[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Oct 28 19:15:36 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
858e09bd by security tracker role at 2026-10-28T19:15:29+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,38 +1,912 @@
-CVE-2026-117501
+CVE-2026-92797 (The MemberPress plugin for WordPress is vulnerable to Cross-Site Reque ...)
+ TODO: check
+CVE-2026-92665 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-90724 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
+ TODO: check
+CVE-2026-90723 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
+ TODO: check
+CVE-2026-90721 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-90720 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-90719 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
+ TODO: check
+CVE-2026-90717 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
+ TODO: check
+CVE-2026-88967 (A user with query access to an Azure Monitor data source in Grafana ca ...)
+ TODO: check
+CVE-2026-88858 (A user with the Viewer role in Grafana can crash the server by submitt ...)
+ TODO: check
+CVE-2026-87880 (Sensitive information disclosure due to missing SSL certificate verifi ...)
+ TODO: check
+CVE-2026-87879 (Sensitive information disclosure due to improper token validation. The ...)
+ TODO: check
+CVE-2026-87878 (Linux binaries have executable stack attribute enabled. The following ...)
+ TODO: check
+CVE-2026-87103 (Sensitive information disclosure and manipulation due to improper toke ...)
+ TODO: check
+CVE-2026-87102 (Sensitive information disclosure and manipulation due to improper toke ...)
+ TODO: check
+CVE-2026-87101 (Sensitive information disclosure due to improper token validation. The ...)
+ TODO: check
+CVE-2026-87100 (Protection mechanism failure due to missing binary hardening in Linux ...)
+ TODO: check
+CVE-2026-87099 (Cross-site scripting (XSS) vulnerability due to improper input validat ...)
+ TODO: check
+CVE-2026-87098 (Sensitive information disclosure due to improper authorization. The fo ...)
+ TODO: check
+CVE-2026-87097 (Sensitive information disclosure due to insufficiently protected crede ...)
+ TODO: check
+CVE-2026-86401 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
+ TODO: check
+CVE-2026-86400 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86399 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86398 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86397 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86396 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86395 (Dell PowerProtect Data Domain Virtual Edition, Feature Release version ...)
+ TODO: check
+CVE-2026-86394 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86393 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86392 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86391 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
+ TODO: check
+CVE-2026-86390 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86389 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86388 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86386 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
+ TODO: check
+CVE-2026-86385 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86384 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86383 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86380 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86379 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
+ TODO: check
+CVE-2026-86378 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-86377 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-85655 (The Enable Media Replace plugin for WordPress is vulnerable to authori ...)
+ TODO: check
+CVE-2026-84725 (when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attack ...)
+ TODO: check
+CVE-2026-83525 (Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apach ...)
+ TODO: check
+CVE-2026-82962 (ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepen ...)
+ TODO: check
+CVE-2026-82961 (The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not vali ...)
+ TODO: check
+CVE-2026-81472 (Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module ...)
+ TODO: check
+CVE-2026-79656 (A user with read access to Grafana's server logs, or to a log store th ...)
+ TODO: check
+CVE-2026-6064 (Link following vulnerability in Data Shredder components in Norton Ant ...)
+ TODO: check
+CVE-2026-67187 (Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete ...)
+ TODO: check
+CVE-2026-67080 (HCL BigFix AEX is affected by an Information Disclosure vulnerability ...)
+ TODO: check
+CVE-2026-67079 (HCL BigFix AEX is affected by a Clickjacking vulnerability, which coul ...)
+ TODO: check
+CVE-2026-67077 (HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerabil ...)
+ TODO: check
+CVE-2026-67074 (HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . ...)
+ TODO: check
+CVE-2026-67073 (HCL BigFix AEX is affected by an Unrestricted File Upload and Improper ...)
+ TODO: check
+CVE-2026-59979 (YosemiteCrew provides organization-based service and task management. ...)
+ TODO: check
+CVE-2026-59959 (SAIL is a cross-platform library for loading and saving images with su ...)
+ TODO: check
+CVE-2026-59185 (identrail is a machine identity security platform for AWS, GitHub/OIDC ...)
+ TODO: check
+CVE-2026-59179 (OpenHop is a tool for creating interactive data-flow diagrams. Prior t ...)
+ TODO: check
+CVE-2026-59177 (ESPHome Device Builder Dashboard is a dashboard for the ESPHome home m ...)
+ TODO: check
+CVE-2026-59176 (Functype is a family of TypeScript functional programming libraries. P ...)
+ TODO: check
+CVE-2026-59172 (Joker is a small Clojure interpreter, linter and formatter written in ...)
+ TODO: check
+CVE-2026-59164 (NORA is a self-hosted artifact registry and pull-through cache. Prior ...)
+ TODO: check
+CVE-2026-58458 (Don't Starve Together (Steam AppID 322330) through build 747465 contai ...)
+ TODO: check
+CVE-2026-56828 (Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, ...)
+ TODO: check
+CVE-2026-55369 (Waline is a comment system with backend support. Prior to version 1.41 ...)
+ TODO: check
+CVE-2026-52729 (Xibo is an open source digital signage platform with a web content man ...)
+ TODO: check
+CVE-2026-50543 (Xibo is an open source digital signage platform with a web content man ...)
+ TODO: check
+CVE-2026-50542 (Xibo is an open source digital signage platform with a web content man ...)
+ TODO: check
+CVE-2026-50541 (Xibo is an open source digital signage platform with a web content man ...)
+ TODO: check
+CVE-2026-50539 (Xibo is an open source digital signage platform with a web content man ...)
+ TODO: check
+CVE-2026-47235 (SimulationCraft is a tool to explore combat mechanics in World of Warc ...)
+ TODO: check
+CVE-2026-44179 (XWiki Remote Macros provides XWiki rendering macros that are useful wh ...)
+ TODO: check
+CVE-2026-21830 (HCL BigFix AEX product is affected by a vulnerability in the aws-sdk p ...)
+ TODO: check
+CVE-2026-16020 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-14571 (A Blind SQL Injection vulnerability in Futurum Software\u2019s managem ...)
+ TODO: check
+CVE-2026-118688 (wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49 ...)
+ TODO: check
+CVE-2026-118687 (Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.3 ...)
+ TODO: check
+CVE-2026-118686 (EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of serv ...)
+ TODO: check
+CVE-2026-118685 (ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization ...)
+ TODO: check
+CVE-2026-118684 (MONAI before 1.6.1 contains an insufficient integrity verification vul ...)
+ TODO: check
+CVE-2026-118683 (MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnera ...)
+ TODO: check
+CVE-2026-118681 (go-chi chi before 5.5.0 contains an authentication bypass in middlewar ...)
+ TODO: check
+CVE-2026-118680 (SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT devic ...)
+ TODO: check
+CVE-2026-118679 (n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request ...)
+ TODO: check
+CVE-2026-118678 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollut ...)
+ TODO: check
+CVE-2026-118677 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirma ...)
+ TODO: check
+CVE-2026-118676 (n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypa ...)
+ TODO: check
+CVE-2026-118675 (n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard by ...)
+ TODO: check
+CVE-2026-118649 (n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied w ...)
+ TODO: check
+CVE-2026-118648 (n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 conta ...)
+ TODO: check
+CVE-2026-118647 (n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves ...)
+ TODO: check
+CVE-2026-118646 (n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression ...)
+ TODO: check
+CVE-2026-118645 (n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 conta ...)
+ TODO: check
+CVE-2026-118644 (n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's ...)
+ TODO: check
+CVE-2026-118643 (n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 store ...)
+ TODO: check
+CVE-2026-118642 (n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypa ...)
+ TODO: check
+CVE-2026-118641 (n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 conta ...)
+ TODO: check
+CVE-2026-118640 (n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypa ...)
+ TODO: check
+CVE-2026-118633 (A path traversal vulnerability allows a remote unauthenticated attacke ...)
+ TODO: check
+CVE-2026-118619 (Ultralytics Google Drive Download Path Traversal Remote Code Execution ...)
+ TODO: check
+CVE-2026-118618 (Ultralytics parse_model Code Injection Remote Code Execution Vulnerabi ...)
+ TODO: check
+CVE-2026-118617 (Ultralytics load_dataset_cache_file Deserialization of Untrusted Data ...)
+ TODO: check
+CVE-2026-118616 (Ultralytics parse_model Code Injection Remote Code Execution Vulnerabi ...)
+ TODO: check
+CVE-2026-118615 (Ultralytics torch_safe_load Command Injection Remote Code Execution Vu ...)
+ TODO: check
+CVE-2026-118614 (Ultralytics check_det_dataset Code Injection Remote Code Execution Vul ...)
+ TODO: check
+CVE-2026-118613 (Ultralytics torch_load Deserialization of Untrusted Data Remote Code E ...)
+ TODO: check
+CVE-2026-118611 (Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overf ...)
+ TODO: check
+CVE-2026-118610 (Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remot ...)
+ TODO: check
+CVE-2026-118609 (Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Ove ...)
+ TODO: check
+CVE-2026-118608 (Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bou ...)
+ TODO: check
+CVE-2026-118607 (Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerab ...)
