[Git][security-tracker-team/security-tracker][pypy-cves] 30 commits: sign-advisory.sh: warn when about to sign an unmodified template
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Oct 27 19:39:47 GMT 2026
Moritz Muehlenhoff pushed to branch pypy-cves at Debian Security Tracker / security-tracker
Commits:
196c4494 by Aron Xu at 2026-10-27T13:38:26+08:00
sign-advisory.sh: warn when about to sign an unmodified template
Before signing, scan the advisory body for leftovers from the
gen-D{L,S}A template and ask for confirmation if any are found:
- unreplaced $VARIABLES (e.g. $bookworm_VERSION when no fixed
version was provided)
- the default $TEXT: "... text goes here" (0 or 1 CVE), "Brief
introduction" followed by bare "Description" lines (multiple
CVEs, as sent out by mistake in DSA-6584-1), or "The CVE ids will
be listed here when --save'ing"
Aborting is the default, so an unedited template can no longer be
signed by mistake, while a false positive only costs one keystroke.
The check runs before the .signed output file is created, so bailing
out leaves no empty/truncated file behind.
- - - - -
4c341ad6 by Salvatore Bonaccorso at 2026-10-27T15:36:40+01:00
Add two more erlang-json issues
- - - - -
9fa5a916 by Salvatore Bonaccorso at 2026-10-27T15:45:08+01:00
Add advisory references for X libraries from update in october
- - - - -
312964c7 by Salvatore Bonaccorso at 2026-10-27T15:46:00+01:00
Add two more libxi issues
- - - - -
5cc1255a by Salvatore Bonaccorso at 2026-10-27T15:49:02+01:00
Add another batch of upstream advisory reference for X library issues
- - - - -
c894d66c by Salvatore Bonaccorso at 2026-10-27T15:51:06+01:00
Add CVE-2026-109088/libxtst
- - - - -
33f24728 by Salvatore Bonaccorso at 2026-10-27T15:52:25+01:00
Add for consistency as well merge request for followup lbixi issues
- - - - -
094f31e6 by Salvatore Bonaccorso at 2026-10-27T16:22:20+01:00
Add new Asterisk issues
- - - - -
5fb45617 by Salvatore Bonaccorso at 2026-10-27T16:30:21+01:00
Merge branch 'sign-advisory-template-check' into 'master'
sign-advisory.sh: warn when about to sign an unmodified template
See merge request security-tracker-team/security-tracker!333
- - - - -
f78ac02c by Salvatore Bonaccorso at 2026-10-27T16:32:38+01:00
Track fixed version via unstable for CVE-2026-107570/mutt
- - - - -
6701e1d1 by Salvatore Bonaccorso at 2026-10-27T16:44:20+01:00
Add references for some python issues
Adding them should not cause conflict for the current WIP from Stefano
Rivera in https://salsa.debian.org/security-tracker-team/security-tracker/-/merge_requests/334
- - - - -
31569e21 by Stefano Rivera at 2026-10-27T17:58:36+02:00
Update Python 3.14 CVEs
- - - - -
6b872dd5 by Salvatore Bonaccorso at 2026-10-27T17:05:01+01:00
Process some NFUs
- - - - -
cc5901f6 by Salvatore Bonaccorso at 2026-10-27T17:19:52+01:00
Add two new devilutionx issues
- - - - -
b2bfacf2 by Salvatore Bonaccorso at 2026-10-27T17:22:00+01:00
Add new llama.cpp issues
- - - - -
d3dcf0f9 by Salvatore Bonaccorso at 2026-10-27T17:32:25+01:00
Add new python-autobahn issue
- - - - -
ca648b98 by Salvatore Bonaccorso at 2026-10-27T17:35:34+01:00
Merge branch 'cpython-cves' into 'master'
cPython CVEs
See merge request security-tracker-team/security-tracker!334
- - - - -
ae5aeca1 by Salvatore Bonaccorso at 2026-10-27T17:50:45+01:00
Add new tornado issues
- - - - -
7c7aa48f by Salvatore Bonaccorso at 2026-10-27T17:58:06+01:00
Merge Linux CVEs from kernel-sec
- - - - -
c2a91b7a by Salvatore Bonaccorso at 2026-10-27T19:20:31+01:00
Add new node-dompurify issues
- - - - -
78344700 by Salvatore Bonaccorso at 2026-10-27T19:23:52+01:00
Add CVE-2026-116748/transmission
- - - - -
334e8366 by Salvatore Bonaccorso at 2026-10-27T19:26:49+01:00
Process some NFUs
- - - - -
e26bf0f5 by Salvatore Bonaccorso at 2026-10-27T19:30:35+01:00
Add CVE-2026-116744/ndpi
- - - - -
58f61f92 by Moritz Mühlenhoff at 2026-10-27T19:49:56+01:00
pdns, php-mongodb, openjdk-21, thunderbird DSAs
- - - - -
c90bb135 by Moritz Mühlenhoff at 2026-10-27T19:53:49+01:00
fix advisory ID for thunderbird
- - - - -
0c5436ea by security tracker role at 2026-10-27T19:15:40+00:00
automatic update
- - - - -
d821bbdf by security tracker role at 2026-10-27T19:18:46+00:00
automatic NOT-FOR-US entries update
- - - - -
e77f24d3 by Salvatore Bonaccorso at 2026-10-27T20:24:41+01:00
Reference upstream fix CVE-2026-109828
- - - - -
43361c4e by Moritz Muehlenhoff at 2026-10-27T20:29:48+01:00
new qbittorrent issues
- - - - -
51f7eadb by Stefano Rivera at 2026-10-27T19:38:49+00:00
PyPy3 CVEs fixed in stdlib v3.11.17
- - - - -
4 changed files:
- bin/sign-advisory.sh
- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt
Changes:
=====================================
bin/sign-advisory.sh
=====================================
@@ -49,6 +49,19 @@ signed_dsa=${dsa}.signed
# figure out the offset for actual DSA text, after headers
n=$(awk '/^$/ {print NR+1 ; exit}' $dsa)
+# crude check for an unedited template: unreplaced $VARIABLES
+# (e.g. $bookworm_VERSION) or default $TEXT leftovers should never be
+# signed: "text goes here" (0 or 1 CVE), "Brief introduction" with
+# bare "Description" lines (multiple CVEs, cf. DSA-6584-1), or "The
+# CVE ids will be listed here when --save'ing"
+template_re='\$[A-Za-z_]+|text goes here|^Brief introduction[[:space:]]*$|^[[:space:]]+Description[[:space:]]*$|listed here when'
+if tail -n +"$n" "$dsa" | grep -qE "$template_re" ; then
+ echo "warning: $dsa looks like an unmodified advisory template:" >&2
+ tail -n +"$n" "$dsa" | grep -nE "$template_re" >&2
+ read -r -p "sign it anyway? [y/N] " reply
+ [[ $reply == [yY]* ]] || exit 1
+fi
+
# create empty destination file with same permissions as the source
:> $signed_dsa
chmod --reference=$dsa $signed_dsa
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,988 @@
+CVE-2026-XXXX [qbittorrent: unauthenticated memory exhaustion in the embedded tracker]
+ - qbittorrent 5.3.0-1 (bug #1151742)
+ [trixie] - qbittorrent <no-dsa> (Minor issue)
+ NOTE: https://github.com/qbittorrent/qBittorrent/pull/24869
+ NOTE: https://github.com/qbittorrent/qBittorrent/commit/56c9b81571a15df2d4b1a8c3d40fe6d35bf6eea5 (release-5.3.0rc1)
+CVE-2026-XXXX [qbittorrent: unsafe RSS and search-result URLs can execute JavaScript in WebUI]
+ - qbittorrent 5.3.0-1 (bug #1151741)
+ [trixie] - qbittorrent <no-dsa> (Minor issue)
+ NOTE: https://github.com/qbittorrent/qBittorrent/pull/24790
+ NOTE: https://github.com/qbittorrent/qBittorrent/commit/b1aa71d8445daeb49ec89afb8efc0c657d4d9663 (release-5.3.0rc1)
+CVE-2026-XXXX [qbittorrent: malicious RSS entries can trigger arbitrary local file deletion]
+ - qbittorrent 5.3.0-1 (bug #1151740)
+ [trixie] - qbittorrent <no-dsa> (Minor issue)
+ NOTE: https://github.com/qbittorrent/qBittorrent/pull/24795
+ NOTE: https://github.com/qbittorrent/qBittorrent/commit/3b7441ee44c1cef6065945f77c2694cdc27e75ed (release-5.3.0rc1)
+CVE-2026-94347 (PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7 ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-94346 (PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7 ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-93866 (An integer overflow vulnerability in the WebSocket connection handling ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-93865 (A missing authentication vulnerability in the Fireware OS FireCluster ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-93864 (A link following vulnerability in WatchGuard Fireware OS\u2019s firewa ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-93862 (An out-of-bounds read vulnerability in the FireCluster Sync processing ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-93857 (A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-93434 (An XPath injection vulnerability in WatchGuard Fireware OS's SSH authe ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-92885 (The Qode Membership plugin for WordPress is vulnerable to Authenticati ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2026-92546 (Authentication bypass by spoofing vulnerability in Keepnet Labs Cybers ...)
+ TODO: check
+CVE-2026-92377 (Improper access control in the Patch Management update mechanism of Te ...)
+ NOT-FOR-US: TeamViewer
+CVE-2026-92376 (Improper authentication in the inter-process communication (IPC) mecha ...)
+ NOT-FOR-US: TeamViewer
+CVE-2026-92375 (An improper access control vulnerability in the IPC communication betw ...)
+ NOT-FOR-US: TeamViewer
+CVE-2026-92374 (A time-of-check time-of-use (TOCTOU) race condition combined with impr ...)
+ NOT-FOR-US: TeamViewer
+CVE-2026-92372 (An out-of-bounds write vulnerability in the screen-image decoder of Te ...)
+ NOT-FOR-US: TeamViewer
+CVE-2026-90732 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-90731 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-90730 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-90729 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-90728 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-90727 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-90726 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-90725 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-90465 (A missing authentication vulnerability in the FireCluster Sync process ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-90464 (An external control of file path vulnerability in a WatchGuard Firewar ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-90442 (A stack-based buffer overflow vulnerability in the Fireware OS certd p ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-87897 (A SSRF vulnerability found that enables access to internal Chrome Devt ...)
+ TODO: check
+CVE-2026-87086 (Tanium addressed a denial of service vulnerability in Provision.)
+ NOT-FOR-US: Tanium
+CVE-2026-87085 (Tanium addressed a SQL injection vulnerability in Provision.)
+ NOT-FOR-US: Tanium
+CVE-2026-86577 (Out-of-bounds Write Vulnerability in JP1 Products. This issue affects ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-86576 (Heap-based Buffer Overflow Vulnerability in JP1 Products. This issue ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-86575 (Stack-based Buffer Overflow Vulnerability in JP1 Products. This issue ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-86574 (Heap-based Buffer Overflow Vulnerability in JP1/Base. This issue affe ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-85299 (A Missing Authorization vulnerability in the disks.createSnapshot and ...)
+ TODO: check
+CVE-2026-82986 (The user in a group can bypass the group restriction set by an adminis ...)
+ TODO: check
+CVE-2026-82984 (When a team was configured as "visible to everyone", the web UI correc ...)
+ TODO: check
+CVE-2026-82983 (The Tables app's share-listing endpoint (GET /apps/tables/share/table/ ...)
+ TODO: check
+CVE-2026-82332 (An improper authentication vulnerability in WatchGuard Fireware OS's A ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-82122 (Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affec ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-82121 (Origin Validation Error Vulnerability in HiRDB. This issue affects H ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-82120 (Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affect ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-82119 (OS Command Injection Vulnerability in HiRDB. This issue affects HiRD ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-82118 (Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affec ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-82117 (Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-82116 (Missing Authentication for Critical Function Vulnerability in HiRDB. ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-78845 (Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart L ...)
+ TODO: check
+CVE-2026-77173 (A user could create a docx or odt file with a # in the filename with c ...)
+ TODO: check
+CVE-2026-77172 (App passwords were allowed to bypass password confirmation on sensitiv ...)
+ TODO: check
+CVE-2026-77171 (A public shared collective always allowed recipients of the link to cr ...)
+ TODO: check
+CVE-2026-77167 (Abusing the federated share endpoint, an attacker can write arbitrary ...)
+ TODO: check
+CVE-2026-76939 (Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Manageme ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-76938 (Authentication Bypass Vulnerability in JP1/Automatic Job Management Sy ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-76937 (Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Manageme ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-76936 (Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Managem ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-76935 (Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Managem ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-76934 (Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Managem ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-76933 (Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Manageme ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-76932 (Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Managem ...)
