[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Sat Oct 24 20:14:57 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ba2c25a0 by security tracker role at 2026-10-24T19:14:50+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,4 +1,96 @@
-CVE-2026-114629
+CVE-2026-94075 (Deserialization of Untrusted Data vulnerability in Tribulant Software  ...)
+	TODO: check
+CVE-2026-116020 (BookStack before 26.09.2 contains an incorrect authorization vulnerabi ...)
+	TODO: check
+CVE-2026-116019 (Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability t ...)
+	TODO: check
+CVE-2026-116018 (ONEARMY community-platform before 2.165.2 contains an insecure direct  ...)
+	TODO: check
+CVE-2026-116017 (Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object r ...)
+	TODO: check
+CVE-2026-116016 (yudao-cloud through 2026.09 contains an authorization bypass vulnerabi ...)
+	TODO: check
+CVE-2026-116015 (yudao-cloud through 2026.09 contains an insecure direct object referen ...)
+	TODO: check
+CVE-2026-116014 (open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataTy ...)
+	TODO: check
+CVE-2026-116013 (OpenResty lua-resty-dns before 0.24 contains an improper input validat ...)
+	TODO: check
+CVE-2026-116012 (Ghidra before 12.2 contains a numeric truncation vulnerability in Pack ...)
+	TODO: check
+CVE-2026-116011 (Crow before 1.3.4 contains an uncontrolled recursion vulnerability in  ...)
+	TODO: check
+CVE-2026-116010 (RosarioSIS before 12.9.1 contains a missing authorization vulnerabilit ...)
+	TODO: check
+CVE-2026-116009 (Camaleon CMS before 2.9.3 contains a path traversal vulnerability that ...)
+	TODO: check
+CVE-2026-116008 (DaybydayCRM through 2.2.1 contains a missing authorization vulnerabili ...)
+	TODO: check
+CVE-2026-115998 (IDOR in Cervantes version v1.3-beta could allow an authenticated attac ...)
+	TODO: check
+CVE-2026-115994 (BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-b ...)
+	TODO: check
+CVE-2026-115993 (Stored XSS vulnerability in the \u201cNotes\u201d field of the Checkli ...)
+	TODO: check
+CVE-2026-115975 (Broken access control in JiraController in Cervantes version v1.3-beta ...)
+	TODO: check
+CVE-2026-115973 (A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Aff ...)
+	TODO: check
+CVE-2026-115972 (A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0. ...)
+	TODO: check
+CVE-2026-115971 (A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the f ...)
+	TODO: check
+CVE-2026-115970 (A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts ...)
+	TODO: check
+CVE-2026-115969 (A flaw has been found in Travisun Opptrix 0.4.0. This affects an unkno ...)
+	TODO: check
+CVE-2026-115933 (Postiz signs its session, invitation and password reset tokens with on ...)
+	TODO: check
+CVE-2026-115932 (When a post is published, Postiz treats a media path that is not a web ...)
+	TODO: check
+CVE-2026-115557 (Python has added a denylist for known compromised certificates to the  ...)
+	TODO: check
+CVE-2026-114820 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+	TODO: check
+CVE-2026-114705 (Missing Authorization vulnerability in quadlayers WP Social Feed Galle ...)
+	TODO: check
+CVE-2026-114704 (Deserialization of Untrusted Data vulnerability in Christoph Vielgrade ...)
+	TODO: check
+CVE-2026-114697 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-114695 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-114694 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-114693 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-114196 (Deserialization of Untrusted Data vulnerability in paytiumsupport Payt ...)
+	TODO: check
+CVE-2026-114194 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-114192 (Missing Authorization vulnerability in Magepeople inc. WpEvently mage- ...)
+	TODO: check
+CVE-2026-114191 (Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Ga ...)
+	TODO: check
+CVE-2026-114190 (Insertion of Sensitive Information Into Sent Data vulnerability in Hai ...)
+	TODO: check
+CVE-2026-114179 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-114178 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-112869 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-112866 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+	TODO: check
+CVE-2026-112844 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+	TODO: check
+CVE-2026-111402 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+	TODO: check
+CVE-2026-110892 (Missing Authorization vulnerability in Brainstorm Force SureDash sured ...)
+	TODO: check
+CVE-2026-110018 (The aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Bui ...)
+	TODO: check
+CVE-2026-114629 (Web::Simple versions before 0.035 for Perl allocate a buffer sized by  ...)
 	- libweb-simple-perl <unfixed>
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44599125/
 	NOTE: Fixed by: https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695 (v0.035)
@@ -605,7 +697,7 @@ CVE-2026-115892 (Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7
 	NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0378.html
 	NOTE: https://github.com/advisories/GHSA-9pvw-hwfg-92h5
 	NOTE: https://github.com/bytecodealliance/wasmtime/pull/14827
-CVE-2026-115893 [RUSTSEC-2026-0379]
+CVE-2026-115893 (Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 4 ...)