+ TODO: check
+CVE-2026-118606 (Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Co ...)
+ TODO: check
+CVE-2026-118605 (Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overf ...)
+ TODO: check
+CVE-2026-118604 (Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote C ...)
+ TODO: check
+CVE-2026-118603 (Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code ...)
+ TODO: check
+CVE-2026-118602 (Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Es ...)
+ TODO: check
+CVE-2026-118601 (Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulne ...)
+ TODO: check
+CVE-2026-118581 (A BSON encoding component of the MongoDB Java Driver does not verify t ...)
+ TODO: check
+CVE-2026-118510 (A type-handling flaw in the relationship query building of this MongoD ...)
+ TODO: check
+CVE-2026-118485 (Axel Download Accelerator 2.17.14 and earlier performs URL percent-dec ...)
+ TODO: check
+CVE-2026-118477 (The ei_git_repo_url parameter in the Git remote configuration endpoint ...)
+ TODO: check
+CVE-2026-118435 (Out-of-bounds write vulnerability in Samsung Open Source escargot allo ...)
+ TODO: check
+CVE-2026-118265 (Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractI ...)
+ TODO: check
+CVE-2026-118264 (Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...)
+ TODO: check
+CVE-2026-118263 (Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump ...)
+ TODO: check
+CVE-2026-118262 (Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...)
+ TODO: check
+CVE-2026-118261 (Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...)
+ TODO: check
+CVE-2026-118260 (Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...)
+ TODO: check
+CVE-2026-118259 (opentelemetry-java is the Java implementation of the OpenTelemetry API ...)
+ TODO: check
+CVE-2026-118258 (i18next-http-backend is a backend layer for i18next that loads transla ...)
+ TODO: check
+CVE-2026-118257 (Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 u ...)
+ TODO: check
+CVE-2026-118256 (Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-bet ...)
+ TODO: check
+CVE-2026-118255 (Highcharts JS is a JavaScript charting library based on SVG. From 2.0. ...)
+ TODO: check
+CVE-2026-118254 (Highcharts JS is a JavaScript charting library based on SVG. From 2.0. ...)
+ TODO: check
+CVE-2026-118253 (Highcharts JS is a JavaScript charting library based on SVG. From 1.0. ...)
+ TODO: check
+CVE-2026-118252 (Highcharts JS is a JavaScript charting library based on SVG. From 1.0. ...)
+ TODO: check
+CVE-2026-118251 (Highcharts JS is a JavaScript charting library based on SVG. Prior to ...)
+ TODO: check
+CVE-2026-118250 (Highcharts JS is a JavaScript charting library based on SVG. From 6.1. ...)
+ TODO: check
+CVE-2026-118249 (Highcharts JS is a JavaScript charting library based on SVG. From 13.0 ...)
+ TODO: check
+CVE-2026-118248 (Highcharts JS is a JavaScript charting library based on SVG. From 1.0. ...)
+ TODO: check
+CVE-2026-118247 (Highcharts JS is a JavaScript charting library based on SVG. From 1.0. ...)
+ TODO: check
+CVE-2026-118246 (Highcharts JS is a JavaScript charting library based on SVG. From 10.0 ...)
+ TODO: check
+CVE-2026-118245 (Highcharts JS is a JavaScript charting library based on SVG. From 1.0. ...)
+ TODO: check
+CVE-2026-118244 (Highcharts JS is a JavaScript charting library based on SVG. From 12.0 ...)
+ TODO: check
+CVE-2026-118243 (Highcharts JS is a JavaScript charting library based on SVG. From 1.0. ...)
+ TODO: check
+CVE-2026-118242 (Highcharts JS is a JavaScript charting library based on SVG. From 2.3. ...)
+ TODO: check
+CVE-2026-118040 (In Progress\xae Telerik\xae Document Processing Libraries prior to ver ...)
+ TODO: check
+CVE-2026-118039 (In Progress\xae Telerik\xae Document Processing Libraries prior to ver ...)
+ TODO: check
+CVE-2026-118038 (In Progress\xae Telerik\xae Document Processing Libraries prior to ver ...)
+ TODO: check
+CVE-2026-118037 (In Progress\xae Telerik\xae Document Processing Libraries prior to ver ...)
+ TODO: check
+CVE-2026-118036 (In Progress\xae Telerik\xae Document Processing Libraries prior to ver ...)
+ TODO: check
+CVE-2026-118035 (In Progress\xae Telerik\xae Document Processing Libraries prior to ver ...)
+ TODO: check
+CVE-2026-118029 (Unverified ownership of the default query result location in the Athen ...)
+ TODO: check
+CVE-2026-117858
+ REJECTED
+CVE-2026-117857
+ REJECTED
+CVE-2026-117856
+ REJECTED
+CVE-2026-117855
+ REJECTED
+CVE-2026-117854
+ REJECTED
+CVE-2026-117853
+ REJECTED
+CVE-2026-117852
+ REJECTED
+CVE-2026-117851
+ REJECTED
+CVE-2026-117850
+ REJECTED
+CVE-2026-117849
+ REJECTED
+CVE-2026-117848
+ REJECTED
+CVE-2026-117847
+ REJECTED
+CVE-2026-117846
+ REJECTED
+CVE-2026-117845
+ REJECTED
+CVE-2026-117844
+ REJECTED
+CVE-2026-117843
+ REJECTED
+CVE-2026-117842
+ REJECTED
+CVE-2026-117841
+ REJECTED
+CVE-2026-117840
+ REJECTED
+CVE-2026-117839
+ REJECTED
+CVE-2026-117838
+ REJECTED
+CVE-2026-117837
+ REJECTED
+CVE-2026-117836
+ REJECTED
+CVE-2026-117835
+ REJECTED
+CVE-2026-117834
+ REJECTED
+CVE-2026-117833
+ REJECTED
+CVE-2026-117832
+ REJECTED
+CVE-2026-117831
+ REJECTED
+CVE-2026-117830
+ REJECTED
+CVE-2026-117829
+ REJECTED
+CVE-2026-117828
+ REJECTED
+CVE-2026-117827
+ REJECTED
+CVE-2026-117826
+ REJECTED
+CVE-2026-117825
+ REJECTED
+CVE-2026-117824
+ REJECTED
+CVE-2026-117823
+ REJECTED
+CVE-2026-117822
+ REJECTED
+CVE-2026-117821
+ REJECTED
+CVE-2026-117820
+ REJECTED
+CVE-2026-117819
+ REJECTED
+CVE-2026-117818
+ REJECTED
+CVE-2026-117817
+ REJECTED
+CVE-2026-117816
+ REJECTED
+CVE-2026-117815
+ REJECTED
+CVE-2026-117814
+ REJECTED
+CVE-2026-117813
+ REJECTED
+CVE-2026-117812
+ REJECTED
+CVE-2026-117811
+ REJECTED
+CVE-2026-117810
+ REJECTED
+CVE-2026-117809
+ REJECTED
+CVE-2026-117808
+ REJECTED
+CVE-2026-117807
+ REJECTED
+CVE-2026-117806
+ REJECTED
+CVE-2026-117805
+ REJECTED
+CVE-2026-117804
+ REJECTED
+CVE-2026-117803
+ REJECTED
+CVE-2026-117802
+ REJECTED
+CVE-2026-117801
+ REJECTED
+CVE-2026-117800
+ REJECTED
+CVE-2026-117799
+ REJECTED
+CVE-2026-117798
+ REJECTED
+CVE-2026-117797
+ REJECTED
+CVE-2026-117796
+ REJECTED
+CVE-2026-117795
+ REJECTED
+CVE-2026-117794
+ REJECTED
+CVE-2026-117793
+ REJECTED
+CVE-2026-117792
+ REJECTED
+CVE-2026-117791
+ REJECTED
+CVE-2026-117790
+ REJECTED
+CVE-2026-117789
+ REJECTED
+CVE-2026-117788
+ REJECTED
+CVE-2026-117787
+ REJECTED
+CVE-2026-117786
+ REJECTED
+CVE-2026-117785
+ REJECTED
+CVE-2026-117784
+ REJECTED
+CVE-2026-117783
+ REJECTED
+CVE-2026-117782
+ REJECTED
+CVE-2026-117781
+ REJECTED
+CVE-2026-117780
+ REJECTED
+CVE-2026-117779
+ REJECTED
+CVE-2026-117778
+ REJECTED
+CVE-2026-117777
+ REJECTED
+CVE-2026-117776
+ REJECTED
+CVE-2026-117775
+ REJECTED
+CVE-2026-117774
+ REJECTED
+CVE-2026-117773
+ REJECTED
+CVE-2026-117772
+ REJECTED
+CVE-2026-117771
+ REJECTED
+CVE-2026-117770
+ REJECTED
+CVE-2026-117769
+ REJECTED
+CVE-2026-117768
+ REJECTED
+CVE-2026-117767
+ REJECTED
+CVE-2026-117766
+ REJECTED
+CVE-2026-117765
+ REJECTED
+CVE-2026-117764
+ REJECTED
+CVE-2026-117763
+ REJECTED
+CVE-2026-117762
+ REJECTED
+CVE-2026-117761
+ REJECTED
+CVE-2026-117760
+ REJECTED
+CVE-2026-117759
+ REJECTED
+CVE-2026-117758
+ REJECTED
+CVE-2026-117757
+ REJECTED
+CVE-2026-117756
+ REJECTED
+CVE-2026-117755
+ REJECTED
+CVE-2026-117754
+ REJECTED
+CVE-2026-117753
+ REJECTED
+CVE-2026-117752
+ REJECTED
+CVE-2026-117751
+ REJECTED
+CVE-2026-117750
+ REJECTED
+CVE-2026-117749
+ REJECTED
+CVE-2026-117748
+ REJECTED
+CVE-2026-117747
+ REJECTED
+CVE-2026-117746
+ REJECTED
+CVE-2026-117745
+ REJECTED
+CVE-2026-117744
+ REJECTED
+CVE-2026-117743
+ REJECTED
+CVE-2026-117742
+ REJECTED
+CVE-2026-117741
+ REJECTED
+CVE-2026-117740
+ REJECTED
+CVE-2026-117739
+ REJECTED
+CVE-2026-117738
+ REJECTED
+CVE-2026-117737
+ REJECTED
+CVE-2026-117736
+ REJECTED
