[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Oct 20 20:15:11 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
57ee7c54 by security tracker role at 2026-10-20T19:14:56+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,23 +1,585 @@
+CVE-2026-9589 (Missing authorization in the configuration cascade operations of the C ...)
+ TODO: check
+CVE-2026-97406 (XERJ Console API bearer tokens can bypass the passkey\u2011only authen ...)
+ TODO: check
+CVE-2026-97400 (In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic d ...)
+ TODO: check
+CVE-2026-96582 (A HID report descriptor is a sequence of items, each declaring in its ...)
+ TODO: check
+CVE-2026-96406 (A VideoStreaming interface reports the size of its whole class-specifi ...)
+ TODO: check
+CVE-2026-96402 (A malicious USB MTP/PTP device can cause the USBX host to read past a ...)
+ TODO: check
+CVE-2026-95168 (An issue in nvbn thefuck v.3.32 allows a local attacker to execute arb ...)
+ TODO: check
+CVE-2026-95111 (A memory-protected ThreadX module's queue request reaches the Module M ...)
+ TODO: check
+CVE-2026-95109 (The Cortex-A7 MMU Modules port validates a caller-supplied buffer by t ...)
+ TODO: check
+CVE-2026-95108 (One logical thread of a user-mode ThreadX module costs the Module Mana ...)
+ TODO: check
+CVE-2026-95107 (A ThreadX module chooses `object_size` when it calls `txm_module_objec ...)
+ TODO: check
+CVE-2026-94202 (The Module Manager's block-pool create dispatcher proved that two `ALI ...)
+ TODO: check
+CVE-2026-94192 (A ThreadX module allocates the control blocks of its kernel objects fr ...)
+ TODO: check
+CVE-2026-94024 (The Module Manager's object lookup validated one byte of a memory-prot ...)
+ TODO: check
+CVE-2026-94023 (A ThreadX module reaches a kernel object's delete service through the ...)
+ TODO: check
+CVE-2026-94018 (The Web add-on's HTTP server dereferences and releases an uninitialize ...)
+ TODO: check
+CVE-2026-93475 (The X.509 parser in NetX Secure accepts an RSA public key of any size, ...)
+ TODO: check
+CVE-2026-93446 (Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 ...)
+ TODO: check
+CVE-2026-93003 (The Web add-on's HTTP server searches the entire request packet for he ...)
+ TODO: check
+CVE-2026-92853 (The TLS 1.3 Certificate-message parser in NetX Secure decrements the m ...)
+ TODO: check
+CVE-2026-92843 (A missing bounds check in the TLS 1.3 Certificate-message parser of Ne ...)
+ TODO: check
+CVE-2026-92539 (A service account with user-management permissions in one organization ...)
+ TODO: check
+CVE-2026-92454 (The GUIX software JPEG decoder reads four kinds of marker segment with ...)
+ TODO: check
+CVE-2026-92449 (`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) ...)
+ TODO: check
+CVE-2026-92446 (`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource ...)
+ TODO: check
+CVE-2026-92287 (Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parq ...)
+ TODO: check
+CVE-2026-91189 (The GUIX binary resource loader never checks that a font page's glyph ...)
+ TODO: check
+CVE-2026-91186 (The PNG chunk reader has no notion of chunk ordering. It records wheth ...)
+ TODO: check
+CVE-2026-91059 (The GUIX JPEG software decoder enforces no ordering on JPEG markers. A ...)
+ TODO: check
+CVE-2026-91057 (`_gx_multi_line_text_view_display_info_get()` reads one byte past the ...)
+ TODO: check
+CVE-2026-91041 (Mounting an attacker-controlled FAT image with fault tolerance enabled ...)
+ TODO: check
+CVE-2026-90800 (Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and bel ...)
+ TODO: check
+CVE-2026-90799 (Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and be ...)
+ TODO: check
+CVE-2026-90798 (A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 an ...)
+ TODO: check
+CVE-2026-90797 (An unlimited gzip decompression routine in chttpd in Apache CouchDB 3. ...)
+ TODO: check
+CVE-2026-88041 (Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer i ...)
+ TODO: check
+CVE-2026-86471 (An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and ...)
+ TODO: check
+CVE-2026-85267 (A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to ...)
