[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 30 07:14:02 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
c9bff0d2 by security tracker role at 2026-10-30T07:13:54+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,4 +1,452 @@
-CVE-2026-115943
+CVE-2026-97645 (The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-S ...)
+ TODO: check
+CVE-2026-96389 (Missing Authorization vulnerability in Drupal Xray Audit allows Forcef ...)
+ TODO: check
+CVE-2026-92744 (Under certain conditions, privilege manager agent allows a remote unau ...)
+ TODO: check
+CVE-2026-92092 (A flaw was found in openshift-ansible. The installer container's `run` ...)
+ TODO: check
+CVE-2026-91920 (A flaw was found in the ChunkReader component of the Undertow web serv ...)
+ TODO: check
+CVE-2026-90437 (The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-S ...)
+ TODO: check
+CVE-2026-89435 (The Formidable Forms \u2013 WordPress Form Builder for Contact Forms, ...)
+ TODO: check
+CVE-2026-76031 (Use after free in Input in Google Chrome prior to 156.0.8078.79 allowe ...)
+ TODO: check
+CVE-2026-76030 (Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.7 ...)
+ TODO: check
+CVE-2026-76029 (Memory corruption in Network in Google Chrome prior to 156.0.8078.79 a ...)
+ TODO: check
+CVE-2026-76028 (Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 a ...)
+ TODO: check
+CVE-2026-76027 (Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078 ...)
+ TODO: check
+CVE-2026-76026 (Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 ...)
+ TODO: check
+CVE-2026-76025 (Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 a ...)
+ TODO: check
+CVE-2026-76024 (Memory corruption in MediaStream in Google Chrome prior to 156.0.8078. ...)
+ TODO: check
+CVE-2026-74915 (A web page that contains unusual WebGPU content loaded into the GPU GL ...)
+ TODO: check
+CVE-2026-74912 (On GPU systems with the security vulnerability fix for CVE-2026-49746 ...)
+ TODO: check
+CVE-2026-67205
+ REJECTED
+CVE-2026-67203
+ REJECTED
+CVE-2026-65587 (A web page that contains unusual WebGPU content loaded into the GPU GL ...)
+ TODO: check
+CVE-2026-65586 (Software installed and run as a non-privileged user may conduct improp ...)
+ TODO: check
+CVE-2026-65584 (Software installed and run as a non-privileged user may conduct improp ...)
+ TODO: check
+CVE-2026-61719 (WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a ...)
+ TODO: check
+CVE-2026-61707 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
+ TODO: check
+CVE-2026-61673 (WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a ...)
+ TODO: check
+CVE-2026-61671 (WeGIA is a web manager for charitable institutions. Prior to the advis ...)
+ TODO: check
+CVE-2026-61654 (Lightdash is an open source business intelligence platform. In affecte ...)
+ TODO: check
+CVE-2026-61645 (Docat is a tool for hosting versioned static documentation. In the aff ...)
+ TODO: check
+CVE-2026-61576 (Lightdash is an open source business intelligence platform. In affecte ...)
+ TODO: check
+CVE-2026-5461 (The Forminator Forms plugin for WordPress is vulnerable to Limited Fil ...)
+ TODO: check
+CVE-2026-51832 (An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below ...)
+ TODO: check
+CVE-2026-51831 (An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below ...)
+ TODO: check
+CVE-2026-45049 (Open Access Management (OpenAM) is an access management solution. Prio ...)
+ TODO: check
+CVE-2026-19199 (Software installed and run as a non-privileged user may conduct improp ...)
+ TODO: check
+CVE-2026-18629 (A web page that contains unusual GPU shader code is loaded into the GP ...)
+ TODO: check
+CVE-2026-15466 (Software installed and run as a non-privileged user may conduct improp ...)
+ TODO: check
+CVE-2026-13303 (HashiCorp Boundary and Boundary Enterprise are vulnerable to a server- ...)
+ TODO: check
+CVE-2026-119325 (Bricks Theme 2.4 and before for WordPress contains an unauthenticated ...)
+ TODO: check
+CVE-2026-119317 (On Linux, an authenticated, low-privileged Nessus user with scan-creat ...)
+ TODO: check
+CVE-2026-119286 (GraphQL-core is a Python port of the GraphQL.js reference implementati ...)
+ TODO: check
+CVE-2026-119285 (Fiber is an Express inspired web framework written in Go. From 2.52.1 ...)
+ TODO: check
+CVE-2026-119284 (joserfc is a Python library that provides an implementation of several ...)
+ TODO: check
+CVE-2026-119283 (joserfc is a Python library that provides an implementation of several ...)
+ TODO: check
+CVE-2026-119282 (Nx is a monorepo solution for TypeScript and polyglot codebases. From ...)
+ TODO: check
+CVE-2026-119281 (MariaDB Connector/J is used to connect applications developed in Java ...)
+ TODO: check
+CVE-2026-119280 (MariaDB Connector/J is used to connect applications developed in Java ...)
+ TODO: check
+CVE-2026-119279 (MariaDB Connector/J is used to connect applications developed in Java ...)
+ TODO: check
+CVE-2026-119278 (MariaDB Connector/J is used to connect applications developed in Java ...)