+CVE-2026-117735
+ REJECTED
+CVE-2026-117734
+ REJECTED
+CVE-2026-117733
+ REJECTED
+CVE-2026-117732
+ REJECTED
+CVE-2026-117731
+ REJECTED
+CVE-2026-117730
+ REJECTED
+CVE-2026-117729
+ REJECTED
+CVE-2026-117728
+ REJECTED
+CVE-2026-117727
+ REJECTED
+CVE-2026-117726
+ REJECTED
+CVE-2026-117725
+ REJECTED
+CVE-2026-117724
+ REJECTED
+CVE-2026-117723
+ REJECTED
+CVE-2026-117722
+ REJECTED
+CVE-2026-117721
+ REJECTED
+CVE-2026-117720
+ REJECTED
+CVE-2026-117719
+ REJECTED
+CVE-2026-117718
+ REJECTED
+CVE-2026-117717
+ REJECTED
+CVE-2026-117716
+ REJECTED
+CVE-2026-117715
+ REJECTED
+CVE-2026-117714
+ REJECTED
+CVE-2026-117713
+ REJECTED
+CVE-2026-117712
+ REJECTED
+CVE-2026-117711
+ REJECTED
+CVE-2026-117710
+ REJECTED
+CVE-2026-117709
+ REJECTED
+CVE-2026-117708
+ REJECTED
+CVE-2026-117707
+ REJECTED
+CVE-2026-117706
+ REJECTED
+CVE-2026-117705
+ REJECTED
+CVE-2026-117704
+ REJECTED
+CVE-2026-117703
+ REJECTED
+CVE-2026-117702
+ REJECTED
+CVE-2026-117701
+ REJECTED
+CVE-2026-117700
+ REJECTED
+CVE-2026-117699
+ REJECTED
+CVE-2026-117698
+ REJECTED
+CVE-2026-117697
+ REJECTED
+CVE-2026-117696
+ REJECTED
+CVE-2026-117695
+ REJECTED
+CVE-2026-117694
+ REJECTED
+CVE-2026-117693
+ REJECTED
+CVE-2026-117692
+ REJECTED
+CVE-2026-117626 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifi ...)
+ TODO: check
+CVE-2026-117625 (A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 a ...)
+ TODO: check
+CVE-2026-117624 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistent ...)
+ TODO: check
+CVE-2026-117623 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the ...)
+ TODO: check
+CVE-2026-117622 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to se ...)
+ TODO: check
+CVE-2026-117621 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the age ...)
+ TODO: check
+CVE-2026-117620 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers wi ...)
+ TODO: check
+CVE-2026-117619 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests aut ...)
+ TODO: check
+CVE-2026-117618 (In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoi ...)
+ TODO: check
+CVE-2026-117617 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic ...)
+ TODO: check
+CVE-2026-117616 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP en ...)
+ TODO: check
+CVE-2026-117615 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic li ...)
+ TODO: check
+CVE-2026-117614 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch ...)
+ TODO: check
+CVE-2026-117613 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict i ...)
+ TODO: check
+CVE-2026-117612 (Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its ...)
+ TODO: check
+CVE-2026-116855 (Missing Authorization vulnerability in wphocus My auctions allegro my- ...)
+ TODO: check
+CVE-2026-116797 (Highcharts JS is a JavaScript charting library based on SVG. From 2.0. ...)
+ TODO: check
+CVE-2026-116796 (Highcharts JS is a JavaScript charting library based on SVG. From 10.3 ...)
+ TODO: check
+CVE-2026-116795 (RE2JS is the JavaScript port of RE2, a regular expression engine that ...)
+ TODO: check
+CVE-2026-116794 (russh is a Rust SSH client and server library that includes an SSH age ...)
+ TODO: check
+CVE-2026-116778 (FOG is a free open-source cloning/imaging/rescue suite/inventory manag ...)
+ TODO: check
+CVE-2026-116776 (USB Test is a lightweight Windows CLI utility for verifying sector int ...)
+ TODO: check
+CVE-2026-116593 (Apache Kafka Connect has the /connector-plugins/{connector-type}/confi ...)
+ TODO: check
+CVE-2026-116404 (Missing Authorization vulnerability in David Anderson Redux Framework ...)
+ TODO: check
+CVE-2026-116393 (Missing Authorization vulnerability in iHomefinder, Inc. Optima Expres ...)
+ TODO: check
+CVE-2026-116392 (Deserialization of Untrusted Data vulnerability in PickPlugins Accordi ...)
+ TODO: check
+CVE-2026-116391 (Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo ...)
+ TODO: check
+CVE-2026-116390 (Deserialization of Untrusted Data vulnerability in stepasyuk Filter Ev ...)
+ TODO: check
+CVE-2026-116389 (Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Me ...)
+ TODO: check
+CVE-2026-116078 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-115968 (Deserialization of Untrusted Data vulnerability in Ultimate Member Ult ...)
+ TODO: check
+CVE-2026-115957 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115904 (Topluyo is a social networking platform. A vulnerability exists in Top ...)
+ TODO: check
+CVE-2026-115644 (Apache Kafka Connect contains an authentication bypass vulnerability a ...)
+ TODO: check
+CVE-2026-115612 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115609 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115607 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-115606 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115603 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-115596 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115593 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-115591 (Insertion of Sensitive Information Into Sent Data vulnerability in Sup ...)
+ TODO: check
+CVE-2026-115590 (Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan- ...)
+ TODO: check
+CVE-2026-115402 (OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local us ...)
+ TODO: check
+CVE-2026-115223 (The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not pr ...)
+ TODO: check
+CVE-2026-114349 (When a broker decodes a compressed record batch, the per-record decode ...)
+ TODO: check
+CVE-2026-114278 (The che-machine-exec service constructs a shell command by concatenati ...)
+ TODO: check
+CVE-2026-112375 (An authenticated Kafka principal with no authorization grants (not eve ...)
+ TODO: check
+CVE-2026-112357 (GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), ...)
+ TODO: check
+CVE-2026-112356 (GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cros ...)
+ TODO: check
+CVE-2026-112198 (XML External Entity (XXE) injection vulnerability in the SAFT import f ...)
+ TODO: check
+CVE-2026-112197 (Vulnerability due to a lack of authentication in critical functions of ...)
+ TODO: check
+CVE-2026-111850 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-111551 (Several Kafka deserialization paths read a size or count field from in ...)
+ TODO: check
+CVE-2026-111496 (Kafka Streams derives its stream-time clock from record timestamps. Pu ...)
+ TODO: check
+CVE-2026-111411 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
+ TODO: check
+CVE-2026-111115 (Apache Kafka's code-generated readers for flexible protocol versions r ...)
+ TODO: check
+CVE-2026-111108 (Apache Kafka's code-generated protocol readers pre-size an array's col ...)
+ TODO: check
+CVE-2026-111073 (The broker-side PushTelemetry API (KIP-714) validates only the compres ...)
+ TODO: check
+CVE-2026-110985 (A Kafka broker using SASL/OAUTHBEARER with the default validator(sasl. ...)
+ TODO: check
+CVE-2026-110952 (A Kafka broker that authenticates clients with SASL/OAUTHBEARER using ...)
+ TODO: check
+CVE-2026-110541 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-110540 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
+ TODO: check
+CVE-2026-110508 (The Essential Addons for Elementor WordPress plugin before 6.8.7 does ...)
+ TODO: check
+CVE-2026-110183 (PostgreSQL Anonymizer contains a vulnerability related to static maski ...)
+ TODO: check
+CVE-2026-110182 (PostgreSQL Anonymizer contains a vulnerability related to the anon.par ...)
+ TODO: check
+CVE-2026-110181 (PostgreSQL Anonymizer contains a vulnerability related to anonymizatio ...)
+ TODO: check
+CVE-2026-106972 (An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() ...)
+ TODO: check
+CVE-2026-106971 (An integer overflow in the MessagePack\BufferUnpacker component of ryb ...)