+ TODO: check
+CVE-2026-80353 (Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apa ...)
+ TODO: check
+CVE-2026-75997
+ REJECTED
+CVE-2026-75751
+ REJECTED
+CVE-2026-75747
+ REJECTED
+CVE-2026-74049 (Execution After Redirect (EAR) vulnerability in Apache Tomcat. This ...)
+ TODO: check
+CVE-2026-74048 (Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. ...)
+ TODO: check
+CVE-2026-48279
+ REJECTED
+CVE-2026-43858 (A stack-based buffer overflow vulnerability could allow a remote authe ...)
+ TODO: check
+CVE-2026-43857 (A vulnerability could allow a remote authenticated attacker to achieve ...)
+ TODO: check
+CVE-2026-43856 (A stack-based buffer overflow vulnerability in the FileProcess::CheckD ...)
+ TODO: check
+CVE-2026-43855 (A heap-based buffer overflow vulnerability could allow a remote authen ...)
+ TODO: check
+CVE-2026-43854 (A vulnerability could allow an attacker with access to an encrypted pr ...)
+ TODO: check
+CVE-2026-43853 (A vulnerability could allow an attacker to send a crafted message to t ...)
+ TODO: check
+CVE-2026-43852 (A vulnerability could allow an authenticated attacker to write files t ...)
+ TODO: check
+CVE-2026-43851 (A path traversal vulnerability could allow an authenticated attacker t ...)
+ TODO: check
+CVE-2026-43850 (A command injection vulnerability could allow an authenticated attacke ...)
+ TODO: check
+CVE-2026-43849 (A heap memory read vulnerability could allow an attacker to exfiltrate ...)
+ TODO: check
+CVE-2026-43848 (A vulnerability in the bulk port configuration functionality could all ...)
+ TODO: check
+CVE-2026-43847 (A vulnerability in the proprietary protocol could allow an attacker to ...)
+ TODO: check
+CVE-2026-43846 (A stack-based buffer overflow vulnerability in a non-functional featur ...)
+ TODO: check
+CVE-2026-43845 (A vulnerability in the password reset mechanism could allow an attacke ...)
+ TODO: check
+CVE-2026-43844 (A vulnerability in the proprietary protocol could allow an attacker to ...)
+ TODO: check
+CVE-2026-43843 (An integer overflow vulnerability in the license manager service could ...)
+ TODO: check
+CVE-2026-43842 (A NULL pointer dereference vulnerability in the license manager servic ...)
+ TODO: check
+CVE-2026-43841 (A NULL pointer dereference vulnerability in the license manager servic ...)
+ TODO: check
+CVE-2026-43840 (A NULL pointer dereference vulnerability in the license manager servic ...)
+ TODO: check
+CVE-2026-43839 (A NULL pointer dereference vulnerability in the logs management functi ...)
+ TODO: check
+CVE-2026-43838 (A stack-based buffer overflow vulnerability in the login functionality ...)
+ TODO: check
+CVE-2026-43837 (A buffer overflow vulnerability in the password verification functiona ...)
+ TODO: check
+CVE-2026-43836 (A vulnerability could allow an attacker to forge a packet to execute a ...)
+ TODO: check
+CVE-2026-43835 (A vulnerability in the firmware upgrade functionality could allow an a ...)
+ TODO: check
+CVE-2026-43834 (A stack-based buffer overflow vulnerability in the logs settings funct ...)
+ TODO: check
+CVE-2026-34485 (Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulne ...)
+ TODO: check
+CVE-2026-34484 (Nokia 1830 Global Express GX is vulnerable to a local privilege escala ...)
+ TODO: check
+CVE-2026-28331 (SolarWinds Patch Manager exposes sensitive information accessible to l ...)
+ TODO: check
+CVE-2026-28330 (SolarWinds Observability Self-Hosted was found to be affected by a sto ...)
+ TODO: check
+CVE-2026-28329 (SolarWinds Observability Self-Hosted was found to be affected by a Ser ...)
+ TODO: check
+CVE-2026-28328 (SolarWinds Observability Self-Hosted was found to be affected by a bro ...)
+ TODO: check
+CVE-2026-21356
+ REJECTED
+CVE-2026-21270
+ REJECTED
+CVE-2026-21266
+ REJECTED
+CVE-2026-18205 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-14933 (Cross-site scripting in the embedded co-browsing feature in Unblu inc. ...)
