[Git][security-tracker-team/security-tracker][master] bugnums
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Oct 23 23:11:03 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
190ee076 by Moritz Muehlenhoff at 2026-10-24T00:09:19+02:00
bugnums
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -931,7 +931,7 @@ CVE-2026-97785 (Improper authentication in AAD App Proxy allows an unauthorized
CVE-2026-97635 (The Agent Zero Web UI before 1.15 does not correctly sanitize user-pro ...)
NOT-FOR-US: Agent Zero Web UI
CVE-2026-97631 (EDK2 contains a vulnerability in BIOS where a user may cause \u201cOut ...)
- - edk2 <unfixed>
+ - edk2 <unfixed> (bug #1151853)
[trixie] - edk2 <no-dsa> (Minor issue)
NOTE: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
NOTE: https://github.com/tianocore/edk2/pull/13302
@@ -1286,7 +1286,7 @@ CVE-2026-115393 (Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 4
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0222.html
CVE-2026-115392 (Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, ...)
- - rust-wasmtime <unfixed>
+ - rust-wasmtime <unfixed> (bug #1151856)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0269.html
CVE-2026-115391 (Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an unc ...)
@@ -1299,17 +1299,17 @@ CVE-2026-115390 (Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0315.html
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14407
CVE-2026-115389 (Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0. ...)
- - rust-wasmtime <unfixed>
+ - rust-wasmtime <unfixed> (bug #1151856)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0316.html
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14415
CVE-2026-115388 (wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, a ...)
NOT-FOR-US: Rust wasmtime wasi-http
CVE-2026-115387 (Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0. ...)
- - rust-wasmtime <unfixed>
+ - rust-wasmtime <unfixed> (bug #1151856)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h
CVE-2026-115386 (Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0. ...)
- - rust-wasmtime <unfixed>
+ - rust-wasmtime <unfixed> (bug #1151856)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24
CVE-2026-115385 (Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a deni ...)
- rust-wasmtime <not-affected> (Only affects 46 and later)
@@ -1326,10 +1326,10 @@ CVE-2026-115382 (Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains
- rust-wasmtime <not-affected> (Only affects 46 and later)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv
CVE-2026-115381 (Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0. ...)
- - rust-wasmtime <unfixed>
+ - rust-wasmtime <unfixed> (bug #1151856)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv
CVE-2026-115380 (Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0. ...)
- - rust-wasmtime <unfixed>
+ - rust-wasmtime <unfixed> (bug #1151856)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm
CVE-2026-115379 (Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a miss ...)
- rust-wasmtime <not-affected> (Only affects 47 and later)
@@ -1941,7 +1941,7 @@ CVE-2026-92207 (MindsDB OpenBBtable Code Injection Remote Code Execution Vulnera
CVE-2026-92206 (CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Ex ...)
NOT-FOR-US: CrewAI
CVE-2026-92205 (BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation ...)
- - busybox <unfixed>
+ - busybox <unfixed> (bug #1151857)
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-26-705/
CVE-2026-92204 (Airbyte OneDrive Connector _get_shared_drive_object Server-Side Reques ...)
NOT-FOR-US: Airbyte OneDrive Connector
@@ -2918,13 +2918,13 @@ CVE-2026-102483 (Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remo
[trixie] - ntpsec <no-dsa> (Minor issue)
NOTE: https://blog.ntpsec.org/2026/10/20/version-1.2.6.html
CVE-2026-105482
- - nodejs <unfixed>
+ - nodejs <unfixed> (bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#dnsresolve-truncates-names-containing-nul-char-cve-2026-105482---high
CVE-2026-105483
- - nodejs <unfixed>
+ - nodejs <unfixed> (bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-ip-is-written-fullwidth-digits-cve-2026-105483---high
CVE-2026-106069
- - nodejs <unfixed>
+ - nodejs <unfixed> (bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-host-loosely-resolves-to-an-ip-address-cve-2026-106069---high
CVE-2026-111497 (A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) ...)
- brotli <unfixed> (bug #1151690)
@@ -2935,13 +2935,13 @@ CVE-2026-111497 (A buffer overflow vulnerability in the Brotli decoder (c/dec/de
NOTE: Fixed by: https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12 (v1.1.1)
NOTE: Fixed by: https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0 (v1.0.10)
CVE-2026-105481
- - nodejs <unfixed>
+ - nodejs <unfixed> (bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#keep-alive-socket-process-a-response-that-was-written-before-the-request-was-sent-cve-2026-105481---medium
CVE-2026-106072
- - nodejs <unfixed>
+ - nodejs <unfixed> (bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#improper-certificate-validation-for-non-canonical-ipv4-hostnames-allows-dns-sans-to-authenticate-ip-endpoints-cve-2026-106072---medium
CVE-2026-106074
- - nodejs <unfixed>
+ - nodejs <unfixed> (bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#cryptorandomuuid-and-randomint-entropy-caches-are-saved-into-user-land-startup-snapshots-and-seas-so-every-process-repeats-the-same-values-cve-2026-106074---medium
CVE-2026-106070
- nodejs <not-affected> (Vulnerable code introduced later)
@@ -2950,7 +2950,7 @@ CVE-2026-106071
- nodejs <not-affected> (Vulnerable code introduced later)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#permission-model-filesystem-over-grant-via-wildcard-radix-lookup-cve-2026-106071---low
CVE-2026-106073
- - nodejs <unfixed>
+ - nodejs <unfixed> (bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#permission-model-bypass-with-fsrealpathsync-cve-2026-106073---low
CVE-2026-112921 (Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report cli ...)
NOT-FOR-US: Robots::Validate Perl module
@@ -7152,7 +7152,7 @@ CVE-2026-96406 (A VideoStreaming interface reports the size of its whole class-s
CVE-2026-96402 (A malicious USB MTP/PTP device can cause the USBX host to read past a ...)
NOT-FOR-US: Eclipse
CVE-2026-95168 (An issue in nvbn thefuck v.3.32 allows a local attacker to execute arb ...)
- - thefuck <unfixed>
+ - thefuck <unfixed> (bug #1151855)
[trixie] - thefuck <no-dsa> (Minor issue)
NOTE: https://github.com/nvbn/thefuck/issues/1623
CVE-2026-95111 (A memory-protected ThreadX module's queue request reaches the Module M ...)
@@ -60661,7 +60661,7 @@ CVE-2026-82049 (In CPython 3.13 and earlier, the tarfilemodule's dataand tar ext
- python3.13 <unfixed>
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <not-affected> (extraction filters (PEP 706) absent in 3.11.2)
- - pypy3 <unfixed>
+ - pypy3 <unfixed> (bug #1151858)
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <not-affected> (extraction filters (PEP 706) absent in stdlib 3.9.16)
NOTE: https://github.com/python/cpython/issues/157190
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/190ee076d996ebef5cb2b5ebc506bf812fda3ae8
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/190ee076d996ebef5cb2b5ebc506bf812fda3ae8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/bf81b76c/attachment.htm>
More information about the debian-security-tracker-commits
mailing list