+ NOT-FOR-US: Hitachi
+CVE-2026-68866 (PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7 ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-67400 (A missing token type check allowed to retrieve more additional informa ...)
+ TODO: check
+CVE-2026-65220 (A logic flaw in the BMC IPMI implementation may allow an attacker to s ...)
+ NOT-FOR-US: Supermicro
+CVE-2026-65219 (A flaw in the BMC RAKP+ implementation may allow an attacker to send a ...)
+ NOT-FOR-US: Supermicro
+CVE-2026-65213 (This issue may allow an IPMI authenticated administrator to execute co ...)
+ NOT-FOR-US: Supermicro
+CVE-2026-65211 (This issue may allow an authenticated IPMI Administrator to read and w ...)
+ NOT-FOR-US: Supermicro
+CVE-2026-65210 (This issue may allow an authenticated IPMI Administrator to read arbit ...)
+ NOT-FOR-US: Supermicro
+CVE-2026-65151 (NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker cou ...)
+ TODO: check
+CVE-2026-65145 (NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker co ...)
+ TODO: check
+CVE-2026-65120 (NVIDIA TensorRT-LLM contains a vulnerability where an attacker could c ...)
+ NOT-FOR-US: NVIDIA
+CVE-2026-65119 (NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCac ...)
+ NOT-FOR-US: NVIDIA
+CVE-2026-57202 (Asterisk is an open source private branch exchange and telephony toolk ...)
+ TODO: check
+CVE-2026-57201 (Asterisk is an open source private branch exchange and telephony toolk ...)
+ TODO: check
+CVE-2026-57198 (Asterisk is an open source private branch exchange and telephony toolk ...)
+ TODO: check
+CVE-2026-57197 (Asterisk is an open source private branch exchange and telephony toolk ...)
+ TODO: check
+CVE-2026-57194 (Asterisk is an open source private branch exchange and telephony toolk ...)
+ TODO: check
+CVE-2026-57189 (Asterisk is an open source private branch exchange and telephony toolk ...)
+ TODO: check
+CVE-2026-57188 (Asterisk is an open source private branch exchange and telephony toolk ...)
+ TODO: check
+CVE-2026-57185 (Asterisk is an open source private branch exchange and telephony toolk ...)
+ TODO: check
+CVE-2026-56084 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ NOT-FOR-US: Dell / EMC
+CVE-2026-54462 (Knative pkg provides common packages shared across Knative repositorie ...)
+ TODO: check
+CVE-2026-4337 (Unrestricted Upload of File with Dangerous Type vulnerability in the P ...)
+ TODO: check
+CVE-2026-48380 (Substance3D - Painter is affected by an out-of-bounds read vulnerabili ...)
+ NOT-FOR-US: Adobe
+CVE-2026-48379 (Substance3D - Painter is affected by a Stack-based Buffer Overflow vul ...)
+ NOT-FOR-US: Adobe
+CVE-2026-48360 (Adobe Connect is affected by an Improper Control of Generation of Code ...)
+ NOT-FOR-US: Adobe
+CVE-2026-47486 (NVIDIA PhysX for all platforms contains a vulnerability where an attac ...)
+ TODO: check
+CVE-2026-41022 (Eaton easySoft improperly validates TLS certificates presented by easy ...)
+ NOT-FOR-US: Eaton
+CVE-2026-41021 (Eaton easyE4 uses an insufficiently strong password policy. An attacke ...)
+ NOT-FOR-US: Eaton
+CVE-2026-41020 (Eaton easyE4 uses a static nonce during authentication, which could al ...)
+ NOT-FOR-US: Eaton
+CVE-2026-24269 (NVIDIA TensorRT-LLM contains a vulnerability where an attacker could c ...)
+ NOT-FOR-US: NVIDIA
+CVE-2026-18451 (The HTML5 KVM-over-IP console authenticates with a token returned by t ...)
+ NOT-FOR-US: Supermicro
+CVE-2026-18450 (The BMC does not correctly enforce integrity and encryption requiremen ...)
+ NOT-FOR-US: Supermicro
+CVE-2026-18449 (The BMC does not correctly enforce integrity and encryption requiremen ...)
+ NOT-FOR-US: Supermicro
+CVE-2026-16521 (An OS command injection vulnerability exists because of insufficient i ...)
+ NOT-FOR-US: Supermicro
+CVE-2026-16491 (Grafana\u2019s RBAC service ignored the requested folder when checking ...)
+ NOT-FOR-US: Grafana
+CVE-2026-16307 (Authorization bypass through User-Controlled key vulnerability in Neti ...)
+ TODO: check
+CVE-2026-15586 (Improper restriction of excessive authentication attempts vulnerabilit ...)
+ TODO: check
+CVE-2026-13162 (An OS command vulnerability exists in CoreTec productthat allows authe ...)
+ NOT-FOR-US: Hitachi Energy
+CVE-2026-12887 (In affected versions of Octopus Server, a user with permission to uplo ...)
+ NOT-FOR-US: Octopus Deploy
+CVE-2026-118180 (When logging in to a Matrix account, Thunderbird used the homeserver a ...)
+ TODO: check
+CVE-2026-118179 (Clicking a news: or snews: link that referenced a message-ID made Thun ...)
+ TODO: check
+CVE-2026-118178 (A remote RSS feed could use the itunes:new-feed-url or newLocation ele ...)
+ TODO: check
+CVE-2026-118177 (When looking for calendars in a directory on a server, during account ...)
+ TODO: check
+CVE-2026-118176 (Thunderbird's check that prevents mailbox: URLs from accessing files o ...)
+ TODO: check
+CVE-2026-118175 (When replying to, forwarding, or editing a crafted email message as ne ...)
+ TODO: check
+CVE-2026-118174 (When a message containing an OpenPGP key attachment was displayed, Thu ...)
+ TODO: check
+CVE-2026-118173 (MISP Guard, a proxy that enforces security policies on MISP feed data, ...)
+ TODO: check
+CVE-2026-118172 (The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable ...)
+ TODO: check
+CVE-2026-118171 (The strapi/content-manager package is missing content-scope authorizat ...)
+ TODO: check
+CVE-2026-118170 (The strapi/review-workflows package is vulnerable to a broken access c ...)
+ TODO: check
+CVE-2026-118132 (NextChat version 2.16.1 contains a client\u2011side cross\u2011site sc ...)
+ TODO: check
+CVE-2026-118131 (GnuPG (version 2.5.21) for Windows contains a vulnerability where defa ...)
+ TODO: check
+CVE-2026-118027 (Frame poisoning in the Layout component. This vulnerability was fixed ...)
+ TODO: check
+CVE-2026-118026 (Invalid pointer in the JavaScript: GC component. This vulnerability wa ...)
+ TODO: check
+CVE-2026-118025 (Other issue in the SVG component. This vulnerability was fixed in Fire ...)
+ TODO: check
+CVE-2026-118024 (Use-after-free in the Graphics: Text component. This vulnerability was ...)
+ TODO: check
+CVE-2026-118023 (Sandbox escape due to use-after-free in the Graphics: WebRender compon ...)
+ TODO: check
+CVE-2026-118022 (Sandbox escape due to use-after-free in the Disability Access APIs com ...)
+ TODO: check
+CVE-2026-118021 (Sandbox escape due to use-after-free in the XPCOM component. This vuln ...)
+ TODO: check
+CVE-2026-118020 (Use-after-free in the Layout component. This vulnerability was fixed i ...)
+ TODO: check
+CVE-2026-118019 (Race condition, use-after-free in the DOM: File component. This vulner ...)
+ TODO: check
+CVE-2026-118018 (Spoofing issue in the Downloads component in Firefox for Android. This ...)
+ TODO: check
+CVE-2026-118017 (Use-after-free in the SVG component. This vulnerability was fixed in F ...)
+ TODO: check
+CVE-2026-118016 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-118015 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-118014 (Use-after-free in the JavaScript Engine: JIT component. This vulnerabi ...)
+ TODO: check
+CVE-2026-118013 (Use-after-free in the Layout: Images, Video, and HTML Frames component ...)
+ TODO: check
+CVE-2026-118012 (Use-after-free in the DOM: Animation component. This vulnerability was ...)
+ TODO: check
+CVE-2026-118011 (Frame poisoning in the CSS Parsing and Computation component. This vul ...)
+ TODO: check
+CVE-2026-118010 (Use-after-free in the Disability Access APIs component. This vulnerabi ...)
+ TODO: check
+CVE-2026-118009 (Integer overflow, use-after-free in the Graphics: Text component. This ...)
+ TODO: check
+CVE-2026-118008 (Privilege escalation in the DOM: Navigation component. This vulnerabil ...)
+ TODO: check
+CVE-2026-118007 (Use-after-free in the JavaScript: GC component. This vulnerability was ...)
+ TODO: check
+CVE-2026-118006 (Privilege escalation due to use-after-free in the WebRTC: Signaling co ...)
+ TODO: check
+CVE-2026-118005 (Use-after-free in the WebRTC: Signaling component. This vulnerability ...)
+ TODO: check
+CVE-2026-118004 (Incorrect boundary conditions in the CSS Transitions and Animations co ...)
+ TODO: check
+CVE-2026-118003 (Information disclosure in the Networking: DNS component. This vulnerab ...)
+ TODO: check
+CVE-2026-118002 (Information disclosure due to race condition in the Networking compone ...)
+ TODO: check
+CVE-2026-118000 (Information disclosure in the Networking: HTTP component. This vulnera ...)
+ TODO: check
+CVE-2026-117999 (Race condition in the IPC component. This vulnerability was fixed in F ...)
+ TODO: check
+CVE-2026-117998 (Mitigation bypass in the DOM: Push Subscriptions component. This vulne ...)
+ TODO: check
+CVE-2026-117997 (Sandbox escape due to use-after-free in the Widget component. This vul ...)
+ TODO: check
+CVE-2026-117996 (Incorrect boundary conditions in the WebRTC component. This vulnerabil ...)
+ TODO: check
+CVE-2026-117995 (Privilege escalation in the DOM: UI Events & Focus Handling component. ...)
+ TODO: check
+CVE-2026-117994 (Use-after-free in the JavaScript: GC component. This vulnerability was ...)
+ TODO: check
+CVE-2026-117993 (Integer overflow in the Graphics: Text component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117992 (Information disclosure in the CSS Parsing and Computation component. T ...)
+ TODO: check
+CVE-2026-117991 (Incorrect boundary conditions in the Layout: Text and Fonts component. ...)
+ TODO: check
+CVE-2026-117990 (Sandbox escape due to incorrect boundary conditions in the Graphics: W ...)
+ TODO: check
+CVE-2026-117989 (Use-after-free in the Graphics component. This vulnerability was fixed ...)
+ TODO: check
+CVE-2026-117988 (Sandbox escape due to incorrect boundary conditions in the Graphics: C ...)
+ TODO: check
+CVE-2026-117987 (Use-after-free in the Graphics component. This vulnerability was fixed ...)
+ TODO: check
+CVE-2026-117986 (Use-after-free in the Graphics component. This vulnerability was fixed ...)
+ TODO: check
+CVE-2026-117985 (Sandbox escape due to use-after-free in the Graphics component. This v ...)
+ TODO: check
+CVE-2026-117984 (Incorrect boundary conditions in the Layout: Scrolling and Overflow co ...)
+ TODO: check
+CVE-2026-117983 (Use-after-free in the Graphics component. This vulnerability was fixed ...)
+ TODO: check
+CVE-2026-117982 (Invalid pointer in the JavaScript Engine: JIT component. This vulnerab ...)
+ TODO: check
+CVE-2026-117981 (Privilege escalation in the Toolkit component. This vulnerability was ...)
+ TODO: check
+CVE-2026-117980 (Use-after-free in the Graphics component. This vulnerability was fixed ...)
+ TODO: check
+CVE-2026-117979 (Incorrect boundary conditions in the Graphics: WebRender component. Th ...)
+ TODO: check
+CVE-2026-117978 (Incorrect boundary conditions in the Graphics component. This vulnerab ...)
+ TODO: check
+CVE-2026-117977 (Other issue in the Console component. This vulnerability was fixed in ...)
+ TODO: check
+CVE-2026-117976 (Site isolation issue in the DOM: Navigation component. This vulnerabil ...)
+ TODO: check
+CVE-2026-117975 (Sandbox escape due to invalid pointer in the Graphics: WebRender compo ...)
+ TODO: check
+CVE-2026-117974 (Use-after-free in the XML component. This vulnerability was fixed in F ...)
+ TODO: check
+CVE-2026-117973 (Use-after-free in the Networking: DNS component. This vulnerability wa ...)
+ TODO: check
+CVE-2026-117972 (Use-after-free in the Graphics component. This vulnerability was fixed ...)