+ TODO: check
+CVE-2026-106648 (The Royal Elementor Addons WordPress plugin before 1.7.1070 does not v ...)
+ TODO: check
+CVE-2026-106484 (Insufficient policy enforcement in chrome-devtools-mcp in Google Chrom ...)
+ TODO: check
+CVE-2026-106079 (An Improper Neutralization of Special Elements used in an OS Command ( ...)
+ TODO: check
+CVE-2026-105620 (PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a r ...)
+ TODO: check
+CVE-2026-105619 (PostgreSQL Anonymizer doesn't mask data accessed thru a security_invok ...)
+ TODO: check
+CVE-2026-105618 (PostgreSQL Anonymizer's documentation recommends applying rules on par ...)
+ TODO: check
+CVE-2026-105617 (PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule w ...)
+ TODO: check
+CVE-2026-105616 (PostgreSQL restricts acces to the salt and shift via the `SHOW` comman ...)
+ TODO: check
+CVE-2026-105615 (PostgreSQL's optimized statistics on a table are visible as long as yo ...)
+ TODO: check
+CVE-2026-105614 (PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the ...)
+ TODO: check
+CVE-2026-105613 (PostgreSQL Anonymizer's range-based dummy functions dont constraint th ...)
+ TODO: check
+CVE-2026-105612 (PostgreSQL Anonymizer contains a vulnerability that data-modifying CTE ...)
+ TODO: check
+CVE-2026-105457 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
+ TODO: check
+CVE-2026-105420 (Wing FTP Server does not verify user's base folder. An attacker with a ...)
+ TODO: check
+CVE-2026-103799 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
+ TODO: check
+CVE-2026-103792 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
+ TODO: check
+CVE-2026-103780 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-103779 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
+ TODO: check
+CVE-2026-103506 (An authenticated user in Grafana can read SSO client secrets and modif ...)
+ TODO: check
+CVE-2026-103411 (An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Ne ...)
+ TODO: check
+CVE-2026-103410 (An Integer Overflow vulnerability in the DPI certificate scanner in Ju ...)
+ TODO: check
+CVE-2026-103409 (A Missing authentication for critical function vulnerability in Junipe ...)
+ TODO: check
+CVE-2026-103408 (A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Ne ...)
+ TODO: check
+CVE-2026-103407 (An Improper Limitation of a Pathname to a Restricted Directory vulnera ...)
+ TODO: check
+CVE-2026-103406 (An Improper Neutralization of Special Elements used in an OS Command v ...)
+ TODO: check
+CVE-2026-103405 (An Improper Neutralization of Special Elements in Output Used by a Dow ...)
+ TODO: check
+CVE-2026-103404 (An Incorrect Permission Assignment for Critical Resource vulnerability ...)
+ TODO: check
+CVE-2026-103403 (An Improper Neutralization of Special Elements used in an OS Command ( ...)
+ TODO: check
+CVE-2026-103402 (An Insufficient Verification of Data Authenticity vulnerability in PCL ...)
+ TODO: check
+CVE-2026-103401 (An Improper Link Resolution Before File Access ('Link Following') vuln ...)
+ TODO: check
+CVE-2026-103400 (An Improper Neutralization of Special Elements in Output Used by a Dow ...)
+ TODO: check
+CVE-2026-103394 (An Improper Initialization vulnerability in the SSR software in Junipe ...)
+ TODO: check
+CVE-2026-103393 (An Out-of-Bounds Read vulnerability in the VRRP implementation in Juni ...)
+ TODO: check
+CVE-2026-103392 (An Out-of-Bounds Write vulnerability in the TCP header processing in J ...)
+ TODO: check
+CVE-2026-103391 (An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization ...)
+ TODO: check
+CVE-2026-103390 (An Out-of-Bounds Read vulnerability in the HttpParser component in Jun ...)
+ TODO: check
+CVE-2026-103330 (The Sadad QA Payment WordPress plugin through 1.28 does not correctly ...)
+ TODO: check
+CVE-2026-103313 (The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does ...)
+ TODO: check
+CVE-2026-102799 (Joomla Extension - icagenda.com - CSV formula injection in the registr ...)
+ TODO: check
+CVE-2026-102790 (Joomla Extension - icagenda.com - Stored XSS via url-type event Custo ...)
+ TODO: check
+CVE-2026-101935 (The Echo Knowledge Base \u2013 Documentation, FAQs, Chat & Smart Searc ...)
+ TODO: check
+CVE-2026-101274 (When pretix is used as the identity provider in a Single-Sign-On (SSO) ...)
+ TODO: check
+CVE-2026-101273 (Some of our API endpoints allowed to create order payments referencing ...)
+ TODO: check
+CVE-2026-101272 (The mechanism binding files generated during a shredding process to th ...)
+ TODO: check
+CVE-2026-100105 (A user with permission to edit contact points but not their protected ...)
+ TODO: check
+CVE-2025-30414 (Local privilege escalation due to improper authentication. The followi ...)
+ TODO: check
+CVE-2026-117501 (HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion vi ...)
- libhttp-body-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711939/
NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/7c6dc1ecd49e30ac405a3959c606ba389718f556
-CVE-2026-117500
+CVE-2026-117500 (HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via r ...)
- libhttp-body-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711935/
NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/9ab46daaede02fb13ea55a7e3ede34c8b918d8ca
NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/3abc958d78bd84bf4abb87bad79b9432eab7e694
-CVE-2026-116531
+CVE-2026-116531 (HTTP::Body versions before 1.23_01 for Perl lose track of chunk bounda ...)
- libhttp-body-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711932/
NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/5869dde9fe6d13f189a435b6583fd63fcc18677a (v1.24)
-CVE-2026-116285
+CVE-2026-116285 (HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via q ...)
- libhttp-body-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711941/
NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/954a5343d2a095b59d357f28759c5388d1169574 (v1.24)
-CVE-2026-116135
+CVE-2026-116135 (HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent es ...)
- libhttp-body-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711937/
NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/336f1a23b4115a5cbeb546f36df5af62c90bdc0d (v1.24)
-CVE-2026-116134
+CVE-2026-116134 (HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion vi ...)
- libhttp-body-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711947/
NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/c5d13911aabfad4a7ae4b6ee98ac2315400e5ed5 (v1.24)
-CVE-2026-116133
+CVE-2026-116133 (HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via q ...)
- libhttp-body-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711943/
NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/bf77eb959bbe1641b77f69eefe98d58ce4c4ec79 (v1.24)
-CVE-2026-116132
+CVE-2026-116132 (HTTP::Body versions before 1.23_01 for Perl leave the temporary file o ...)
- libhttp-body-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711945/
NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=84004
NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/29e933b22ff918ccf5412d3513c885208511cfa3 (v1.24)
-CVE-2026-116131
+CVE-2026-116131 (HTTP::Body versions before 1.23_01 for Perl allow memory and temporary ...)