 	- rust-wasmtime <unfixed> (bug #1151861)
 	NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0379.html
 	NOTE: https://github.com/advisories/GHSA-mghf-wjfp-p5xm
@@ -51141,6 +51233,7 @@ CVE-2026-77903 (Authentication bypass by spoofing in Microsoft Dataverse allows
 CVE-2026-77615 (Paella Player is a set of libraries to create a multi stream video pla ...)
 	NOT-FOR-US: Paella Player
 CVE-2026-77281 (Caddy is an extensible server platform that uses TLS by default. In ve ...)
+	{DLA-4857-1}
 	- caddy 2.11.4-1
 	[trixie] - caddy <no-dsa> (Minor issue)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9
@@ -151498,11 +151591,11 @@ CVE-2026-53753 (Crawl4AI is an open-source LLM friendly web crawler & scraper. P
 CVE-2026-53662 (immich is a high performance self-hosted photo and video management so ...)
 	NOT-FOR-US: immich
 CVE-2026-52846 (Caddy is an extensible server platform that uses TLS by default. Prior ...)
-	{DSA-6429-1}
+	{DSA-6429-1 DLA-4857-1}
 	- caddy 2.11.4-1 (bug #1140773)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v
 CVE-2026-52845 (Caddy is an extensible server platform that uses TLS by default. Prior ...)
-	{DSA-6429-1}
+	{DSA-6429-1 DLA-4857-1}
 	- caddy 2.11.4-1 (bug #1140773)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g
 CVE-2026-52844 (Caddy is an extensible server platform that uses TLS by default. Prior ...)
@@ -151562,7 +151655,7 @@ CVE-2026-48519 (Langflow is a tool for building and deploying AI-powered agents
 CVE-2026-45732 (n8n is an open source workflow automation platform. Prior to 1.123.43, ...)
 	NOT-FOR-US: n8n
 CVE-2026-45692 (Caddy is an extensible server platform that uses TLS by default. From  ...)
-	{DSA-6429-1}
+	{DSA-6429-1 DLA-4857-1}
 	- caddy 2.11.4-1 (bug #1140773)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-x5w9-xh9r-mvfc
 CVE-2026-45135 (Caddy is an extensible server platform that uses TLS by default. From  ...)
@@ -223975,19 +224068,19 @@ CVE-2026-2459 (A vulnerability exists in REB500 for an authenticated user with I
 CVE-2026-27732 (WWBN AVideo is an open source video platform. Prior to version 22.0, t ...)
 	NOT-FOR-US: WWBN AVideo
 CVE-2026-27590 (Caddy is an extensible server platform that uses TLS by default. Prior ...)
-	{DSA-6429-1}
+	{DSA-6429-1 DLA-4857-1}
 	- caddy 2.11.2-1 (bug #1132041)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-5r3v-vc8m-m96g
 CVE-2026-27589 (Caddy is an extensible server platform that uses TLS by default. Prior ...)
-	{DSA-6429-1}
+	{DSA-6429-1 DLA-4857-1}
 	- caddy 2.11.2-1 (bug #1132041)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-879p-475x-rqh2
 CVE-2026-27588 (Caddy is an extensible server platform that uses TLS by default. Prior ...)
-	{DSA-6429-1}
+	{DSA-6429-1 DLA-4857-1}
 	- caddy 2.11.2-1 (bug #1132041)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-x76f-jf84-rqj8
 CVE-2026-27587 (Caddy is an extensible server platform that uses TLS by default. Prior ...)
-	{DSA-6429-1}
+	{DSA-6429-1 DLA-4857-1}
 	- caddy 2.11.2-1 (bug #1132041)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-g7pc-pc7g-h8jh
 CVE-2026-27586 (Caddy is an extensible server platform that uses TLS by default. Prior ...)
@@ -224001,7 +224094,7 @@ CVE-2026-27586 (Caddy is an extensible server platform that uses TLS by default.
 	NOTE: convertPEMFilesToDER() were all added by the trusted CA provider modularization
 	NOTE: in 2.8.0; 2.6.2 has no such function and no swallowed error to fail open on.
 CVE-2026-27585 (Caddy is an extensible server platform that uses TLS by default. Prior ...)
-	{DSA-6429-1}
+	{DSA-6429-1 DLA-4857-1}
 	- caddy 2.11.2-1 (bug #1132041)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-4xrr-hq4w-6vf4
 CVE-2026-27584 (Actual is a local-first personal finance tool. Prior to version 26.2.1 ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ba2c25a03279b13eba7fb1becf04b58609acbb93

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ba2c25a03279b13eba7fb1becf04b58609acbb93
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261024/0ef66322/attachment.htm>

More information about the debian-security-tracker-commits mailing list