+ TODO: check
+CVE-2026-117971 (Sandbox escape due to use-after-free in the Print Preview component. T ...)
+ TODO: check
+CVE-2026-117970 (Race condition in the Disability Access APIs component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117969 (Invalid pointer in the JavaScript Engine: JIT component. This vulnerab ...)
+ TODO: check
+CVE-2026-117968 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117967 (Mitigation bypass in the DOM: Security component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117966 (Site isolation issue in the Networking: HTTP component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117965 (Same-origin policy bypass in the Address Bar component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117964 (Use-after-free in the Panning and Zooming component. This vulnerabilit ...)
+ TODO: check
+CVE-2026-117963 (Incorrect boundary conditions in the DOM: Service Workers component. T ...)
+ TODO: check
+CVE-2026-117962 (Sandbox escape due to incorrect boundary conditions in the Storage: Qu ...)
+ TODO: check
+CVE-2026-117961 (Incorrect boundary conditions in the Layout: Text and Fonts component. ...)
+ TODO: check
+CVE-2026-117960 (Spoofing issue in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117959 (Site isolation issue in the DOM: Service Workers component. This vulne ...)
+ TODO: check
+CVE-2026-117958 (Site isolation issue in the Networking: HTTP component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117957 (Cryptographic issue in the WebRTC: Networking component. This vulnerab ...)
+ TODO: check
+CVE-2026-117956 (Invalid pointer in the Nimbus Desktop Client component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117955 (JIT miscompilation in the JavaScript: WebAssembly component. This vuln ...)
+ TODO: check
+CVE-2026-117954 (Use-after-free in the Layout: Positioned component. This vulnerability ...)
+ TODO: check
+CVE-2026-117953 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117952 (Uninitialized memory in the Networking component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117951 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117950 (Incorrect boundary conditions in the DOM: Core & HTML component. This ...)
+ TODO: check
+CVE-2026-117949 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117948 (Use-after-free in the SVG component. This vulnerability was fixed in F ...)
+ TODO: check
+CVE-2026-117947 (Use-after-free in the XML component. This vulnerability was fixed in F ...)
+ TODO: check
+CVE-2026-117946 (Incorrect boundary conditions in the JavaScript Engine component. This ...)
+ TODO: check
+CVE-2026-117945 (Incorrect boundary conditions in the XML component. This vulnerability ...)
+ TODO: check
+CVE-2026-117944 (Use-after-free in the Layout component. This vulnerability was fixed i ...)
+ TODO: check
+CVE-2026-117943 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117942 (Incorrect boundary conditions in the JavaScript Engine: JIT component. ...)
+ TODO: check
+CVE-2026-117941 (Use-after-free in the DOM: CSS Object Model component. This vulnerabil ...)
+ TODO: check
+CVE-2026-117940 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117939 (Use-after-free in the XML component. This vulnerability was fixed in F ...)
+ TODO: check
+CVE-2026-117938 (Use-after-free in the Layout component. This vulnerability was fixed i ...)
+ TODO: check
+CVE-2026-117937 (Invalid pointer in the JavaScript Engine component. This vulnerability ...)
+ TODO: check
+CVE-2026-117936 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117935 (Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117934 (Use-after-free in the Layout component. This vulnerability was fixed i ...)
+ TODO: check
+CVE-2026-117933 (Frame poisoning in the CSS Parsing and Computation component. This vul ...)
+ TODO: check
+CVE-2026-117932 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117931 (Use-after-free in the DOM: Events component. This vulnerability was fi ...)
+ TODO: check
+CVE-2026-117930 (Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117929 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117928 (Same-origin policy bypass in the CSS Parsing and Computation component ...)
+ TODO: check
+CVE-2026-117927 (Use-after-free in the SVG component. This vulnerability was fixed in F ...)
+ TODO: check
+CVE-2026-117926 (Incorrect boundary conditions in the SVG component. This vulnerability ...)
+ TODO: check
+CVE-2026-117925 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117924 (Use-after-free in the XSLT component. This vulnerability was fixed in ...)
+ TODO: check
+CVE-2026-117923 (Use-after-free in the Audio/Video component. This vulnerability was fi ...)
+ TODO: check
+CVE-2026-117922 (Use-after-free in the Networking: WebSockets component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117921 (Use-after-free in the CSS Parsing and Computation component. This vuln ...)
+ TODO: check
+CVE-2026-117920 (Use-after-free in the DOM: HTML Parser component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117919 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117918 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
+ TODO: check
+CVE-2026-117917 (Invalid pointer in the Graphics: WebRender component. This vulnerabili ...)
+ TODO: check
+CVE-2026-117916 (Use-after-free in the XSLT component. This vulnerability was fixed in ...)
+ TODO: check
+CVE-2026-117915 (Incorrect boundary conditions in the Layout: Block and Inline componen ...)
+ TODO: check
+CVE-2026-117914 (Use-after-free in the SVG component. This vulnerability was fixed in F ...)
+ TODO: check
+CVE-2026-117913 (Use-after-free in the SVG component. This vulnerability was fixed in F ...)
+ TODO: check
+CVE-2026-117912 (Same-origin policy bypass in the CSS Parsing and Computation component ...)
+ TODO: check
+CVE-2026-117911 (Use-after-free in the Audio/Video: Playback component. This vulnerabil ...)
+ TODO: check
+CVE-2026-117910 (Invalid pointer in the JavaScript Engine component. This vulnerability ...)
+ TODO: check
+CVE-2026-117909 (Use-after-free in the JavaScript: GC component. This vulnerability was ...)
+ TODO: check
+CVE-2026-117908 (Use-after-free in the Graphics: ImageLib component. This vulnerability ...)
+ TODO: check
+CVE-2026-117907 (Use-after-free in the Networking component. This vulnerability was fix ...)
+ TODO: check
+CVE-2026-117906 (Use-after-free in the CSS Parsing and Computation component. This vuln ...)
+ TODO: check
+CVE-2026-117905 (Use-after-free in the Audio/Video: Playback component. This vulnerabil ...)
+ TODO: check
+CVE-2026-117904 (Use-after-free in the JavaScript: GC component. This vulnerability was ...)
+ TODO: check
+CVE-2026-117903 (Use-after-free in the Audio/Video component. This vulnerability was fi ...)
+ TODO: check
+CVE-2026-117902 (Use-after-free in the Layout: Text and Fonts component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117901 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117900 (Use-after-free in the DOM: Editor component. This vulnerability was fi ...)
+ TODO: check
+CVE-2026-117899 (Use-after-free in the Networking: HTTP component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117898 (Use-after-free in the JavaScript Engine: JIT component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117897 (Incorrect boundary conditions in the Layout: Tables component. This vu ...)
+ TODO: check
+CVE-2026-117896 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117895 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117894 (Incorrect boundary conditions in the WebRTC: Signaling component. This ...)
+ TODO: check
+CVE-2026-117893 (Incorrect boundary conditions in the Security: PSM component. This vul ...)
+ TODO: check
+CVE-2026-117892 (Privilege escalation due to use-after-free in the WebRTC: Networking c ...)
+ TODO: check
+CVE-2026-117891 (Use-after-free in the JavaScript Engine: JIT component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117890 (JIT miscompilation in the JavaScript Engine: JIT component. This vulne ...)
+ TODO: check
+CVE-2026-117889 (Incorrect boundary conditions in the JavaScript Engine component. This ...)
+ TODO: check
+CVE-2026-117888 (Uninitialized memory in the Graphics: Canvas2D component. This vulnera ...)
+ TODO: check
+CVE-2026-117887 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117886 (Incorrect boundary conditions in the Graphics: Text component. This vu ...)
+ TODO: check
+CVE-2026-117885 (Use-after-free in the Layout: Grid component. This vulnerability was f ...)
+ TODO: check
+CVE-2026-117884 (Use-after-free in the Networking component. This vulnerability was fix ...)
+ TODO: check
+CVE-2026-117883 (Use-after-free in the DOM: HTML Parser component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117882 (Use-after-free in the Layout component. This vulnerability was fixed i ...)
+ TODO: check
+CVE-2026-117881 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117880 (Use-after-free in the XML component. This vulnerability was fixed in F ...)
+ TODO: check
+CVE-2026-117879 (Incorrect boundary conditions in the Layout: Tables component. This vu ...)
+ TODO: check
+CVE-2026-117878 (Other issue, use-after-free in the Storage: IndexedDB component. This ...)
+ TODO: check
+CVE-2026-117877 (Use-after-free in the Layout: Text and Fonts component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117876 (Use-after-free in the Layout: Text and Fonts component. This vulnerabi ...)
+ TODO: check
+CVE-2026-117875 (Use-after-free in the Layout: Scrolling and Overflow component. This v ...)
+ TODO: check
+CVE-2026-117874 (Use-after-free in the Internationalization component. This vulnerabili ...)
+ TODO: check
+CVE-2026-117873 (Incorrect boundary conditions in the Audio/Video: Playback component. ...)
+ TODO: check
+CVE-2026-117872 (Use-after-free in the JavaScript: Standard Library component. This vul ...)
+ TODO: check
+CVE-2026-117871 (Invalid pointer in the Graphics component. This vulnerability was fixe ...)
+ TODO: check
+CVE-2026-117870 (Use-after-free in the JavaScript Engine component. This vulnerability ...)
+ TODO: check
+CVE-2026-117869 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
+ TODO: check
+CVE-2026-117868 (Sandbox escape in the DOM: Networking component. This vulnerability wa ...)
+ TODO: check
+CVE-2026-117867 (Use-after-free in the Layout component. This vulnerability was fixed i ...)
+ TODO: check
+CVE-2026-117866 (Privilege escalation due to use-after-free in the Graphics: Canvas2D c ...)
+ TODO: check
+CVE-2026-117865 (Use-after-free in the JavaScript: GC component. This vulnerability was ...)
+ TODO: check
+CVE-2026-117864 (Sandbox escape in the Form Manager component. This vulnerability was f ...)
+ TODO: check
+CVE-2026-117863 (Information disclosure due to uninitialized memory in the Audio/Video ...)
+ TODO: check
+CVE-2026-117862 (Privilege escalation due to incorrect boundary conditions in the Netwo ...)
+ TODO: check
+CVE-2026-117861 (Sandbox escape in the DOM: Navigation component. This vulnerability wa ...)
+ TODO: check
+CVE-2026-117860 (Same-origin policy bypass in the DOM: Navigation component. This vulne ...)
+ TODO: check
+CVE-2026-117604 (Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in ...)
+ TODO: check
+CVE-2026-117603 (Electrum before 4.7.2 contains a spending limit bypass vulnerability i ...)
+ TODO: check
+CVE-2026-117602 (Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the ex ...)
+ TODO: check
+CVE-2026-117601 (Electrum before 4.8.3 fails to verify signatures of wallet-owned input ...)
+ TODO: check
+CVE-2026-117573 (hagent through commit 761eec6 contains an OS command injection vulnera ...)
+ TODO: check
+CVE-2026-117570 (Vorota-ai nmap-mcp through commit 3636afa contains an improper allowli ...)
+ TODO: check
+CVE-2026-117569 (Kali-GPT through commit a608c74 contains an OS command injection vulne ...)
+ TODO: check
+CVE-2026-117568 (mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerabilit ...)
+ TODO: check
+CVE-2026-117567 (esp-mcp through commit 28afddf contains an OS command injection vulner ...)
+ TODO: check
+CVE-2026-117566 (EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal ...)
+ TODO: check
+CVE-2026-117565 (Artalk before 2.10.1 contains an unauthenticated server-side request f ...)
+ TODO: check
+CVE-2026-117564 (nest-admin before 1.0.1 contains an authentication bypass vulnerabilit ...)
+ TODO: check
+CVE-2026-117563 (MrDoc through 1.1.1 contains a broken access control vulnerability in ...)
+ TODO: check
+CVE-2026-117562 (rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerabil ...)
+ TODO: check
+CVE-2026-117561 (Codefriar sf-mcp through 1.3.2 contains an OS command injection vulner ...)
+ TODO: check
+CVE-2026-117560 (ATXP Gemini CLI extension through 1.0.0 contains an OS command injecti ...)
+ TODO: check
+CVE-2026-117559 (DroidMind through 0.4.0 contains a command injection vulnerability tha ...)
+ TODO: check
+CVE-2026-117558 (The ai-sdlc plugin MCP server through 0.31.2 contains an OS command in ...)
+ TODO: check
+CVE-2026-117557 (SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bou ...)
+ TODO: check
+CVE-2026-117556 (zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability i ...)
+ TODO: check
+CVE-2026-117555 (CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in ...)
+ TODO: check
+CVE-2026-117554 (Admidio before 5.0.17 contains an improper access control vulnerabilit ...)
+ TODO: check
+CVE-2026-117553 (Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass ...)
