[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 30 19:15:16 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
812babbb by security tracker role at 2026-10-30T19:15:09+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,777 @@
+CVE-2026-9239 (The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Si ...)
+ TODO: check
+CVE-2026-97638 (The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form B ...)
+ TODO: check
+CVE-2026-97209 (Insecure Temporary File vulnerability in Mix deps.partition in Elixir ...)
+ TODO: check
+CVE-2026-96894 (The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plu ...)
+ TODO: check
+CVE-2026-94175 (Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4. ...)
+ TODO: check
+CVE-2026-93327 (A Deserialization of Untrusted Data vulnerability in the SubWorkflow t ...)
+ TODO: check
+CVE-2026-91917 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
+ TODO: check
+CVE-2026-91915 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
+ TODO: check
+CVE-2026-91914 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authe ...)
+ TODO: check
+CVE-2026-91913 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
+ TODO: check
+CVE-2026-91912 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use o ...)
+ TODO: check
+CVE-2026-90888 (Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.)
+ TODO: check
+CVE-2026-87768 (DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via ...)
+ TODO: check
+CVE-2026-86715 (Plaintext storage of a password vulnerability in Crypttech Crypto and ...)
+ TODO: check
+CVE-2026-85268 (A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handle ...)
+ TODO: check
+CVE-2026-84243 (The gettext family of functions in the GNU C Library version 2.0 and l ...)
+ TODO: check
+CVE-2026-82104 (In Teltonika Networks RUTOS devices running versions from 7.22 through ...)
+ TODO: check
+CVE-2026-7004 (WIT SynApps Runtime through 1.4.11 contains a pre-authentication refle ...)
+ TODO: check
+CVE-2026-7003 (WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vu ...)
+ TODO: check
+CVE-2026-78527 (Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 ve ...)
+ TODO: check
+CVE-2026-76012 (The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery ...)
+ TODO: check
+CVE-2026-75882 (An improper access control vulnerability in ESET Endpoint Encryption a ...)
+ TODO: check
+CVE-2026-73322 (Incorrect Authorization vulnerability in the single-stage query engine ...)
+ TODO: check
+CVE-2026-73186 (Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versi ...)
+ TODO: check
+CVE-2026-69446 (Incorrect authorization in Microsoft Edge (Chromium-based) allows an a ...)
+ TODO: check
+CVE-2026-66026
+ REJECTED
+CVE-2026-66025
+ REJECTED
+CVE-2026-65874 (This issue affects Apache Fineract versions up to and including 1.15.0 ...)
+ TODO: check
+CVE-2026-65566 (Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ...)
+ TODO: check
+CVE-2026-65444 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-64860
+ REJECTED
+CVE-2026-64618 (Improper Neutralization of Special Elements used in an SQL Command ("S ...)
+ TODO: check
+CVE-2026-62303 (Pistache is a high-performance REST toolkit written in C++. From 0.0.5 ...)
+ TODO: check
+CVE-2026-62298 (mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` dec ...)
+ TODO: check
+CVE-2026-62264 (PDF Reader MCP is a Model Context Protocol server for reading PDF docu ...)
+ TODO: check
+CVE-2026-62162 (Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, ...)
+ TODO: check
+CVE-2026-62160 (Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the globa ...)
+ TODO: check
+CVE-2026-62141 (Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM f ...)
+ TODO: check
+CVE-2026-62122 (Missing Authorization vulnerability in Arraytics Booktics booktics all ...)
+ TODO: check
+CVE-2026-62121 (Improper Control of Filename for Include/Require Statement in PHP Prog ...)
+ TODO: check
+CVE-2026-62057 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
+ TODO: check
+CVE-2026-62056 (Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM f ...)
+ TODO: check
+CVE-2026-62055 (Missing Authorization vulnerability in Liquid Web / StellarWP Event Ti ...)
+ TODO: check
+CVE-2026-62047 (Missing Authorization vulnerability in Liquid Web / StellarWP Event Ti ...)
+ TODO: check
+CVE-2026-62023 (Missing Authorization vulnerability in Unlimited Elements Unlimited El ...)
+ TODO: check
+CVE-2026-62019 (Missing Authorization vulnerability in Liquid Web / StellarWP BookIt b ...)
+ TODO: check
+CVE-2026-61854 (VoiceSentinel is a real-time voice moderation system for Minecraft ser ...)
+ TODO: check
+CVE-2026-61848 (Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax ...)
+ TODO: check
+CVE-2026-61847 (Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax ...)
