[Git][security-tracker-team/security-tracker][master] 3 commits: Add two new phpipam issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d14c46b2 by Salvatore Bonaccorso at 2026-10-25T08:41:23+01:00
Add two new phpipam issues

- - - - -
6dcfda05 by Salvatore Bonaccorso at 2026-10-25T08:42:07+01:00
Add CVE-2025-71437/uv

- - - - -
5db0f837 by Salvatore Bonaccorso at 2026-10-25T08:42:20+01:00
Add CVE-2025-71436/raptor2

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -25,9 +25,9 @@ CVE-2026-115996 (A vulnerability was detected in Unitree Robotics Unitree Go2 up
 CVE-2026-115995 (A security vulnerability has been detected in Unitree Robotics Unitree ...)
 	NOT-FOR-US: Unitree Robotics Unitree Go2
 CVE-2026-115982 (A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this  ...)
-	TODO: check
+	- phpipam <itp> (bug #731713)
 CVE-2026-115981 (A security vulnerability has been detected in phpIPAM up to 1.8.3. Aff ...)
-	TODO: check
+	- phpipam <itp> (bug #731713)
 CVE-2026-115251 (The Duplicator  WordPress plugin before 5.0.0 does not restrict its on ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-115214 (The Datawiza Proxy Auth Plugin  WordPress plugin before 1.1.1 does not ...)
@@ -6830,7 +6830,8 @@ CVE-2026-101103 (The PEAK-System PCAN diagnostic call did not validate that the
 CVE-2026-100145 (The Synchrony Financing WordPress plugin before 1.1.2 does not properl ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2025-71437 (Astral uv before 0.8.22 contains a path traversal vulnerability in sou ...)
-	TODO: check
+	- uv <not-affected> (Fixed before initial upload to Debian)
+	NOTE: https://github.com/astral-sh/uv/security/advisories/GHSA-7j9j-68r2-f35q
 CVE-2025-60496 (A Floating-Point Exception (FPE) in the reframer_send_packet function  ...)
 	- gpac <removed>
 CVE-2025-60494 (A segmentation violation in the gf_props_equal_internal function (/fil ...)
@@ -8636,7 +8637,9 @@ CVE-2026-100134 (Acrobat for Edge is affected by an out-of-bounds write vulnerab
 CVE-2026-100132 (Acrobat for Edge is affected by an out-of-bounds read vulnerability th ...)
 	NOT-FOR-US: Adobe
 CVE-2025-71436 (Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-b ...)
-	TODO: check
+	- raptor2 <unfixed>
+	NOTE: https://github.com/dajobe/raptor/issues/83
+	NOTE: Fixed by: https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575
 CVE-2024-2323 (The RemoteUserStoreManagerService does not sufficiently validate passw ...)
 	NOT-FOR-US: WSO2
 CVE-2026-71195 (In OpenStack Manila before 23.0.1, multiple Manila API operations on p ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/3d0bca969eec0574f3107691e2ae41610a56a350...5db0f837d63773e0d402340efdd1d8e5d856c417

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/3d0bca969eec0574f3107691e2ae41610a56a350...5db0f837d63773e0d402340efdd1d8e5d856c417
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261025/30a0fd5b/attachment.htm>