[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Sat Oct 24 23:11:06 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
2ef5a372 by Moritz Muehlenhoff at 2026-10-25T00:10:40+02:00
trixie triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2077,30 +2077,39 @@ CVE-2026-115356 (OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, wh
- openbao <itp> (bug #1069794)
CVE-2026-115355 (Mistune before 3.3.0 contains a path traversal vulnerability in the In ...)
- mistune 3.3.4-1
+ [trixie] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-h7ww-273w-6cm8
CVE-2026-115354 (Mistune before 3.3.0 contains a path traversal vulnerability in the op ...)
- mistune 3.3.4-1
+ [trixie] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-jhcm-5rpf-j3wv
CVE-2026-115353 (Mistune before 3.3.0 contains a path traversal vulnerability in the RS ...)
- mistune 3.3.4-1
+ [trixie] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-9jjx-3hq3-hx4j
CVE-2026-115352 (Mistune before 3.3.0 contains an algorithmic complexity vulnerability ...)
- mistune 3.3.4-1
+ [trixie] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-xrpv-r66x-8p7j
CVE-2026-115351 (Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability ...)
- mistune 3.3.4-1
+ [trixie] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-xmwc-wjpr-q378
CVE-2026-115350 (Mistune before 3.3.0 contains a cross-site scripting vulnerability in ...)
- mistune 3.3.4-1
+ [trixie] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-96vr-jm8v-g22j
CVE-2026-115349 (Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity den ...)
- mistune 3.3.4-1
+ [trixie] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-3q64-rw38-243v
CVE-2026-115348 (Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vul ...)
- mistune 3.3.4-1
+ [trixie] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-x2gr-6qf2-fc9x
CVE-2026-115347 (Mistune before 3.3.0 contains an inefficient algorithmic complexity vu ...)
- mistune 3.3.4-1
+ [trixie] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-f32h-38gf-rg5r
CVE-2026-115334 (Lotus through 0.10.2 contains an authorization bypass vulnerability in ...)
NOT-FOR-US: Lotus
@@ -15167,15 +15176,19 @@ CVE-2026-110873 (Heym from 0.0.55 before 0.0.121 contains a privilege escalation
NOT-FOR-US: Heym
CVE-2026-110872 (Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity d ...)
- node-nodemailer 10.0.10+~8.0.1-1
+ [trixie] - node-nodemailer <no-dsa> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc
CVE-2026-110871 (Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vuln ...)
- node-nodemailer 10.0.10+~8.0.1-1
+ [trixie] - node-nodemailer <no-dsa> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27
CVE-2026-110870 (Nodemailer from 3.0.0 before 10.0.13 contains an improper input valida ...)
- node-nodemailer 10.0.13+~8.0.2-1
+ [trixie] - node-nodemailer <no-dsa> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g73g-hqqh-jr95
CVE-2026-110869 (Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of ser ...)
- node-nodemailer 10.0.13+~8.0.2-1
+ [trixie] - node-nodemailer <no-dsa> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx
CVE-2026-110868 (Renovate before 44.79.0 contains a server-side request forgery vulnera ...)
NOT-FOR-US: Renovate
@@ -28031,8 +28044,9 @@ CVE-2026-107166 (A weakness has been identified in Open5GS up to 2.7.7. This vul
CVE-2026-107162 (Express Gateway through 1.16.11 contains an authentication bypass vuln ...)
NOT-FOR-US: Express Gateway
CVE-2026-107159 (MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero ...)
- - miniupnpd <unfixed> (bug #1150457)
+ - miniupnpd <unfixed> (bug #1150457; unimportant)
NOTE: Fixed by: https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a
+ NOTE: Debian build doesn't use --strict
CVE-2026-107151 (Missing authentication has been found in remote-execution task updates ...)
NOT-FOR-US: rubygem-smart_proxy_dynflow
CVE-2026-107125 (A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown ...)
@@ -61674,6 +61688,7 @@ CVE-2026-90699 (A weakness has been identified in D-Link DWR-M920 1.1.7. This is
NOT-FOR-US: D-Link
CVE-2026-90698 (A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. ...)
- memcached 1.6.45-1
+ [trixie] - memcached <no-dsa> (Minor issue)
[bookworm] - memcached <not-affected> (Vulnerable code not present)
NOTE: https://protectiv.ph/research/memcached-asciiauth-empty-line-dos
NOTE: protocol processing code deduplication done in: https://github.com/memcached/memcached/commit/778cfd6e56a276f69bdd1c4c7725c977147aee47 (1.6.40)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2ef5a37290921fbcdb83ffc2e583f46524c25158
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2ef5a37290921fbcdb83ffc2e583f46524c25158
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261024/d2b0eb1e/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list