+ NOT-FOR-US: Umbraco CMS
+CVE-2026-117541 (svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception ...)
+ TODO: check
+CVE-2026-117540 (svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vul ...)
+ TODO: check
+CVE-2026-117539 (darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remo ...)
+ TODO: check
+CVE-2026-117538 (REDAXO before 5.21.0 contains a reflected cross-site scripting vulnera ...)
+ TODO: check
+CVE-2026-117537 (REDAXO before 5.21.0 contains a reflected cross-site scripting vulnera ...)
+ TODO: check
+CVE-2026-117536 (REDAXO before 5.21.3 contains a cross-site request forgery vulnerabili ...)
+ TODO: check
+CVE-2026-117535 (REDAXO before 5.21.3 contains a reflected cross-site scripting vulnera ...)
+ TODO: check
+CVE-2026-117534 (REDAXO before 5.21.3 contains a cross-site request forgery vulnerabili ...)
+ TODO: check
+CVE-2026-117533 (REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scriptin ...)
+ TODO: check
+CVE-2026-117532 (REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass ...)
+ TODO: check
+CVE-2026-117530 (In JetBrains Junie CLI before 26.8.17 command execution was possible d ...)
+ NOT-FOR-US: JetBrains
+CVE-2026-117526 (A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by ...)
+ TODO: check
+CVE-2026-117516 (A weakness has been identified in oretnom23 php-travel-agency-system. ...)
+ TODO: check
+CVE-2026-117515 (A security flaw has been discovered in oretnom23 php-travel-agency-sys ...)
+ TODO: check
+CVE-2026-117514 (A vulnerability was identified in oretnom23 php-travel-agency-system. ...)
+ TODO: check
+CVE-2026-117513 (A vulnerability was determined in oretnom23 php-travel-agency-system. ...)
+ TODO: check
+CVE-2026-117512 (A vulnerability was found in oretnom23 php-travel-agency-system. This ...)
+ TODO: check
+CVE-2026-117511 (A vulnerability has been found in desmondmorris node-tesseract up to 0 ...)
+ TODO: check
+CVE-2026-117510 (A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this ...)
+ TODO: check
+CVE-2026-117509 (A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Af ...)
+ TODO: check
+CVE-2026-117507 (A security vulnerability has been detected in a2aproject a2a-java up t ...)
+ TODO: check
+CVE-2026-117506 (A weakness has been identified in a2aproject a2a-java up to 1.2.0.Fina ...)
+ TODO: check
+CVE-2026-117505 (A security flaw has been discovered in a2aproject a2a-java up to 1.2.0 ...)
+ TODO: check
+CVE-2026-117504 (A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The a ...)
+ TODO: check
+CVE-2026-117503 (A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impac ...)
+ TODO: check
+CVE-2026-117499 (@fastify/session is a session plugin for Fastify. In all releases befo ...)
+ TODO: check
+CVE-2026-117494 (Cross-Site Scripting (XSS) in the processing of SVG images submitted t ...)
+ TODO: check
+CVE-2026-117493 (Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards ...)
+ TODO: check
+CVE-2026-117466 (In affected versions of Octopus Server, a user holding the System Mana ...)
+ NOT-FOR-US: Octopus Deploy
+CVE-2026-117341 (In affected versions of Octopus Server, creating a user invitation wri ...)
+ NOT-FOR-US: Octopus Deploy
+CVE-2026-116900 (REDAXO before 5.21.4 contains a stored cross-site scripting vulnerabil ...)
+ TODO: check
+CVE-2026-116899 (REDAXO before 5.21.4 contains a broken access control vulnerability th ...)
+ TODO: check
+CVE-2026-116898 (REDAXO before 5.21.4 contains a missing authorization vulnerability in ...)
+ TODO: check
+CVE-2026-116897 (REDAXO core before 5.21.4 contains a missing authorization vulnerabili ...)
+ TODO: check
+CVE-2026-116896 (REDAXO before 5.21.5 contains a missing authorization vulnerability in ...)
+ TODO: check
+CVE-2026-116895 (REDAXO before 5.21.5 contains a cross-site request forgery vulnerabili ...)
+ TODO: check
+CVE-2026-116894 (REDAXO before 5.21.5 contains an insufficient session expiration vulne ...)
+ TODO: check
+CVE-2026-116893 (REDAXO core before 5.21.5 contains a missing authorization vulnerabili ...)
+ TODO: check
+CVE-2026-116892 (SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-s ...)
+ TODO: check
+CVE-2026-116891 (SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-s ...)
+ TODO: check
+CVE-2026-116890 (Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authoriz ...)
+ TODO: check
+CVE-2026-116889 (SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site ...)
+ TODO: check
+CVE-2026-116888 (SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site ...)
+ TODO: check
+CVE-2026-116887 (Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-sit ...)
+ TODO: check
+CVE-2026-116886 (Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-sit ...)
+ TODO: check
+CVE-2026-116885 (Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross- ...)
+ TODO: check
+CVE-2026-116884 (SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site ...)
+ TODO: check
+CVE-2026-116883 (Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-sit ...)
+ TODO: check
+CVE-2026-116882 (Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-sit ...)
+ TODO: check
+CVE-2026-116881 (Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scrip ...)
+ TODO: check
+CVE-2026-116880 (Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site reque ...)
+ TODO: check
+CVE-2026-116879 (Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authoriz ...)
+ TODO: check
+CVE-2026-116878 (Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled re ...)
+ TODO: check
+CVE-2026-116877 (Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled re ...)
+ TODO: check
+CVE-2026-116876 (Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper author ...)
+ TODO: check
+CVE-2026-116875 (SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-s ...)
+ TODO: check
+CVE-2026-116874 (SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-s ...)
+ TODO: check
+CVE-2026-116873 (Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authoriz ...)
+ TODO: check
+CVE-2026-116872 (Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic com ...)
+ TODO: check
+CVE-2026-116871 (Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursi ...)
+ TODO: check
+CVE-2026-116870 (In affected versions of Octopus Server, OIDC token issuer validation w ...)
+ NOT-FOR-US: Octopus Deploy
+CVE-2026-116863 (Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software ...)
+ NOT-FOR-US: WordPress plugin or theme
+CVE-2026-116683 (CTFer.io's CTFd Terraform Provider manages CTFd resources as code. Fro ...)
+ TODO: check
+CVE-2026-116682 (FileBrowser Quantum is a free, self-hosted, web-based file manager. Pr ...)
+ TODO: check
+CVE-2026-116680 (HomeBox is a home inventory and organization system. Prior to version ...)
+ TODO: check
+CVE-2026-116679 (Neko is a a self-hosted virtual browser that runs in Docker and uses W ...)
+ TODO: check
+CVE-2026-116678 (Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to ...)
+ TODO: check
+CVE-2026-116677 (OpenWISP Controller is a network and WiFi controller for provisioning, ...)
+ TODO: check
+CVE-2026-116676 (Atlantis is a self-hosted golang application that listens for Terrafor ...)
+ TODO: check
+CVE-2026-116675 (TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and ...)
+ TODO: check
+CVE-2026-116674 (systeminformation is a System and OS information library for node.js. ...)
+ TODO: check
+CVE-2026-116673 (systeminformation is a System and OS information library for node.js. ...)
+ TODO: check
+CVE-2026-116672 (Authlib is a Python library which builds OAuth and OpenID Connect serv ...)
+ TODO: check
+CVE-2026-116662 (Tanium addressed a compression bomb vulnerability in Enforce.)
+ NOT-FOR-US: Tanium
+CVE-2026-116660 (Tanium addressed an improper access controls vulnerability in Enforce.)
+ NOT-FOR-US: Tanium
+CVE-2026-116659 (Tanium addressed an uncontrolled resource consumption vulnerability in ...)
+ NOT-FOR-US: Tanium
+CVE-2026-116658 (Tanium addressed a denial of service vulnerability in Enforce.)
+ NOT-FOR-US: Tanium
+CVE-2026-116657 (Tanium addressed a denial of service vulnerability in Enforce.)
+ NOT-FOR-US: Tanium
+CVE-2026-116656 (Tanium addressed an uncontrolled resource consumption vulnerability in ...)
+ NOT-FOR-US: Tanium
+CVE-2026-116649 (Tanium addressed an improper output sanitization vulnerability in Enfo ...)
+ NOT-FOR-US: Tanium
+CVE-2026-116647 (Tanium addressed an improper output sanitization vulnerability in Comp ...)
+ NOT-FOR-US: Tanium
+CVE-2026-116627 (Improper neutralization of input during web page generation ('Cross-si ...)
+ NOT-FOR-US: Devolutions
+CVE-2026-115495 (Cleartext Transmission of Sensitive Information vulnerability in the W ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-115413 (Missing token audience validation in the OAuth authentication mode of ...)
+ NOT-FOR-US: Amazon
+CVE-2026-115408 (In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= ...)
+ NOT-FOR-US: Eclipse
+CVE-2026-115216 (In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate ...)
+ NOT-FOR-US: Eclipse
+CVE-2026-114598 (In EPICS Base release 7.0.10 and prior, an insufficient validation of ...)
+ TODO: check
+CVE-2026-114597 (In EPICS Base release 7.0.10 and prior, an insufficient validation of ...)
+ TODO: check
+CVE-2026-114596 (In EPICS Base release 7.0.10 and prior, an improper validation of mess ...)
+ TODO: check
+CVE-2026-114595 (In EPICS Base release 7.0.10 and prior, an integer overflow in network ...)
+ TODO: check
+CVE-2026-114409 (Docker Desktop before version 4.97.0 could write third-party API keys ...)
+ NOT-FOR-US: Docker products not packaged in Debian
+CVE-2026-113881 (A stack-based buffer overflow vulnerability in Fireware OS's VPN Netwo ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-113775 (A maliciously crafted dynamic library, when loaded from an arbitrary p ...)
+ NOT-FOR-US: Autodesk
+CVE-2026-113644 (In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 ...)
+ NOT-FOR-US: Eclipse
+CVE-2026-112710 (A heap-based buffer overflow vulnerability exists in the Fireware OS a ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-112709 (A heap-based buffer overflow vulnerability in the Fireware OS authenti ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-112362 (@fastify/express is a Fastify plugin that runs Express middleware insi ...)
+ TODO: check
+CVE-2026-112353 (GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stor ...)
+ TODO: check
+CVE-2026-111585 (An integer overflow in the remote-control screen processing component ...)
+ NOT-FOR-US: TeamViewer
+CVE-2026-111584 (A race condition in the installation process of TeamViewer Remote Mana ...)
+ NOT-FOR-US: TeamViewer
+CVE-2026-111583 (Improper access control in the installer staging directory used by Tea ...)
+ NOT-FOR-US: TeamViewer
+CVE-2026-111582 (A DLL loading vulnerability in the TeamViewer Remote Management Monito ...)
+ NOT-FOR-US: TeamViewer
+CVE-2026-111548 (A stack-based buffer overflow vulnerabilityexists in the web managemen ...)
+ NOT-FOR-US: Moxa
+CVE-2026-111461 (An OS command injection vulnerability exists inOnCell G3150A-LTE Serie ...)
+ NOT-FOR-US: Moxa
+CVE-2026-111460 (A hard-coded cryptographic key vulnerability exists in the OnCell G315 ...)
+ NOT-FOR-US: Moxa
+CVE-2026-111459 (An improper certificate validation vulnerability exists in Moxa Remote ...)
+ NOT-FOR-US: Moxa
+CVE-2026-111107 (A NULL pointer dereference vulnerability in WatchGuard Fireware OS\u20 ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-111054
+ REJECTED
+CVE-2026-110737 (The push endpoint of a Vaadin application that uses server push reflec ...)
+ NOT-FOR-US: Vaadin
+CVE-2026-10756 (TRO600 contains a vulnerability that allows an authenticated attacker ...)
+ NOT-FOR-US: Hitachi Energy
+CVE-2026-10752 (The Advanced Custom Fields: Extended plugin for WordPress is vulnerabl ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2026-10537 (A misconfiguration issue in the affected service in Control-M/Enterpri ...)
+ TODO: check
+CVE-2026-10511 (The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross- ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2026-109995 (The Advanced Views \u2013 Display Framework for Gutenberg & Elementor ...)
+ NOT-FOR-US: WordPress plugin
+CVE-2026-109823 (An attacker can read the name of filesystem paths of your application ...)
