[Git][security-tracker-team/security-tracker][master] Track first batch of now assigned CVEs for incus issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8dbca5b2 by Salvatore Bonaccorso at 2026-10-23T09:35:44+02:00
Track first batch of now assigned CVEs for incus issues

- - - - -


2 changed files:

- data/CVE/list
- data/DSA/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -362,16 +362,6 @@ CVE-2026-115380 (Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 befor
 	TODO: check
 CVE-2026-115379 (Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a miss ...)
 	TODO: check
-CVE-2026-115378 (Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contain ...)
-	TODO: check
-CVE-2026-115377 (Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contain ...)
-	TODO: check
-CVE-2026-115376 (Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorizat ...)
-	TODO: check
-CVE-2026-115375 (Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traver ...)
-	TODO: check
-CVE-2026-115374 (Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature v ...)
-	TODO: check
 CVE-2026-115373 (Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contain ...)
 	TODO: check
 CVE-2026-115372 (Incus from 7.3.0 before 7.5.0 contains a project restriction bypass th ...)
@@ -42088,31 +42078,29 @@ CVE-2026-XXXX [GHSA-4cph-ccqv-hm3c]
 	- incus 7.0.1-5
 	[trixie] - incus 6.0.4-2+deb13u11
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-4cph-ccqv-hm3c
-CVE-2026-XXXX [GHSA-hpjh-q53p-f27r]
+CVE-2026-115375 [GHSA-hpjh-q53p-f27r]
 	- incus 7.0.1-5
 	[trixie] - incus <not-affected> (Vulnerable code not present, only affects 7.x)
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-hpjh-q53p-f27r
-CVE-2026-XXXX [GHSA-579w-c4rw-c8q3]
+CVE-2026-115377 [GHSA-579w-c4rw-c8q3]
 	- incus 7.0.1-5
-	[trixie] - incus 6.0.4-2+deb13u11
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-579w-c4rw-c8q3
 CVE-2026-XXXX [GHSA-x8gj-2q73-qr6j]
 	- incus 7.0.1-5
 	[trixie] - incus 6.0.4-2+deb13u11
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-x8gj-2q73-qr6j
-CVE-2026-XXXX [GHSA-mmj7-8rgf-mx2h]
+CVE-2026-115374 [GHSA-mmj7-8rgf-mx2h]
 	- incus 7.0.1-5
 	[trixie] - incus <not-affected> (Vulnerable code not present, only affects 7.x)
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-mmj7-8rgf-mx2h
-CVE-2026-XXXX [GHSA-jh4v-j34r-2mgh]
+CVE-2026-115376 [GHSA-jh4v-j34r-2mgh]
 	- incus 7.0.1-5
-	[trixie] - incus 6.0.4-2+deb13u11
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-jh4v-j34r-2mgh
 CVE-2026-XXXX [GHSA-mfwv-x733-9446]
 	- incus 7.0.1-5
 	[trixie] - incus 6.0.4-2+deb13u11
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-mfwv-x733-9446
-CVE-2026-XXXX [GHSA-wfvq-qh87-gm4j]
+CVE-2026-115378 [GHSA-wfvq-qh87-gm4j]
 	- incus 7.0.1-5
 	[trixie] - incus <postponed> (Wait until 6.x backport is available)
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-wfvq-qh87-gm4j


=====================================
data/DSA/list
=====================================
@@ -181,6 +181,7 @@
 	{CVE-2026-97149}
 	[trixie] - swift 2.35.1-0+deb13u4
 [26 Sep 2026] DSA-6518-1 incus - security update
+	{CVE-2026-115376 CVE-2026-115377}
 	[trixie] - incus 6.0.4-2+deb13u11
 [26 Sep 2026] DSA-6517-1 nodejs - security update
 	{CVE-2026-48617 CVE-2026-48618 CVE-2026-48619 CVE-2026-48928 CVE-2026-48930 CVE-2026-48931 CVE-2026-48933 CVE-2026-48934 CVE-2026-48935 CVE-2026-48937 CVE-2026-56846 CVE-2026-56847 CVE-2026-56848 CVE-2026-56850 CVE-2026-58039 CVE-2026-58042 CVE-2026-58043}



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8dbca5b2e49dc7ba2d4107418355553b414ebb77

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8dbca5b2e49dc7ba2d4107418355553b414ebb77
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/bbc7a8aa/attachment-0001.htm>