+ TODO: check
+CVE-2026-61846 (Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax ...)
+ TODO: check
+CVE-2026-61845 (Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax ...)
+ TODO: check
+CVE-2026-61840 (Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to ...)
+ TODO: check
+CVE-2026-61826 (Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7 ...)
+ TODO: check
+CVE-2026-61806 (Frappe Learning Management System (LMS) is a learning system that help ...)
+ TODO: check
+CVE-2026-61805 (Frappe Learning Management System (LMS) is a learning system that help ...)
+ TODO: check
+CVE-2026-61804 (myTinyWMS is a free, open-source warehouse management system. Prior to ...)
+ TODO: check
+CVE-2026-61803 (Frappe Learning Management System (LMS) is a learning system that help ...)
+ TODO: check
+CVE-2026-61789 (DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle ...)
+ TODO: check
+CVE-2026-61739 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
+ TODO: check
+CVE-2026-61738 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
+ TODO: check
+CVE-2026-61737 (ng-antd-admin is an Angular and NestJS administration system template. ...)
+ TODO: check
+CVE-2026-61730 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
+ TODO: check
+CVE-2026-61729 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
+ TODO: check
+CVE-2026-61728 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
+ TODO: check
+CVE-2026-61708 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
+ TODO: check
+CVE-2026-61586 (Copernik XML Factory provides secure-by-default JAXP factory creation ...)
+ TODO: check
+CVE-2026-59978 (AdminNeo is a full-featured database management tool written in PHP. F ...)
+ TODO: check
+CVE-2026-59396 (A denial-of-service vulnerability exists in UAA's private_key_jwt clie ...)
+ TODO: check
+CVE-2026-59388 (Cloud Controller (CAPI) leaks sensitive data into audit logs in multip ...)
+ TODO: check
+CVE-2026-59387 (The Nginx routing configuration for Cloud Controller blocks unauthenti ...)
+ TODO: check
+CVE-2026-59386 (A SpaceSupporter could improperly modify an application's start comman ...)
+ TODO: check
+CVE-2026-59385 (A user with SpaceDeveloper privileges could modify the URL of a space- ...)
+ TODO: check
+CVE-2026-55551 (ZAC is an open-source, workflow-based Common Ground component for Dutc ...)
+ TODO: check
+CVE-2026-54855 (Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 ...)
+ TODO: check
+CVE-2026-54854 (Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.)
+ TODO: check
+CVE-2026-54850 (Subscriber Broken Access Control in Booking and Rental Manager <= 2.8. ...)
+ TODO: check
+CVE-2026-52710 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
+ TODO: check
+CVE-2026-50000 (SecureDrop is an open-source whistleblower submission system that medi ...)
+ TODO: check
+CVE-2026-49116
+ REJECTED
+CVE-2026-49115
+ REJECTED
+CVE-2026-48201 (Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= ...)
+ TODO: check
+CVE-2026-48164 (Collabora Online is a collaborative online office suite based on Libre ...)
+ TODO: check
+CVE-2026-46560 (Open Access Management (OpenAM) is an access management solution. Prio ...)
+ TODO: check
+CVE-2026-46499 (Collabora Online is a collaborative online office suite based on Libre ...)
+ TODO: check
+CVE-2026-45145 (Chamilo LMS is an open-source learning management system. Prior to 2.0 ...)
+ TODO: check
+CVE-2026-45144 (Chamilo LMS is an open-source learning management system. From 2.0.0 u ...)
+ TODO: check
+CVE-2026-45141 (Chamilo LMS is an open-source learning management system. Prior to 2.0 ...)
+ TODO: check
+CVE-2026-44344 (Chamilo LMS is an open-source learning management system. In the 1.x l ...)
+ TODO: check
+CVE-2026-39786 (Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1. ...)
+ TODO: check
+CVE-2026-39739 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-39738 (Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6 ...)
+ TODO: check
+CVE-2026-39734 (Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.)
+ TODO: check
+CVE-2026-39732 (Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.)
+ TODO: check
+CVE-2026-39375 (Frappe Learning Management System (LMS) is a learning system that help ...)
+ TODO: check
+CVE-2026-37468 (Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11 ...)
+ TODO: check
+CVE-2026-28160 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 ver ...)
+ TODO: check
+CVE-2026-27061 (Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 ve ...)
+ TODO: check
+CVE-2026-22114 (HTTP basic auth enforces no retry limit or backoff. Combined with the ...)
