[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Oct 24 20:36:55 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
5c201df3 by Salvatore Bonaccorso at 2026-10-24T21:36:10+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -91,7 +91,7 @@ CVE-2026-110892 (Missing Authorization vulnerability in Brainstorm Force SureDas
CVE-2026-110018 (The aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Bui ...)
NOT-FOR-US: WordPress plugin
CVE-2026-114629 (Web::Simple versions before 0.035 for Perl allocate a buffer sized by ...)
- - libweb-simple-perl <unfixed>
+ - libweb-simple-perl <unfixed> (bug #1151935)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44599125/
NOTE: Fixed by: https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695 (v0.035)
CVE-2026-115936
@@ -159,7 +159,7 @@ CVE-2026-87901 (Improper sanitization in the registration module allows reflecte
CVE-2026-87835 (The Front End Users WordPress plugin through 3.2.35 does not restrict ...)
NOT-FOR-US: WordPress plugin
CVE-2026-83813 (Twisted is an event-based framework for internet applications, support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1151938)
[trixie] - twisted <no-dsa> (Minor issue)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-jj36-9pvh-vj5r
NOTE: https://github.com/twisted/twisted/pull/12700
@@ -355,7 +355,7 @@ CVE-2026-115885 (The LangGraph CLI is the official command-line interface for La
CVE-2026-115883 (LangGraph checkpoint savers provide Postgres- and SQLite-backed state ...)
NOT-FOR-US: LangGraph
CVE-2026-115877 (Twisted is an event-based framework for internet applications, support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1151938)
[trixie] - twisted <no-dsa> (Minor issue)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4
NOTE: https://github.com/twisted/twisted/pull/12755
@@ -394,33 +394,33 @@ CVE-2026-115786 (A mailbox quota-accounting vulnerability in Zimbra Collaboratio
CVE-2026-115785 (An SMTP command injection vulnerability in the data-source testing fun ...)
NOT-FOR-US: Zimbra
CVE-2026-115778 (Twisted is an event-based framework for internet applications, support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1151938)
[trixie] - twisted <no-dsa> (Minor issue)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-cwm5-jh59-mwxr
NOTE: https://github.com/twisted/twisted/pull/12750
NOTE: Fixed by: https://github.com/twisted/twisted/commit/073ba878c6c07d569cb61abc5ae76d46eff1b529 (twisted-26.10.0rc1)
NOTE: Fixed by: https://github.com/twisted/twisted/commit/5d91cc66a3591faba758a80a1479e0103602facc (twisted-26.10.0rc1)
CVE-2026-115776 (Twisted is an event-based framework for internet applications, support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1151938)
[trixie] - twisted <no-dsa> (Minor issue)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798
NOTE: https://github.com/twisted/twisted/pull/12771
NOTE: Fixed by: https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30 (twisted-26.10.0rc1)
NOTE: Fixed by: https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059 (twisted-26.10.0rc1)
CVE-2026-115775 (Twisted is an event-based framework for internet applications, support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1151938)
[trixie] - twisted <no-dsa> (Minor issue)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-3476-c5c2-fr73
NOTE: https://github.com/twisted/twisted/pull/12751
NOTE: Fixed by: https://github.com/twisted/twisted/commit/8873814bec8288e2466fad4d2c4d64039beb88b0 (twisted-26.10.0rc1)
CVE-2026-115774 (Twisted is an event-based framework for internet applications, support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1151938)
[trixie] - twisted <no-dsa> (Minor issue)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-2qrf-pqgx-qh9v
NOTE: https://github.com/twisted/twisted/pull/12764
NOTE: Fixed by: https://github.com/twisted/twisted/commit/3d125548bcbe955007cb97f480bb699a5e074741 (twisted-26.10.0rc1)
CVE-2026-115754 (serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scr ...)