+ TODO: check
+CVE-2026-119277 (MariaDB Connector/J is used to connect applications developed in Java ...)
+ TODO: check
+CVE-2026-119276 (MariaDB Connector/J is used to connect applications developed in Java ...)
+ TODO: check
+CVE-2026-119272 (Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078. ...)
+ TODO: check
+CVE-2026-119271 (Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed ...)
+ TODO: check
+CVE-2026-119270 (Improper input validation in CacheStorage in Google Chrome prior to 15 ...)
+ TODO: check
+CVE-2026-119269 (Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowe ...)
+ TODO: check
+CVE-2026-119268 (Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 al ...)
+ TODO: check
+CVE-2026-119267 (Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allow ...)
+ TODO: check
+CVE-2026-119266 (Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowe ...)
+ TODO: check
+CVE-2026-119265 (Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 all ...)
+ TODO: check
+CVE-2026-119264 (Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allo ...)
+ TODO: check
+CVE-2026-119263 (Memory corruption in GarbageCollection in Google Chrome prior to 156.0 ...)
+ TODO: check
+CVE-2026-119262 (Improper input validation in V8 in Google Chrome prior to 156.0.8078.7 ...)
+ TODO: check
+CVE-2026-119261 (Improper input validation in Skia in Google Chrome prior to 156.0.8078 ...)
+ TODO: check
+CVE-2026-119260 (Use after free in Frames in Google Chrome prior to 156.0.8078.79 allow ...)
+ TODO: check
+CVE-2026-119210 (MariaDB Connector/J is used to connect applications developed in Java ...)
+ TODO: check
+CVE-2026-119209 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
+ TODO: check
+CVE-2026-119208 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
+ TODO: check
+CVE-2026-119207 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
+ TODO: check
+CVE-2026-119206 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
+ TODO: check
+CVE-2026-119205 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
+ TODO: check
+CVE-2026-119204 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
+ TODO: check
+CVE-2026-119203 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
+ TODO: check
+CVE-2026-119202 (@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until ...)
+ TODO: check
+CVE-2026-119201 (Nuxt is an open-source web development framework for Vue.js. From 4.6. ...)
+ TODO: check
+CVE-2026-119200 (Nuxt is an open-source web development framework for Vue.js. From 4.6. ...)
+ TODO: check
+CVE-2026-119199 (Nuxt is an open-source web development framework for Vue.js. From 3.0. ...)
+ TODO: check
+CVE-2026-119198 (Nuxt is an open-source web development framework for Vue.js. From 4.6. ...)
+ TODO: check
+CVE-2026-119197 (pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary R ...)
+ TODO: check
+CVE-2026-119196 (pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, construc ...)
+ TODO: check
+CVE-2026-119195 (pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, construc ...)
+ TODO: check
+CVE-2026-119194 (pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, ...)
+ TODO: check
+CVE-2026-119193 (PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the ...)
+ TODO: check
+CVE-2026-119191 (Forge (also called node-forge) is a native implementation of Transport ...)
+ TODO: check
+CVE-2026-119190 (Forge (also called node-forge) is a native implementation of Transport ...)
+ TODO: check
+CVE-2026-119189 (Forge (also called node-forge) is a native implementation of Transport ...)
+ TODO: check
+CVE-2026-119188 (Forge (also called node-forge) is a native implementation of Transport ...)
+ TODO: check
+CVE-2026-119187 (Forge (also called node-forge) is a native implementation of Transport ...)
+ TODO: check
+CVE-2026-119186 (Forge (also called node-forge) is a native implementation of Transport ...)
+ TODO: check
+CVE-2026-119087 (The Content Egg \u2013 Affiliate Product Importer & Price Comparison p ...)
+ TODO: check
+CVE-2026-119059 (The Content Egg plugin for WordPress is vulnerable to unauthorized mod ...)
+ TODO: check
+CVE-2026-118959 (A flaw was found in the required action provider mechanism of Keycloak ...)
+ TODO: check
+CVE-2026-118952 (A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matchi ...)
+ TODO: check
+CVE-2026-118947 (A flaw was found in the UMA resource registration endpoint of the keyc ...)
+ TODO: check
+CVE-2026-118698 (The JoomSport \u2013 for Sports: Team & League, Football, Hockey & mor ...)
+ TODO: check
+CVE-2026-118634 (The Events Made Easy plugin for WordPress is vulnerable to Stored Cros ...)
+ TODO: check
+CVE-2026-118593 (A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incom ...)
+ TODO: check
+CVE-2026-118584 (Incorrect Authorization vulnerability in Drupal Field Permissions allo ...)
+ TODO: check
+CVE-2026-118583 (Incorrect Authorization vulnerability in Drupal Field Permissions allo ...)
+ TODO: check
+CVE-2026-118582 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
+ TODO: check
+CVE-2026-118576 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-118575 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-118574 (Incorrect Permission Assignment for Critical Resource vulnerability in ...)
+ TODO: check
+CVE-2026-118573 (Missing Authorization vulnerability in Drupal OAuth2 Token Manager all ...)
+ TODO: check
+CVE-2026-118572 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
+ TODO: check
+CVE-2026-118571 (Use of Web Browser Cache Containing Sensitive Information vulnerabilit ...)
