[Git][security-tracker-team/security-tracker][master] Add two new uv issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a2c185d5 by Salvatore Bonaccorso at 2026-10-22T22:12:34+02:00
Add two new uv issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2819,9 +2819,11 @@ CVE-2026-114112 (Sharp before 0.35.4 bundles a vulnerable libheif dependency tha
 CVE-2026-114111 (sharp before 0.35.5 bundles a librsvg dependency affected by a memory- ...)
 	NOT-FOR-US: Sharp
 CVE-2026-114110 (Astral uv before 0.11.6 contains a path traversal vulnerability that a ...)
-	TODO: check
+	- uv <unfixed>
+	NOTE: https://github.com/astral-sh/uv/security/advisories/GHSA-pjjw-68hj-v9mw
 CVE-2026-114109 (uv before 0.11.15 contains a path traversal vulnerability that allows  ...)
-	TODO: check
+	- uv <unfixed>
+	NOTE: https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph
 CVE-2026-114108 (HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authenti ...)
 	NOT-FOR-US: Vibe-Trading
 CVE-2026-114107 (HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a2c185d5d0eb7d857fe38650329af26ef4d68a5b

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a2c185d5d0eb7d857fe38650329af26ef4d68a5b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/e1b5155f/attachment-0001.htm>