[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Mon Oct 26 19:13:29 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
57458f59 by security tracker role at 2026-10-26T19:13:19+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,53 +1,617 @@
-CVE-2026-99099 [x86/CPU/AMD: Fix AMD TLBI Erratum #1718]
+CVE-2026-97295 (Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media ...)
+ TODO: check
+CVE-2026-97255 (Authorization Bypass Through User-Controlled Key vulnerability in WPro ...)
+ TODO: check
+CVE-2026-97254 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-97200 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-96581 (Authorization Bypass Through User-Controlled Key vulnerability in ash- ...)
+ TODO: check
+CVE-2026-96432 (A malicious or compromised HTTP/2 server withholding SETTINGS ACK can ...)
+ TODO: check
+CVE-2026-95664 (Improper Neutralization of Special Elements used in an Expression Lang ...)
+ TODO: check
+CVE-2026-95663 (Insufficient Session Expiration vulnerability in Apache Camel Keycloak ...)
+ TODO: check
+CVE-2026-95629 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
+ TODO: check
+CVE-2026-95628 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
+ TODO: check
+CVE-2026-94386 (Use of Cache Containing Sensitive Information vulnerability in Apache ...)
+ TODO: check
+CVE-2026-94380 (Weak Password Recovery Mechanism for Forgotten Password vulnerability ...)
+ TODO: check
+CVE-2026-93850 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7 ...)
+ TODO: check
+CVE-2026-93849 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7 ...)
+ TODO: check
+CVE-2026-93848 (Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal- ...)
+ TODO: check
+CVE-2026-93847 (Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system ...)
+ TODO: check
+CVE-2026-93846 (Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in ...)
+ TODO: check
+CVE-2026-93328 (Path Traversal and Missing Authorization in cloud-storage source in Go ...)
+ TODO: check
+CVE-2026-92171 (A flaw was found in the Infinispan Operator for Red Hat Data Grid. Whe ...)
+ TODO: check
+CVE-2026-90885 (Improper Restriction of XML External Entity Reference vulnerability in ...)
+ TODO: check
+CVE-2026-89209 (A vulnerability has been identified in Mendix SAML (Mendix 10 compatib ...)
+ TODO: check
+CVE-2026-85297 (Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on G ...)
+ TODO: check
+CVE-2026-82947 (SOEM version 2.0.0 and earlier contains multiple vulnerabilities in fr ...)
+ TODO: check
+CVE-2026-82946 (SOEM version 2.0.0 and earlier contains a vulnerability where a malici ...)
+ TODO: check
+CVE-2026-82945 (SOEM version 2.0.0 and earlier contains a vulnerability during device ...)
+ TODO: check
+CVE-2026-82944 (SOEM version 2.0.0 and earlier contains a vulnerability in multi-segme ...)
+ TODO: check
+CVE-2026-82943 (SOEM version 2.0.0 and earlier contains vulnerabilities where a malici ...)
+ TODO: check
+CVE-2026-82390 (The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises ...)
+ TODO: check
+CVE-2026-82389 (In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag ...)
+ TODO: check
+CVE-2026-82388 (bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocate ...)
+ TODO: check
+CVE-2026-81509 (nforwardauth is a forward auth service that allows the use of a single ...)
+ TODO: check
+CVE-2026-81039 (The Bluetooth host pre-allocates a bt_conn object (a "reservation") fr ...)
+ TODO: check
+CVE-2026-81038 (The Object Transfer Service server builds its Object Action Control Po ...)
+ TODO: check
+CVE-2026-77062 (The boneIO Black web interface lacks proper clickjacking protections. ...)
+ TODO: check
+CVE-2026-77061 (boneIO Black directly excludes several API endpoints from the authenti ...)
+ TODO: check
+CVE-2026-77060 (boneIO black_debian_images stores the Mosquitto MQTT broker password f ...)
+ TODO: check
+CVE-2026-77059 (boneIO Black contains a TOCTOU race condition in the create_timedatect ...)
+ TODO: check
+CVE-2026-77058 (boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all ...)
+ TODO: check
+CVE-2026-77057 (boneIO Black does not limit authentication attempts on its web interfa ...)
+ TODO: check
+CVE-2026-77056 (boneIO black_debian_images ships with a Mosquitto MQTT broker that use ...)
+ TODO: check
+CVE-2026-77055 (boneIO black_debian_images gives the boneio service account excessive ...)
+ TODO: check
+CVE-2026-77054 (boneIO Black stores passwords, including the MQTT broker and web panel ...)
+ TODO: check
+CVE-2026-77053 (boneIO Black firmware ships with authentication disabled by default. I ...)
+ TODO: check
+CVE-2026-77052 (boneIO Black exposes a Node-RED instance without authentication at the ...)
+ TODO: check
+CVE-2026-72758 (When parsing an AS range in Routinator, if the maximum value of the ra ...)
+ TODO: check
+CVE-2026-72757 (Routinator runs out of open connections on the HTTP server when many c ...)
+ TODO: check
+CVE-2026-72756 (Routinator exits when an rsync URI for a file obtained over RRDP conta ...)
+ TODO: check
+CVE-2026-72755 (Routinator stores a newly-retrieved TA certificate via HTTPS in cache ...)
+ TODO: check
+CVE-2026-72754 (When Routinator encounters a CRL with many entries, it may hang or run ...)
+ TODO: check
+CVE-2026-72753 (When Routinator encounters an RRDP notification file with gaps in the ...)
+ TODO: check
+CVE-2026-72752 (Routinator runs out of memory when the JSON output is requested many t ...)
+ TODO: check
+CVE-2026-71456 (Use of hard-coded cryptographic key vulnerability in Johnson Controls ...)
+ TODO: check
+CVE-2026-71455 (Cleartext storage of sensitive information in memory vulnerability in ...)
+ TODO: check
+CVE-2026-70388 (SOEM version 2.0.0 and earlier contains vulnerabilities where a malici ...)
+ TODO: check
+CVE-2026-70379 (When the vSolution Matrix feature is enabled, affected devices may mak ...)
+ TODO: check
+CVE-2026-65226
+ REJECTED
+CVE-2026-65222
+ REJECTED
+CVE-2026-65221
+ REJECTED
+CVE-2026-65218
+ REJECTED
+CVE-2026-65217
+ REJECTED
+CVE-2026-65216
+ REJECTED
+CVE-2026-65215
+ REJECTED
+CVE-2026-65214
+ REJECTED
+CVE-2026-65212
+ REJECTED
+CVE-2026-65203
+ REJECTED
+CVE-2026-65202
+ REJECTED
+CVE-2026-65184 (The root-privileged `wsserver` terminal-bridge daemon builds a shell c ...)
+ TODO: check
+CVE-2026-59107 (A security vulnerability has been identified in the vSolution Matrix f ...)
+ TODO: check
+CVE-2026-59106 (A security vulnerability has been identified in the WolfProt interface ...)
+ TODO: check
+CVE-2026-50096 (There is a reflected cross site scripting vulnerability in Esri Portal ...)
+ TODO: check
+CVE-2026-50095 (There is a stored cross site scripting issue in Esri ArcGIS Server 11. ...)
+ TODO: check
+CVE-2026-4316 (Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGy ...)