+ TODO: check
+CVE-2026-11960 (Enumeration of unauthenticated users in FacturaScripts, version 2025.6 ...)
+ TODO: check
+CVE-2026-11959 (Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, ...)
+ TODO: check
+CVE-2026-113810 (A Stored Cross-Site Scripting vulnerability exists in the SNS enrollme ...)
+ TODO: check
+CVE-2026-113808 (A Stored Cross-Site Scripting vulnerability exists in the SNS enrollme ...)
+ TODO: check
+CVE-2026-113802 (Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS c ...)
+ TODO: check
+CVE-2026-113711 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113710 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113709 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
+ TODO: check
+CVE-2026-113708 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
+ TODO: check
+CVE-2026-113703 (SuggestArr before 3.0.0 contains an authentication bypass vulnerabilit ...)
+ TODO: check
+CVE-2026-113683 (VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a refle ...)
+ TODO: check
+CVE-2026-113682 (Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication ...)
+ TODO: check
+CVE-2026-113681 (OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3 ...)
+ TODO: check
+CVE-2026-113680 (HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference ...)
+ TODO: check
+CVE-2026-113679 (HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerab ...)
+ TODO: check
+CVE-2026-113678 (Froxlor before 2.3.15 contains a symlink following vulnerability in St ...)
+ TODO: check
+CVE-2026-113677 (Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vul ...)
+ TODO: check
+CVE-2026-113676 (Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vul ...)
+ TODO: check
+CVE-2026-113672 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
+ TODO: check
+CVE-2026-113671 (ApostropheCMS is an open-source Node.js content management system. Fro ...)
+ TODO: check
+CVE-2026-113670 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113669 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113668 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113667 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113666 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113665 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113664 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113662 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113661 (ApostropheCMS is an open-source Node.js content management system, and ...)
+ TODO: check
+CVE-2026-113660 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113659 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113658 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113657 (ApostropheCMS is an open-source Node.js content management system, and ...)
+ TODO: check
+CVE-2026-113656 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113655 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113654 (ApostropheCMS is an open-source Node.js content management system, and ...)
+ TODO: check
+CVE-2026-113653 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113652 (ApostropheCMS is an open-source Node.js content management system. Fro ...)
+ TODO: check
+CVE-2026-113651 (ApostropheCMS is an open-source Node.js content management system, and ...)
+ TODO: check
+CVE-2026-113650 (ApostropheCMS is an open-source Node.js content management system. In ...)
+ TODO: check
+CVE-2026-113649 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113648 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-113643 (A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affect ...)
+ TODO: check
+CVE-2026-113620 (In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator Web ...)
+ TODO: check
+CVE-2026-113619 (In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, a ...)
+ TODO: check
+CVE-2026-113613 (FlexGet before 3.20.7 contains a path traversal vulnerability in the d ...)
+ TODO: check
+CVE-2026-113612 (SparkyFitness before 0.17.0 contains a missing authorization vulnerabi ...)
+ TODO: check
+CVE-2026-113611 (Outline before 1.8.0 contains an improper access revocation vulnerabil ...)
+ TODO: check
+CVE-2026-113610 (Xen Orchestra before 6.9.0 contains an authorization bypass vulnerabil ...)
+ TODO: check
+CVE-2026-113609 (Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to e ...)
+ TODO: check
+CVE-2026-113608 (Configurable Reports block for Moodle (moodle-block_configurablereport ...)
+ TODO: check
+CVE-2026-113607 (Configurable Reports block for Moodle before 5.3.0 contains an authori ...)
+ TODO: check
+CVE-2026-113606 (Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vuln ...)
+ TODO: check
+CVE-2026-113605 (Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist ...)
+ TODO: check
+CVE-2026-113604 (Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability ...)
+ TODO: check
+CVE-2026-113603 (The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28. ...)
+ TODO: check
+CVE-2026-113602 (json-smart through 2.6.0 contains an input validation bypass vulnerabi ...)
+ TODO: check
+CVE-2026-113601 (Memos before 0.27.0 contains a missing authorization vulnerability in ...)
+ TODO: check
+CVE-2026-113600 (Fat Free CRM before 0.26.0 contains an insecure direct object referenc ...)