- libhttp-body-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711949/
NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/47beca524a3062eacfd646664576f005fb4be19b (v1.24)
@@ -88,450 +962,450 @@ CVE-2026-XXXX [The query cache could return an answer obtained using different E
- c-ares 1.34.9-1
NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-wrgc-prmw-27xh
NOTE: https://github.com/c-ares/c-ares/commit/a21160045f9d7039225fa285be7cb1b02173a3a5 (v1.34.9)
-CVE-2026-99210 [accel/rocket: clear rdev on device init failure]
+CVE-2026-99210 (In the Linux kernel, the following vulnerability has been resolved: a ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/4ac852419f0d317c7bd8db5b8acb3cc78be7fe33 (7.3)
-CVE-2026-99207 [scsi: target: Disable interrupts while holding delayed_cmd_lock]
+CVE-2026-99207 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/04a67a8b1a4460345d22fe75d93430cbf7e651d7 (7.3)
-CVE-2026-99205 [sched/core: Call wakeup_preempt() for queued tasks during class change]
+CVE-2026-99205 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/118a2cf4ced60777a2408001e2b4838fed1cea55 (7.3)
-CVE-2026-99200 [net: hisilicon: hisi_femac: Move setting of netops to fix crash]
+CVE-2026-99200 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/444889dfa27b54b39026e962464b1f8f9093e1ea (7.3)
-CVE-2026-99199 [net: hisilicon: hip04_eth: Move setting of netops to fix crash]
+CVE-2026-99199 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/0d9342701f14ec0a9465772b7cd5d515c1ecd818 (7.3)
-CVE-2026-99198 [net: ethernet: actions: Move setting of netops to fix crash]
+CVE-2026-99198 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/c2c4824319850c87e77d26aeb8f860bc310a64d7 (7.3)
-CVE-2026-99197 [net: mv643xx: move setting of netops to fix crash]
+CVE-2026-99197 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a (7.3)
-CVE-2026-99196 [net: au1000: move setting of netops to fix crash]
+CVE-2026-99196 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/beabbafdd0f6779813a7656baa1b412b19bda911 (7.3)
-CVE-2026-99195 [net: ethoc: move setting of netops to fix crash]
+CVE-2026-99195 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/c9f8ce62a5faa73515ff5457716bd7306d20fd93 (7.3)
-CVE-2026-99194 [net: ethernet: aeroflex: move setting of netops to fix crash]
+CVE-2026-99194 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/d71483f0716e7ae98578817bfdc8a5b822d250f8 (7.3)
-CVE-2026-99193 [net: ti: icssm-prueth: Move setting of netops to fix crash]
+CVE-2026-99193 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/955bb7cf680d8699ce94c73539af882840a9be43 (7.3)
-CVE-2026-99188 [net: stmmac: dwmac1000: clear the RGMII status interrupt]
+CVE-2026-99188 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/aa07285705f8d5bac464eb1c5b7412f8e88b91e1 (7.3)
-CVE-2026-99186 [x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()]
+CVE-2026-99186 (In the Linux kernel, the following vulnerability has been resolved: x ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/32c52ec87d6245ee2d12ed5dd509e40062939b50 (7.3)
-CVE-2026-99185 [firewire: core: fix race condition in split transaction handling]
+CVE-2026-99185 (In the Linux kernel, the following vulnerability has been resolved: f ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/7f9f2d6abc40f79e802b4063859eda343043b85c (7.3)
-CVE-2026-99184 [accel/rocket: search every core slot when a core is removed]
+CVE-2026-99184 (In the Linux kernel, the following vulnerability has been resolved: a ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/6eff1d69dae808a1518aee5a58d0853a8db3f1be (7.3)
-CVE-2026-99177 [KVM: SEV: Fix page dirtying in sev_gmem_post_populate()]
+CVE-2026-99177 (In the Linux kernel, the following vulnerability has been resolved: K ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/97818b2fa7082e940ddd36dab12a68615300e798 (7.3)
-CVE-2026-99170 [namespace: a mount that copy_tree() leaves out can't take over a lock]
+CVE-2026-99170 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/69fbe94f80bc423613fa18dae6656757423732a2 (7.3)
-CVE-2026-99168 [mshv_vtl: Check per-CPU register page before mmap]
+CVE-2026-99168 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/874194a8de75fc2f4d1fb70c670b289b7e48f93e (7.3)
-CVE-2026-99164 [spi: imx: fix slab corruption from undersized DMA bounce buffers]
+CVE-2026-99164 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/59eb22641f0c526dd064390b11cff99ae87c2858 (7.3)
-CVE-2026-99162 [gpio: shared: fix use-after-free bug when adding shared proxies]
+CVE-2026-99162 (In the Linux kernel, the following vulnerability has been resolved: g ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/bd22f7e63509fa758cf500d9af3e88a3d3df96be (7.3)
-CVE-2026-99151 [drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions]
+CVE-2026-99151 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/55a67aa89342545b89f469dea6f29bfb6fac6f3d (7.3)
-CVE-2026-99149 [drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl]
+CVE-2026-99149 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/3c516a5646285442e1cd71dff2584b77eb4fc421 (7.3)
-CVE-2026-99148 [drm/amdgpu: keep the eviction fence until the last handle is closed]
+CVE-2026-99148 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/3c44cbcec5eb370713bbd2c315ed7c34d8ccec2b (7.3)
-CVE-2026-99145 [drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change]
+CVE-2026-99145 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/ffbfd3f98f4393e91dffce3a46ccb7cf5329cf2f (7.3)
-CVE-2026-99144 [sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue]
+CVE-2026-99144 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/069403dff337feb192bfc70fb28ddc8a171e20c1 (7.3)
-CVE-2026-99141 [tracing: Fix crash in print_graph_function_event()]
+CVE-2026-99141 (In the Linux kernel, the following vulnerability has been resolved: t ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/3cc117514d69067a94d6c7479730dce41e678f50 (7.3)
-CVE-2026-99137 [cifs: don't update i_size in cifs_do_truncate without a cached handle]
+CVE-2026-99137 (In the Linux kernel, the following vulnerability has been resolved: c ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/fe39cd9d48f2346605f3746e0cc19e89d5f373eb (7.3-rc2)
-CVE-2026-99129 [selinux: fix BPF token permission checks]
+CVE-2026-99129 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/77d499e61d36e883a6ad1f10afe05f556aa7e0cc (7.3-rc2)
-CVE-2026-99120 [KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes]
+CVE-2026-99120 (In the Linux kernel, the following vulnerability has been resolved: K ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/e90ab3669181c6469e3647ef2b30ae408275f496 (7.3)
-CVE-2026-99119 [drm/amdgpu/userq: actually validate userq BOs]
+CVE-2026-99119 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/32d0771ef4ca69c30a1db3aefa34dd177cd2a047 (7.3)
-CVE-2026-99116 [net: psp: do not inherit the Rx association on clone]
+CVE-2026-99116 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/1d2929d0850fff683b8aff051275945e65f082c8 (7.3-rc2)
-CVE-2026-99111 [smb: client: fix data corruption with concurrent writes and O_TRUNC]
+CVE-2026-99111 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/a8603b52b39f520ea8a34def74c23fba87396d3e (7.3-rc2)
-CVE-2026-99108 [ntfs: fix FITRIM range alignment]
+CVE-2026-99108 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/03c6ecc4b4b13a3901f207152451fdd2d82e40c4 (7.3-rc2)
-CVE-2026-99107 [ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize]
+CVE-2026-99107 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/8d139e3635c86e2c97c78d55538ce0b00b6d9986 (7.3-rc2)
-CVE-2026-99104 [sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor]
+CVE-2026-99104 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/5bdeca322a6f8d10acaf67cccab1f69747ee7be3 (7.3)
-CVE-2026-99102 [ntfs: take invalidate_lock in ntfs_setattr_size()]
+CVE-2026-99102 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/9cc5761b8f28f9cef72061094eb5e37e2cd44d97 (7.3-rc2)
-CVE-2026-99216 [Drivers: hv: Don't reset VMBus connection state on error/exit paths]
+CVE-2026-99216 (In the Linux kernel, the following vulnerability has been resolved: D ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/ec31dc39e835ccde0930daccece8c492d28282fc (7.3)
-CVE-2026-99215 [power: supply: core: prevent unregistering a power supply while a callback runs]
+CVE-2026-99215 (In the Linux kernel, the following vulnerability has been resolved: p ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/5b4bd13e0552926648a46c2c9a12a24dfaee3715 (7.3)
-CVE-2026-99214 [drm/vc4: hdmi: Move packet RAM enable to PM runtime]
+CVE-2026-99214 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/3f57b34485dc01e5a2db60a89a6ae5439a897e53 (7.3)
-CVE-2026-99213 [vsock: treat TCP_CLOSING as once-established]
+CVE-2026-99213 (In the Linux kernel, the following vulnerability has been resolved: v ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/4f6ac74fa594a918d41255c941256e1d51592d3b (7.3)
-CVE-2026-99212 [net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure]
+CVE-2026-99212 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/98d446b7c013254a8a7b49720557676a3a851fde (7.3)
-CVE-2026-99211 [netlink: reset skb headers before unicast and multicast filtering]
+CVE-2026-99211 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/8bf659bd54e1f00e34cf5244b1d289c506fa47c0 (7.3)
-CVE-2026-99209 [drm/xe: skip eviction of a BO with no resource]
+CVE-2026-99209 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed (7.3)
-CVE-2026-99208 [drm/xe/oa: Zero OA buffer at allocation]
+CVE-2026-99208 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/fd8662823caa114a63f07222d2aa448f6ac5e864 (7.3)
-CVE-2026-99206 [scsi: target: iscsi: Fix race in discovery auth updates]
+CVE-2026-99206 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/e15b81f602edbdee39c335546f25486a1747f3f0 (7.3)
-CVE-2026-99204 [ocfs2/dlm: Protect the recovery list during debugfs reads]
+CVE-2026-99204 (In the Linux kernel, the following vulnerability has been resolved: o ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/4c435828932bf46f29860e4a0375bcae101b778a (7.3)
-CVE-2026-99203 [pipe: preserve existing fasync readers on writer setup failure]
+CVE-2026-99203 (In the Linux kernel, the following vulnerability has been resolved: p ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/40bb03d3ea6f6a915218508819ecc4d7a7fa260d (7.3)
-CVE-2026-99202 [scsi: libsas: Fix SMP IO deadlock during HA resume]
+CVE-2026-99202 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/81e097a064b28b4a1f6ca1a8b433e659c1bd64c0 (7.3)
-CVE-2026-99201 [netlink: avoid hashing the network namespace pointer]
+CVE-2026-99201 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/f88bb3606e4bd11ee035b682cddc2999e604609a (7.3)
-CVE-2026-99192 [net: bcmgenet: unshare the skb before writing the control block]
+CVE-2026-99192 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/89771ce4f8f67dcffae561b2ccac95c0f6e3aa01 (7.3)
-CVE-2026-99191 [calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()]
+CVE-2026-99191 (In the Linux kernel, the following vulnerability has been resolved: c ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/8070ed578b6b9134e045627fb745c887a806d46e (7.3)
-CVE-2026-99190 [gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths]
+CVE-2026-99190 (In the Linux kernel, the following vulnerability has been resolved: g ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/c28846ca1ac6134881114d272314623c8433e372 (7.3)
-CVE-2026-99189 [gpio: mxc: fix race between chained IRQ handler install and probe completion]
+CVE-2026-99189 (In the Linux kernel, the following vulnerability has been resolved: g ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/38d44f78f041ffe60c8e2443b99434a199e7541d (7.3)
-CVE-2026-99187 [perf: Fix perf_pmu_migrate_context() leaving events behind]
+CVE-2026-99187 (In the Linux kernel, the following vulnerability has been resolved: p ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/e76b36b4be7160eaa14b416681e548b125702395 (7.3)
-CVE-2026-99183 [accel/rocket: search every core slot when looking up a scheduler]
+CVE-2026-99183 (In the Linux kernel, the following vulnerability has been resolved: a ...)