+ TODO: check
+CVE-2026-108333 (Tanium addressed a use-after-free vulnerability in Threat Response Cli ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108332 (Tanium addressed an improper link resolution before file access vulner ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108331 (Tanium addressed an infinite loop vulnerability in Threat Response Cli ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108330 (Tanium addressed an information disclosure vulnerability in Threat Res ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108329 (Tanium addressed an unauthorized code execution vulnerability in Threa ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108328 (Tanium addressed an insertion of sensitive information into log file v ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108326 (Tanium addressed an improper certificate validation vulnerability in S ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108325 (Tanium addressed an insertion of sensitive information into log file v ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108316 (Tanium addressed an information disclosure vulnerability in Tanium Ser ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108313 (Tanium addressed an incorrect privilege assignment vulnerability in Ta ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108311 (Tanium addressed an insufficient logging vulnerability in Tanium Serve ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108310 (Tanium addressed a denial of service vulnerability in Tanium Server.)
+ NOT-FOR-US: Tanium
+CVE-2026-108309 (Tanium addressed an uncontrolled resource consumption vulnerability in ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108308 (Tanium addressed a SQL injection vulnerability in Patch.)
+ NOT-FOR-US: Tanium
+CVE-2026-108307 (Tanium addressed a heap-based buffer overflow vulnerability in Index.)
+ NOT-FOR-US: Tanium
+CVE-2026-108306 (Tanium addressed a local privilege escalation vulnerability in End-Use ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108305 (Tanium addressed a local privilege escalation vulnerability in End-Use ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108304 (Tanium addressed a local privilege escalation vulnerability in End-Use ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108303 (Tanium addressed an unauthorized code execution vulnerability in Certi ...)
+ NOT-FOR-US: Tanium
+CVE-2026-108302 (Tanium addressed an improper access controls vulnerability in Comply.)
+ NOT-FOR-US: Tanium
+CVE-2026-108301 (Tanium addressed an improper access controls vulnerability in Comply.)
+ NOT-FOR-US: Tanium
+CVE-2026-108142 (A vulnerability allowing an unauthenticated attacker to bypass authori ...)
+ TODO: check
+CVE-2026-108141 (A vulnerability allowing an authenticated user with the Restore Operat ...)
+ TODO: check
+CVE-2026-108140 (A vulnerability allowing an authenticated user with the Restore Operat ...)
+ TODO: check
+CVE-2026-108015 (Private keys for eight eMudhra intermediate CA certificates have been ...)
+ NOT-FOR-US: HCL
+CVE-2026-108014 (Private keys for eight eMudhra intermediate CA certificates have been ...)
+ NOT-FOR-US: HCL
+CVE-2026-107672 (A maliciously crafted .stack.json file can trigger a trusted Markdown ...)
+ NOT-FOR-US: Autodesk
+CVE-2026-107671 (A vulnerability allowing an attacker with valid Administrator credenti ...)
+ TODO: check
+CVE-2026-107590 (An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based ...)
+ TODO: check
+CVE-2026-107472 (An out-of-bounds read vulnerability in the QTextCodec TSCII encoding o ...)
+ TODO: check
+CVE-2026-107458
+ REJECTED
+CVE-2026-107147 (The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa ...)
+ TODO: check
+CVE-2026-107146 (The twofactor_gauthenticator plugin for Roundcube is vulnerable to ses ...)
+ TODO: check
+CVE-2026-107145 (The twofactor_gauthenticator plugin for Roundcube is vulnerable to bru ...)
+ TODO: check
+CVE-2026-107067 (An issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local ...)
+ TODO: check
+CVE-2026-106087 (TRO600 contains an arbitrary file read vulnerability. An unauthenticat ...)
+ NOT-FOR-US: Hitachi Energy
+CVE-2026-106078 (A vulnerability allowing an unauthenticated attacker to bypass REST AP ...)
+ TODO: check
+CVE-2026-106077 (A vulnerability allowing a user with the Veeam Backup for Microsoft 36 ...)
+ TODO: check
+CVE-2026-106076 (A vulnerability allowing an authenticated organization-transfer peer t ...)
+ TODO: check
+CVE-2026-105987 (KGS Software tia Viewer is vulnerable to Stored XSS via the annotation ...)
+ TODO: check
+CVE-2026-105781 (Adobe Campaign Classic (ACC) is affected by an Improper Neutralization ...)
+ NOT-FOR-US: Adobe
+CVE-2026-105780 (Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization ...)
+ NOT-FOR-US: Adobe
+CVE-2026-105779 (Adobe Campaign Classic (ACC) is affected by an Improper Neutralization ...)
+ NOT-FOR-US: Adobe
+CVE-2026-105489 (Adobe Campaign Classic (ACC) is affected by an Improper Neutralization ...)
+ NOT-FOR-US: Adobe
+CVE-2026-105477 (A vulnerability in Veeam Agent for Linux allows for local privilege es ...)
+ TODO: check
+CVE-2026-105323 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-104381 (A missing authentication vulnerability in Fireware OS's FireCluster st ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-104354 (Adobe Campaign Classic (ACC) is affected by an Improper Neutralization ...)
+ NOT-FOR-US: Adobe
+CVE-2026-104353 (Adobe Campaign Classic (ACC) is affected by an Improper Neutralization ...)
+ NOT-FOR-US: Adobe
+CVE-2026-104351 (Adobe Campaign Classic (ACC) is affected by an Improper Control of Gen ...)
+ NOT-FOR-US: Adobe
+CVE-2026-104350 (Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scr ...)
+ NOT-FOR-US: Adobe
+CVE-2026-104349 (Creative Cloud Desktop is affected by an Uncontrolled Search Path Elem ...)
+ NOT-FOR-US: Adobe
+CVE-2026-104189 (The 3D Viewer for Nextcloud is a comprehensive 3D model viewer applica ...)
+ TODO: check
+CVE-2026-103594 (A stack-based buffer overflow vulnerability in Fireware OS's WireGuard ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-103593 (A stack-based buffer overflow vulnerability in the Fireware OS logging ...)
+ NOT-FOR-US: WatchGuard
+CVE-2026-102816 (An authorization vulnerability exists in the country or region configu ...)
+ NOT-FOR-US: TPLink
+CVE-2026-102815 (An operating-system command injection vulnerability exists in the tmpS ...)
+ NOT-FOR-US: TPLink
+CVE-2026-102814 (An authentication weakness exists in the TP-Link TDDP v2 service of TP ...)
+ NOT-FOR-US: TPLink
+CVE-2026-102813 (An authentication flaw exists in the password-recovery functionality o ...)
+ NOT-FOR-US: TPLink
+CVE-2026-102812 (A hard-coded cryptographic key vulnerability exists in the user-config ...)
+ NOT-FOR-US: TPLink
+CVE-2026-102800 (Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in D ...)
+ NOT-FOR-US: Joomla
+CVE-2026-102789 (Joomla Extension - balbooa.com - Missing Authorization Check on Editor ...)
+ NOT-FOR-US: Joomla
+CVE-2026-102788 (Joomla Extension - balbooa.com - Unauthenticated SQL injection in Grid ...)
+ NOT-FOR-US: Joomla
+CVE-2026-102787 (Joomla Extension - phoca.cz - CSRF in category management in Phoca Dow ...)
+ NOT-FOR-US: Joomla
+CVE-2026-102638 (A maliciously crafted HTML payload in the description of an electronic ...)
+ NOT-FOR-US: Autodesk
+CVE-2026-102637 (A maliciously crafted HTML payload in the documentName parameter of a ...)
+ NOT-FOR-US: Autodesk
+CVE-2026-102636 (A maliciously crafted HTML payload in a design name, when displayed af ...)
+ NOT-FOR-US: Autodesk
+CVE-2026-101034 (An attacker who obtained the hardcoded key could decrypt domain/servic ...)
+ NOT-FOR-US: Symantec
+CVE-2026-100164 (Observable response discrepancy vulnerability in Rolantis Information ...)
+ TODO: check
+CVE-2025-64394 (A vulnerability allowing a low-privileged local user to write arbitrar ...)
+ TODO: check
CVE-2026-XXXX [qbittorrent: WebUI authentication bypass via spoofed X-Forwarded-For]
- qbittorrent 5.3.0-1 (bug #1151739)
[trixie] - qbittorrent <no-dsa> (Minor issue)
@@ -137,7 +1122,7 @@ CVE-2026-77215
CVE-2026-75891 (The Kirki plugin for WordPress is vulnerable to Privilege Escalation v ...)
NOT-FOR-US: WordPress plugin
CVE-2026-70382 (Some externally supplied values stored by the device may be rendered i ...)
- TODO: check
+ NOT-FOR-US: WolfVision
CVE-2026-70381 (An access-control vulnerability has been identified in the web server ...)
NOT-FOR-US: WolfVision
CVE-2026-70380 (A denial-of-service vulnerability has been identified in the Miracast ...)
@@ -197,9 +1182,19 @@ CVE-2026-65627 (Improper Handling of Highly Compressed Data (Data Amplification)
NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429 (1.0.0)
NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/857eb8e7f2d33e2c9ca2189e77226561cacaf2ad (1.11.13)
CVE-2026-65626 (The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 modu ...)
- TODO: check
+ - erlang-jose <unfixed>
+ NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-vwvr-f994-6j9j
+ NOTE: https://cna.erlef.org/cves/CVE-2026-65626.html
+ NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65626
+ NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/853c5d4c4c0bd2a7ecb055b237f4284184e176c8 (1.3.0)
+ NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/0eac8cef9aaa48fb6846f4e47a0002dc4a73966d (1.11.13)
CVE-2026-65625 (The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of ...)
- TODO: check
+ - erlang-jose <unfixed>
+ NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-6gxw-6f7r-cjr6
+ NOTE: https://cna.erlef.org/cves/CVE-2026-65625.html
+ NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65625
+ NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/8848b172575fb7d7e1e2977e8ae0a21678d2157a (1.2.0)
+ NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/3fa1f8e3efda0da5ce6f4c9984789f979dc02740 (1.11.13)
CVE-2026-65397 (An authorization issue was addressed with improved state management. T ...)
NOT-FOR-US: Apple
CVE-2026-65392 (A permissions issue was addressed with additional restrictions. This i ...)
@@ -225,13 +1220,21 @@ CVE-2026-64759 (An integer overflow was addressed with improved input validation
CVE-2026-64750 (An out-of-bounds write issue was addressed with improved bounds checki ...)
NOT-FOR-US: Apple
CVE-2026-57196 (Asterisk is an open source private branch exchange and telephony toolk ...)
- TODO: check
+ - asterisk 1:22.10.1+dfsg+~cs6.17.60671434-1
+ NOTE: https://github.com/asterisk/asterisk/security/advisories/GHSA-4pgv-j3mr-3rcp
+ NOTE: Fixed by: https://github.com/asterisk/asterisk/commit/dc43c5b32a3a216da4c9e95388fbadaca3e78bc8 (22.10.1)
CVE-2026-57193 (Asterisk is an open source private branch exchange and telephony toolk ...)
- TODO: check
+ - asterisk 1:22.10.1+dfsg+~cs6.17.60671434-1
+ NOTE: https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp
+ NOTE: Fixed by: https://github.com/asterisk/asterisk/commit/23c01b6d359c5d85da725beea89e394a6c031c5d (22.10.1)
CVE-2026-57187 (Asterisk is an open source private branch exchange and telephony toolk ...)
- TODO: check
+ - asterisk 1:22.10.1+dfsg+~cs6.17.60671434-1
+ NOTE: https://github.com/asterisk/asterisk/security/advisories/GHSA-g8q2-p36q-94f6
+ NOTE: Fixed by: https://github.com/asterisk/asterisk/commit/27b9544b32f059a4f614169243eaa7559f622aa0 (22.10.1)
CVE-2026-57184 (Asterisk is an open source private branch exchange and telephony toolk ...)
- TODO: check
+ - asterisk 1:22.10.1+dfsg+~cs6.17.60671434-1
+ NOTE: https://github.com/asterisk/asterisk/security/advisories/GHSA-746q-794h-cc7f
+ NOTE: Fixed by: https://github.com/asterisk/asterisk/commit/6dba027f8aea35bf3bbd89371a0cf516b13f8588 (22.10.1)
CVE-2026-43736 (An authorization issue was addressed with improved state management. T ...)
NOT-FOR-US: Apple
CVE-2026-117472 (Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the reque ...)
@@ -245,15 +1248,18 @@ CVE-2026-117469 (Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enf
CVE-2026-117468 (Psono Server versions 5.3.5 through 7.2.3 used a permission class that ...)
NOT-FOR-US: esaqa GmbH
CVE-2026-116844 (Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmissio ...)
- TODO: check
+ NOT-FOR-US: Fclairamb ftpserverlib
CVE-2026-116843 (Mistral Vibe before 3.0.3 contains a remote code execution vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Mistral Vibe
CVE-2026-116842 (DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulner ...)
- TODO: check
+ - devilutionx <itp> (bug #1088174)
CVE-2026-116841 (DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnera ...)
- TODO: check
+ - devilutionx <itp> (bug #1088174)
CVE-2026-116840 (llama.cpp b5854 before b11275 contains an integer overflow vulnerabili ...)