+ TODO: check
+CVE-2026-113599 (Modoboa before 2.8.0 contains an insecure direct object reference vuln ...)
+ TODO: check
+CVE-2026-113598 (Modoboa before 2.8.0 contains an insecure direct object reference vuln ...)
+ TODO: check
+CVE-2026-113597 (Blinko through 1.8.8 contains an insecure direct object reference vuln ...)
+ TODO: check
+CVE-2026-113596 (Webstudio before 0.256.0 contains a missing authorization vulnerabilit ...)
+ TODO: check
+CVE-2026-113595 (Sharkord before 0.0.26 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-113594 (Sharkord before 0.0.8 contains a missing authorization vulnerability t ...)
+ TODO: check
+CVE-2026-113583 (Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scr ...)
+ TODO: check
+CVE-2026-113507 (A vulnerability was found in aaPanel up to 8.25.0. The impacted elemen ...)
+ TODO: check
+CVE-2026-113506 (A vulnerability has been found in aaPanel up to 8.25.0. The affected e ...)
+ TODO: check
+CVE-2026-113505 (A flaw has been found in aaPanel up to 8.25.0. Impacted is the functio ...)
+ TODO: check
+CVE-2026-113496 (A flaw was found in cockpit-machines. When saving Virtual Network Comp ...)
+ TODO: check
+CVE-2026-113495 (A flaw was found in cockpit-machines. Red Hat Subscription Management ...)
+ TODO: check
+CVE-2026-113469 (A failure has been identified in the SNS during dynamic data files sig ...)
+ TODO: check
+CVE-2026-113468 (The payment notification endpoint for PayPal accepts incoming data wit ...)
+ TODO: check
+CVE-2026-113466 (A security vulnerability has been detected in MinIO up to RELEASE.2025 ...)
+ TODO: check
+CVE-2026-113465 (It is possible to execute a DOM-based Cross-Site Scripting attack agai ...)
+ TODO: check
+CVE-2026-113459 (In versions running on TYPO3 10 and 11, the configured OpenAI API key ...)
+ TODO: check
+CVE-2026-113442 (Values entered by visitors were placed into the HTML summary email wit ...)
+ TODO: check
+CVE-2026-113411 (A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by ...)
+ TODO: check
+CVE-2026-113407 (BA-Workflow developed by YS-infoware has a SQL Injection vulnerability ...)
+ TODO: check
+CVE-2026-113406 (BA-Workflow developed by YS-infoware has a SQL Injection vulnerability ...)
+ TODO: check
+CVE-2026-113405 (BA-Workflow developed by YS-infoware has a SQL Injection vulnerability ...)
+ TODO: check
+CVE-2026-113403 (ArmorX Spam developed by ArmorX Global Technology has a Command Inject ...)
+ TODO: check
+CVE-2026-113397 (A security vulnerability has been detected in DrayTek Vigor2960 1.5.1. ...)
+ TODO: check
+CVE-2026-113396 (A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8 ...)
+ TODO: check
+CVE-2026-113395 (A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revis ...)
+ TODO: check
+CVE-2026-113394 (A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8 ...)
+ TODO: check
+CVE-2026-113393 (A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8 ...)
+ TODO: check
+CVE-2026-113392 (A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. ...)
+ TODO: check
+CVE-2026-113391 (A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8 ...)
+ TODO: check
+CVE-2026-113390 (A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affe ...)
+ TODO: check
+CVE-2026-113389 (A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 821 ...)
+ TODO: check
+CVE-2026-113388 (A security flaw has been discovered in opensource-socialnetwork up to ...)
+ TODO: check
+CVE-2026-113385 (A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0. ...)
+ TODO: check
+CVE-2026-113384 (A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerabil ...)
+ TODO: check
+CVE-2026-113383 (A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This aff ...)
+ TODO: check
+CVE-2026-113382 (A security vulnerability has been detected in arizu-id fast-tunnel 1.0 ...)
+ TODO: check
+CVE-2026-113381 (A weakness has been identified in Osclass up to 8.3.1. Affected by thi ...)
+ TODO: check
+CVE-2026-113378 (A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4. ...)
+ TODO: check
+CVE-2026-113359 (Baserow before 2.3.0 contains a missing authorization vulnerability th ...)