+ TODO: check
+CVE-2026-118570 (Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle a ...)
+ TODO: check
+CVE-2026-118569 (Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forc ...)
+ TODO: check
+CVE-2026-118568 (Insecure Storage of Sensitive Information vulnerability in Drupal Cont ...)
+ TODO: check
+CVE-2026-118567 (Incorrect Authorization vulnerability in Drupal Bulk Update User Roles ...)
+ TODO: check
+CVE-2026-118565 (Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue ...)
+ TODO: check
+CVE-2026-118564 (Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affe ...)
+ TODO: check
+CVE-2026-118563 (Vulnerability in Drupal CacheFlush. This issue affects CacheFlush vers ...)
+ TODO: check
+CVE-2026-118562 (Deserialization of Untrusted Data vulnerability in Drupal Single Conte ...)
+ TODO: check
+CVE-2026-118561 (External Control of File Name or Path vulnerability in Drupal Single C ...)
+ TODO: check
+CVE-2026-118560 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-118559 (Improper Verification of Cryptographic Signature vulnerability in Drup ...)
+ TODO: check
+CVE-2026-118558 (Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Str ...)
+ TODO: check
+CVE-2026-118557 (Incorrect Authorization vulnerability in Drupal Commerce Shipping allo ...)
+ TODO: check
+CVE-2026-118556 (Incorrect Authorization vulnerability in Drupal Commerce Shipping allo ...)
+ TODO: check
+CVE-2026-118555 (Incorrect Authorization vulnerability in Drupal Commerce License allow ...)
+ TODO: check
+CVE-2026-118554 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
+ TODO: check
+CVE-2026-118553 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-118552 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-118551 (Insecure Storage of Sensitive Information vulnerability in Drupal AI ( ...)
+ TODO: check
+CVE-2026-118550 (Use of Web Browser Cache Containing Sensitive Information vulnerabilit ...)
+ TODO: check
+CVE-2026-118549 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-118548 (Incorrect Authorization vulnerability in Drupal AI (Artificial Intelli ...)
+ TODO: check
+CVE-2026-118546 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-118545 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-118544 (Exposure of Sensitive Information Through Data Queries vulnerability i ...)
+ TODO: check
+CVE-2026-118543 (Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Cor ...)
+ TODO: check
+CVE-2026-118542 (Incorrect Authorization vulnerability in Drupal Commerce Core allows F ...)
+ TODO: check
+CVE-2026-118541 (Incorrect Authorization vulnerability in Drupal Commerce Core allows F ...)
+ TODO: check
+CVE-2026-118540 (Incorrect Authorization vulnerability in Drupal Commerce Core allows F ...)
+ TODO: check
+CVE-2026-118539 (Missing Authorization vulnerability in Drupal Commerce Core allows For ...)
+ TODO: check
+CVE-2026-118500 (The Cool FormKit Lite \u2013 Advanced Form Builder for Elementor plugi ...)
+ TODO: check
+CVE-2026-118475 (A flaw was found in Eye of GNOME. When parsing a specially crafted PNG ...)
+ TODO: check
+CVE-2026-118194 (The Page and Post Restriction plugin for WordPress is vulnerable to Au ...)
+ TODO: check
+CVE-2026-118165 (The Firelight Lightbox WordPress plugin before 2.3.23 does not escape ...)
+ TODO: check
+CVE-2026-118101 (The BuddyForms WordPress plugin before 2.10.1 does not verify that a u ...)
+ TODO: check
+CVE-2026-118100 (The BuddyForms WordPress plugin before 2.10.3 does not check that the ...)
+ TODO: check
+CVE-2026-118072 (The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2 ...)
+ TODO: check
+CVE-2026-118071 (The Joinchat WordPress plugin before 6.4.2 does not escape the messag ...)
+ TODO: check
+CVE-2026-117572 (The WP Visitor Statistics (Real Time Traffic) WordPress plugin before ...)
+ TODO: check
+CVE-2026-117571 (The WP Visitor Statistics (Real Time Traffic) WordPress plugin before ...)
+ TODO: check
+CVE-2026-116622 (The Food Store \u2013 Online Food Delivery & Pickup plugin for WordPre ...)
+ TODO: check
+CVE-2026-115277 (The User Frontend WordPress plugin before 4.3.14 does not sanitise an ...)
+ TODO: check
+CVE-2026-114573 (Improperly Controlled Modification of Dynamically-Determined Object At ...)
+ TODO: check
+CVE-2026-114572 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
+ TODO: check
+CVE-2026-114571 (Incorrect Authorization vulnerability in Drupal Rabbit Hole allows For ...)
+ TODO: check
+CVE-2026-114555 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-114554 (Incorrect Authorization vulnerability in Drupal AI File to Text allows ...)
+ TODO: check
+CVE-2026-114553 (Incorrect Authorization vulnerability in Drupal Frontend Editing allow ...)
+ TODO: check
+CVE-2026-114548 (Use of Web Browser Cache Containing Sensitive Information vulnerabilit ...)
+ TODO: check
+CVE-2026-114547 (Missing Authorization vulnerability in Drupal TinyPNG allows Forceful ...)
+ TODO: check
+CVE-2026-114546 (Use of Web Browser Cache Containing Sensitive Information vulnerabilit ...)
