated p ...)
+ TODO: check
+CVE-2026-104000 (The Simply Schedule Appointments plugin for WordPress is vulnerable to ...)
+ TODO: check
+CVE-2026-103999 (The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable ...)
+ TODO: check
+CVE-2026-103911 (The The Forminator Forms \u2013 Contact Form, Payment Form & Custom Fo ...)
+ TODO: check
+CVE-2026-103910
+ REJECTED
+CVE-2026-103896 (The 10Web Booster \u2013 Website speed optimization, Cache & Page Spee ...)
+ TODO: check
+CVE-2026-103895 (The miniOrange OTP Login, Verification and SMS Notifications plugin fo ...)
+ TODO: check
+CVE-2026-103768 (The ELEX WordPress HelpDesk & Customer Ticketing System plugin for Wor ...)
+ TODO: check
+CVE-2026-103696 (The Mobile builder WordPress plugin through 1.4.2 does not sanitise an ...)
+ TODO: check
+CVE-2026-103525 (The FluentCart A New Era of eCommerce \u2013 Faster, Lighter, and Simp ...)
+ TODO: check
+CVE-2026-103518 (The FluentCart A New Era of eCommerce \u2013 Faster, Lighter, and Simp ...)
+ TODO: check
+CVE-2026-103481 (The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected C ...)
+ TODO: check
+CVE-2026-103480 (The Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rent ...)
+ TODO: check
+CVE-2026-102764 (The vulnerability exists within internal components of BeyondTrust\u20 ...)
+ TODO: check
+CVE-2026-101335 (The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form B ...)
+ TODO: check
+CVE-2026-100186 (The User Profile Builder \u2013 Beautiful User Registration Forms, Use ...)
+ TODO: check
+CVE-2026-100159 (The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcod ...)
+ TODO: check
+CVE-2026-100158 (The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cro ...)
+ TODO: check
+CVE-2025-3778
+ REJECTED
+CVE-2024-58397 (MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4Fil ...)
+ TODO: check
+CVE-2026-104715 (A flaw was found in cifs-utils. This flaw allows an unprivileged local ...)
- cifs-utils 2:7.9-1
NOTE: Fixed by: https://git.samba.org/?p=cifs-utils.git;a=commit;h=d561eb914a389f6f2f009f13f0d09df0887bae72 (cifs-utils-7.9)
NOTE: Fixed by: https://git.samba.org/?p=cifs-utils.git;a=commit;h=fa0ba5a155ef925bb7547cb4cdc36425a2f5b8f9 (cifs-utils-7.9)
@@ -12316,6 +12852,7 @@ CVE-2026-107573 (Incorrect default permissions in the Windows installer of Progr
CVE-2026-107572 (Inefficient complexity in the Sieve filter evaluation of Progressive R ...)
NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107570 (heap OOB write in convert_file_from_to() via a crafted Content-Type he ...)
+ {DSA-6563-1}
- mutt <unfixed> (bug #1150407)
NOTE: https://gitlab.com/muttmua/mutt/-/work_items/533
NOTE: Fixed by: https://gitlab.com/muttmua/mutt/-/commit/7752d93f26f8f1384905fad874afff5abb0f3e54 (mutt-2-4-3-rel)
@@ -17074,7 +17611,7 @@ CVE-2026-XXXX [GHSA-gj33-wxpv-6fgg: ZDI-CAN-33033: OpenPrinting CUPS Scheduler C
- cups <unfixed>
NOTE: https://github.com/OpenPrinting/cups/security/advisories/GHSA-gj33-wxpv-6fgg
NOTE: Fixed by: https://github.com/OpenPrinting/cups/commit/a7bd8ba80c2abb1d15dffc6c5ad7aece0c7b9db9 (v2.4.20)
-CVE-2026-55467 [GHSA-69qc-prxg-h2c7: CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)]
+CVE-2026-55467 (OpenPrinting CUPS is an open source printing system for Linux and othe ...)
- cups 2.4.20-1
NOTE: https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7
NOTE: Fixed by: https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681 (v2.4.20)
@@ -23948,10 +24485,12 @@ CVE-2026-102635 (ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain unin
CVE-2026-102634 (SGLang through 0.5.20 in prefill/decode disaggregation mode fails to v ...)
NOT-FOR-US: SGLang
CVE-2026-77214 (libexpat before commit 13c5f63 contains a heap buffer over-read vulner ...)
+ {DSA-6566-1}
- expat 2.9.0-1 (bug #1150320)
NOTE: https://github.com/libexpat/libexpat/pull/1393
NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/4d9b1c499ecb66323260a7274edcf86c5eab0517 (R_2_9_0)
CVE-2026-102633 (libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vuln ...)