+ TODO: check
+CVE-2026-113358 (LavaLite CMS through 10.1.2 contains a missing authentication vulnerab ...)
+ TODO: check
+CVE-2026-113357 (@e2e-dev/github before 0.4.1 contains an improper authorization vulner ...)
+ TODO: check
+CVE-2026-113356 (DokuWiki before 2026-07-14c contains a PHP object injection vulnerabil ...)
+ TODO: check
+CVE-2026-113355 (Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerab ...)
+ TODO: check
+CVE-2026-113354 (Dockhand before 1.0.46 contains an arbitrary file read vulnerability t ...)
+ TODO: check
+CVE-2026-113353 (LearnPress before 4.4.10 contains a missing authorization vulnerabilit ...)
+ TODO: check
+CVE-2026-113352 (uTox through 0.18.1 contains a path traversal vulnerability that allow ...)
+ TODO: check
+CVE-2026-113351 (libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerabilit ...)
+ TODO: check
+CVE-2026-113350 (react-admin before 5.15.5 contains a stored cross-site scripting vulne ...)
+ TODO: check
+CVE-2026-113349 (OpenCATS before 0.10.0 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-112958 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-112957 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-112956 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-112955 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-112954 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-112953 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-112952 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-112951 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
+ TODO: check
+CVE-2026-112950 (Vitest is a Vite-native testing framework for JavaScript and TypeScrip ...)
+ TODO: check
+CVE-2026-112949 (Vitest is a Vite-native testing framework for JavaScript and TypeScrip ...)
+ TODO: check
+CVE-2026-112948 (Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until ...)
+ TODO: check
+CVE-2026-112947 (Vite is a frontend tooling framework for JavaScript. From 8.2.0 until ...)
+ TODO: check
+CVE-2026-112946 (Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7 ...)
+ TODO: check
+CVE-2026-112945 (Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7 ...)
+ TODO: check
+CVE-2026-112944 (launch-editor allows users to open files with line numbers in editor f ...)
+ TODO: check
+CVE-2026-112943 (launch-editor allows users to open files with line numbers in editor f ...)
+ TODO: check
+CVE-2026-112942 (launch-editor allows users to open files with line numbers in editor f ...)
+ TODO: check
+CVE-2026-112941 (filelock is a platform-independent file lock for Python. From 4.1.0 un ...)
+ TODO: check
+CVE-2026-112940 (filelock is a platform-independent file lock for Python. From 3.20.4 u ...)
+ TODO: check
+CVE-2026-112939 (filelock is a platform-independent file lock for Python. From 3.22.0 u ...)
+ TODO: check
+CVE-2026-112937 (filelock is a platform-independent file lock for Python. From 4.1.0 un ...)
+ TODO: check
+CVE-2026-112936 (filelock is a platform-independent file lock for Python. From 3.20.4 u ...)
+ TODO: check
+CVE-2026-112935 (filelock is a platform-independent file lock for Python. From 3.22.0 u ...)
+ TODO: check
+CVE-2026-112934 (filelock is a platform-independent file lock for Python. From 4.0.0 un ...)
+ TODO: check
+CVE-2026-112915 (filelock is a platform-independent file lock for Python. From 3.20.4 u ...)
+ TODO: check
+CVE-2026-112914 (filelock is a platform-independent file lock for Python. From 4.1.0 un ...)
+ TODO: check
+CVE-2026-112912 (filelock is a platform-independent file lock for Python. From 3.32.6 u ...)
+ TODO: check
+CVE-2026-112911 (filelock is a platform-independent file lock for Python. From 3.30.0 u ...)
+ TODO: check
+CVE-2026-112909 (filelock is a platform-independent file lock for Python. Prior to 4.2. ...)
+ TODO: check
+CVE-2026-112906 (filelock is a platform-independent file lock for Python. From 4.1.0 un ...)
+ TODO: check
+CVE-2026-112861 (Authorization Bypass Through User-Controlled Key vulnerability in xnau ...)
+ TODO: check
+CVE-2026-112840 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-112836 (Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar ...)
+ TODO: check
+CVE-2026-112834 (Missing Authorization vulnerability in Castos Seriously Simple Podcast ...)