- - node-serialize-javascript <unfixed>
+ - node-serialize-javascript <unfixed> (bug #1151937)
NOTE: https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v
NOTE: https://github.com/yahoo/serialize-javascript/pull/235
NOTE: Fixed by: https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61 (v7.1.3)
@@ -1951,13 +1951,13 @@ CVE-2026-115496 (Overly informative error messages in the catalog functionality
CVE-2026-115494 (A flaw in the cross-site request forgery (CSRF) prevention of KNIME Bu ...)
NOT-FOR-US: KNIME Business Hub
CVE-2026-115486 (A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Nei ...)
- - open-iscsi <unfixed>
+ - open-iscsi <unfixed> (bug #1151936)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2556267
CVE-2026-115485 (A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 o ...)
- - open-iscsi <unfixed>
+ - open-iscsi <unfixed> (bug #1151936)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2556266
CVE-2026-115484 (A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 o ...)
- - open-iscsi <unfixed>
+ - open-iscsi <unfixed> (bug #1151936)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2556265
CVE-2026-115482 (In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive ...)
NOT-FOR-US: lsquic
@@ -8478,7 +8478,7 @@ CVE-2026-111762 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A)
CVE-2026-111761 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protoc ...)
NOT-FOR-US: A2A Java SDK
CVE-2026-111756 (follow-redirects is a Node.js HTTP and HTTPS client wrapper that autom ...)
- - node-follow-redirects <unfixed>
+ - node-follow-redirects <unfixed> (bug #1151931)
NOTE: https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8
NOTE: Fixed by: https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff (v1.16.1)
CVE-2026-111090 (A logic error exists in the signature verification routine resulting i ...)
@@ -8948,7 +8948,7 @@ CVE-2026-112254 (A vulnerability was found in agit8or1 clientst0r up to 3.17.586
CVE-2026-112148 (A vulnerability has been identified in LIFF SDK versions 2.20.0 throug ...)
NOT-FOR-US: LIFF SDK
CVE-2026-111766 (markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the ...)
- - node-markdown-it <unfixed>
+ - node-markdown-it <unfixed> (bug #1151932)
NOTE: https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q
NOTE: Fixed by: https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79 (15.0.3)
NOTE: Fixed by: https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503 (14.3.3)
@@ -9476,7 +9476,7 @@ CVE-2026-11319 (TickTick Android application (com.ticktick.task) 8.2.2.0 contain
CVE-2026-112377 (CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to b ...)
NOT-FOR-US: CCC Attestation SIG attested-tls-poc
CVE-2026-112368 (An uncontrolled recursion weakness in the BSON decoding logic of the M ...)
- - php-mongodb <unfixed>
+ - php-mongodb <unfixed> (bug #1151934)
[trixie] - php-mongodb <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/PHPC-276
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/795e914e6f7cc631a2f80c89aedcdd2a1df4ada9 (2.5.5, 2.1.12, 1.21.12)
@@ -9754,7 +9754,7 @@ CVE-2026-111759 (markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, w
CVE-2026-111757 (Hono is a Web application framework that provides support for any Java ...)
NOT-FOR-US: Hono
CVE-2026-111755 (follow-redirects is a Node.js HTTP and HTTPS client wrapper that autom ...)
- - node-follow-redirects <unfixed>
+ - node-follow-redirects <unfixed> (bug #1151930)
NOTE: https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c
NOTE: Fixed by: https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8 (v1.16.1)
CVE-2026-111750 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
@@ -10257,7 +10257,7 @@ CVE-2026-111999 (Vanus 0.8.0 through 0.9.0 contains a missing authentication vul
CVE-2026-111998 (Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability ...)
NOT-FOR-US: Vanus
CVE-2026-111997 (ip-address before 10.7.4 allows a denial of service (CPU consumption f ...)
- - node-ip-address <unfixed>
+ - node-ip-address <unfixed> (bug #1151933)
NOTE: https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5
CVE-2026-111993 (A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015a ...)
NOT-FOR-US: Soarkey StudentManagement
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5c201df354d157540071262322ff470e25f06a1d
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5c201df354d157540071262322ff470e25f06a1d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261024/9a42dcd0/attachment.htm>
More information about the debian-security-tracker-commits
mailing list