[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Sat Oct 24 16:38:25 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
08d2810c by Moritz Muehlenhoff at 2026-10-24T17:30:17+02:00
trixie triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2400,9 +2400,11 @@ CVE-2026-XXXX [OSSN-01111: oslo.utils can log LUKS key material]
NOTE: https://docs.openstack.org/security-notes/OSSN-0111.html
CVE-2026-89419 (OpenStack Ironic before 39.0.1 sometimes allows a user to change the m ...)
- ironic 1:39.0.0-6 (bug #1151657)
+ [trixie] - ironic <no-dsa> (Minor issue)
NOTE: https://security.openstack.org/ossa/OSSA-2026-048.html
CVE-2026-90458 (OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passth ...)
- ironic 1:39.0.0-6 (bug #1151656)
+ [trixie] - ironic <no-dsa> (Minor issue)
NOTE: https://security.openstack.org/ossa/OSSA-2026-047.html
CVE-2026-XXXX [RUSTSEC-2026-0382]
- rust-rustls-webpki <unfixed> (bug #1151660)
@@ -2554,6 +2556,7 @@ CVE-2026-92206 (CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote C
NOT-FOR-US: CrewAI
CVE-2026-92205 (BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation ...)
- busybox <unfixed> (bug #1151857)
+ [trixie] - busybox <no-dsa> (Minor issue)
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-26-705/
CVE-2026-92204 (Airbyte OneDrive Connector _get_shared_drive_object Server-Side Reques ...)
NOT-FOR-US: Airbyte OneDrive Connector
@@ -10029,19 +10032,24 @@ CVE-2026-102503 (Missing Authentication for Critical Function (CWE-306) and Miss
NOT-FOR-US: Google SAM
CVE-2026-110336
- libplack-perl 1.0055-1 (unimportant; bug #1151241)
+ [trixie] - libplack-perl <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/plack/Plack/commit/92eba54ba698b4dad9009604064c9f9fe40e01eb (1.0055)
NOTE: Fix in documentation update only.
CVE-2026-110334
- libplack-perl 1.0055-1 (bug #1151241)
+ [trixie] - libplack-perl <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/plack/Plack/commit/92da1dd969bf1ce14eb031f007ca1ab64d402109 (1.0055)
CVE-2026-110335
- libplack-perl 1.0055-1 (bug #1151241)
+ [trixie] - libplack-perl <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/plack/Plack/commit/0ca608112188044d0764af59d5257efa9210ff84 (1.0055)
CVE-2026-110332
- libplack-perl 1.0055-1 (bug #1151241)
+ [trixie] - libplack-perl <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/plack/Plack/commit/580c331f0029d70166a8ac9d9f1df4d273582bd8 (1.0055)
CVE-2026-110333
- libplack-perl 1.0055-1 (bug #1151241)
+ [trixie] - libplack-perl <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/plack/Plack/commit/5389003eae39d3fe8fadd84bbeb85fa1b9f1dc7b (1.0055)
CVE-2026-96534 (The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern ...)
NOT-FOR-US: WordPress plugin
@@ -12739,6 +12747,7 @@ CVE-2026-30971 (ZoneMinder is a free, open source closed-circuit television soft
NOTE: Only supported for trusted users/behind auth
CVE-2026-17591 (A flaw was found in libarchive. An attacker can cause a Denial of Serv ...)
- libarchive 3.8.9-1
+ [trixie] - libarchive <no-dsa> (Minor issue)
NOTE: https://github.com/libarchive/libarchive/pull/3318
NOTE: Fixed by: https://github.com/mmatuska/libarchive/commit/45f7ec5422e7677673a7da1ae9ae2ac2b5721204 (v3.8.9)
CVE-2026-111855 (An issue was discovered on Tektronix 3 Series MDO devices before 1.21. ...)
@@ -15364,6 +15373,7 @@ CVE-2026-91156 (Discourse is an open-source discussion platform. Prior to 2026.9
NOT-FOR-US: Discourse
CVE-2026-90954 (A flaw was found in BusyBox's dpkg-deb archive extraction. The ar arch ...)
- busybox <unfixed>
+ [trixie] - busybox <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2533007
CVE-2026-89077 (Incorrect implementation of authentication algorithm vulnerability in ...)
NOT-FOR-US: Progress Software
@@ -20642,14 +20652,17 @@ CVE-2026-89097 (The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for WordP
NOT-FOR-US: WordPress plugin
CVE-2026-88838 (A flaw was found in BusyBox's mount utility. A non-root user can bypas ...)
- busybox <unfixed> (bug #1150940)
+ [trixie] - busybox <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531352
CVE-2026-88836
REJECTED
CVE-2026-88834 (A flaw was found in BusyBox's httpd web server. When configured with s ...)
- busybox <unfixed> (bug #1150941)
+ [trixie] - busybox <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531348
CVE-2026-88833 (A flaw was found in BusyBox's udhcpc DHCP client. When processing raw ...)
- busybox <unfixed> (bug #1150942)
+ [trixie] - busybox <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531347
CVE-2026-85990 (Leantime is an open source project management system. Prior to 3.10.0, ...)
NOT-FOR-US: Leantime
@@ -22585,6 +22598,7 @@ CVE-2026-109426 (Telegram-Stremio through 5.1.0 contains an insecure storage vul
NOT-FOR-US: Telegram-Stremio
CVE-2026-109425 (Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validati ...)
- golang-github-tink-crypto-tink-go <unfixed> (bug #1150934)
+ [trixie] - golang-github-tink-crypto-tink-go <no-dsa> (Minor issue)
NOTE: https://github.com/tink-crypto/tink-go/issues/68
CVE-2026-109424 (NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.3 ...)
NOT-FOR-US: NetEase Cloud Music client for Windows
@@ -27734,6 +27748,7 @@ CVE-2026-58068 (This vulnerability in Veeam Agent for Microsoft Windows allows a
NOT-FOR-US: Veeam
CVE-2026-56851 (The Nickname profile can panic with an out-of-bounds slice error when ...)
- golang-golang-x-text 0.41.0-1
+ [trixie] - golang-golang-x-text <no-dsa> (Minor issue)
NOTE: https://github.com/golang/go/issues/80112
NOTE: Fixed by: https://github.com/golang/text/commit/02aa981a75cb366b39e71729b935c15a7b4e146a (v0.41.0)
CVE-2026-46438 (wger is a free, open-source workout and fitness manager. Prior to vers ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/08d2810c6e77da7c6ea17d77e49ee71b5879094c
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/08d2810c6e77da7c6ea17d77e49ee71b5879094c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261024/53842494/attachment.htm>
More information about the debian-security-tracker-commits
mailing list