+ TODO: check
+CVE-2026-3322 (Due to improper permission checks inLobster_pro, attackers are able to ...)
+ TODO: check
+CVE-2026-36698 (Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10 ...)
+ TODO: check
+CVE-2026-33522 (Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthe ...)
+ TODO: check
+CVE-2026-33521 (There is s denial of service vulnerability in Esri ArcGIS Server versi ...)
+ TODO: check
+CVE-2026-33520 (There is a reflected cross site scripting vulnerability in Esri Portal ...)
+ TODO: check
+CVE-2026-31158 (SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradein ...)
+ TODO: check
+CVE-2026-19742 (The IPv6 stack derived the long-lived secret key used to compute RFC 7 ...)
+ TODO: check
+CVE-2026-116638 (The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allo ...)
+ TODO: check
+CVE-2026-116634 (OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulne ...)
+ TODO: check
+CVE-2026-116632 (A malicious web page could insert arbitrary text into the FaceTime cal ...)
+ TODO: check
+CVE-2026-116631 (A malicious web page could open a tel link in a window that was showin ...)
+ TODO: check
+CVE-2026-116612 (A flaw was found in GStreamer Editing Services (gst-editing-services). ...)
+ TODO: check
+CVE-2026-116596 (Pyrus Sync for Windows contains a local privilege escalation vulnerabi ...)
+ TODO: check
+CVE-2026-116544 (Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerabili ...)
+ TODO: check
+CVE-2026-116543 (Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulner ...)
+ TODO: check
+CVE-2026-116542 (Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoo ...)
+ TODO: check
+CVE-2026-116541 (Netty netty-tcnative before 2.0.84.Final contains a denial of service ...)
+ TODO: check
+CVE-2026-116540 (netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL ...)
+ TODO: check
+CVE-2026-116539 (Netty netty-tcnative before 2.0.84.Final contains a heap buffer overfl ...)
+ TODO: check
+CVE-2026-116538 (HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-be ...)
+ TODO: check
+CVE-2026-116516 (Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zo ...)
+ TODO: check
+CVE-2026-116497 (A NULL pointer dereference vulnerability was found in gssproxy. When a ...)
+ TODO: check
+CVE-2026-116492 (Frappe CRM app before 1.89.1 contains a missing authorization vulnerab ...)
+ TODO: check
+CVE-2026-116489 (Timescale pgvectorscale before 0.9.1 contains a type confusion vulnera ...)
+ TODO: check
+CVE-2026-116488 (NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13 ...)
+ TODO: check
+CVE-2026-116487 (NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13 ...)
+ TODO: check
+CVE-2026-116486 (Objenesis before 3.6 contains a type confusion vulnerability that allo ...)
+ TODO: check
+CVE-2026-116485 (danmu_api before 1.21.7 contains an authentication bypass vulnerabilit ...)
+ TODO: check
+CVE-2026-116476 (A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-pr ...)
+ TODO: check
+CVE-2026-116471 (A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The i ...)
+ TODO: check
+CVE-2026-116469 (MISP Guard, a proxy-based security filter for MISP (Malware Informatio ...)
+ TODO: check
+CVE-2026-116467 (A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. ...)
+ TODO: check
+CVE-2026-116463 (A vulnerability was identified in FastStone Image Viewer up to 8.5. Af ...)
+ TODO: check
+CVE-2026-116461 (A vulnerability was determined in Omega Solution Restro POS up to 2026 ...)
+ TODO: check
+CVE-2026-116408 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-116403 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
+ TODO: check
+CVE-2026-116400 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-116398 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-116396 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-116395 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-116394 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
+ TODO: check
+CVE-2026-116388 (Missing Authorization vulnerability in TMS Amelia ameliabooking allows ...)
+ TODO: check
+CVE-2026-116385 (A security vulnerability has been detected in Bdtask Garage 24 Garage ...)
+ TODO: check
+CVE-2026-116384 (A weakness has been identified in Bdtask Garage 24 Garage Management S ...)
+ TODO: check
+CVE-2026-116372 (MISP mispguard is a security filtering proxy that inspects and blocks ...)
+ TODO: check
+CVE-2026-116371 (A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.4 ...)
+ TODO: check
+CVE-2026-116370 (A security flaw has been discovered in 2K Games Sid Meier's Civilizati ...)
+ TODO: check
+CVE-2026-116369 (A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-se ...)
+ TODO: check
+CVE-2026-116368 (A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. T ...)
+ TODO: check
+CVE-2026-116367 (A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This v ...)
+ TODO: check
+CVE-2026-116340 (A vulnerability was identified in iFlytek astron-agent up to 1.1.2. Th ...)
+ TODO: check
+CVE-2026-116339 (A vulnerability was determined in iFlytek astron-agent up to 1.1.2. Th ...)
+ TODO: check
+CVE-2026-116284 (A security vulnerability has been detected in Kameleo up to 5.3.1. Thi ...)
+ TODO: check
+CVE-2026-116283 (A weakness has been identified in Kameleo up to 5.0.1.26. This affects ...)
+ TODO: check
+CVE-2026-116282 (A security flaw has been discovered in Kameleo up to 5.3.1. Affected b ...)
+ TODO: check
+CVE-2026-116281 (A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by ...)
+ TODO: check
+CVE-2026-116280 (A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is ...)
+ TODO: check
+CVE-2026-116275 (A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impac ...)
+ TODO: check
+CVE-2026-116274 (A vulnerability has been found in JIZHICMS up to 2.5.6. This affects t ...)
+ TODO: check
+CVE-2026-116263 (A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The i ...)
+ TODO: check
+CVE-2026-116262 (A vulnerability was detected in libimobiledevice up to 1.4.0. The affe ...)
+ TODO: check
+CVE-2026-116261 (A security vulnerability has been detected in libimobiledevice up to 1 ...)
+ TODO: check
+CVE-2026-116260 (A weakness has been identified in libimobiledevice up to 1.4.0. This i ...)
+ TODO: check
+CVE-2026-116259 (A security flaw has been discovered in libimobiledevice up to 1.4.0. T ...)
+ TODO: check
+CVE-2026-116258 (A vulnerability was identified in libimobiledevice up to 1.4.0. This a ...)
+ TODO: check
+CVE-2026-116257 (A vulnerability was determined in BillaBear up to 2025.01.03. Affected ...)
+ TODO: check
+CVE-2026-116256 (A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627fa ...)
+ TODO: check
+CVE-2026-116255 (A vulnerability has been found in PGYER codefever up to 0c35e60f006f9d ...)
+ TODO: check
+CVE-2026-116254 (A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c ...)
+ TODO: check
+CVE-2026-116253 (A vulnerability was determined in DedeCMS 5.7.118. This vulnerability ...)
+ TODO: check
+CVE-2026-116237 (A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affect ...)
+ TODO: check
+CVE-2026-116236 (A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affect ...)
+ TODO: check
+CVE-2026-116235 (A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by thi ...)
+ TODO: check
+CVE-2026-116234 (A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected ...)
+ TODO: check
+CVE-2026-116233 (A security vulnerability has been detected in Oray Pugongying X5 Pro 7 ...)
+ TODO: check
+CVE-2026-116232 (A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This a ...)
