[Git][security-tracker-team/security-tracker][master] bugnums

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
281a27c4 by Moritz Muehlenhoff at 2026-10-16T14:58:08+02:00
bugnums

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2311,7 +2311,7 @@ CVE-2026-109968 (A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-a
 CVE-2026-109901 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-109527 (The Model Context Protocol Python SDK is the official Python SDK for M ...)
-	- python-mcp <unfixed>
+	- python-mcp <unfixed> (bug #1151047)
 	NOTE: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc
 	NOTE: https://github.com/modelcontextprotocol/python-sdk/commit/4dc224fab201bdef2fd5a065976b7ca31420187c (v1.29.1)
 	NOTE: https://github.com/modelcontextprotocol/python-sdk/commit/5f0b6af9f2b0aad3be3ba5cbfe80a9e4ea32e189 (v1.29.0)
@@ -31992,17 +31992,17 @@ CVE-2026-88845 (The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.
 CVE-2026-88843 (The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 d ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-88840 (BusyBox TLS get_client_hello() reads past the end of the input buffer  ...)
-	- busybox <unfixed>
+	- busybox <unfixed> (bug #1151053)
 	[trixie] - busybox <not-affected> (Vulnerable code not present)
 	[bookworm] - busybox <not-affected> (Vulnerable code not present)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531354
 	NOTE: Introduced by: https://git.busybox.net/busybox/commit/archival?id=657fbcd62c6cb1e15692ad471bc94cfe6efd8a5f (1_38_0)
 CVE-2026-88839 (BusyBox passwd/group tokenize() references a stale endpoint pointer af ...)
-	- busybox <unfixed>
+	- busybox <unfixed> (bug #1151052)
 	[trixie] - busybox <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531353
 CVE-2026-88837 (BusyBox httpd treats yescrypt ($y$) password hashes as plaintext durin ...)
-	- busybox <unfixed>
+	- busybox <unfixed> (bug #1151051)
 	[trixie] - busybox <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531351
 CVE-2026-88835 (BusyBox dpkg read_package_field() steps past a NUL terminator on malfo ...)
@@ -32010,15 +32010,15 @@ CVE-2026-88835 (BusyBox dpkg read_package_field() steps past a NUL terminator on
 	NOTE: ttps://bugzilla.redhat.com/show_bug.cgi?id=2531349
 	NOTE: Crash in CLI tool, no security impact
 CVE-2026-88832 (BusyBox romfs volume ID parsing uses unbounded strlen on attacker-cont ...)
-	- busybox <unfixed>
+	- busybox <unfixed> (bug #1151050)
 	[trixie] - busybox <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531345
 CVE-2026-88831 (BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open ...)
-	- busybox <unfixed>
+	- busybox <unfixed> (bug #1151049)
 	[trixie] - busybox <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531346
 CVE-2026-88830 (A unit confusion in BusyBox TLS Montgomery reduction buffer allocation ...)
-	- busybox <unfixed>
+	- busybox <unfixed> (bug #1151048)
 	[trixie] - busybox <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531344
 CVE-2026-87978 (The Paymob for WooCommerce WordPress plugin before 4.1.14 does not ver ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/281a27c45bca54761a6b654b99521f7ffd0d495d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/281a27c45bca54761a6b654b99521f7ffd0d495d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/a77d0be6/attachment.htm>