- linux 7.2.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/89c2c777df17eb0201c8e22afabbf3691f2a28fe (7.3)
-CVE-2026-99182 [ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture]
+CVE-2026-99182 (In the Linux kernel, the following vulnerability has been resolved: A ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/746de48c3a250f0c264105dcbfcdf0c5001e970b (7.3)
-CVE-2026-99181 [autofs: ignore notification errors from a replaced pipe]
+CVE-2026-99181 (In the Linux kernel, the following vulnerability has been resolved: a ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/65676cd4203c0e41a94caf54080a7f0a95434bda (7.3)
-CVE-2026-99180 [unicode: free the map after a grace period]
+CVE-2026-99180 (In the Linux kernel, the following vulnerability has been resolved: u ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/a96c5299bd7305eb984377681eb3222a57376405 (7.3)
-CVE-2026-99179 [watch_queue: Fix note pool publication race in watch_queue_set_size()]
+CVE-2026-99179 (In the Linux kernel, the following vulnerability has been resolved: w ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/5e531d62f1f8834faf7a4eed0d41105cf6570a8f (7.3)
-CVE-2026-99178 [x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context]
+CVE-2026-99178 (In the Linux kernel, the following vulnerability has been resolved: x ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/81d99abe2bd81379abfb595e403bbbee6fbfc624 (7.3)
-CVE-2026-99176 [KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry]
+CVE-2026-99176 (In the Linux kernel, the following vulnerability has been resolved: K ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/c8f4cfe1cf93bce924e27f2abead7a4c4a487505 (7.3)
-CVE-2026-99175 [fsnotify: prevent mark additions during connector teardown]
+CVE-2026-99175 (In the Linux kernel, the following vulnerability has been resolved: f ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/36ebddca56b9d8993d6dc984fdecc748ee1f5e06 (7.3)
-CVE-2026-99174 [ext4: free the sbi after a grace period]
+CVE-2026-99174 (In the Linux kernel, the following vulnerability has been resolved: e ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/c17b44266a1f9fcb49b894d4611d1254bf1aa313 (7.3)
-CVE-2026-99173 [eventfs: Free the eventfs_inode after an rcu grace period too]
+CVE-2026-99173 (In the Linux kernel, the following vulnerability has been resolved: e ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/2cd88c498ecff8e22bf4c397b8eb226db70ac343 (7.3)
-CVE-2026-99172 [ipc: drop the mqueue mount with kern_unmount() on setup failure]
+CVE-2026-99172 (In the Linux kernel, the following vulnerability has been resolved: i ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/f0e48172a59e517e613b73f73cc35f24fd123aeb (7.3)
-CVE-2026-99171 [ntfs3: free the sbi after a grace period]
+CVE-2026-99171 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/c01b091b06412d3b1b53d8c2925f6de586c8a2fc (7.3)
-CVE-2026-99169 [futex: Fix mm reuse handling for FUT_OFF_MMSHARED]
+CVE-2026-99169 (In the Linux kernel, the following vulnerability has been resolved: f ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/3267512ad1c2cc0c7768c5b014dc2cceb398a801 (7.3)
-CVE-2026-99167 [net/sched: fix use-after-free in __tcf_action_put()]
+CVE-2026-99167 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/7b16eb911091aae237a8673da94e4dfb9cd21d54 (7.3)
-CVE-2026-99166 [net: rds: fix uninitialized trans dereference in CM event handler]
+CVE-2026-99166 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/492ba6ac1b1ffb8a06ff52db0825c1af2cdb28c8 (7.3)
-CVE-2026-99165 [sctp: revalidate output stream after association connect wait]
+CVE-2026-99165 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/b7ad72414c673ce1fa1f463e807cd4f34f8be9bf (7.3)
-CVE-2026-99163 [tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields]
+CVE-2026-99163 (In the Linux kernel, the following vulnerability has been resolved: t ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/a244c241593b5b38a08f0df2cb43c26574efbdcb (7.3)
-CVE-2026-99161 [i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()]
+CVE-2026-99161 (In the Linux kernel, the following vulnerability has been resolved: i ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/aaabefc79b0ff0018e8e3832169bbe359d0551fc (7.3)
-CVE-2026-99160 [ring-buffer: Do not show buffer_meta for CPUs without a buffer]
+CVE-2026-99160 (In the Linux kernel, the following vulnerability has been resolved: r ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/3f23cae09a4677a3f7c163a68388512cb231ff22 (7.3)
-CVE-2026-99159 [ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()]
+CVE-2026-99159 (In the Linux kernel, the following vulnerability has been resolved: r ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/25132363c723afc39aace8b098f547ab4a0ea759 (7.3)
-CVE-2026-99158 [ring-buffer: Fix false warning in ring_buffer_map_get_reader()]
+CVE-2026-99158 (In the Linux kernel, the following vulnerability has been resolved: r ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/89bab1dba8a0167ef0d819e0f55b6bafa038e87f (7.3)
-CVE-2026-99157 [scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies]
+CVE-2026-99157 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/ec6b083915e8146e147314a5f4f1285d07b57bfc (7.3)
-CVE-2026-99156 [scsi: st: Fix use-after-free race between st_remove() and st_open()]
+CVE-2026-99156 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/71caf7f84bd62a4bf91cc95abd2de690afb8d15f (7.3)
-CVE-2026-99155 [scsi: xen/scsifront: Check for a NULL shadow entry on a backend response]
+CVE-2026-99155 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/8c8222c255772713eb36cde695777a1fce224917 (7.3)
-CVE-2026-99154 [scsi: libiscsi: Reject a negative task index from parse_pdu_itt]
+CVE-2026-99154 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/8ee2a09a1dbb257c9e828ad2497f8e4832dfb142 (7.3)
-CVE-2026-99153 [scsi: libiscsi: Validate the ITT reflected in a Reject PDU]
+CVE-2026-99153 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/c5958c770b2a0ee492414e26b07da9164a0d1f5d (7.3)
-CVE-2026-99152 [scsi: libiscsi: Validate the task named by a management response]
+CVE-2026-99152 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/11bffcd9cb346732eab2914ef44fe777a3f0b585 (7.3)
-CVE-2026-99150 [drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr]
+CVE-2026-99150 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/de9f6bcdb44f0e410031002e2f103826ea6b6259 (7.3)
-CVE-2026-99147 [drm/exec: don't immediately add prelocked obj to array of locked objs]
+CVE-2026-99147 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/26401a4999f1596a515b2e704e7066ac09306488 (7.3)
-CVE-2026-99146 [drm/i915/dmc: Add sanity check for DMC load address]
+CVE-2026-99146 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/7dedc5bb11f95e96fe80757c924d8d9aa7327759 (7.3)
-CVE-2026-99143 [tracing: Keep the predicate limit separate from program capacity]
+CVE-2026-99143 (In the Linux kernel, the following vulnerability has been resolved: t ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/803aa6fc2dbea25ab9d3ed19eca1c96d0ab17445 (7.3)
-CVE-2026-99142 [tracing: Check operator stack capacity before pushing]
+CVE-2026-99142 (In the Linux kernel, the following vulnerability has been resolved: t ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/c47a7b11bcb3d45e29723afcf6336866476b1d08 (7.3)
-CVE-2026-99140 [tracing: Fix hist trigger timestamps for buffered events]
+CVE-2026-99140 (In the Linux kernel, the following vulnerability has been resolved: t ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/9414ca3b99e5a7f1f3bf51c2a01b383e1b355dd0 (7.3)
-CVE-2026-99139 [tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)]
+CVE-2026-99139 (In the Linux kernel, the following vulnerability has been resolved: t ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/5271b79b7ad68dcb222e893773f92bdabf7750f3 (7.3-rc2)
-CVE-2026-99138 [tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)]
+CVE-2026-99138 (In the Linux kernel, the following vulnerability has been resolved: t ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/385e474086c2e7e29e2dded690be40dc273e20ee (7.3-rc2)
-CVE-2026-99136 [dm-crypt: fix a tiny race condition in crypt_dec_pending]
+CVE-2026-99136 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/148845aa1921d95ef5dc851c76e6a284f6657df6 (7.3-rc2)
-CVE-2026-99135 [dm-integrity: fix infinite loop on discard with large tag size]
+CVE-2026-99135 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/18d80c77b4c7dd20699e81cedfbbff4e9d198f28 (7.3-rc2)
-CVE-2026-99134 [mac802154: fix data race and NULL deref on local->assoc_dev]
+CVE-2026-99134 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/c037915f80c4db47f7d061d68e703ffd551b1a34 (7.3-rc2)
-CVE-2026-99133 [net/iucv: fix the recvmsg window update]