+ TODO: check
+CVE-2026-116231 (A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. T ...)
+ TODO: check
+CVE-2026-116230 (A vulnerability was identified in Ndemic Creations Plague Inc Evolved ...)
+ TODO: check
+CVE-2026-116229 (A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up t ...)
+ TODO: check
+CVE-2026-116219 (Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulner ...)
+ TODO: check
+CVE-2026-116218 (Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulner ...)
+ TODO: check
+CVE-2026-116217 (RosarioSIS before 12.9.2 contains a reflected cross-site scripting vul ...)
+ TODO: check
+CVE-2026-116216 (MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerabi ...)
+ TODO: check
+CVE-2026-116215 (MacCMS v10 through 2026.1000.4056 contains a race condition vulnerabil ...)
+ TODO: check
+CVE-2026-116214 (MacCMS v10 before 2026.1000.4054 contains an authentication bypass vul ...)
+ TODO: check
+CVE-2026-116213 (Webasyst Framework through 4.4.0 contains an arbitrary file read vulne ...)
+ TODO: check
+CVE-2026-116212 (Webasyst Framework through 4.4.0 contains a stored cross-site scriptin ...)
+ TODO: check
+CVE-2026-116210 (Webasyst Framework through 4.4.0 contains a cross-site request forgery ...)
+ TODO: check
+CVE-2026-115966 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115961 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115960 (Missing Authorization vulnerability in WPExperts APIExperts Square for ...)
+ TODO: check
+CVE-2026-115959 (Missing Authorization vulnerability in WPExperts APIExperts Square for ...)
+ TODO: check
+CVE-2026-115958 (Missing Authorization vulnerability in WP Discussion Board WP Discussi ...)
+ TODO: check
+CVE-2026-115956 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115955 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115954 (Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mash ...)
+ TODO: check
+CVE-2026-115953 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115951 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115950 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115949 (Missing Authorization vulnerability in WP Smart Widgets Better Post & ...)
+ TODO: check
+CVE-2026-115948 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-115930 (The MongoDB Shell (mongosh) relies on Node.jsas a third-party runtime ...)
+ TODO: check
+CVE-2026-115923 (Backstage is an open framework for building developer portals. Prior t ...)
+ TODO: check
+CVE-2026-115922 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
+ TODO: check
+CVE-2026-115921 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
+ TODO: check
+CVE-2026-115920 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
+ TODO: check
+CVE-2026-115919 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
+ TODO: check
+CVE-2026-115918 (vLLM is an inference and serving engine for large language models. Fro ...)
+ TODO: check
+CVE-2026-115917 (vLLM is an inference and serving engine for large language models. Pri ...)
+ TODO: check
+CVE-2026-115916 (vLLM is an inference and serving engine for large language models. Pri ...)
+ TODO: check
+CVE-2026-115915 (vLLM is an inference and serving engine for large language models. Pri ...)
+ TODO: check
+CVE-2026-115914 (vLLM is an inference and serving engine for large language models. Fro ...)
+ TODO: check
+CVE-2026-115913 (vLLM is an inference and serving engine for large language models. Pri ...)
+ TODO: check
+CVE-2026-115912 (vLLM is an inference and serving engine for large language models. Pri ...)
+ TODO: check
+CVE-2026-115911 (vLLM is an inference and serving engine for large language models. Fro ...)
+ TODO: check
+CVE-2026-115910 (Python Social Auth is a social authentication and registration mechani ...)
+ TODO: check
+CVE-2026-115909 (zip is a zip library for Rust that supports reading and writing simple ...)
+ TODO: check
+CVE-2026-115908 (zip is a zip library for Rust that supports reading and writing simple ...)
+ TODO: check
+CVE-2026-115907 (zip is a zip library for Rust that supports reading and writing simple ...)
+ TODO: check
+CVE-2026-115906 (zip is a zip library for Rust that supports reading and writing simple ...)
+ TODO: check
+CVE-2026-115905 (zip is a zip library for Rust that supports reading and writing simple ...)
+ TODO: check
+CVE-2026-115804 (HashiCorp Consul and Consul Enterprise are vulnerable to an authorizat ...)
+ TODO: check
+CVE-2026-115748 (**UNSUPPORTED WHEN ASSIGNED**Authorization bypass in Apache Vysper, al ...)
+ TODO: check
+CVE-2026-115721 (**UNSUPPORTED WHEN ASSIGNED**Unbounded allocation in XML parsing in Ap ...)
+ TODO: check
+CVE-2026-115720 (Frappe Builder before 1.36.1 contains a server-side request forgery vu ...)
+ TODO: check
+CVE-2026-115718 (Frappe Builder versions 1.33.0 before1.36.0 contain a missing authoriz ...)
+ TODO: check
+CVE-2026-115717 (Frappe Builder versions before 1.36.1 contain a server-side request fo ...)
+ TODO: check
+CVE-2026-115700 (Interpretation Conflict vulnerability in hackney_url in benoitc hackne ...)
+ TODO: check
+CVE-2026-115693 (Improper Certificate Validation vulnerability in hackney_ssl in benoit ...)
+ TODO: check
+CVE-2026-115680 (Arm Keil MDK-Middleware 8.0.0-8.3.0 may allowDHCPv6 Option-Walk Over-R ...)
+ TODO: check
+CVE-2026-115679 (Arm Keil MDK-Middleware 8.3.0 may allowout-of-boundsreads and writes t ...)
+ TODO: check
+CVE-2026-115678 (Arm Keil MDK-Middleware 8.0.0-8.3.0 may allowpre-authentication out-of ...)
+ TODO: check
+CVE-2026-115614 (Missing Authorization vulnerability in Magepeople inc. Booking and Ren ...)
+ TODO: check
+CVE-2026-115613 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115608 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-115602 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115598 (Missing Authorization vulnerability in ThimPress LearnPress learnpress ...)
+ TODO: check
+CVE-2026-115597 (Missing Authorization vulnerability in ThimPress LearnPress learnpress ...)
+ TODO: check
+CVE-2026-115595 (Missing Authorization vulnerability in Supsystic Contact Form by Supsy ...)
+ TODO: check
+CVE-2026-115594 (Insertion of Sensitive Information Into Sent Data vulnerability in Dav ...)
+ TODO: check
+CVE-2026-115425 (Multiple cross site scripting (XSS) vulnerabilities affectOPNsense fir ...)
+ TODO: check
+CVE-2026-115418 (SQL injection in the database-query custom resource handlers in the Am ...)
+ TODO: check
+CVE-2026-115269 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-115196 (An Open Redirect vulnerability exists in the public form submission en ...)
+ TODO: check
+CVE-2026-115195 (A broken access control vulnerability exists in the Mautic Stats API ( ...)
+ TODO: check
+CVE-2026-115194 (A path traversal vulnerability exists in the Mautic Asset API. When cr ...)
+ TODO: check
+CVE-2026-115193 (A stored Cross-Site Scripting (XSS) vulnerability exists in the contac ...)
+ TODO: check
+CVE-2026-115192 (An SQL Injection vulnerability exists in the dashboard widget data API ...)
+ TODO: check
+CVE-2026-115191 (A SQL injection vulnerability exists in a contact lookup AJAX endpoint ...)