+ TODO: check
+CVE-2026-114545 (Incorrect Authorization vulnerability in Drupal Fullcalendar View allo ...)
+ TODO: check
+CVE-2026-114544 (Incorrect Authorization vulnerability in Drupal Media Bulk Upload allo ...)
+ TODO: check
+CVE-2026-114543 (Incorrect Authorization vulnerability in Drupal Simple User Management ...)
+ TODO: check
+CVE-2026-114542 (Use of Web Browser Cache Containing Sensitive Information vulnerabilit ...)
+ TODO: check
+CVE-2026-114541 (Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Edi ...)
+ TODO: check
+CVE-2026-114540 (Incorrect Authorization vulnerability in Drupal Domain allows Forceful ...)
+ TODO: check
+CVE-2026-114539 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
+ TODO: check
+CVE-2026-114538 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-114537 (Incorrect Authorization vulnerability in Drupal View Unpublished allow ...)
+ TODO: check
+CVE-2026-114536 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-114535 (Missing Authorization vulnerability in Drupal Swiper formatter allows ...)
+ TODO: check
+CVE-2026-114534 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-114533 (Missing Authorization vulnerability in Drupal \xc1gora Transparency Th ...)
+ TODO: check
+CVE-2026-114532 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-114531 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-114530 (Incorrect Authorization vulnerability in Drupal Dopup allows Forceful ...)
+ TODO: check
+CVE-2026-114529 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-114528 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-114527 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-114526 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-114525 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-114524 (Privilege Defined With Unsafe Actions vulnerability in Drupal Custom F ...)
+ TODO: check
+CVE-2026-114523 (Improper Neutralization of Special Elements used in an OS Command ("OS ...)
+ TODO: check
+CVE-2026-114444 (The Security Plugin, Firewall & Malware Scanner with Auto Removal Word ...)
+ TODO: check
+CVE-2026-114443 (The Security Plugin, Firewall & Malware Scanner with Auto Removal Word ...)
+ TODO: check
+CVE-2026-114422 (The Enable Media Replace WordPress plugin before 4.2.3 does not restri ...)
+ TODO: check
+CVE-2026-112922 (A flaw was found in Ghostscript. A remote attacker could exploit this ...)
+ TODO: check
+CVE-2026-112605 (This issue was addressed with improved handling of symlinks. This issu ...)
+ TODO: check
+CVE-2026-112602 (An authorization issue was addressed with improved state management. T ...)
+ TODO: check
+CVE-2026-112211
+ REJECTED
+CVE-2026-110738 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-110732 (The AI Engine \u2013 The Chatbot, AI Framework & MCP for WordPress plu ...)
+ TODO: check
+CVE-2026-110133 (A flaw was found in Ghostscript. When processing a specially crafted T ...)
+ TODO: check
+CVE-2026-108515 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-108514 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-108099 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe ...)
+ TODO: check
+CVE-2026-108097 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe ...)
+ TODO: check
+CVE-2026-107312 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2026-107311 (Improper Check for Unusual or Exceptional Conditions vulnerability in ...)
+ TODO: check
+CVE-2026-107310 (Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking ...)
+ TODO: check
+CVE-2026-107309 (Missing Authorization vulnerability in Drupal Easy Breadcrumb allows F ...)
+ TODO: check
+CVE-2026-107308 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-107307 (Incorrect Authorization vulnerability in Drupal SmartLinker AI allows ...)
+ TODO: check
+CVE-2026-107306 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-107268 (Insertion of Sensitive Information Into Sent Data vulnerability in Dru ...)
+ TODO: check
+CVE-2026-107267 (Missing Authorization vulnerability in Drupal DKAN allows Forceful Bro ...)
+ TODO: check
+CVE-2026-107266 (Missing Authorization vulnerability in Drupal Views Share allows Force ...)
+ TODO: check
+CVE-2026-107265 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-107264 (Improper Neutralization of Special Elements Used in a Template Engine ...)
+ TODO: check
+CVE-2026-107263 (Incorrect Authorization vulnerability in Drupal Gutenberg allows Force ...)
+ TODO: check
+CVE-2026-107262 (Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Fil ...)
+ TODO: check
+CVE-2026-107261 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
+ TODO: check
+CVE-2026-107260 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-107259 (Improper Neutralization of Special Elements Used in a Template Engine ...)
+ TODO: check
+CVE-2026-107258 (Incorrect Authorization vulnerability in Drupal Inline Entity Form Dia ...)
+ TODO: check
+CVE-2026-107257 (Incorrect Authorization vulnerability in Drupal Actstream allows Force ...)
+ TODO: check
+CVE-2026-107256 (Improper Restriction of Excessive Authentication Attempts vulnerabilit ...)
+ TODO: check
+CVE-2026-107255 (Incorrect Authorization vulnerability in Drupal Restrict route by IP a ...)
+ TODO: check
+CVE-2026-107254 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
+ TODO: check
+CVE-2026-107253 (Vulnerability in Drupal Orphans Media. This issue affects Orphans Medi ...)
+ TODO: check
+CVE-2026-107252 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-107251 (Incorrect Authorization vulnerability in Drupal Entity Reference Manag ...)