+CVE-2026-99133 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/fa5acd038ea657ad5033713d6916214cbd349151 (7.3-rc2)
-CVE-2026-99132 [xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf]
+CVE-2026-99132 (In the Linux kernel, the following vulnerability has been resolved: x ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff (7.3-rc2)
-CVE-2026-99131 [xfs: fix capability check in xfs]
+CVE-2026-99131 (In the Linux kernel, the following vulnerability has been resolved: x ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/e2f62a9744ebad3bcb6347a648e615026e9efeff (7.3-rc2)
-CVE-2026-99130 [io_uring/cancel: don't spin on local work the task can't run]
+CVE-2026-99130 (In the Linux kernel, the following vulnerability has been resolved: i ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/fddcf4c5321b3ea5f72166c3fd36a9d1c34f80c7 (7.3-rc7)
-CVE-2026-99128 [sctp: validate chunk length in the inqueue parser]
+CVE-2026-99128 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a (7.3-rc2)
-CVE-2026-99127 [page_pool: keep frag_offset aligned for odd-sized requests]
+CVE-2026-99127 (In the Linux kernel, the following vulnerability has been resolved: p ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/dc0df5a0c62ccea1d0e08d39a4dc9064de81d411 (7.3-rc2)
-CVE-2026-99126 [s390/ctcm: Prevent XID null dereference]
+CVE-2026-99126 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/b264d8422779d69febce914efc47a92a85cc382c (7.3-rc2)
-CVE-2026-99125 [s390/pai: Handle multiple PMU stop callback invocations]
+CVE-2026-99125 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40 (7.3-rc2)
-CVE-2026-99124 [s390/pci: Fix leak of uninitialized kernel data in SCLP report]
+CVE-2026-99124 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/8ac60ae2a307a50b599bf5d300b448d638f3ba29 (7.3-rc2)
-CVE-2026-99123 [vsock/virtio: validate packet source for connected sockets]
+CVE-2026-99123 (In the Linux kernel, the following vulnerability has been resolved: v ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/dee44f41f206becb41c492899c1996cfd7f82a1b (7.3-rc2)
-CVE-2026-99122 [vsock/vmci: validate packet source for connected sockets]
+CVE-2026-99122 (In the Linux kernel, the following vulnerability has been resolved: v ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7 (7.3-rc2)
-CVE-2026-99121 [ipv4: avoid divide by zero in fib_rebalance]
+CVE-2026-99121 (In the Linux kernel, the following vulnerability has been resolved: i ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/5046d2880fec7d49ebed2fd2866747ee1d06ad71 (7.3-rc2)
-CVE-2026-99118 [drm/i915/dmc: Harden DMC firmware payload parsing]
+CVE-2026-99118 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/8bb1858db453cd4250e3b633f5d2d09206024ca6 (7.3)
-CVE-2026-99117 [net: bridge: mcast: don't truncate the port group walk on teardown]
+CVE-2026-99117 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/5a3f7a683aee56e1f15c9d53041f3236767eaae7 (7.3-rc2)
-CVE-2026-99115 [ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION]
+CVE-2026-99115 (In the Linux kernel, the following vulnerability has been resolved: k ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/db2267b27c054a6c2151ff7fbb67927e784f31d6 (7.3-rc2)
-CVE-2026-99114 [ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION]
+CVE-2026-99114 (In the Linux kernel, the following vulnerability has been resolved: k ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8e (7.3-rc2)
-CVE-2026-99113 [ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in]
+CVE-2026-99113 (In the Linux kernel, the following vulnerability has been resolved: k ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/399aa12450a61a5c73dc77e73f069ece9687c95d (7.3-rc2)
-CVE-2026-99112 [net/sched: cls_flower: validate mask pointer after nla_next()]
+CVE-2026-99112 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/fee10655709c5c597e8e9f722f3035d9ea31ff3a (7.3-rc2)
-CVE-2026-99110 [smb: client: fix heap overflow in cifs_do_set_acl()]
+CVE-2026-99110 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/1dac61e2c29d1a71784604b48cf3b1234a65ec29 (7.3-rc2)
-CVE-2026-99109 [smb: client: reject SetEA requests that do not fit the request buffer]
+CVE-2026-99109 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/4aa2c106aef4bf3dfd97c30842db0767b26e8428 (7.3-rc2)
-CVE-2026-99106 [drm/amdgpu: free the userptr ranges when a CS fails after parser_bos]
+CVE-2026-99106 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/1b4da805a0ba354a549ce07459c871c17dd94fe0 (7.3)
-CVE-2026-99105 [sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ]
+CVE-2026-99105 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/7a9df76679633cf26e0fea882a684012c6ec245a (7.3)
-CVE-2026-99103 [workqueue: Fix unbound pool lifetime for pending pwqs]
+CVE-2026-99103 (In the Linux kernel, the following vulnerability has been resolved: w ...)
- linux 7.2.13-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/cf9c8aaea0d47410df8708bec195889f3a85cd3c (7.3-rc2)
-CVE-2026-99101 [ntfs: move attribute payload before shrinking its record]
+CVE-2026-99101 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 7.2.13-1
NOTE: https://git.kernel.org/linus/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64 (7.3-rc1)
CVE-2026-XXXX [GHSA-chm5-8fg3-g6fw: The default email notification scripts may allow command injection from the recipient address]
@@ -1129,43 +2003,43 @@ CVE-2026-XXXX [GHSA-9vw2-f4vp-x7gf: PHPUnit vulnerable to code execution by othe
[trixie] - phpunit <not-affected> (Vulnerable code introduced later)
[bookworm] - phpunit <not-affected> (Vulnerable code introduced later)
NOTE: https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-9vw2-f4vp-x7gf
-CVE-2026-116273
+CVE-2026-116273 (MIME::Parser versions before 5.521 for Perl set no limit on the number ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712323/
-CVE-2026-116272
+CVE-2026-116272 (MIME::Field::ParamVal versions before 5.521 for Perl do not flag a dup ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712325/
-CVE-2026-116271
+CVE-2026-116271 (MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-cre ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712322/
-CVE-2026-116270
+CVE-2026-116270 (MIME::Words versions before 5.521 for Perl allow memory exhaustion via ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712320/
-CVE-2026-116269
+CVE-2026-116269 (MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712331/
-CVE-2026-116268
+CVE-2026-116268 (MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaust ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712328/
-CVE-2026-116267
+CVE-2026-116267 (MIME::Parser versions before 5.521 for Perl allow memory exhaustion vi ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712333/
-CVE-2026-116266
+CVE-2026-116266 (MIME::Head versions from 5.518 before 5.521 for Perl decode a partly e ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712335/
-CVE-2026-116265
+CVE-2026-116265 (MIME::Field::ParamVal versions before 5.521 for Perl do not flag an am ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712330/
-CVE-2026-116264
+CVE-2026-116264 (MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712337/
@@ -11736,6 +12610,7 @@ CVE-2026-101518 (Vulnerability in the Oracle Enterprise Manager Base Platform pr
CVE-2026-101517 (Vulnerability in the Oracle Utilities Network Management System produc ...)
NOT-FOR-US: Oracle
CVE-2026-101516 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
+ {DSA-6588-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -34326,67 +35201,67 @@ CVE-2026-88812 (A double free inXKB SetGeometryin X.Org X Server before 21.1.25
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/c724006ee76fb002add50fcb4d97e8c96c279f09 (xorg-server-21.1.25)
-CVE-2026-93515 [Present Extension Cross-Window Notify Use-After-Free]
+CVE-2026-93515 (A use-after-free inpresent_clear_window_notifies() in the X.org X Ser ...)
- xorg-server 2:21.1.25-1 (bug #1150214)
- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/a469f98bcfab50dab607ff5ac24037632b0079a3 (xorg-server-21.1.25)
-CVE-2026-93516 [XInput Passive Grab modifierDevice Use-After-Free]
+CVE-2026-93516 (A use-after-free caused by lack of lifecycle management when adding / ...)
- xorg-server 2:21.1.25-1 (bug #1150214)
- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9442a53c137bb9eb61336c6fd39627912d50cc8d (xorg-server-21.1.25)
-CVE-2026-93517 [GLX RenderLarge Heap Buffer Overflow]
+CVE-2026-93517 (A heap buffer overflow in handlingGLX RenderLarge requestwhere dataByt ...)
- xorg-server 2:21.1.25-1 (bug #1150214)
- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/3961cdca467975a7d377f1f7bcd55d52eb3f417a (xorg-server-21.1.25)
-CVE-2026-93518 [XKB ResizeKeyType Numeric Truncation]
+CVE-2026-93518 (An integer truncation issue in XkbResizeKeyType() that could lead to a ...)