+ TODO: check
+CVE-2026-115190 (An insecure deserialization (PHP object injection) vulnerability exist ...)
+ TODO: check
+CVE-2026-115189 (A server-side template injection vulnerability exists in the Twig them ...)
+ TODO: check
+CVE-2026-115188 (An unrestricted file upload vulnerability exists in the campaign impor ...)
+ TODO: check
+CVE-2026-114710 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-114709 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-114708 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-114707 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-114216 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response S ...)
+ TODO: check
+CVE-2026-114213 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-113440 (Insufficiently Protected Credentials vulnerability in hackney in benoi ...)
+ TODO: check
+CVE-2026-113438 (Pleasanter provided fails to properly verify passwords in LDAP authent ...)
+ TODO: check
+CVE-2026-113436 (Inefficient Algorithmic Complexity vulnerability in the header integer ...)
+ TODO: check
+CVE-2026-112880 (Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Reque ...)
+ TODO: check
+CVE-2026-112865 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-112839 (Missing Authorization vulnerability in VillaTheme Customer Coupons for ...)
+ TODO: check
+CVE-2026-112828 (Missing Authorization vulnerability in Meow Apps AI Engine ai-engine a ...)
+ TODO: check
+CVE-2026-112346 (OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated ...)
+ TODO: check
+CVE-2026-112345 (TTLock Android application before v9.8.260718 and associated smart-loc ...)
+ TODO: check
+CVE-2026-112344 (Syncplify Server! before 8.8.0 contains a path traversal vulnerability ...)
+ TODO: check
+CVE-2026-112343 (Syncplify Server! before 8.8.0 contains an access control bypass vulne ...)
+ TODO: check
+CVE-2026-112250 (A vulnerability has been identified in BRAIN2 versions up to and inclu ...)
+ TODO: check
+CVE-2026-111841 (Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Auto ...)
+ TODO: check
+CVE-2026-111590 (A wide range of Harbor versions allow SSRF via its webhook delivery co ...)
+ TODO: check
+CVE-2026-111404 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
+ TODO: check
+CVE-2026-111103 (Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handl ...)
+ TODO: check
+CVE-2026-111101 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-110748 (This issue affects Apache SIS from version 0.7 through 1.6 inclusive. ...)
+ TODO: check
+CVE-2026-110733 (Vulnerability in the SQL storage module of Apache SIS. When sorting a ...)
+ TODO: check
+CVE-2026-110720 (Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespa ...)
+ TODO: check
+CVE-2026-110499 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-110475 (This vulnerability exists in the CreditNirvana Collections Platform du ...)
+ TODO: check
+CVE-2026-110474 (This vulnerability exists in the CreditNirvana Agentic AI Call Centre ...)
+ TODO: check
+CVE-2026-110377 (Missing Authorization vulnerability in VillaTheme Bopo \u2013 WooComme ...)
+ TODO: check
+CVE-2026-110376 (Missing Authorization vulnerability in VillaTheme DEPART depart-deposi ...)
+ TODO: check
+CVE-2026-110314 (Client-Side Enforcement of Server-Side Security vulnerability in the W ...)
+ TODO: check
+CVE-2026-10757 (There is a SQL injection vulnerability in Esri ArcGIS Server versions ...)
+ TODO: check
+CVE-2026-109584 (Improper Handling of Highly Compressed Data (Data Amplification) vulne ...)
+ TODO: check
+CVE-2026-108529 (Inefficient Algorithmic Complexity vulnerability in the HTTP/2 impleme ...)
+ TODO: check
+CVE-2026-108525 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-107656 (An authentication bypass using an alternate path or channel vulnerabil ...)
+ TODO: check
+CVE-2026-107157 (Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt ...)
+ TODO: check
+CVE-2026-107092 (NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update ...)
+ TODO: check
+CVE-2026-107091 (An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 al ...)
+ TODO: check
+CVE-2026-107090 (An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 ...)
+ TODO: check
+CVE-2026-107080 (OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, ...)
+ TODO: check
+CVE-2026-106781 (An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package ...)
+ TODO: check
+CVE-2026-106677 (Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServ ...)
+ TODO: check
+CVE-2026-106676 (qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in Cart ...)
+ TODO: check
+CVE-2026-105947 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
+ TODO: check
+CVE-2026-105765 (HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerab ...)
+ TODO: check
+CVE-2026-105626 (HashiCorp Consul and Consul Enterprise are vulnerable to a denial of s ...)
+ TODO: check
+CVE-2026-105608 (HashiCorp Consul and Consul Enterprise are vulnerable to an authorizat ...)
+ TODO: check
+CVE-2026-104594 (libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM ...)
+ TODO: check
+CVE-2026-104593 (osmo-msc through 1.15.0 contains a stack-based buffer overflow in deco ...)
+ TODO: check
+CVE-2026-104592 (libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP ...)
+ TODO: check
+CVE-2026-104591 (libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_com ...)
+ TODO: check
+CVE-2026-103377 (A reflected Cross-Site Scripting (XSS) vulnerability has been identifi ...)
+ TODO: check
+CVE-2026-102649 (Burrito is a Terraform Automation Collaboration Software (TACoS) Kuber ...)
+ TODO: check
+CVE-2026-101259 (Generation of Error Message Containing Sensitive Information vulnerabi ...)
+ TODO: check
+CVE-2013-10077 (A weakness has been identified in OctoPrint 1.0.0. This impacts the fu ...)
+ TODO: check
+CVE-2012-20006
+ REJECTED
+CVE-2026-99099 (In the Linux kernel, the following vulnerability has been resolved: x ...)
- linux 7.2.11-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/87db7795cbaaf636ae22ae031f4906db7bb77803 (7.3-rc7)
-CVE-2026-99097 [tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()]
+CVE-2026-99097 (In the Linux kernel, the following vulnerability has been resolved: t ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/b7f925fd5226deb953c8dcdc9677d3fcc2717c00 (7.3-rc7)
-CVE-2026-99096 [io_uring/register: don't exempt disabled rings from task restrictions]
+CVE-2026-99096 (In the Linux kernel, the following vulnerability has been resolved: i ...)
- linux 7.2.11-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/6da8f402e362b2f546e2efb7167fc9597aef6faf (7.3-rc7)
-CVE-2026-99094 [Bluetooth: btintel_pcie: fix TX descriptor bounds check]
+CVE-2026-99094 (In the Linux kernel, the following vulnerability has been resolved: B ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/baa53af641c9e3644e717b8dfd1b95a55a0c111b (7.3-rc7)
-CVE-2026-99093 [mm: don't schedule deferred kernel page table freeing while booting]
+CVE-2026-99093 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 7.2.11-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/2fb552b0bee70c24c092720028ab4620f5eb2646 (7.3-rc7)
-CVE-2026-99098 [dm-integrity: fix buffer overflow in inline mode with large tag size]
+CVE-2026-99098 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.11-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/764b683a6180fd72c931c13fea98d383506a3475 (7.3-rc7)
-CVE-2026-99095 [drm/vc4: drain the hangcheck timer and works on V3D unbind]
+CVE-2026-99095 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
NOTE: https://git.kernel.org/linus/94cf5971b1d04c6382437387c4dc3836cc7a1437 (7.3-rc7)
-CVE-2026-99092 [riscv: patch: fix handling of bpf-jit execmem addresses]
+CVE-2026-99092 (In the Linux kernel, the following vulnerability has been resolved: r ...)