+ TODO: check
+CVE-2026-107250 (Vulnerability in Drupal ECA Helper. This issue affects ECA Helper vers ...)
+ TODO: check
+CVE-2026-107249 (Improperly Controlled Modification of Dynamically-Determined Object At ...)
+ TODO: check
+CVE-2026-107239 (A vulnerability allowing a member of the Veeam Virtualization Extensio ...)
+ TODO: check
+CVE-2026-107238 (A vulnerability allowing an authenticated domain user to perform remot ...)
+ TODO: check
+CVE-2026-104368 (The Export and Import Users and Customers plugin for WordPress is vuln ...)
+ TODO: check
+CVE-2026-103963 (A flaw was found in glib-networking. When establishing connections usi ...)
+ TODO: check
+CVE-2026-103039 (The Gravity Forms plugin for WordPress is vulnerable to PHP Object Inj ...)
+ TODO: check
+CVE-2026-115943 (Spreadsheet::XLSX versions before 0.19 for Perl allow code execution v ...)
- libspreadsheet-xlsx-perl <unfixed> (bug #1152516)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44746764/
CVE-2026-XXXX [GHSA-5pgx-q9xx-j3qv]
@@ -8534,42 +8982,42 @@ CVE-2025-30045 (CGM CLININET is vulnerable to Code Injection in the ConvExpr fun
NOT-FOR-US: CGM CLININET
CVE-2025-30043 (CGM CLININET is vulnerable to Missing Authentication for Critical Func ...)
NOT-FOR-US: CGM CLININET
-CVE-2026-119139 [RUSTSEC-2026-0353]
+CVE-2026-119139 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a left ...)
- rust-wasmtime <not-affected> (Only affects 46 and later)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0353.html
NOTE: https://github.com/advisories/GHSA-m6w2-jwq2-cv2c
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14737
-CVE-2026-119142 [RUSTSEC-2026-0354]
+CVE-2026-119142 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a deni ...)
- rust-wasmtime <not-affected> (Only affects 46 and later)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0354.html
NOTE: https://github.com/advisories/GHSA-3r89-v5mq-j5xf
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14741
-CVE-2026-119135 [RUSTSEC-2026-0355]
+CVE-2026-119135 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the ...)
- rust-wasmtime <not-affected> (Only affects 46 and later)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0355.html
NOTE: https://github.com/advisories/GHSA-63h4-6cx9-pjfj
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14733
-CVE-2026-119141 [RUSTSEC-2026-0356]
+CVE-2026-119141 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a deni ...)
- rust-wasmtime <not-affected> (Only affects 46 and later)
NOTE: https://github.com/advisories/GHSA-7v24-42x9-pxf7
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0356.html
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14739
-CVE-2026-119143 [RUSTSEC-2026-0357]
+CVE-2026-119143 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a deni ...)
- rust-wasmtime <not-affected> (Only affects 46 and later)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0357.html
NOTE: https://github.com/advisories/GHSA-93g3-36p8-x2gc
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14740
-CVE-2026-119137 [RUSTSEC-2026-0359]
+CVE-2026-119137 (Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stac ...)
- rust-wasmtime <not-affected> (Only affects 42 and later)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0359.html
NOTE: https://github.com/advisories/GHSA-wjc8-633q-pwxr
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14735
-CVE-2026-119132 [RUSTSEC-2026-0360]
+CVE-2026-119132 (Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulner ...)
- rust-wasmtime <not-affected> (Only affects 49 and later)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0360.html
NOTE: https://github.com/advisories/GHSA-54p9-vhhq-8f7q
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14730
-CVE-2026-119134 [RUSTSEC-2026-0363]
+CVE-2026-119134 (Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0. ...)
- rust-wasmtime <unfixed> (bug #1151861)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0363.html
NOTE: https://github.com/advisories/GHSA-q554-3cjc-rx7p
@@ -37161,6 +37609,7 @@ CVE-2026-67270 (Dell Container Storage Modules (CSM) versions prior to 1.18.0, c
CVE-2026-67269 (Dell Container Storage Modules (CSM) Operator, versions prior to 1.18. ...)
NOT-FOR-US: Dell / EMC
CVE-2026-66666 (Insertion of Sensitive Information Into Sent Data vulnerability in Aut ...)
+ {DSA-6596-1}
- wordpress 7.1.3+dfsg1-1 (bug #1150336)
NOTE: https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/
CVE-2026-66588
@@ -83430,7 +83879,7 @@ CVE-2026-84809 (Tencent AI-Infra-Guard's skill-scan component excludes compiled
NOT-FOR-US: Tencent AI-Infra-Guard
CVE-2026-84808 (Kimai versions before 2.65.0 contain an authorization bypass vulnerabi ...)
NOT-FOR-US: Kimai
-CVE-2026-84807 (Kimai (kimai/kimai) through 2.65.0 contains a business logic / imprope ...)
+CVE-2026-84807 (Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper ...)
NOT-FOR-US: Kimai
CVE-2026-84806 (Kimai before 2.63.0 contains an improper authorization vulnerability i ...)
NOT-FOR-US: Kimai
@@ -101435,7 +101884,7 @@ CVE-2026-75915 (CodeWhale versions before 0.8.64 contain an environment variable
NOT-FOR-US: CodeWhale
CVE-2026-75914 (CodeWhale versions before 0.8.64 contain a path traversal vulnerabilit ...)