+ TODO: check
+CVE-2026-112833 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-112829 (Missing Authorization vulnerability in Arraytics Booktics booktics all ...)
+ TODO: check
+CVE-2026-112824 (Missing Authorization vulnerability in Magepeople inc. Bus Ticket Book ...)
+ TODO: check
+CVE-2026-112823 (Missing Authorization vulnerability in WP User Manager WP User Manager ...)
+ TODO: check
+CVE-2026-112787 (OpenCATS before 0.10.0 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-112786 (OpenCATS before 0.10.0 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-112785 (OpenCATS before 0.10.0 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-112784 (OpenCATS before 0.10.0 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-112783 (OpenCATS before 0.10.0 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-112240 (The download link for files uploaded through a form relied on a token ...)
+ TODO: check
+CVE-2026-112239 (The extension provides a backend endpoint that writes a submitted valu ...)
+ TODO: check
+CVE-2026-112238 (The file search of the extension builds its database conditions by wra ...)
+ TODO: check
+CVE-2026-112237 (The extension provides a public proxy endpoint that fetches a URL on b ...)
+ TODO: check
+CVE-2026-112177 (A flaw was found in Ghostscript as shipped with Red Hat Enterprise Lin ...)
+ TODO: check
+CVE-2026-112071 (The order cancellation function accepts an order identifier from the r ...)
+ TODO: check
+CVE-2026-112070 (The AJAX routes of the extension do not check whether a backend user h ...)
+ TODO: check
+CVE-2026-112069 (The extension no longer applied its access protection to files in file ...)
+ TODO: check
+CVE-2026-112068 (The backend module does not check whether a backend user has access to ...)
+ TODO: check
+CVE-2026-112067 (The extension hides the correct answer to each CAPTCHA inside the imag ...)
+ TODO: check
+CVE-2026-112066 (The JSON import of the cookie consent configuration did not respect th ...)
+ TODO: check
+CVE-2026-112065 (The routes that provide consent history and statistics data did not ch ...)
+ TODO: check
+CVE-2026-112064 (The backend module for reviewing the consent history accepted sorting, ...)
+ TODO: check
+CVE-2026-111844 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-111843 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-111767 (MCP TypeScript SDK is the official TypeScript SDK for Model Context Pr ...)
+ TODO: check
+CVE-2026-111765 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protoc ...)
+ TODO: check
+CVE-2026-111764 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protoc ...)
+ TODO: check
+CVE-2026-111763 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protoc ...)
+ TODO: check
+CVE-2026-111762 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protoc ...)
+ TODO: check
+CVE-2026-111761 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protoc ...)
+ TODO: check
+CVE-2026-111756 (follow-redirects is a Node.js HTTP and HTTPS client wrapper that autom ...)
+ TODO: check
+CVE-2026-111090 (A logic error exists in the signature verification routine resulting i ...)
+ TODO: check
+CVE-2026-111088 (A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log ...)
+ TODO: check
+CVE-2026-110725 (fast-uri is a dependency-free RFC 3986 URI parser and serializer for N ...)
+ TODO: check
+CVE-2026-110306 (fast-uri is a dependency-free RFC 3986 URI parser and serializer for N ...)
+ TODO: check
+CVE-2026-110180 (fast-uri is a dependency-free RFC 3986 URI parser and serializer for N ...)
+ TODO: check
+CVE-2026-109700 (Missing Authorization vulnerability in eLightUp Meta Box \u2013 WordPr ...)
+ TODO: check
+CVE-2026-108089 (** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system informati ...)
+ TODO: check
+CVE-2026-108088 (** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive info ...)
+ TODO: check
+CVE-2026-108087 (** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special ele ...)
+ TODO: check
+CVE-2026-108086 (** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive enti ...)
+ TODO: check
+CVE-2026-108062 (Pre-authentication OIDC discovery and JWKS fetches run synchronously o ...)
+ TODO: check
+CVE-2026-107755 (Insufficient filtering of credentials in the _replicator database in A ...)
+ TODO: check
+CVE-2026-107597 (PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the ...)
+ TODO: check
+CVE-2026-105949 (Cruise Control's Jetty ConstraintSecurityHandler registers security co ...)
+ TODO: check
+CVE-2026-105941 (The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted ...)