+ {DSA-6566-1}
- expat 2.8.5-2 (bug #1149507)
[bookworm] - expat <postponed> (Minor issue; CVE-2025-59375 back-port code is compiled out, XML_GE unset)
NOTE: https://github.com/libexpat/libexpat/pull/1392
@@ -34825,7 +35364,7 @@ CVE-2026-93992 (Gopeed through 2.0.0-beta.3 contains a path traversal vulnerabil
CVE-2026-93991 (Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization b ...)
NOT-FOR-US: Argo Workflows
CVE-2026-93990 (Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 i ...)
- {DLA-4807-1}
+ {DSA-6566-1 DLA-4807-1}
- expat 2.8.4-2 (bug #1148665)
NOTE: https://github.com/libexpat/libexpat/pull/1282
NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/0cfd15bdf4b2c22d6b0df73610709dfb60921091 (R_2_8_5)
@@ -48935,7 +49474,8 @@ CVE-2026-89604 (In the Linux kernel, the following vulnerability has been resolv
{DSA-6528-1 DLA-4817-1}
- linux 7.2.6-1
NOTE: https://git.kernel.org/linus/b2326338dc683e8c1067c0cbf7a47986c4190902 (7.3-rc1)
-CVE-2026-89603 (In the Linux kernel, the following vulnerability has been resolved: e ...)
+CVE-2026-89603
+ REJECTED
{DSA-6528-1 DLA-4817-1}
- linux 7.2.6-1
NOTE: https://git.kernel.org/linus/4a3591287fb7f808e209b4974ed337f609a2006b (7.3-rc1)
@@ -74713,12 +75253,13 @@ CVE-2026-75803 (Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an
CVE-2026-8619 (An unauthenticated denial-of-service vulnerability was identified in T ...)
NOT-FOR-US: TPLink
CVE-2026-76957 (libexpat before 2.8.4 lacks handler call depth tracking with custom en ...)
- {DLA-4765-1}
+ {DSA-6566-1 DLA-4765-1}
- expat 2.8.4-1 (bug #1144927)
NOTE: https://github.com/libexpat/libexpat/pull/1322
NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/127b7d4beb8fe7e5ce5cb021c2e56379c95863d0 (R_2_8_4)
NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/acbd2e1179c04fe9a8c3f3837701904d05de71fc (R_2_8_4)
CVE-2026-76956 (In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentr ...)
+ {DSA-6566-1}
- expat 2.8.4-1 (bug #1144926)
[bookworm] - expat <not-affected> (Vulnerable code not present)
[bullseye] - expat <not-affected> (Vulnerable code not present)
@@ -79242,7 +79783,7 @@ CVE-2026-66621 (Improper Neutralization of Input During Web Page Generation ('Cr
CVE-2026-66620 (Editor PHP Object Injection in OptionTree <= 2.7.3 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-66046 (Expat through 2.8.3 contains a denial of service vulnerability caused ...)
- {DLA-4807-1}
+ {DSA-6566-1 DLA-4807-1}
- expat 2.8.4-1 (bug #1144925)
NOTE: https://github.com/libexpat/libexpat/pull/1321
NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/98f5acc146af76859cd7c345c0906e9e9e8ea656 (R_2_8_4)
@@ -116187,6 +116728,7 @@ CVE-2026-53727 (css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssPars
NOTE: Fixed by: https://github.com/premailer/css_parser/commit/7d2ddf0189cd54b54f378f59daefa10cb036e476 (v3.0.0)
NOTE: Fixed by: https://github.com/premailer/css_parser/commit/e0a151458b2a801ae265ba420862ef8b1127b3ae (v3.0.0)
CVE-2026-52584 (Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a l ...)
+ {DSA-6564-1}
- jpeg-xl 0.11.2-5.1 (bug #1142476)
NOTE: https://github.com/libjxl/libjxl/issues/4803
NOTE: https://github.com/libjxl/libjxl/pull/4804
@@ -125123,7 +125665,7 @@ CVE-2026-XXXX [RUSTSEC-2026-0190]
[bullseye] - rust-anyhow <postponed> (Minor issue)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0190.html
NOTE: https://github.com/dtolnay/anyhow/issues/451
-CVE-2026-63430 [RUSTSEC-2026-0193]
+CVE-2026-63430 (ammonia is a Rust library for repairing and securing untrusted HTML. P ...)
- rust-ammonia 4.1.3-1 (bug #1141594)
[trixie] - rust-ammonia <no-dsa> (Minor issue)
[bookworm] - rust-ammonia <postponed> (Limited support, minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4309abf23e2432b687a1e9cc76fb04e125b50c67
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4309abf23e2432b687a1e9cc76fb04e125b50c67
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/b5a367eb/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list