NOT-FOR-US: CodeWhale
-CVE-2026-75913 (CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 ...)
+CVE-2026-75913 (CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui > ...)
NOT-FOR-US: CodeWhale
CVE-2026-75912 (CodeWhale versions before 0.8.64 contain an argument injection vulnera ...)
NOT-FOR-US: CodeWhale
@@ -101466,7 +101915,7 @@ CVE-2026-75859 (CodeWhale versions before 0.8.64 fail to validate file paths in
NOT-FOR-US: CodeWhale
CVE-2026-75858 (CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and ...)
NOT-FOR-US: CodeWhale
-CVE-2026-75857 (CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in t ...)
+CVE-2026-75857 (CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui > ...)
NOT-FOR-US: CodeWhale
CVE-2026-75856 (CodeWhale before 0.8.64 contains a server-side request forgery bypass ...)
NOT-FOR-US: CodeWhale
@@ -130919,7 +131368,7 @@ CVE-2026-65904 (DOMPurify through 3.3.3 fails to sanitize DOM elements passed vi
CVE-2026-65903 (DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function ...)
- node-dompurify 3.4.1+dfsg-1
NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cp
-CVE-2026-65902 (DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct refe ...)
+CVE-2026-65902 (DOMPurify before 3.4.7 passes direct references to the module-level DE ...)
- node-dompurify 3.4.12+dfsg-1
NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm
NOTE: Fixed by: https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36
@@ -138987,7 +139436,7 @@ CVE-2024-58365 (SurrealDB versions before 1.2.0 contain an uncaught exception vu
NOT-FOR-US: SurrealDB
CVE-2024-58364 (SurrealDB versions before 1.2.1 contain an uncaught exception handling ...)
NOT-FOR-US: SurrealDB
-CVE-2024-58363 (SurrealDB before 1.5.4 fails to properly validate authentication when ...)
+CVE-2024-58363 (SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to ...)
NOT-FOR-US: SurrealDB
CVE-2024-58362 (SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an ...)
NOT-FOR-US: SurrealDB
@@ -140800,7 +141249,7 @@ CVE-2026-59236 (Authorization Bypass Through User-Controlled Key (CWE-639) in th
NOT-FOR-US: prospero-flow-crm
CVE-2026-59235 (Missing Authorization (CWE-862) in BankAccountListController (app/Http ...)
NOT-FOR-US: prospero-flow-crm
-CVE-2026-58660 (Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController ...)
+CVE-2026-58660 (Kanboard before 1.2.53, fixed in commit 564cc30, BoardAjaxController s ...)
- kanboard <unfixed> (bug #1142272)
NOTE: https://github.com/kanboard/kanboard/issues/5852
NOTE: https://github.com/kanboard/kanboard/pull/5853
@@ -141139,7 +141588,7 @@ CVE-2026-62655 (A security flaw was found in certain NETGEAR Orbi models that co
NOT-FOR-US: Netgear
CVE-2026-62422 (In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.14804 ...)
NOT-FOR-US: JetBrains
-CVE-2026-61520 (Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to com ...)
+CVE-2026-61520 (Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and ...)
NOT-FOR-US: Simple Machines Forum
CVE-2026-60119 (Hi.Events before 1.11.0 contains a cross-site scripting vulnerability ...)
NOT-FOR-US: Hi.Events
@@ -151298,7 +151747,7 @@ CVE-2026-10129 (IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Requ
NOT-FOR-US: IBM
CVE-2026-10109 (IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable ...)
NOT-FOR-US: IBM
-CVE-2025-71381 (Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middl ...)
+CVE-2025-71381 (Hono before 4.10.3 contains a flaw in its CORS middleware: when the or ...)
NOT-FOR-US: Hono
CVE-2025-71374 (picklescan before 0.0.29 fails to detect the built-in python profile.P ...)
NOT-FOR-US: picklescan
@@ -155745,7 +156194,7 @@ CVE-2025-71336 (Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlie
NOT-FOR-US: Flowise
CVE-2025-71335 (Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to i ...)
NOT-FOR-US: Flowise
-CVE-2025-71334 (Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an ...)
+CVE-2025-71334 (Flowise before 3.0.6 contains an arbitrary file access vulnerability d ...)
NOT-FOR-US: Flowise
CVE-2025-71333 (Flowise through 2.2.4 contains an unauthenticated arbitrary file uploa ...)
NOT-FOR-US: Flowise
@@ -167410,7 +167859,7 @@ CVE-2026-11824 (SQLite before 3.53.2 contains a heap-based buffer overflow vulne
[bullseye] - sqlite3 <postponed> (Minor issue)
NOTE: https://sqlite.org/src/info/061febcf41ca
NOTE: https://sqlite.org/src/info/4a5ad516ea93
-CVE-2026-11822 (SQLite before 3.53.2 contains memory corruption vulnerabilities in the ...)
+CVE-2026-11822 (SQLite before 3.53.2 contains an out-of-bounds read vulnerability in t ...)