+ TODO: check
+CVE-2026-105772 (Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScrip ...)
+ TODO: check
+CVE-2026-105312 (A Kubernetes tenant with create permission on Console custom resources ...)
+ TODO: check
+CVE-2026-105311 (The StreamsHub Console operator acts as a confused deputy: a Kubernete ...)
+ TODO: check
+CVE-2026-103119 (Buffer under-read vulnerability in Apache Tomcat meant that a large no ...)
+ TODO: check
+CVE-2026-101356 (Incorrect object recycling and re-use vulnerability in Apache Tomcat a ...)
+ TODO: check
+CVE-2026-101296 (A missing critical step in authentication vulnerability in Apache Tomc ...)
+ TODO: check
+CVE-2026-101201 (A malformed header in the binary file fed to QBinaryJson::fromBinaryDa ...)
+ TODO: check
+CVE-2026-100134 (Acrobat for Edge is affected by an out-of-bounds write vulnerability t ...)
+ TODO: check
+CVE-2026-100132 (Acrobat for Edge is affected by an out-of-bounds read vulnerability th ...)
+ TODO: check
+CVE-2025-71436 (Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-b ...)
+ TODO: check
+CVE-2024-2323 (The RemoteUserStoreManagerService does not sufficiently validate passw ...)
+ TODO: check
CVE-2026-71195
- manila <unfixed> (bug #1151439)
NOTE: https://security.openstack.org/ossa/OSSA-2026-046.html
CVE-2026-93856
- cinder <unfixed> (bug #1151437)
NOTE: https://security.openstack.org/ossa/OSSA-2026-045.html
-CVE-2026-113401
+CVE-2026-113401 (Denial-of-service in the PDF Viewer component. This vulnerability was ...)
- firefox <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113401
-CVE-2026-113400
+CVE-2026-113400 (Uninitialized memory in the Audio/Video: cubeb component. This vulnera ...)
- firefox <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113400
-CVE-2026-113470
+CVE-2026-113470 (Mozilla blocked compromised intermediate eMudhra certificates via OneC ...)
- firefox <unfixed>
- firefox-esr <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113470
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-112/#CVE-2026-113470
NOTE: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
NOTE: https://www.openwall.com/lists/oss-security/2026/10/20/1
-CVE-2026-113399
+CVE-2026-113399 (Incorrect boundary conditions in the SVG component. This vulnerability ...)
- firefox <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113399
CVE-2026-97627 (Hidden functionality issue exists in Multiple DVRs (Digital Video Reco ...)
@@ -630,7 +1192,7 @@ CVE-2026-111879
NOTE: Fixed by: https://github.com/perl5-dbi/dbi/commit/99bbf2ab9d137e6f042a770bd3bbba3bc0b3a901 (1.656)
CVE-2026-111946 (Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclo ...)
NOT-FOR-US: Plack::Middleware::ETag Perl module
-CVE-2026-113386 [Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action]
+CVE-2026-113386 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by ...)
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447 (1.6.20)
@@ -4937,7 +5499,7 @@ CVE-2026-111312 (OpenHealth through 0.2.0 contains a missing authentication and
NOT-FOR-US: OpenHealth
CVE-2026-111284 (Aureus ERP through 1.6.0 contains a stored cross-site scripting vulner ...)
NOT-FOR-US: Aureus ERP
-CVE-2026-111283 (BMC Helix Network Management on-prem before 26.3.01 contains an authen ...)
+CVE-2026-111283 (BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains a ...)
NOT-FOR-US: BMC Helix Network Management on-prem
CVE-2026-111282 (Driftregion iso14229 before 0.10.1 contains an integer wraparound in H ...)
NOT-FOR-US: Driftregion iso14229
@@ -11307,7 +11869,7 @@ CVE-2026-102206 (Heap-based buffer overflow in Windows Portable Device MTP Drive
NOT-FOR-US: Microsoft
CVE-2026-102205 (Heap-based buffer overflow in Windows Universal Disk Format File Syste ...)
NOT-FOR-US: Microsoft
-CVE-2026-102204 (Improper link resolution before file access ('link following') in Micr ...)
+CVE-2026-102204 (Improper link resolution before file access ('link following') in Wind ...)