- TODO: check
+ - llama.cpp 1:0.6.0+dfsg-1
+ NOTE: https://github.com/ggml-org/llama.cpp/issues/26978
+ NOTE: https://github.com/ggml-org/llama.cpp/pull/26979
+ NOTE: Fixed by: https://github.com/ggml-org/llama.cpp/commit/a6ea155d3d38b3f6f43d0c0dc29c2d592413ef44 (v0.6.0, b11275)
CVE-2026-116839 (A malicious actor who lures an authenticated user to a malicious page ...)
NOT-FOR-US: Ubiquity
CVE-2026-116838 (A malicious actor who lures an authenticated user to a malicious page ...)
@@ -263,7 +1269,10 @@ CVE-2026-116837 (A malicious actor with access to the adjacent network could exp
CVE-2026-116836 (A malicious actor with access to the adjacent network and under certai ...)
NOT-FOR-US: Ubiquity
CVE-2026-116829 (llama.cpp b10398 before b11301 contains an integer overflow vulnerabil ...)
- TODO: check
+ - llama.cpp 1:0.6.0+dfsg-1
+ NOTE: https://github.com/ggml-org/llama.cpp/issues/29383
+ NOTE: https://github.com/ggml-org/llama.cpp/pull/29384
+ NOTE: Fixed by: https://github.com/ggml-org/llama.cpp/commit/2149c00f4442dc59302e134a02e4c99d5f7ed9fc (v0.6.0, b11301)
CVE-2026-116828 (YesWiki before 4.7.0 contains a sql injection vulnerability in despam. ...)
NOT-FOR-US: YesWiki
CVE-2026-116827 (YesWiki before 4.7.0 contains a server-side request forgery vulnerabil ...)
@@ -289,7 +1298,10 @@ CVE-2026-116818 (OpenPanel before 3.0.0 contains an unauthenticated ClickHouse s
CVE-2026-116817 (OpenPanel before 3.0.0 contains a missing authentication vulnerability ...)
NOT-FOR-US: OpenPanel
CVE-2026-116816 (llama.cpp b5899 before b10261 contains a heap out-of-bounds write vuln ...)
- TODO: check
+ - llama.cpp 10271+dfsg-1
+ NOTE: https://github.com/ggml-org/llama.cpp/pull/25969
+ NOTE: https://github.com/ggml-org/llama.cpp/pull/26511
+ NOTE: Fixed by: https://github.com/ggml-org/llama.cpp/commit/cf06ad7dfe79e7bf2934150d4fefe1ce8db05490 (v0.1.0, b10261)
CVE-2026-116815 (OpenPanel before 3.0.0 contains an improper escaping vulnerability in ...)
NOT-FOR-US: OpenPanel
CVE-2026-116814 (OpenPanel before 3.0.0 contains an information exposure vulnerability ...)
@@ -313,25 +1325,36 @@ CVE-2026-116806 (OpenPanel before 3.0.0 contains a missing authorization vulnera
CVE-2026-116805 (OpenPanel before 3.0.0 contains an information disclosure vulnerabilit ...)
NOT-FOR-US: OpenPanel
CVE-2026-116804 (DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypas ...)
- TODO: check
+ - node-dompurify <unfixed>
+ [trixie] - node-dompurify <not-affected> (Vulnerable code introduced in 3.4.4 upstream)
+ [bookworm] - node-dompurify <not-affected> (Vulnerable code introduced in 3.4.4 upstream)
+ NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7
CVE-2026-116803 (DOMPurify before 3.4.17 contains a cross-site scripting vulnerability ...)
- TODO: check
+ - node-dompurify <unfixed>
+ NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr
+ NOTE: Issue exists because of an incomplete fix for CVE-2026-109344 / GHSA-p98j-92pf-mc4p
CVE-2026-116802 (DOMPurify before 3.4.17 contains a cross-site scripting vulnerability ...)
- TODO: check
+ - node-dompurify <unfixed>
+ NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f
CVE-2026-116801 (Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not v ...)
NOT-FOR-US: Parse Server
CVE-2026-116800 (WWBN AVideo before 29.5.0 contains a local file inclusion vulnerabilit ...)
NOT-FOR-US: WWBN AVideo
CVE-2026-116748 (Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerabili ...)
- TODO: check
+ - transmission 4.1.3+dfsg-1
+ NOTE: https://github.com/transmission/transmission/pull/8938
+ NOTE: Fixed by: https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e (4.1.3)
CVE-2026-116747 (Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Kener
CVE-2026-116746 (QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerabi ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-116745 (QloApps through 1.7.0 contains an information disclosure vulnerability ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-116744 (ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in ...)
- TODO: check
+ - ndpi <unfixed>
+ NOTE: https://github.com/ntop/nDPI/issues/3291
+ NOTE: https://github.com/ntop/nDPI/pull/3298
+ NOTE: Fixed by: https://github.com/ntop/nDPI/commit/ca9d819151606377ac53305583fe819748c69be2
CVE-2026-116743 (libyal libmsiecf through 20260525 contains a double free vulnerability ...)
TODO: check
CVE-2026-116742 (HTSlib through 1.24 contains a heap out-of-bounds write and read vulne ...)
@@ -419,11 +1442,22 @@ CVE-2026-116581 (Seroval facilitates JavaScript value stringification, including
CVE-2026-116580 (Seroval facilitates JavaScript value stringification, including comple ...)
TODO: check
CVE-2026-116579 (Autobahn Python is a WebSocket and WAMP implementation for Python that ...)
- TODO: check
+ - python-autobahn <not-affected> (Incomplete fix for CVE-2026-77528 not applied)
+ NOTE: https://github.com/crossbario/autobahn-python/security/advisories/GHSA-pjh6-c8mg-3x7m
+ NOTE: https://github.com/crossbario/autobahn-python/pull/1987
+ NOTE: Fixed by: https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1 (v26_10_1)
CVE-2026-116578 (Tornado is a Python web framework and asynchronous networking library. ...)
- TODO: check
+ - python-tornado <unfixed>
+ NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p
+ NOTE: https://github.com/tornadoweb/tornado/pull/3786
+ NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233 (v6.6.0b1)
+ NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117 (v6.6.0rc1)
+ NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035 (v6.6.0rc1)
CVE-2026-116577 (Tornado is a Python web framework and asynchronous networking library. ...)
- TODO: check
+ - python-tornado <unfixed>
+ NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-pcg2-g6cj-q92c
+ NOTE: https://github.com/tornadoweb/tornado/pull/3765
+ NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/1b7a1dc9f340f52de929852e8125aa12f25297c9 (v6.6.0b1)
CVE-2026-116576 (systeminformation is a System and OS information library for node.js. ...)
TODO: check
CVE-2026-116575 (Mem0 provides persistent memory infrastructure for AI agents and appli ...)
@@ -459,7 +1493,10 @@ CVE-2026-116478 (A vulnerability was detected in a2aproject a2a-go up to 2.4.0.
CVE-2026-116477 (A security vulnerability has been detected in a2aproject a2a-dotnet up ...)
TODO: check
CVE-2026-115927 (Tornado is a Python web framework and asynchronous networking library. ...)
- TODO: check
+ - python-tornado <unfixed>
+ NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-r4j5-9xpp-3985
+ NOTE: https://github.com/tornadoweb/tornado/pull/3773
+ NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/ceab33581489751a66fba8566ad6d5960d4b01c8 (v6.6.0b1)
CVE-2026-115924 (Rembg is a tool to remove images background. Prior to 2.0.82, the publ ...)
TODO: check
CVE-2026-115533 (The LeRobot library is vulnerable to arbitrary code execution via unsa ...)
@@ -1234,7 +2271,7 @@ CVE-2026-116476 (A weakness has been identified in a2aproject a2a-dotnet up to 1
NOT-FOR-US: a2aproject a2a-dotnet
CVE-2026-116471 (A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The i ...)
NOT-FOR-US: BKWLD Decoy
-CVE-2026-116469 (MISP Guard, a proxy-based security filter for MISP (Malware Informatio ...)
+CVE-2026-116469 (MISP Guard, a proxy-based security filter for MISP feed distribution, ...)
NOT-FOR-US: MISP Guard
CVE-2026-116467 (A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. ...)
- llama.cpp <unfixed>
@@ -1583,7 +2620,7 @@ CVE-2026-108525 (Allocation of Resources Without Limits or Throttling vulnerabil
NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-107656 (An authentication bypass using an alternate path or channel vulnerabil ...)
NOT-FOR-US: Fortinet
-CVE-2026-107157 (Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt ...)
+CVE-2026-107157 (Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Co ...)
TODO: check
CVE-2026-107092 (NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update ...)
NOT-FOR-US: NexoPOS
@@ -4893,6 +5930,7 @@ CVE-2026-92183 (GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code E
- gimp 3.2.6-1
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/e4b0d6bc389df4b9b439a3f4e1155e4de965869e (GIMP_3_2_6)
CVE-2026-91403 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DSA-6588-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5974,6 +7012,7 @@ CVE-2026-111817 (Apache Traffic Server can stall a chunked transfer that it pass
- trafficserver <removed>
NOTE: https://trafficserver.apache.org/security-2026-10.html
CVE-2026-73206 [A crafted DNS packet can cause a denial of service decompressing the DNS names in the packet]
+ {DSA-6587-1}
- pdns 5.1.5-1 (bug #1152255)
- pdns-recursor 5.4.8-1
NOTE: https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-12.html#cve-2026-73206-crafted-packet-using-compression-pointers-can-lead-to-denial-of-service
@@ -6341,7 +7380,7 @@ CVE-2026-91489 (Vulnerability in the Oracle Identity Manager Connector product o
CVE-2026-91488 (Vulnerability in the Oracle Identity Manager Connector product of Orac ...)
NOT-FOR-US: Oracle
CVE-2026-91487 (Vulnerability in Oracle Java SE (component: Compiler). Supported vers ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6389,7 +7428,7 @@ CVE-2026-91466 (Vulnerability in the PeopleSoft Enterprise FIN Common Objects Ar
CVE-2026-91465 (Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentin ...)
NOT-FOR-US: Oracle
CVE-2026-91464 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6398,7 +7437,7 @@ CVE-2026-91464 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91463 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6407,7 +7446,7 @@ CVE-2026-91463 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91462 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6416,7 +7455,7 @@ CVE-2026-91462 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91461 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6435,7 +7474,7 @@ CVE-2026-91457 (Vulnerability in the Oracle Outside In Technology product of Ora
CVE-2026-91455 (Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle ...)
NOT-FOR-US: Oracle
CVE-2026-91453 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6444,7 +7483,7 @@ CVE-2026-91453 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91452 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6453,7 +7492,7 @@ CVE-2026-91452 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91451 (Vulnerability in Oracle Java SE (component: Networking). Supported ve ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6524,7 +7563,7 @@ CVE-2026-91420 (Vulnerability in the Siebel CRM Deployment product of Oracle Sie
CVE-2026-91419 (Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middl ...)
NOT-FOR-US: Oracle
CVE-2026-91418 (Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6536,7 +7575,7 @@ CVE-2026-91417 (Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise E
- openjdk-8 <unfixed> (bug #1151673)
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91415 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6551,14 +7590,14 @@ CVE-2026-91413 (Vulnerability in the Siebel CRM Development product of Oracle Si
CVE-2026-91412 (Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM ...)
NOT-FOR-US: Oracle
CVE-2026-91411 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
- openjdk-21 21.0.13+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91410 (Vulnerability in Oracle Java SE (component: Libraries). Supported ver ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6584,7 +7623,7 @@ CVE-2026-91402 (Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle Graal
[bookworm] - openjfx <not-affected> (Vulnerable code not present, only affects 21 and later)
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91400 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6595,7 +7634,7 @@ CVE-2026-91400 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
CVE-2026-91399 (Vulnerability in the Primavera P6 Enterprise Project Portfolio Managem ...)
NOT-FOR-US: Oracle
CVE-2026-91398 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6604,7 +7643,7 @@ CVE-2026-91398 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91397 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6621,7 +7660,7 @@ CVE-2026-91395 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-11 <unfixed>
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91394 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
- openjdk-21 21.0.13+9-1
@@ -6654,7 +7693,7 @@ CVE-2026-91384 (Vulnerability in the JD Edwards EnterpriseOne Tools product of O
CVE-2026-91383 (Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle ...)
NOT-FOR-US: Oracle
CVE-2026-91382 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6664,7 +7703,7 @@ CVE-2026-91381 (Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise E
- openjdk-8 <unfixed> (bug #1151673)
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91380 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6673,7 +7712,7 @@ CVE-2026-91380 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91379 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6688,7 +7727,7 @@ CVE-2026-91377 (Vulnerability in the Siebel CRM Integration product of Oracle Si
CVE-2026-91376 (Vulnerability in the Primavera P6 Enterprise Project Portfolio Managem ...)