- sqlite3 3.53.2-1 (bug #1139960)
[trixie] - sqlite3 3.46.1-7+deb13u2
[bookworm] - sqlite3 <postponed> (Minor issue)
@@ -181554,7 +182003,7 @@ CVE-2026-42347
REJECTED
CVE-2026-41917 (OpenKM 6.3.12 contains a local file inclusion vulnerability in the adm ...)
NOT-FOR-US: OpenKM
-CVE-2026-41401 (libyang before 5.2.6 contains a heap use-after-free write vulnerabilit ...)
+CVE-2026-41401 (libyang before 5.4.3 contains a heap use-after-free write vulnerabilit ...)
- libyang 6.4.13-1 (bug #1149179)
[trixie] - libyang <no-dsa> (Minor issue)
[bullseye] - libyang <no-dsa> (Minor issue)
@@ -198126,7 +198575,7 @@ CVE-2018-25310 (VideoFlow Digital Video Protection DVP 2.10 contains an authenti
NOT-FOR-US: VideoFlow Digital Video Protection
CVE-2018-25309 (MyBB Recent threads 17.0 contains a persistent cross-site scripting vu ...)
NOT-FOR-US: MyBB
-CVE-2018-25308 (BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code ex ...)
+CVE-2018-25308 (BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary fil ...)
NOT-FOR-US: BuddyPress Xprofile Custom Fields Type
CVE-2018-25307 (SysGauge Pro 4.6.12 contains a local buffer overflow vulnerability in ...)
NOT-FOR-US: SysGauge
@@ -203469,7 +203918,7 @@ CVE-2026-6553 (Changing backend users' passwords via the user settings module re
NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-6550 (Cryptographic algorithm downgrade in the caching layer of Amazon AWS E ...)
NOT-FOR-US: Amazon
-CVE-2026-6257 (Vvveb CMS v1.0.8.2 contains a remote code execution vulnerability in i ...)
+CVE-2026-6257 (Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerabilit ...)
NOT-FOR-US: Vvveb CMS
CVE-2026-6249 (Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in it ...)
NOT-FOR-US: Vvveb CMS
@@ -208504,7 +208953,7 @@ CVE-2026-35634 (OpenClaw before 2026.3.23 contains an authentication bypass vuln
NOT-FOR-US: OpenClaw
CVE-2026-35633 (OpenClaw before 2026.3.22 contains an unbounded memory allocation vuln ...)
NOT-FOR-US: OpenClaw
-CVE-2026-35632 (OpenClaw through 2026.2.22 contains a symlink traversal vulnerability ...)
+CVE-2026-35632 (OpenClaw before 2026.3.24 contains a symlink traversal vulnerability i ...)
NOT-FOR-US: OpenClaw
CVE-2026-35631 (OpenClaw before 2026.3.22 fails to enforce operator.admin scope on mut ...)
NOT-FOR-US: OpenClaw
@@ -209461,7 +209910,7 @@ CVE-2026-4073 (The pdfl.io plugin for WordPress is vulnerable to Stored Cross-Si
NOT-FOR-US: WordPress plugin
CVE-2026-4025 (The PrivateContent Free plugin for WordPress is vulnerable to Stored C ...)
NOT-FOR-US: WordPress plugin
-CVE-2026-40037 (OpenClaw before 2026.3.31 (patched in 2026.4.8) contains a request bod ...)
+CVE-2026-40037 (OpenClaw before 2026.4.8 contains a request body replay vulnerability ...)
NOT-FOR-US: OpenClaw
CVE-2026-40036 (Unfurl before2026.04 contains an unbounded zlib decompression vulnerab ...)
NOT-FOR-US: Unfurl
@@ -251975,7 +252424,7 @@ CVE-2026-22187 (Bio-Formats versions up to and including 8.3.0 perform unsafe Ja
NOT-FOR-US: Bio-Formats
CVE-2026-22186 (Bio-Formats versions up to and including 8.3.0 contain an XML External ...)
NOT-FOR-US: Bio-Formats
-CVE-2026-22185 (OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and in ...)
+CVE-2026-22185 (OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 befor ...)
- openldap <unfixed> (unimportant)
- lmdb <unfixed> (bug #1126287)
[trixie] - lmdb <no-dsa> (Minor issue)
@@ -259877,7 +260326,7 @@ CVE-2023-5093
REJECTED
CVE-2023-5092
REJECTED
-CVE-2023-53982 (PMB 7.4.6 contains a SQL injection vulnerability in the storage parame ...)
+CVE-2023-53982 (PMB 7.4.6 contains a SQL injection vulnerability in the id parameter o ...)
NOT-FOR-US: PMB
CVE-2023-52210 (Vulnerability in Tyche softwares Product Delivery Date for WooCommerce ...)
NOT-FOR-US: WordPress plugin or theme
@@ -259983,7 +260432,7 @@ CVE-2025-65856 (Authentication bypass vulnerability in Xiongmai XM530 IP cameras
NOT-FOR-US: Xiongmai
CVE-2025-65817 (LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability ...)
NOT-FOR-US: LSC Smart Connect Indoor IP Camera
-CVE-2025-34458 (wb2osz/direwolf (Dire Wolf) versions up to and including 1.8, prior to ...)
+CVE-2025-34458 (wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior ...)