NOT-FOR-US: Microsoft
CVE-2026-102203 (Access of resource using incompatible type ('type confusion') in RPC R ...)
NOT-FOR-US: Microsoft
@@ -26171,7 +26733,7 @@ CVE-2026-97248 (Unauthenticated PHP Object Injection in Booking Activities <= 1.
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97247 (Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 v ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-97246 (Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 ...)
+CVE-2026-97246 (Deserialization of Untrusted Data vulnerability in ShortPixel ShortPix ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97245 (Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.)
NOT-FOR-US: WordPress plugin or theme
@@ -97002,7 +97564,7 @@ CVE-2026-96279 (A malicious OCI registry can hardlink arbitrary host files into
[bullseye] - flatpak <not-affected> (Vulnerable code not present)
NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-9rww-v4mm-x4jg
NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/e6fa2f9b416ec382644694c8737dc8fbe7f07b89 (1.18.1)
-CVE-2026-92162 [GHSA-v2gw-v9h5-9q4x]
+CVE-2026-92162 (Flatpak is a system for building, distributing, and running sandboxed ...)
{DSA-6524-1 DSA-6432-1}
- flatpak 1.18.1-1 (bug #1144130)
NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-v2gw-v9h5-9q4x
@@ -105991,15 +106553,15 @@ CVE-2026-54715 (GoAccess is a real-time web log analyzer and interactive viewer
NOTE: Fixed by: https://github.com/allinurl/goaccess/commit/81f90d9dafd6956c188dea9f944d24946d3d3351 (v1.11)
CVE-2026-52539 (Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When t ...)
NOT-FOR-US: Outstatic CMS
-CVE-2026-43833 (Full details and mitigation steps are currently restricted and will be ...)
+CVE-2026-43833 (A stack-based buffer overflow vulnerability in the upload functionalit ...)
NOT-FOR-US: Advantech
-CVE-2026-43832 (Full details and mitigation steps are currently restricted and will be ...)
+CVE-2026-43832 (A stack-based buffer overflow vulnerability in the Cookie parsing meth ...)
NOT-FOR-US: Advantech
-CVE-2026-43831 (Full details and mitigation steps are currently restricted and will be ...)
+CVE-2026-43831 (A stack-based buffer overflow vulnerability in the log message functio ...)
NOT-FOR-US: Advantech
-CVE-2026-43830 (Full details and mitigation steps are currently restricted and will be ...)
+CVE-2026-43830 (A command injection vulnerability in the firmware upgrade file verific ...)
NOT-FOR-US: Advantech
-CVE-2026-43829 (Full details and mitigation steps are currently restricted and will be ...)
+CVE-2026-43829 (A stack-based buffer overflow vulnerability in the password functional ...)
NOT-FOR-US: Advantech
CVE-2026-38709 (TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 ...)
NOT-FOR-US: Cudy
@@ -245986,7 +246548,7 @@ CVE-2025-50401 (Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to
NOT-FOR-US: Mercury D196G
CVE-2025-50398 (Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffe ...)
NOT-FOR-US: Mercury D196G
-CVE-2025-49300 (Insertion of Sensitive Information Into Sent Data vulnerability in shi ...)
+CVE-2025-49300 (Insertion of Sensitive Information Into Sent Data vulnerability in Shi ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-46296 (An authorization bypass vulnerability in FileMaker Server Admin Consol ...)
NOT-FOR-US: Apple
@@ -479129,7 +479691,7 @@ CVE-2023-44093 (Vulnerability of package names' public keys not being verified i
NOT-FOR-US: Huawei
CVE-2023-43960 (An issue in DLINK DPH-400SE FRU 2.2.15.8 allows a remote attacker to e ...)
NOT-FOR-US: DLINK
-CVE-2023-43661 (Cachet, the open-source status page system. Prior to the 2.4 branch, a ...)
+CVE-2023-43661 (Cachet is an open-source status page system. Prior to the 2.4 branch, ...)
NOT-FOR-US: Cachet
CVE-2023-42138 (Out-of-bounds read vulnerability exists in KV STUDIO Ver. 11.62 and ea ...)
NOT-FOR-US: KV STUDIO
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57ee7c54b1ac0da809f11979218ad9f847a6462a
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57ee7c54b1ac0da809f11979218ad9f847a6462a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261020/b13002d7/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list