- linux 7.2.11-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06 (7.3-rc7)
-CVE-2026-99091 [Bluetooth: MGMT: Fix status of pending commands flushed on power off]
+CVE-2026-99091 (In the Linux kernel, the following vulnerability has been resolved: B ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
NOTE: https://git.kernel.org/linus/86ef0f58bdecdedb3a1240971c56d71b7e4ce3fc (7.3-rc7)
-CVE-2026-99090 [drm/amdgpu: serialize vblank counter reads against GPU reset]
+CVE-2026-99090 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
NOTE: https://git.kernel.org/linus/1a6023edfbb5673f55fab6348f135fb3b1428ea5 (7.3-rc7)
-CVE-2026-99089 [ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM]
+CVE-2026-99089 (In the Linux kernel, the following vulnerability has been resolved: A ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
NOTE: https://git.kernel.org/linus/7529254014764ae0b8c33d5c61a58f36c65b1a1c (7.3-rc7)
-CVE-2026-99088 [net: openvswitch: validate transport header presence in set_ipv6_addr]
+CVE-2026-99088 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
NOTE: https://git.kernel.org/linus/3c6a4b11330fe424557538a98fca9f0a4c5bf313 (7.3-rc7)
@@ -2376,7 +2940,7 @@ CVE-2026-79846 (Command injection vulnerabilities exist in the affected interfac
NOT-FOR-US: HPE
CVE-2026-79844 (Authentication bypass vulnerabilities in the affected interface of AOS ...)
NOT-FOR-US: HPE
-CVE-2026-78846 (AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overfl ...)
+CVE-2026-78846 (Multiple AiDot devices are vulnerable to a heap-based buffer overflow ...)
NOT-FOR-US: AiDot Linkind Matter Smart Plug
CVE-2026-78801 (An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fib ...)
NOT-FOR-US: SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M)
@@ -4674,6 +5238,7 @@ CVE-2026-91489 (Vulnerability in the Oracle Identity Manager Connector product o
CVE-2026-91488 (Vulnerability in the Oracle Identity Manager Connector product of Orac ...)
NOT-FOR-US: Oracle
CVE-2026-91487 (Vulnerability in Oracle Java SE (component: Compiler). Supported vers ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4721,6 +5286,7 @@ CVE-2026-91466 (Vulnerability in the PeopleSoft Enterprise FIN Common Objects Ar
CVE-2026-91465 (Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentin ...)
NOT-FOR-US: Oracle
CVE-2026-91464 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4729,6 +5295,7 @@ CVE-2026-91464 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91463 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4737,6 +5304,7 @@ CVE-2026-91463 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91462 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4745,6 +5313,7 @@ CVE-2026-91462 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91461 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4763,6 +5332,7 @@ CVE-2026-91457 (Vulnerability in the Oracle Outside In Technology product of Ora
CVE-2026-91455 (Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle ...)
NOT-FOR-US: Oracle
CVE-2026-91453 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4771,6 +5341,7 @@ CVE-2026-91453 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91452 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4779,6 +5350,7 @@ CVE-2026-91452 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91451 (Vulnerability in Oracle Java SE (component: Networking). Supported ve ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4849,6 +5421,7 @@ CVE-2026-91420 (Vulnerability in the Siebel CRM Deployment product of Oracle Sie
CVE-2026-91419 (Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middl ...)
NOT-FOR-US: Oracle
CVE-2026-91418 (Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4860,6 +5433,7 @@ CVE-2026-91417 (Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise E
- openjdk-8 <unfixed> (bug #1151673)
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91415 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4874,12 +5448,14 @@ CVE-2026-91413 (Vulnerability in the Siebel CRM Development product of Oracle Si
CVE-2026-91412 (Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM ...)
NOT-FOR-US: Oracle
CVE-2026-91411 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
- openjdk-21 21.0.13+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91410 (Vulnerability in Oracle Java SE (component: Libraries). Supported ver ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4905,6 +5481,7 @@ CVE-2026-91402 (Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle Graal
[bookworm] - openjfx <not-affected> (Vulnerable code not present, only affects 21 and later)
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91400 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4915,6 +5492,7 @@ CVE-2026-91400 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
CVE-2026-91399 (Vulnerability in the Primavera P6 Enterprise Project Portfolio Managem ...)
NOT-FOR-US: Oracle
CVE-2026-91398 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4923,6 +5501,7 @@ CVE-2026-91398 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91397 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4939,6 +5518,7 @@ CVE-2026-91395 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-11 <unfixed>
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91394 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of ...)
+ {DLA-4861-1}
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
- openjdk-21 21.0.13+9-1
@@ -4971,6 +5551,7 @@ CVE-2026-91384 (Vulnerability in the JD Edwards EnterpriseOne Tools product of O
CVE-2026-91383 (Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle ...)
NOT-FOR-US: Oracle
CVE-2026-91382 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4980,6 +5561,7 @@ CVE-2026-91381 (Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise E
- openjdk-8 <unfixed> (bug #1151673)
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91380 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4988,6 +5570,7 @@ CVE-2026-91380 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91379 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5002,6 +5585,7 @@ CVE-2026-91377 (Vulnerability in the Siebel CRM Integration product of Oracle Si
CVE-2026-91376 (Vulnerability in the Primavera P6 Enterprise Project Portfolio Managem ...)
NOT-FOR-US: Oracle
CVE-2026-91375 (Vulnerability in Oracle Java SE (component: Libraries). Supported ver ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5010,6 +5594,7 @@ CVE-2026-91375 (Vulnerability in Oracle Java SE (component: Libraries). Support
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91374 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5018,6 +5603,7 @@ CVE-2026-91374 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91373 (Vulnerability in Oracle Java SE (component: JSSE). Supported versions ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5100,6 +5686,7 @@ CVE-2026-91337 (Vulnerability in the iProcurement product of Oracle E-Business S
CVE-2026-91336 (Vulnerability in the Oracle Solaris product of Oracle Systems (compone ...)
NOT-FOR-US: Oracle
CVE-2026-91335 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5108,6 +5695,7 @@ CVE-2026-91335 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91334 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5121,6 +5709,7 @@ CVE-2026-91333 (Vulnerability in Oracle Java SE (component: Security). Supporte
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91332 (Vulnerability in Oracle Java SE (component: Networking). Supported ve ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5489,6 +6078,7 @@ CVE-2026-87370 (Vulnerability in the Oracle WebCenter Content product of Oracle
CVE-2026-87369 (Vulnerability in the Oracle Service Bus product of Oracle Fusion Middl ...)
NOT-FOR-US: Oracle
CVE-2026-87367 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5639,6 +6229,7 @@ CVE-2026-87296 (Vulnerability in the Oracle Access Manager product of Oracle Fus
CVE-2026-87295 (Vulnerability in the Oracle HRMS (India) product of Oracle E-Business ...)