- xorg-server 2:21.1.25-1 (bug #1150214)
- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/558ba8f784b0f5d4d96948051b2f04c983af20cc (xorg-server-21.1.25)
-CVE-2026-93519 [XFixes Pointer Barrier Event List Buffer Overflow]
+CVE-2026-93519 (A buffer overflow when handling pointer barriers in the XFIXES extensi ...)
- xorg-server 2:21.1.25-1 (bug #1150214)
- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9c3880d0745acefc98ed37e79498dfbe558a0f40 (xorg-server-21.1.25)
-CVE-2026-93520 [XKB ChangeKeycodeRange Heap Out-of-Bounds Write]
+CVE-2026-93520 (A heap buffer overflow caused by mismatching size calculations between ...)
- xorg-server 2:21.1.25-1 (bug #1150214)
- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5ec0535af2bcc93381666dc110abebba8975f8ae (xorg-server-21.1.25)
-CVE-2026-93521 [RandR ChangeProviderProperty Heap Buffer Overflow]
+CVE-2026-93521 (A buffer overflow in RandR ChangeProviderProperty requests in X.Org X ...)
- xorg-server 2:21.1.25-1 (bug #1150214)
- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/00ce692c7f6ea1900888a2a24aecf6cba5544ae1 (xorg-server-21.1.25)
-CVE-2026-93522 [Glamor CopyArea CPU-FBO Heap Buffer Overflow]
+CVE-2026-93522 (A heap buffer overflow caused by mismatched size usage in CopyArea CPU ...)
- xorg-server <not-affected> (Vulnerable code not present)
- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/d6deb27b655abae79396bf3aedc2937a10ae2d4f (xwayland-24.1.14)
-CVE-2026-93523 [XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write]
+CVE-2026-93523 (A heap buffer overflow caused by a XIPassiveUngrabDevice request with ...)
- xorg-server 2:21.1.25-1 (bug #1150214)
- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/aa56160fa213d8767e7da0c076b5c8242703313b (xorg-server-21.1.25)
-CVE-2026-93524 [XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read]
+CVE-2026-93524 (A buffer overread inCheckKeySyms() in X.Org X Server before 21.1.25 an ...)
- xorg-server 2:21.1.25-1 (bug #1150214)
- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/927ee1282d21550807619521bee909ef62ed0571 (xorg-server-21.1.25)
-CVE-2026-93536 [GestureBuildSprite Use-After-Free]
+CVE-2026-93536 (A use after free caused by missing lifecycle management of gesture spr ...)
- xorg-server 2:21.1.25-1 (bug #1150214)
- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
@@ -34568,7 +35443,7 @@ CVE-2026-39797 (Unauthenticated PHP Object Injection in GDPR Framework By Data44
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39796 (Unauthenticated Broken Access Control in Advanced Posts Listing \u2013 ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-39795 (Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 ve ...)
+CVE-2026-39795 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39794 (Unauthenticated Broken Access Control in WooCommerce Multivendor Marke ...)
NOT-FOR-US: WordPress plugin or theme
@@ -34650,7 +35525,7 @@ CVE-2026-39748 (Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 v
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39747 (Subscriber SQL Injection in Woffice <= 5.4.35 versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-39746 (Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.)
+CVE-2026-39746 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39745 (Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by Be ...)
NOT-FOR-US: WordPress plugin or theme
@@ -98851,7 +99726,7 @@ CVE-2026-75032 (A flaw was found in BlueZ. Insufficient validation of packet len
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2517490
NOTE: Fixed by: https://github.com/bluez/bluez/commit/bd8989620ed6e80755f06cfdb18f5b4a3913493c
NOTE: Followup: https://github.com/bluez/bluez/commit/58088149872d014684a582fdb7ad01a5180c9bc5
-CVE-2026-74990 (Internally found bugs present in Thunderbird ESR 140.13, Thunderbird E ...)
+CVE-2026-74990 (Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.1 ...)
{DSA-6461-1 DSA-6451-1 DLA-4754-1 DLA-4750-1}
- firefox 154.0-1
- firefox-esr 140.14.0esr-2
@@ -98859,13 +99734,13 @@ CVE-2026-74990 (Internally found bugs present in Thunderbird ESR 140.13, Thunder
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-74/#CVE-2026-74990
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-76/#CVE-2026-74990
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-79/#CVE-2026-74990
-CVE-2026-74989 (Internally found bugs present in Thunderbird 153. Some of these bugs s ...)
+CVE-2026-74989 (Internally found bugs present in Firefox 153. Some of these bugs showe ...)
- firefox 154.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-74/#CVE-2026-74989
-CVE-2026-74988 (Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird ...)
+CVE-2026-74988 (Internally found bugs present in Firefox ESR 153.0 and Firefox 153. So ...)
- firefox 154.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-74/#CVE-2026-74988
-CVE-2026-74987 (Internally found bugs present in Thunderbird ESR 140.13, Thunderbird E ...)
+CVE-2026-74987 (Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 ...)
{DSA-6461-1 DSA-6451-1 DLA-4754-1 DLA-4750-1}
- firefox 154.0-1
- firefox-esr 140.14.0esr-2
@@ -98954,7 +99829,7 @@ CVE-2026-74971 (Information disclosure in the DOM: UI Events & Focus Handling co
CVE-2026-74970 (Site isolation issue in the Graphics component. This vulnerability was ...)
- firefox 154.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-74/#CVE-2026-74970
-CVE-2026-74969 (Use-after-free in the Layout: Text and Fonts component. This vulnerabi ...)
+CVE-2026-74969 (Race condition, use-after-free in the Layout: Text and Fonts component ...)
{DSA-6461-1 DSA-6451-1 DLA-4754-1 DLA-4750-1}
- firefox 154.0-1
- firefox-esr 140.14.0esr-2
@@ -99064,7 +99939,7 @@ CVE-2026-74951 (Clickjacking issue in Firefox for Android. This vulnerability wa
CVE-2026-74950 (Privilege escalation in the Downloads API component. This vulnerabilit ...)
- firefox 154.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-74/#CVE-2026-74950
-CVE-2026-74949 (Privilege escalation due to use-after-free in the Graphics: Canvas2D c ...)
+CVE-2026-74949 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
{DSA-6461-1 DSA-6451-1 DLA-4754-1 DLA-4750-1}
- firefox 154.0-1
- firefox-esr 140.14.0esr-2
@@ -99083,7 +99958,7 @@ CVE-2026-74948 (Information disclosure in the Graphics component. This vulnerabi
CVE-2026-74947 (Privilege escalation due to invalid pointer in the Graphics component. ...)
- firefox 154.0-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-74/#CVE-2026-74947
-CVE-2026-74946 (Privilege escalation due to incorrect boundary conditions in the Graph ...)
+CVE-2026-74946 (Information disclosure due to incorrect boundary conditions in the Gra ...)
{DSA-6461-1 DSA-6451-1 DLA-4754-1 DLA-4750-1}
- firefox 154.0-1
- firefox-esr 140.14.0esr-2
@@ -99401,7 +100276,7 @@ CVE-2026-68922 (MobSF is a mobile application security testing tool used. Prior
NOT-FOR-US: MobSF
CVE-2026-68568 (Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-68567 (Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 ver ...)
+CVE-2026-68567 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-68565 (Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 vers ...)
NOT-FOR-US: WordPress plugin or theme
@@ -159797,7 +160672,7 @@ CVE-2026-27041 (Contributor Arbitrary File Upload in Unlimited Elements for Elem
NOT-FOR-US: WordPress plugin or theme
CVE-2026-25446 (Subscriber Arbitrary File Upload in WishList Member X <= 3.29.0 versio ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-25439 (Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions.)
+CVE-2026-25439 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-24611 (Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions ...)
NOT-FOR-US: WordPress plugin or theme
@@ -252391,7 +253266,7 @@ CVE-2025-63038 (Missing Authorization vulnerability in Northern Beaches Websites
NOT-FOR-US: WordPress plugin or theme
CVE-2025-63032 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2025-63031 (Missing Authorization vulnerability in WP Grids EasyTest convertpro al ...)
+CVE-2025-63031 (Missing Authorization vulnerability in WP Grids EasyTest \u2013 Simpli ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-63022 (Missing Authorization vulnerability in topdevs.net Simple Like Page si ...)
NOT-FOR-US: WordPress plugin or theme
@@ -361460,7 +362335,7 @@ CVE-2025-26931 (Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Sof
NOT-FOR-US: WordPress plugin
CVE-2025-26928 (Missing Authorization vulnerability in Xfinitysoft Order Limit for Woo ...)
NOT-FOR-US: WordPress plugin
-CVE-2025-26926 (Cross-Site Request Forgery (CSRF) vulnerability in fs-code Booknetic b ...)
+CVE-2025-26926 (Cross-Site Request Forgery (CSRF) vulnerability in Booknetic Booknetic ...)
NOT-FOR-US: WordPress plugin
CVE-2025-26915 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
NOT-FOR-US: WordPress plugin
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/858e09bdd4a77038ce86723eb8cd3d706d9320fd
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/858e09bdd4a77038ce86723eb8cd3d706d9320fd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/6c497d2f/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list