[Git][security-tracker-team/security-tracker][master] Add new icingaweb2 issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a5dc6eab by Salvatore Bonaccorso at 2026-10-28T16:51:47+01:00
Add new icingaweb2 issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,21 @@
+CVE-2026-XXXX [GHSA-mph2-hvq4-8423: Unauthenticated file read and denial of service through chart endpoints]
+	- icingaweb2 2.14.1-1
+	NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
+	NOTE: https://github.com/Icinga/icingaweb2/security/advisories/GHSA-mph2-hvq4-8423
+CVE-2026-XXXX [GHSA-jff6-vjrf-q9gj: Wildcards in login names grant the group memberships of other users]
+	- icingaweb2 2.14.1-1
+	NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
+	NOTE: https://github.com/Icinga/icingaweb2/security/advisories/GHSA-jff6-vjrf-q9gj
+CVE-2026-XXXX [GHSA-grpw-587v-93vw: Stored XSS through navigation item names in sidebar submenu headers]
+	- icingaweb2 2.14.1-1
+	[trixie] - icingaweb2 <not-affected> (Vulnerable code introduced later)
+	[bookworm] - icingaweb2 <not-affected> (Vulnerable code introduced later)
+	NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
+	NOTE: https://github.com/Icinga/icingaweb2/security/advisories/GHSA-grpw-587v-93vw
+CVE-2026-XXXX [GHSA-fmf2-272p-p3r9: Missing ownership check lets users remove other users' remembered devices]
+	- icingaweb2 2.14.1-1
+	NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
+	NOTE: https://github.com/Icinga/icingaweb2/security/advisories/GHSA-fmf2-272p-p3r9
 CVE-2026-99100 (In the Linux kernel, the following vulnerability has been resolved:  w ...)
 	- linux 7.2.13-1
 	NOTE: https://git.kernel.org/linus/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f (7.3-rc6)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a5dc6eabb989c6e63cdc16219498d0c4a45f6d97

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a5dc6eabb989c6e63cdc16219498d0c4a45f6d97
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/2aeee9d1/attachment-0001.htm>