NOT-FOR-US: Oracle
CVE-2026-87294 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5650,6 +6241,7 @@ CVE-2026-87293 (Vulnerability in Oracle Java SE (component: RMI). Supported ver
- openjdk-8 <unfixed> (bug #1151673)
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-87292 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5663,6 +6255,7 @@ CVE-2026-87291 (Vulnerability in Oracle Java SE (component: Networking). Suppor
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-87290 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5701,6 +6294,7 @@ CVE-2026-83402 (Vulnerability in the Oracle Identity Manager product of Oracle F
CVE-2026-83401 (Vulnerability in the Oracle Identity Manager product of Oracle Fusion ...)
NOT-FOR-US: Oracle
CVE-2026-83400 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5717,6 +6311,7 @@ CVE-2026-83397 (Vulnerability in the Oracle Data Integrator product of Oracle Fu
CVE-2026-83396 (Vulnerability in the Oracle Data Integrator product of Oracle Fusion M ...)
NOT-FOR-US: Oracle
CVE-2026-83395 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5739,6 +6334,7 @@ CVE-2026-83389 (Vulnerability in the Oracle HRMS (UK) product of Oracle E-Busine
CVE-2026-83388 (Vulnerability in the Oracle Applications Manager product of Oracle E-B ...)
NOT-FOR-US: Oracle
CVE-2026-83387 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5757,6 +6353,7 @@ CVE-2026-83383 (Vulnerability in the Oracle HRMS (US) product of Oracle E-Busine
CVE-2026-83382 (Vulnerability in the Oracle Report Manager product of Oracle E-Busines ...)
NOT-FOR-US: Oracle
CVE-2026-83381 (Vulnerability in Oracle Java SE (component: Security). Supported vers ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5765,6 +6362,7 @@ CVE-2026-83381 (Vulnerability in Oracle Java SE (component: Security). Supporte
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-83380 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5782,6 +6380,7 @@ CVE-2026-83378 (Vulnerability in Oracle Java SE (component: Compiler). Supporte
CVE-2026-83377 (Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Sui ...)
NOT-FOR-US: Oracle
CVE-2026-83376 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5792,6 +6391,7 @@ CVE-2026-83376 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
CVE-2026-83375 (Vulnerability in the PeopleSoft Enterprise HCM Human Resources product ...)
NOT-FOR-US: Oracle
CVE-2026-83374 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6090,15 +6690,15 @@ CVE-2026-113869 (When Thunderbird asked for a security device password (for exam
- thunderbird <not-affected> (Only affects Thunderbird post ESR153)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-114/#CVE-2026-113869
CVE-2026-113868 (When authenticating to a POP3 or SMTP server using NTLM, Thunderbird d ...)
- {DSA-6585-1}
+ {DSA-6585-1 DLA-4863-1}
- thunderbird 1:153.5.1esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/#CVE-2026-113868
CVE-2026-113867 (Thunderbird did not escape attribute values when serializing outgoing ...)
- {DSA-6585-1}
+ {DSA-6585-1 DLA-4863-1}
- thunderbird 1:153.5.1esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/#CVE-2026-113867
CVE-2026-113866 (When setting up an account, Thunderbird's Exchange AutoDiscover lookup ...)
- {DSA-6585-1}
+ {DSA-6585-1 DLA-4863-1}
- thunderbird 1:153.5.1esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/#CVE-2026-113866
CVE-2026-113776 (virtualenv is a tool for creating isolated virtual python environments ...)
@@ -9149,7 +9749,7 @@ CVE-2026-113400 (Uninitialized memory in the Audio/Video: cubeb component. This
- firefox 158.0.1-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113400
CVE-2026-113470 (Cryptographic issue in the Security Block-lists, Allow-lists, and othe ...)
- {DSA-6585-1 DSA-6573-1 DLA-4847-1}
+ {DSA-6585-1 DSA-6573-1 DLA-4863-1 DLA-4847-1}
- firefox 158.0.1-1
- firefox-esr 153.5.1esr-1
- thunderbird 1:153.5.1esr-1
@@ -21425,7 +22025,7 @@ CVE-2026-74045 (Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow
NOT-FOR-US: Wazuh
CVE-2026-74043 (Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability ...)
NOT-FOR-US: Wazuh
-CVE-2026-74041 (Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch betwee ...)
+CVE-2026-74041 (Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mism ...)
NOT-FOR-US: Wazuh
CVE-2026-74040 (Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file over ...)
NOT-FOR-US: Wazuh
@@ -21606,7 +22206,7 @@ CVE-2026-11731 (An authentication bypass vulnerability in the listed NETGEAR RAX
CVE-2026-11730 (Insufficient session randomness vulnerability in the listed NETGEAR Ex ...)
NOT-FOR-US: Netgear
CVE-2026-110249 (A malicious, compromised, or MITM-controlled Exchange server can retur ...)
- {DSA-6585-1}
+ {DSA-6585-1 DLA-4863-1}
- thunderbird 1:153.5.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-110249
CVE-2026-110247 (Several buffer-growth sites in libmime performed size arithmetic in 32 ...)
@@ -22272,7 +22872,7 @@ CVE-2026-109704 (Privilege escalation in the Application Update component. This
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109704
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109704
CVE-2026-109705 (Sandbox escape, site isolation issue due to incorrect boundary conditi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22280,7 +22880,7 @@ CVE-2026-109705 (Sandbox escape, site isolation issue due to incorrect boundary
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109705
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109705
CVE-2026-109706 (Use-after-free in the Storage: IndexedDB component. This vulnerability ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22288,7 +22888,7 @@ CVE-2026-109706 (Use-after-free in the Storage: IndexedDB component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109706
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109706
CVE-2026-109707 (Sandbox escape due to use-after-free in the Networking component. This ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22296,7 +22896,7 @@ CVE-2026-109707 (Sandbox escape due to use-after-free in the Networking componen
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109707
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109707
CVE-2026-109708 (Sandbox escape due to incorrect boundary conditions in the Networking ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22304,7 +22904,7 @@ CVE-2026-109708 (Sandbox escape due to incorrect boundary conditions in the Netw
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109708
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109708
CVE-2026-109709 (Information disclosure, privilege escalation in the Security: Process ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22312,7 +22912,7 @@ CVE-2026-109709 (Information disclosure, privilege escalation in the Security: P
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109709
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109709
CVE-2026-109710 (Use-after-free in the Graphics: Text component. This vulnerability was ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22320,7 +22920,7 @@ CVE-2026-109710 (Use-after-free in the Graphics: Text component. This vulnerabil
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109710
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109710
CVE-2026-109711 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22328,7 +22928,7 @@ CVE-2026-109711 (Use-after-free in the Graphics: Canvas2D component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109711
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109711
CVE-2026-109712 (Sandbox escape due to uninitialized memory in the Graphics component. ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22336,7 +22936,7 @@ CVE-2026-109712 (Sandbox escape due to uninitialized memory in the Graphics comp
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109712
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109712
CVE-2026-109713 (Use-after-free in the Crash Reporting component. This vulnerability wa ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22347,7 +22947,7 @@ CVE-2026-109714 (Incorrect boundary conditions in the Layout component. This vul
- firefox 158.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109714
CVE-2026-109715 (Incorrect boundary conditions in the JavaScript Engine component. This ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22355,7 +22955,7 @@ CVE-2026-109715 (Incorrect boundary conditions in the JavaScript Engine componen
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109715
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109715
CVE-2026-109716 (Incorrect boundary conditions in the JavaScript Engine component. This ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22363,7 +22963,7 @@ CVE-2026-109716 (Incorrect boundary conditions in the JavaScript Engine componen
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109716
