[Git][security-tracker-team/security-tracker][master] Add new icinga2 issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e8f86400 by Salvatore Bonaccorso at 2026-10-28T17:02:49+01:00
Add new icinga2 issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,23 @@
+CVE-2026-XXXX [GHSA-chm5-8fg3-g6fw: The default email notification scripts may allow command injection from the recipient address]
+	- icinga2 2.16.6-1
+	NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
+	NOTE: https://github.com/Icinga/icinga2/security/advisories/GHSA-chm5-8fg3-g6fw
+CVE-2026-XXXX [GHSA-33vf-h78f-99p3: Attacker-Controlled Comparator crashes Array#sort]
+	- icinga2 2.16.6-1
+	NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
+	NOTE: https://github.com/Icinga/icinga2/security/advisories/GHSA-33vf-h78f-99p3
+CVE-2026-XXXX [GHSA-hhxh-8qx6-pxc3: Multiple instances of log injections]
+	- icinga2 2.16.6-1
+	NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
+	NOTE: https://github.com/Icinga/icinga2/security/advisories/GHSA-hhxh-8qx6-pxc3
+CVE-2026-XXXX [GHSA-vwj4-g6h6-65gj: ASLR bypass via addresses from API call exception stack trace]
+	- icinga2 2.16.6-1
+	NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
+	NOTE: https://github.com/Icinga/icinga2/security/advisories/GHSA-vwj4-g6h6-65gj
+CVE-2026-XXXX [ GHSA-2hhr-ccxm-x85p: /v1/objects: supposedly inaccessible related objects can be accessed in filter expressions]
+	- icinga2 2.16.6-1
+	NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
+	NOTE: https://github.com/Icinga/icinga2/security/advisories/GHSA-2hhr-ccxm-x85p
 CVE-2026-XXXX [GHSA-mph2-hvq4-8423: Unauthenticated file read and denial of service through chart endpoints]
 	- icingaweb2 2.14.1-1
 	NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e8f86400e6084c5847dca213590c726b05a7d386

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e8f86400e6084c5847dca213590c726b05a7d386
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/4ad055a5/attachment.htm>