NOT-FOR-US: Oracle
CVE-2026-91375 (Vulnerability in Oracle Java SE (component: Libraries). Supported ver ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6697,7 +7736,7 @@ CVE-2026-91375 (Vulnerability in Oracle Java SE (component: Libraries). Support
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91374 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6706,7 +7745,7 @@ CVE-2026-91374 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91373 (Vulnerability in Oracle Java SE (component: JSSE). Supported versions ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6789,7 +7828,7 @@ CVE-2026-91337 (Vulnerability in the iProcurement product of Oracle E-Business S
CVE-2026-91336 (Vulnerability in the Oracle Solaris product of Oracle Systems (compone ...)
NOT-FOR-US: Oracle
CVE-2026-91335 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6798,7 +7837,7 @@ CVE-2026-91335 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91334 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6807,12 +7846,13 @@ CVE-2026-91334 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91333 (Vulnerability in Oracle Java SE (component: Security). Supported vers ...)
+ {DSA-6588-1}
- openjdk-21 21.0.13+9-1
- openjdk-25 25.0.5+8-1
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91332 (Vulnerability in Oracle Java SE (component: Networking). Supported ve ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -7181,7 +8221,7 @@ CVE-2026-87370 (Vulnerability in the Oracle WebCenter Content product of Oracle
CVE-2026-87369 (Vulnerability in the Oracle Service Bus product of Oracle Fusion Middl ...)
NOT-FOR-US: Oracle
CVE-2026-87367 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -7332,7 +8372,7 @@ CVE-2026-87296 (Vulnerability in the Oracle Access Manager product of Oracle Fus
CVE-2026-87295 (Vulnerability in the Oracle HRMS (India) product of Oracle E-Business ...)
NOT-FOR-US: Oracle
CVE-2026-87294 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -7344,7 +8384,7 @@ CVE-2026-87293 (Vulnerability in Oracle Java SE (component: RMI). Supported ver
- openjdk-8 <unfixed> (bug #1151673)
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-87292 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -7353,12 +8393,13 @@ CVE-2026-87292 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-87291 (Vulnerability in Oracle Java SE (component: Networking). Supported ve ...)
+ {DSA-6588-1}
- openjdk-21 21.0.13+9-1
- openjdk-25 25.0.5+8-1
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-87290 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -7397,7 +8438,7 @@ CVE-2026-83402 (Vulnerability in the Oracle Identity Manager product of Oracle F
CVE-2026-83401 (Vulnerability in the Oracle Identity Manager product of Oracle Fusion ...)
NOT-FOR-US: Oracle
CVE-2026-83400 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -7414,7 +8455,7 @@ CVE-2026-83397 (Vulnerability in the Oracle Data Integrator product of Oracle Fu
CVE-2026-83396 (Vulnerability in the Oracle Data Integrator product of Oracle Fusion M ...)
NOT-FOR-US: Oracle
CVE-2026-83395 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -7437,7 +8478,7 @@ CVE-2026-83389 (Vulnerability in the Oracle HRMS (UK) product of Oracle E-Busine
CVE-2026-83388 (Vulnerability in the Oracle Applications Manager product of Oracle E-B ...)
NOT-FOR-US: Oracle
CVE-2026-83387 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -7456,7 +8497,7 @@ CVE-2026-83383 (Vulnerability in the Oracle HRMS (US) product of Oracle E-Busine
CVE-2026-83382 (Vulnerability in the Oracle Report Manager product of Oracle E-Busines ...)
NOT-FOR-US: Oracle
CVE-2026-83381 (Vulnerability in Oracle Java SE (component: Security). Supported vers ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -7465,7 +8506,7 @@ CVE-2026-83381 (Vulnerability in Oracle Java SE (component: Security). Supporte
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-83380 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -7476,6 +8517,7 @@ CVE-2026-83380 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
CVE-2026-83379 (Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of O ...)
NOT-FOR-US: Oracle
CVE-2026-83378 (Vulnerability in Oracle Java SE (component: Compiler). Supported vers ...)
+ {DSA-6588-1}
- openjdk-21 21.0.13+9-1
- openjdk-25 25.0.5+8-1
- openjdk-27 27.0.1+9-1
@@ -7483,7 +8525,7 @@ CVE-2026-83378 (Vulnerability in Oracle Java SE (component: Compiler). Supporte
CVE-2026-83377 (Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Sui ...)
NOT-FOR-US: Oracle
CVE-2026-83376 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -7494,7 +8536,7 @@ CVE-2026-83376 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
CVE-2026-83375 (Vulnerability in the PeopleSoft Enterprise HCM Human Resources product ...)
NOT-FOR-US: Oracle
CVE-2026-83374 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- {DLA-4861-1}
+ {DSA-6588-1 DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -11766,8 +12808,8 @@ CVE-2026-11319 (TickTick Android application (com.ticktick.task) 8.2.2.0 contain
CVE-2026-112377 (CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to b ...)
NOT-FOR-US: CCC Attestation SIG attested-tls-poc
CVE-2026-112368 (An uncontrolled recursion weakness in the BSON decoding logic of the M ...)
+ {DSA-6589-1}
- php-mongodb <unfixed> (bug #1151934)
- [trixie] - php-mongodb <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/PHPC-276
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/795e914e6f7cc631a2f80c89aedcdd2a1df4ada9 (2.5.5, 2.1.12, 1.21.12)
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/01363996a93b33fea58c90f5e8d1eaea5e01eafd (2.5.5, 2.1.12, 1.21.12)
@@ -23606,6 +24648,7 @@ CVE-2026-109828 (A vulnerability was found in libsndfile up to 1.2.2. This issue
- libsndfile <unfixed> (unimportant)
NOTE: https://github.com/libsndfile/libsndfile/issues/1169
NOTE: https://github.com/libsndfile/libsndfile/pull/1170
+ NOTE: Fixed by: https://github.com/libsndfile/libsndfile/commit/1ccd2a18826722c3aa9ed54122ebff20e3b92b10
NOTE: Negligible security impact
CVE-2026-109827 (A vulnerability has been found in GPAC up to 26.07.0. This vulnerabili ...)
- gpac <removed>
@@ -29107,7 +30150,7 @@ CVE-2026-107572 (Inefficient complexity in the Sieve filter evaluation of Progre
NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107570 (heap OOB write in convert_file_from_to() via a crafted Content-Type he ...)
{DSA-6563-1}
- - mutt <unfixed> (bug #1150407)
+ - mutt 2.4.1-1.1 (bug #1150407)
NOTE: https://gitlab.com/muttmua/mutt/-/work_items/533
NOTE: Fixed by: https://gitlab.com/muttmua/mutt/-/commit/7752d93f26f8f1384905fad874afff5abb0f3e54 (mutt-2-4-3-rel)
CVE-2026-107565 (A flaw was found in luksmeta. A local attacker with administrative pri ...)
@@ -29269,8 +30312,8 @@ CVE-2026-106437 (The BSON buffer-reservation API in the MongoDB C Driver can rec
NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/6c593a59a9dce87e42298b85779ca02a9357dd74 (2.5.6)
NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/b7f1f5742351741c068020196fd88f196551aad2 (1.30.13)
CVE-2026-106436 (The BSON encoder in the MongoDB PHP Driver does not check some return ...)
+ {DSA-6589-1}
- php-mongodb <unfixed> (bug #1150514)
- [trixie] - php-mongodb <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/PHPC-2739
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/79036dd7a4c946cfef2d0105f8102f26d685b260 (2.5.4, 2.1.11, 1.21.11)
CVE-2026-106435 (The MongoDB Python Driver's binary accelerator can read outside a buff ...)
@@ -29292,8 +30335,8 @@ CVE-2026-106433 (Improper state management in MongoDB libmongocrypt can cause pr
NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/556bcb70b6efecb7f568d824b03469df3a3bc91a (1.20.5)
NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/8bc580ea69eea13a932197221edf72830fbc38a1 (1.20.5)
CVE-2026-106432 (The BSON encoder in the MongoDB PHP Driver converts a string length to ...)
+ {DSA-6589-1}
- php-mongodb <unfixed> (bug #1150514)
- [trixie] - php-mongodb <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/PHPC-2741
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/79036dd7a4c946cfef2d0105f8102f26d685b260 (2.5.4, 2.1.11, 1.21.11)
CVE-2026-106431 (An off-by-one error in the BSON bulk document writer in the MongoDB C ...)
@@ -31262,7 +32305,7 @@ CVE-2026-101027 (When `[migrations] ALLOWED_DOMAINS` was configured, a hostname
NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-101023 (Gitea's OAuth2 token endpoint verified the signature and grant of a to ...)
NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
-CVE-2026-88812 [XKB SetGeometry TextDoodad Double Free]
+CVE-2026-88812 (A double free inXKB SetGeometryin X.Org X Server before 21.1.25 and X ...)
- xorg-server 2:21.1.25-1 (bug #1150214)
- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
@@ -39668,7 +40711,7 @@ CVE-2026-19553 (ssl.SSLContext.wrap_bio() didn't require the server_hostname arg
- python3.13 <unfixed>
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
- - pypy3 <unfixed> (bug #1150803)
+ - pypy3 8.0.1+dfsg-1 (bug #1150803)
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <postponed> (Minor issue)
NOTE: https://github.com/python/cpython/issues/156793
@@ -39982,7 +41025,7 @@ CVE-2026-19445 (A remote, unauthenticated TLS client can make a server crash or
- python3.13 <unfixed>
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
- - pypy3 <unfixed> (bug #1150805)
+ - pypy3 8.0.1+dfsg-1 (bug #1150805)
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <postponed> (Minor issue)
NOTE: https://github.com/python/cpython/issues/156293
@@ -40783,7 +41826,7 @@ CVE-2026-15390 (Das U-Bootwith CONFIG_IP_DEFRAG=y parameter fails to clear IP re
NOTE: Fixed by: https://source.denx.de/u-boot/u-boot/-/commit/b1aec609bb5e0d08c25c888c91935287ab4ee5fa (v2026.07)
CVE-2026-12345 (The cleanup of tempfile.TemporaryDirectory is vulnerable to a race con ...)
- python3.15 3.15.0~rc3-1
- - python3.14 <unfixed>
+ - python3.14 3.14.9-1
- python3.13 <unfixed>
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
@@ -40794,6 +41837,8 @@ CVE-2026-12345 (The cleanup of tempfile.TemporaryDirectory is vulnerable to a ra
NOTE: https://github.com/python/cpython/issues/157579
NOTE: https://github.com/python/cpython/pull/157580
NOTE: https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970 (v3.15.0rc3)
+ NOTE: https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74 (v3.14.9)
+ NOTE: https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa (v3.13.18)
CVE-2026-11796 (Asset Suite allows unauthenticated users to access PropertiesReloadSer ...)
NOT-FOR-US: Hitachi Energy
CVE-2026-10518 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
@@ -42255,30 +43300,41 @@ CVE-2026-94287 (A denial of service via unsigned underflow in libXpm's write pat
- libxpm 1:3.5.20-1 (bug #1149666)
[trixie] - libxpm <no-dsa> (Minor issue)
[bookworm] - libxpm <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/32
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/6e42eb9e105ae17318f3ba5656d94cd3f80eeaa3
+CVE-2026-109088 (A malicious X server could send malformedRECORD EnableContextreolies t ...)
+ - libxtst 2:1.2.6-1
+ [trixie] - libxtst <no-dsa> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
+ NOTE: https://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/11
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/ac60f5f474bc6440332a88225763a71cdbaed570
CVE-2026-94286 (An out-of-bounds read in libXtst's RECORD reply parser in libXtst befo ...)
- libxtst 2:1.2.6-1 (bug #1149667)
[trixie] - libxtst <no-dsa> (Minor issue)
[bookworm] - libxtst <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/10
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/b84737d8400db7f06293822838d0e1c374cf71c4
CVE-2026-94285 (An out-of-bounds read in libX11's byte-oriented codeset parser in libX ...)
- libx11 2:1.8.14-1 (bug #1149668)
[trixie] - libx11 <no-dsa> (Minor issue)
[bookworm] - libx11 <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/797eaf0bd69524144e0df7af516b680f4b7694e9
CVE-2026-94284 (An out-of-bounds read vulnerability in libX11's XIM trigger-key regist ...)
- libx11 2:1.8.14-1 (bug #1149668)
[trixie] - libx11 <no-dsa> (Minor issue)
[bookworm] - libx11 <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/924fc91f08ece9cddc93609b4dc945a9cc90ea12
CVE-2026-94283 (An out-of-bounds read vulnerability in libX11's XIM (X Input Method) a ...)