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109716
CVE-2026-109717 (Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerabi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22371,7 +22971,7 @@ CVE-2026-109717 (Use-after-free in the DOM: Bindings (WebIDL) component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109717
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109717
CVE-2026-109718 (Use-after-free in the XML component. This vulnerability was fixed in F ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22379,7 +22979,7 @@ CVE-2026-109718 (Use-after-free in the XML component. This vulnerability was fix
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109718
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109718
CVE-2026-109719 (Race condition, use-after-free in the Graphics: CanvasWebGL component. ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22387,7 +22987,7 @@ CVE-2026-109719 (Race condition, use-after-free in the Graphics: CanvasWebGL com
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109719
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109719
CVE-2026-109720 (JIT miscompilation in the JavaScript: WebAssembly component. This vuln ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22395,7 +22995,7 @@ CVE-2026-109720 (JIT miscompilation in the JavaScript: WebAssembly component. Th
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109720
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109720
CVE-2026-109721 (Incorrect boundary conditions in the JavaScript Engine: JIT component. ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22403,7 +23003,7 @@ CVE-2026-109721 (Incorrect boundary conditions in the JavaScript Engine: JIT com
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109721
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109721
CVE-2026-109722 (JIT miscompilation in the JavaScript Engine: JIT component. This vulne ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22411,7 +23011,7 @@ CVE-2026-109722 (JIT miscompilation in the JavaScript Engine: JIT component. Thi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109722
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109722
CVE-2026-109723 (Integer overflow in the Layout: Text and Fonts component. This vulnera ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22419,7 +23019,7 @@ CVE-2026-109723 (Integer overflow in the Layout: Text and Fonts component. This
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109723
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109723
CVE-2026-109724 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22427,14 +23027,14 @@ CVE-2026-109724 (Use-after-free in the DOM: Core & HTML component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109724
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109724
CVE-2026-109725 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109725
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109725
CVE-2026-109726 (Use-after-free in the SVG component. This vulnerability was fixed in F ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22442,7 +23042,7 @@ CVE-2026-109726 (Use-after-free in the SVG component. This vulnerability was fix
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109726
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109726
CVE-2026-109727 (Use-after-free in the Audio/Video component. This vulnerability was fi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22450,7 +23050,7 @@ CVE-2026-109727 (Use-after-free in the Audio/Video component. This vulnerability
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109727
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109727
CVE-2026-109728 (Use-after-free in the DOM: Animation component. This vulnerability was ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22458,7 +23058,7 @@ CVE-2026-109728 (Use-after-free in the DOM: Animation component. This vulnerabil
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109728
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109728
CVE-2026-109729 (Use-after-free in the JavaScript Engine: JIT component. This vulnerabi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22466,7 +23066,7 @@ CVE-2026-109729 (Use-after-free in the JavaScript Engine: JIT component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109729
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109729
CVE-2026-109730 (Integer overflow in the Graphics component. This vulnerability was fix ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22474,7 +23074,7 @@ CVE-2026-109730 (Integer overflow in the Graphics component. This vulnerability
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109730
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109730
CVE-2026-109731 (Incorrect boundary conditions in the Graphics: Canvas2D component. Thi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22482,7 +23082,7 @@ CVE-2026-109731 (Incorrect boundary conditions in the Graphics: Canvas2D compone
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109731
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109731
CVE-2026-109732 (Use-after-free in the DOM: Streams component. This vulnerability was f ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22490,7 +23090,7 @@ CVE-2026-109732 (Use-after-free in the DOM: Streams component. This vulnerabilit
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109732
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109732
CVE-2026-109733 (JIT miscompilation in the JavaScript Engine: JIT component. This vulne ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22498,7 +23098,7 @@ CVE-2026-109733 (JIT miscompilation in the JavaScript Engine: JIT component. Thi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109733
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109733
CVE-2026-109734 (Mitigation bypass in the DOM: Security component. This vulnerability w ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22509,7 +23109,7 @@ CVE-2026-109735 (Use-after-free in the DOM: Animation component. This vulnerabil
- firefox 158.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109735
CVE-2026-109736 (Frame poisoning in the Layout component. This vulnerability was fixed ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22517,7 +23117,7 @@ CVE-2026-109736 (Frame poisoning in the Layout component. This vulnerability was
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109736
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109736
CVE-2026-109737 (Mitigation bypass in the Enterprise Policies component. This vulnerabi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22525,7 +23125,7 @@ CVE-2026-109737 (Mitigation bypass in the Enterprise Policies component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109737
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109737
CVE-2026-109738 (Use-after-free in the Audio/Video: Playback component. This vulnerabil ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22543,7 +23143,7 @@ CVE-2026-109740 (Sandbox escape due to incorrect boundary conditions in the Widg
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109740
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109740
CVE-2026-109741 (Use-after-free in the Storage: Bucket File System component. This vuln ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22551,7 +23151,7 @@ CVE-2026-109741 (Use-after-free in the Storage: Bucket File System component. Th
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109741
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109741
CVE-2026-109742 (Information disclosure in the PDF Viewer component. This vulnerability ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22559,7 +23159,7 @@ CVE-2026-109742 (Information disclosure in the PDF Viewer component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109742
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109742
CVE-2026-109743 (Privilege escalation in the Panning and Zooming component. This vulner ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22567,7 +23167,7 @@ CVE-2026-109743 (Privilege escalation in the Panning and Zooming component. This
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109743
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109743
CVE-2026-109744 (Other issue in the DOM: File component. This vulnerability was fixed i ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22575,7 +23175,7 @@ CVE-2026-109744 (Other issue in the DOM: File component. This vulnerability was
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109744
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109744
CVE-2026-109745 (Sandbox escape due to uninitialized memory in the DOM: Web Serial comp ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22598,7 +23198,7 @@ CVE-2026-109750 (Site isolation issue in the DOM: Web Authentication component.