- direwolf 1.8.1+dfsg-2 (bug #1123925; unimportant)
[trixie] - direwolf <not-affected> (Vulnerable code introduced later)
[bookworm] - direwolf <not-affected> (Vulnerable code introduced later)
@@ -259992,7 +260441,7 @@ CVE-2025-34458 (wb2osz/direwolf (Dire Wolf) versions up to and including 1.8, pr
NOTE: Introduced with: https://github.com/wb2osz/direwolf/commit/46f31d4453ed133c99db71a514deacebae19f877 (1.8-beta1)
NOTE: Fixed by: https://github.com/wb2osz/direwolf/commit/3658a878920803bbb69a4567579dcc4d6cb80a92 (dev)
NOTE: Crash in CLI tool, no security impact
-CVE-2025-34457 (wb2osz/direwolf (Dire Wolf) versions up to and including 1.8, prior to ...)
+CVE-2025-34457 (wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior ...)
- direwolf 1.8.1+dfsg-2 (bug #1123925)
[trixie] - direwolf 1.7+dfsg-2+deb13u1
[bookworm] - direwolf <no-dsa> (Minor issue)
@@ -260972,7 +261421,7 @@ CVE-2023-53939 (TinyWebGallery v2.5 contains a stored cross-site scripting vulne
NOT-FOR-US: TinyWebGallery
CVE-2023-53938 (RockMongo 1.1.7 contains a stored cross-site scripting vulnerability t ...)
NOT-FOR-US: RockMongo
-CVE-2023-53937 (Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability th ...)
+CVE-2023-53937 (Hubstaff 1.6.13 and 1.6.14 contain a DLL search order hijacking vulner ...)
NOT-FOR-US: Hubstaff
CVE-2023-53936 (Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerab ...)
NOT-FOR-US: Cameleon CMS
@@ -261695,7 +262144,7 @@ CVE-2023-53909 (WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerabil
NOT-FOR-US: WBCE CMS
CVE-2023-53908 (HiSecOS 04.0.01 contains a privilege escalation vulnerability that all ...)
NOT-FOR-US: HiSecOS
-CVE-2023-53907 (Bludit versions before 3.13.1 contain an authenticated file download v ...)
+CVE-2023-53907 (Bludit versions before 3.13.0 contain an authenticated file download v ...)
NOT-FOR-US: Bludit CMS
CVE-2023-53906 (projectSend r1605 contains a stored cross-site scripting vulnerability ...)
NOT-FOR-US: projectSend
@@ -264576,13 +265025,13 @@ CVE-2024-58302 (FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerabil
NOT-FOR-US: FoF Pretty Mail
CVE-2024-58301 (Purei CMS 1.0 contains a time-based blind SQL injection vulnerability ...)
NOT-FOR-US: Purei CMS
-CVE-2024-58300 (Siklu MultiHaul TG series devices before version 2.0.0 contain an unau ...)
+CVE-2024-58300 (Siklu MultiHaul TG series devices through version 2.0.0 contain an una ...)
NOT-FOR-US: Siklu MultiHaul TG series devices
CVE-2024-58298 (Compuware iStrobe Web 20.13 contains a pre-authentication remote code ...)
NOT-FOR-US: Compuware iStrobe Web
CVE-2024-58297 (PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in ...)
NOT-FOR-US: PyroCMS
-CVE-2024-58296 (CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability ...)
+CVE-2024-58296 (CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerabil ...)
NOT-FOR-US: CE Phoenix
CVE-2024-58295 (ElkArte Forum 1.1.9 contains a remote code execution vulnerability tha ...)
NOT-FOR-US: ElkArte Forum
@@ -481279,7 +481728,7 @@ CVE-2024-22051 (CommonMarker versions prior to 0.23.4 are at risk of an integer
NOTE: https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3 (v0.23.4)
NOTE: This is a specific CVE assignment for the issue covered in CVE-2022-24724
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2256887
-CVE-2024-22047 (A race condition exists in Audited 4.0.0 to 5.3.3 that can result in a ...)
+CVE-2024-22047 (A race condition exists in Audited 4.0.0 before 5.3.3 that can result ...)
NOT-FOR-US: audited ruby gem
CVE-2024-21625 (SideQuest is a place to get virtual reality applications for Oculus Qu ...)
NOT-FOR-US: SideQuest
@@ -543987,8 +544436,8 @@ CVE-2023-22794 (A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1
[buster] - rails <not-affected> (Only affects 6.x and later)
NOTE: https://discuss.rubyonrails.org/t/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments/82117
NOTE: https://github.com/rails/rails/commit/048e9fc05e18c91838a44e60175e475de8b2aad5 (6-1-stable)
-CVE-2023-22793
- RESERVED
+CVE-2023-22793 (A vulnerability allowing an unauthenticated attacker to perform remote ...)
+ TODO: check
CVE-2023-22792 (A regular expression based DoS vulnerability in Action Dispatch <6.0.6 ...)
{DSA-5372-1}
- rails 2:6.1.7.3+dfsg-1 (bug #1030050)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c9bff0d2dd967f87eba59c7cb91d86d30db73088
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c9bff0d2dd967f87eba59c7cb91d86d30db73088
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261030/2c1bc2f9/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list