- libx11 2:1.8.14-1 (bug #1149668)
[trixie] - libx11 <no-dsa> (Minor issue)
[bookworm] - libx11 <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/f263bbca24d04c766775e7af2e203ca41b4ece2e
CVE-2026-94194 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response S ...)
@@ -46502,46 +47558,65 @@ CVE-2026-94604
REJECTED
CVE-2026-94416 (An authorization bypass was found in the Ansible Automation Platform ( ...)
NOT-FOR-US: Red Hat Ansible Automation Platform
+CVE-2026-109090 (A malicious X server could cause a heap overflow by injecting a largeD ...)
+ - libxi 2:1.8.4-1
+ [trixie] - libxi <no-dsa> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
+ NOTE: https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/26
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b67034ace1abdf785fd8dcba7b6dc739d
+CVE-2026-109089 (A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8. ...)
+ - libxi 2:1.8.4-1
+ [trixie] - libxi <no-dsa> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
+ NOTE: https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/26
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f7836d0a0f45e9e6c2c147c5dea4b6bc08231f2e
CVE-2026-94282 (An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversi ...)
- libxi 2:1.8.4-1 (bug #1148965)
[trixie] - libxi <no-dsa> (Minor issue)
[bookworm] - libxi <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/8caed97a3e356ff5827704f3c28aed0d50d9136d
CVE-2026-94281 (An out-of-bounds read in libXi's XListInputDevices() class parsing in ...)
- libxi 2:1.8.4-1 (bug #1148965)
[trixie] - libxi <no-dsa> (Minor issue)
[bookworm] - libxi <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/1d5813ba0431b7e9a324a412e8b8ef532f65c5be
CVE-2026-93545 (An out-of-bounds read in libXi's XListInputDevices() in libXi before 1 ...)
- libxi 2:1.8.4-1 (bug #1148965)
[trixie] - libxi <no-dsa> (Minor issue)
[bookworm] - libxi <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/2e5ecd1876a72e09aaeea87e1a8135ae764803d9
CVE-2026-93544 (An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in li ...)
- libxi 2:1.8.4-1 (bug #1148965)
[trixie] - libxi <no-dsa> (Minor issue)
[bookworm] - libxi <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/e2ec4a1c8403c99f6c08621920b0efb0e0d6d533
CVE-2026-93543 (An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8. ...)
- libxi 2:1.8.4-1 (bug #1148965)
[trixie] - libxi <no-dsa> (Minor issue)
[bookworm] - libxi <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f885619bb67f1ddec5d4e40ff3eff1a3269a0069
CVE-2026-93542 (An out-of-bounds read in libXi's XI2 class parsing via size_classes() ...)
- libxi 2:1.8.4-1 (bug #1148965)
[trixie] - libxi <no-dsa> (Minor issue)
[bookworm] - libxi <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/59f8dece822889f1db2b160775f9badbf810a734
CVE-2026-93541 (An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1 ...)
- libxi 2:1.8.4-1 (bug #1148965)
[trixie] - libxi <no-dsa> (Minor issue)
[bookworm] - libxi <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/9a5f8636b9f3a2092ed845be6719abcf8f6bf383
CVE-2026-93425 (Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior t ...)
@@ -51171,11 +52246,13 @@ CVE-2026-88807 (A heap overflow in libXrender before 0.9.13 inRenderQueryPictFor
- libxrender 1:0.9.13-1 (bug #1148735)
[trixie] - libxrender <no-dsa> (Minor issue)
[bookworm] - libxrender <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19
CVE-2026-88806 (A malicious X server could exploit a buffer overflow in libX11 before ...)
- libx11 2:1.8.14-1 (bug #1148733)
[trixie] - libx11 <no-dsa> (Minor issue)
[bookworm] - libx11 <postponed> (Minor issue)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/6d4432b13c0b3b6a644c13de9c793a14db48d545
CVE-2026-88788 (The Text Styler WordPress plugin through 1.1.1 does not sanitise and e ...)
@@ -52285,6 +53362,7 @@ CVE-2026-77528 (Autobahn Python is a WebSocket and WAMP implementation for Pytho
NOTE: https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566
NOTE: https://github.com/crossbario/autobahn-python/pull/1916
NOTE: Fixed by: https://github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613 (v26.7.1)
+ NOTE: When fixing this issue make sure to make the fix complete to not open up CVE-2026-116579
CVE-2026-76902 (CordysCRM is an open source AI-powered customer relationship managemen ...)
NOT-FOR-US: CordysCRM
CVE-2026-76901 (CordysCRM is an open source AI-powered customer relationship managemen ...)
@@ -63818,7 +64896,7 @@ CVE-2026-82049 (In CPython 3.13 and earlier, the tarfilemodule's dataand tar ext
- python3.13 <unfixed>
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <not-affected> (extraction filters (PEP 706) absent in 3.11.2)
- - pypy3 <unfixed> (bug #1151858)
+ - pypy3 8.0.1+dfsg-1 (bug #1151858)
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <not-affected> (extraction filters (PEP 706) absent in stdlib 3.9.16)
NOTE: https://github.com/python/cpython/issues/157190
@@ -67312,11 +68390,11 @@ CVE-2026-87983 (An arbitrary file read vulnerability in Mistral Vibe, introduced
NOT-FOR-US: Mistral Vibe
CVE-2026-87910 (When tarfile extracts a link on a system that doesn't support links, i ...)
- python3.15 3.15.0~rc3-1
- - python3.14 <unfixed>
+ - python3.14 3.14.9-1
- python3.13 <unfixed>
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <not-affected> (extraction filters (PEP 706) absent in 3.11.2)
- - pypy3 <unfixed>
+ - pypy3 8.0.1+dfsg-1
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <not-affected> (extraction filters (PEP 706) absent in stdlib 3.9.16)
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/
@@ -67324,6 +68402,8 @@ CVE-2026-87910 (When tarfile extracts a link on a system that doesn't support li
NOTE: https://github.com/python/cpython/pull/157266
NOTE: https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2 (main)
NOTE: https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5 (v3.15.0rc3)
+ NOTE: https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0 (v3.14.9)
+ NOTE: https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955 (v3.13.16)
NOTE: Same code situation as with CVE-2025-4435.
CVE-2026-87859 (morgan is an HTTP request logger middleware for Node.js. In versions b ...)
- node-morgan 1.12.1+~1.9.10-1 (bug #1147520)
@@ -76643,7 +77723,7 @@ CVE-2026-19795 (Qiskit could allow a local attacker to cause a denial of service
NOT-FOR-US: IBM
CVE-2026-19224 (The Hummingbird Performance WordPress plugin before 3.21.2 does not r ...)
NOT-FOR-US: WordPress plugin
-CVE-2026-18330 (A hard-coded cryptographic key vulnerability exists in theweb module o ...)
+CVE-2026-18330 (A hard-coded cryptographic key vulnerability exists in TP-Link RE305 V ...)
NOT-FOR-US: TPLink
CVE-2026-18167 (A stack-based buffer overflow vulnerability exists in the EasyMesh mod ...)
NOT-FOR-US: TPLink
@@ -96762,7 +97842,7 @@ CVE-2026-17084 (The "stringprep" module didn't process characters from RFC 3454
- python3.9 <removed>
- python2.7 <removed>
[bullseye] - python2.7 <end-of-life> (EOL in bullseye LTS)
- - pypy3 <unfixed> (bug #1147445)
+ - pypy3 8.0.1+dfsg-1 (bug #1147445)
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <postponed> (Minor issue)
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/
@@ -96783,7 +97863,7 @@ CVE-2026-15806 (The HTTPPasswordMgr class in the urllib.request module, along wi
- python3.9 <removed>
- python2.7 <removed>
[bullseye] - python2.7 <end-of-life> (EOL in bullseye LTS)
- - pypy3 <unfixed> (bug #1147448)
+ - pypy3 8.0.1+dfsg-1 (bug #1147448)
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <postponed> (Minor issue)
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/
@@ -109338,7 +110418,7 @@ CVE-2026-18503 (Attacker-controlled CSV samples can trigger super-linear regula
- python3.9 <removed>
- python2.7 <removed>
[bullseye] - python2.7 <end-of-life> (EOL in bullseye LTS)
- - pypy3 <unfixed> (bug #1147450)
+ - pypy3 8.0.1+dfsg-1 (bug #1147450)
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <postponed> (Minor issue)
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/
@@ -158382,13 +159462,15 @@ CVE-2026-12289 (Privilege escalation in the Graphics: WebRender component. This
CVE-2026-12225 (syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitb ...)
NOT-FOR-US: syracom AG Secure Login (2FA) for Atlassian
CVE-2026-12003 (To allow builds of Python to be run from an in-tree layout (rather tha ...)
- - python3.14 <unfixed> (unimportant)
+ - python3.14 3.14.9-1 (unimportant)
- python3.13 <unfixed> (unimportant)
- python3.11 <removed> (unimportant)
- python3.9 <removed> (unimportant)
NOTE: No security impact outside of Windows
NOTE: https://github.com/python/cpython/pull/151545
NOTE: https://www.openwall.com/lists/oss-security/2026/06/16/8
+ NOTE: https://github.com/python/cpython/commit/a86de0bc236fbb9452f98998fc8437e9fca35700 (v3.15.0b3)
+ NOTE: https://github.com/python/cpython/commit/b93d6d3399adbd3a5037b6b92fc3587c85ac5d56 (v3.14.7)
CVE-2026-11317 (A denial of service security issue exists in the affected product. The ...)
NOT-FOR-US: Rockwell Automation
CVE-2026-10831 (A denial-of-service vulnerability exists in NPort devices because of i ...)
@@ -426003,6 +427085,7 @@ CVE-2024-38565 (In the Linux kernel, the following vulnerability has been resolv
NOTE: https://git.kernel.org/linus/e120b6388d7d88635d67dcae6483f39c37111850 (6.10-rc1)
CVE-2024-38564 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.8.12-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/543576ec15b17c0c93301ac8297333c7b6e84ac7 (6.10-rc1)
CVE-2024-38563 (In the Linux kernel, the following vulnerability has been resolved: w ...)
=====================================
data/DSA/list
=====================================
@@ -1,3 +1,14 @@
+[27 Oct 2026] DSA-6585-2 thunderbird - regression update
+ [trixie] - thunderbird 1:153.5.1esr-1~deb13u2
+[27 Oct 2026] DSA-6589-1 php-mongodb - security update
+ {CVE-2026-106432 CVE-2026-106436 CVE-2026-112368}
+ [trixie] - php-mongodb 2.0.0-1+deb13u2
+[27 Oct 2026] DSA-6588-1 openjdk-21 - security update
+ {CVE-2026-83374 CVE-2026-83376 CVE-2026-83378 CVE-2026-83380 CVE-2026-83381 CVE-2026-83387 CVE-2026-83395 CVE-2026-83400 CVE-2026-87290 CVE-2026-87291 CVE-2026-87292 CVE-2026-87294 CVE-2026-87367 CVE-2026-91332 CVE-2026-91333 CVE-2026-91334 CVE-2026-91335 CVE-2026-91373 CVE-2026-91374 CVE-2026-91375 CVE-2026-91379 CVE-2026-91380 CVE-2026-91382 CVE-2026-91394 CVE-2026-91397 CVE-2026-91398 CVE-2026-91400 CVE-2026-91403 CVE-2026-91410 CVE-2026-91411 CVE-2026-91415 CVE-2026-91418 CVE-2026-91451 CVE-2026-91452 CVE-2026-91453 CVE-2026-91461 CVE-2026-91462 CVE-2026-91463 CVE-2026-91464 CVE-2026-91487}
+ [trixie] - openjdk-21 21.0.13+9-1~deb13u2
+[27 Oct 2026] DSA-6587-1 pdns - security update
+ {CVE-2026-73206}
+ [trixie] - pdns 4.9.18-0+deb13u1
[27 Oct 2026] DSA-6586-1 valkey - security update
{CVE-2026-23479 CVE-2026-23631 CVE-2026-25243 CVE-2026-56684 CVE-2026-63639 CVE-2026-82631 CVE-2026-82677}
[trixie] - valkey 8.1.1+dfsg1-3+deb13u3
=====================================
data/dsa-needed.txt
=====================================
@@ -125,8 +125,6 @@ nss (carnil)
--
openexr
--
-openjdk-21 (jmm)
---
openjdk-25 (jmm)
--
pacemaker
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/efbbd8a3a93b41bfbdb5d58cc065b305163021e8...51f7eadbd7c98dce111e83a7a3e6c525178b9a2e
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/efbbd8a3a93b41bfbdb5d58cc065b305163021e8...51f7eadbd7c98dce111e83a7a3e6c525178b9a2e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/d842f0d7/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list