- firefox 158.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109750
CVE-2026-109751 (Information disclosure in the Networking component. This vulnerability ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22606,7 +23206,7 @@ CVE-2026-109751 (Information disclosure in the Networking component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109751
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109751
CVE-2026-109752 (Use-after-free in the DOM: Workers component. This vulnerability was f ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22614,7 +23214,7 @@ CVE-2026-109752 (Use-after-free in the DOM: Workers component. This vulnerabilit
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109752
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109752
CVE-2026-109753 (Incorrect boundary conditions in the Layout component. This vulnerabil ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22622,7 +23222,7 @@ CVE-2026-109753 (Incorrect boundary conditions in the Layout component. This vul
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109753
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109753
CVE-2026-109754 (Incorrect boundary conditions in the DOM: Editor component. This vulne ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22633,7 +23233,7 @@ CVE-2026-109755 (Sandbox escape in the DOM: Content Processes component. This vu
- firefox 158.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109755
CVE-2026-109756 (Privilege escalation in the DOM: Navigation component. This vulnerabil ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22641,7 +23241,7 @@ CVE-2026-109756 (Privilege escalation in the DOM: Navigation component. This vul
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109756
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109756
CVE-2026-109757 (Sandbox escape due to race condition in the Networking component. This ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22649,7 +23249,7 @@ CVE-2026-109757 (Sandbox escape due to race condition in the Networking componen
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109757
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109757
CVE-2026-109759 (Site isolation issue in the Networking component. This vulnerability w ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22657,7 +23257,7 @@ CVE-2026-109759 (Site isolation issue in the Networking component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109759
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109759
CVE-2026-109760 (Mitigation bypass in the Networking: HTTP component. This vulnerabilit ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22668,7 +23268,7 @@ CVE-2026-109761 (Use-after-free in the JavaScript: WebAssembly component. This v
- firefox 158.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109761
CVE-2026-109762 (Incorrect boundary conditions in the SVG component. This vulnerability ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22676,7 +23276,7 @@ CVE-2026-109762 (Incorrect boundary conditions in the SVG component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109762
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109762
CVE-2026-109763 (Mitigation bypass in the File Handling component. This vulnerability w ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22684,7 +23284,7 @@ CVE-2026-109763 (Mitigation bypass in the File Handling component. This vulnerab
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109763
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109763
CVE-2026-109764 (Mitigation bypass in the Enterprise Policies component. This vulnerabi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22692,7 +23292,7 @@ CVE-2026-109764 (Mitigation bypass in the Enterprise Policies component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109764
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109764
CVE-2026-109765 (Race condition, use-after-free in the Graphics: Text component. This v ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22700,7 +23300,7 @@ CVE-2026-109765 (Race condition, use-after-free in the Graphics: Text component.
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109765
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109765
CVE-2026-109766 (Mitigation bypass in the Enterprise Policies component. This vulnerabi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22708,7 +23308,7 @@ CVE-2026-109766 (Mitigation bypass in the Enterprise Policies component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109766
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109766
CVE-2026-109767 (Information disclosure in the Networking component. This vulnerability ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22722,7 +23322,7 @@ CVE-2026-109769 (Information disclosure in the Networking: Cache component. This
- firefox 158.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109769
CVE-2026-109770 (Spoofing issue in the DOM: Web Serial component. This vulnerability wa ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22742,7 +23342,7 @@ CVE-2026-109774 (Invalid pointer, undefined behavior in the DOM: Notifications c
- firefox 158.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109774
CVE-2026-109775 (Denial-of-service in the WebRTC component. This vulnerability was fixe ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22750,7 +23350,7 @@ CVE-2026-109775 (Denial-of-service in the WebRTC component. This vulnerability w
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109775
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109775
CVE-2026-109776 (Race condition in the XPCOM component. This vulnerability was fixed in ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22758,7 +23358,7 @@ CVE-2026-109776 (Race condition in the XPCOM component. This vulnerability was f
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109776
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109776
CVE-2026-109777 (Information disclosure in the Storage: IndexedDB component. This vulne ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22766,7 +23366,7 @@ CVE-2026-109777 (Information disclosure in the Storage: IndexedDB component. Thi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109777
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109777
CVE-2026-109778 (Privilege escalation in the WebExtensions component. This vulnerabilit ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22780,7 +23380,7 @@ CVE-2026-109780 (Mitigation bypass in the DOM: Core & HTML component. This vulne
- firefox 158.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109780
CVE-2026-109781 (Denial-of-service in the Printing: Output component. This vulnerabilit ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -33128,9 +33728,9 @@ CVE-2026-17005 (The Horizontal scrolling announcements WordPress plugin through
NOT-FOR-US: WordPress plugin
CVE-2026-105135 (A vulnerability has been found in InternLM MindSearch 0.1.0. This issu ...)
NOT-FOR-US: InternLM MindSearch
-CVE-2026-105134 (A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerabili ...)
+CVE-2026-105134 (A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. Thi ...)
NOT-FOR-US: Ahsay AhsayCBS
-CVE-2026-105133 (A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affe ...)
+CVE-2026-105133 (A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4. ...)
NOT-FOR-US: Ahsay AhsayCBS
CVE-2026-105131 (ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulne ...)
NOT-FOR-US: ezBookkeeping
@@ -111489,7 +112089,8 @@ CVE-2026-65549 (Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 v
NOT-FOR-US: WordPress plugin or theme
CVE-2026-65548 (Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-65547 (Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.)
+CVE-2026-65547
+ REJECTED
NOT-FOR-US: WordPress plugin or theme
CVE-2026-65546 (Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.)
NOT-FOR-US: WordPress plugin or theme
@@ -111617,7 +112218,7 @@ CVE-2026-28179 (Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0
NOT-FOR-US: WordPress plugin or theme
CVE-2026-28178 (Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-28177 (Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 ve ...)
+CVE-2026-28177 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-28172 (Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Man ...)
NOT-FOR-US: WordPress plugin or theme
@@ -208193,6 +208794,7 @@ CVE-2026-4984 (The Twilio integration webhook handler accepts any POST request w
CVE-2026-4982 (A user with permission "update world" in any Venueless world is able t ...)
NOT-FOR-US: rami.io products
CVE-2026-4980 (A local file disclosure vulnerability in the XInclude processing compo ...)
+ {DLA-4862-1}
- inkscape 1.4-4
[bullseye] - inkscape <not-affected> (XInclude support added in v1.1)
NOTE: https://gitlab.com/inkscape/inkscape/-/work_items/3557
@@ -238701,7 +239303,7 @@ CVE-2025-69037 (Improper Control of Filename for Include/Require Statement in PH
NOT-FOR-US: WordPress plugin or theme
CVE-2025-69036 (Deserialization of Untrusted Data vulnerability in strongholdthemes Te ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2025-69035 (Deserialization of Untrusted Data vulnerability in strongholdthemes De ...)
+CVE-2025-69035 (Deserialization of Untrusted Data vulnerability in Strongholdthemes De ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-69005 (Improper Control of Filename for Include/Require Statement in PHP Prog ...)
NOT-FOR-US: WordPress plugin or theme
@@ -345952,9 +346554,9 @@ CVE-2025-2746 (An authentication bypass vulnerability in Kentico Xperience allow
NOT-FOR-US: Kentico
CVE-2025-2709 (A vulnerability has been found in Yonyou UFIDA ERP-NC 5.0 and classifi ...)
NOT-FOR-US: Yonyou UFIDA ERP-NC
-CVE-2025-2708 (A vulnerability, which was classified as critical, was found in zhijia ...)
+CVE-2025-2708 (A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. A ...)
NOT-FOR-US: zhijiantianya ruoyi-vue-pro
-CVE-2025-2707 (A vulnerability, which was classified as critical, has been found in z ...)
+CVE-2025-2707 (A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. T ...)
NOT-FOR-US: zhijiantianya ruoyi-vue-pro
CVE-2025-2706 (A vulnerability classified as critical was found in Digiwin ERP 5.0.1. ...)
NOT-FOR-US: Digiwin ERP
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57458f59f63fba0735ec5fb0fc738cbcfe0c9d86
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57458f59f63fba0735ec5fb0fc738cbcfe0c9d86
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261026/01ab2fac/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list