+ TODO: check
+CVE-2026-22110 (The web server does not check authentication on POST or PUT. An unauth ...)
+ TODO: check
+CVE-2026-22109 (The shipped WebUI template database retains the factory default passwo ...)
+ TODO: check
+CVE-2026-22105 (Delta UFC500 charging stations derive the default credentials of the S ...)
+ TODO: check
+CVE-2026-14467 (An information disclosure vulnerability in the Forocoches comments edi ...)
+ TODO: check
+CVE-2026-13747 (The Meow Gallery plugin for WordPress is vulnerable to authorization b ...)
+ TODO: check
+CVE-2026-13576 (CallBackery versions before 0.62.0 for Perl store user passwords as un ...)
+ TODO: check
+CVE-2026-120046 (Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerabi ...)
+ TODO: check
+CVE-2026-120007 (NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerab ...)
+ TODO: check
+CVE-2026-119979 (LM Studio before 0.4.22+1 contains a path traversal vulnerability in t ...)
+ TODO: check
+CVE-2026-119978 (Flowise through 3.1.4 contains a sandbox escape vulnerability that all ...)
+ TODO: check
+CVE-2026-119842 (A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle par ...)
+ TODO: check
+CVE-2026-119777 (A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When ...)
+ TODO: check
+CVE-2026-119764 (Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting ...)
+ TODO: check
+CVE-2026-119763 (changelog.com before commit 7b35e829 contains a missing authorization ...)
+ TODO: check
+CVE-2026-119762 (Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x b ...)
+ TODO: check
+CVE-2026-119761 (Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored ...)
+ TODO: check
+CVE-2026-119760 (sniproxy through 0.7.0 contains a NULL pointer dereference vulnerabili ...)
+ TODO: check
+CVE-2026-119729 (A flaw was found in GStreamer. An integer overflow vulnerability in th ...)
+ TODO: check
+CVE-2026-119728 (A flaw was found in the H.264 video parser in gst-plugins-bad. When pr ...)
+ TODO: check
+CVE-2026-119727 (A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. Wh ...)
+ TODO: check
+CVE-2026-119722 (Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-boun ...)
+ TODO: check
+CVE-2026-119721 (Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds r ...)
+ TODO: check
+CVE-2026-119720 (Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-boun ...)
+ TODO: check
+CVE-2026-119719 (Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer over ...)
+ TODO: check
+CVE-2026-119718 (Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer over ...)
+ TODO: check
+CVE-2026-119717 (pybars4 through 0.9.13 contains a code injection vulnerability in pyba ...)
+ TODO: check
+CVE-2026-119716 (pybars3 through 0.9.7 contains a code injection vulnerability in pybar ...)
+ TODO: check
+CVE-2026-119715 (NocoDB before 2026.08.0 contains a clickjacking vulnerability that all ...)
+ TODO: check
+CVE-2026-119714 (My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode ...)
+ TODO: check
+CVE-2026-119713 (Paperclip 2026.403.0 before 2026.416.0 contains a remote code executio ...)
+ TODO: check
+CVE-2026-119712 (PipesHub before 0.10.0 contains a server-side request forgery vulnerab ...)
+ TODO: check
+CVE-2026-119711 (PipesHub before 0.10.0 contains a rate limit bypass vulnerability in g ...)
+ TODO: check
+CVE-2026-119710 (PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerab ...)
+ TODO: check
+CVE-2026-119709 (Grimoire before 1.0.0 contains an unauthenticated server-side request ...)
+ TODO: check
+CVE-2026-119708 (abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authoriza ...)
+ TODO: check
+CVE-2026-119707 (SonicJS through 3.0.0 contains a missing authorization vulnerability i ...)
+ TODO: check
+CVE-2026-119706 (InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated rem ...)
+ TODO: check
+CVE-2026-119705 (SerpBear before 3.1.1 contains a missing authentication vulnerability ...)
+ TODO: check
+CVE-2026-119704 (Bastille through 1.4.4 contains a symlink following vulnerability in t ...)
+ TODO: check
+CVE-2026-119703 (xiaozhi-esp32-server through 0.9.8 contains an authentication bypass v ...)
+ TODO: check
+CVE-2026-119702 (WPGraphQL before 2.24.1 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-119701 (WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability ...)
+ TODO: check
+CVE-2026-119700 (WPGraphQL before 2.24.2 contains an information disclosure vulnerabili ...)
+ TODO: check
+CVE-2026-119699 (WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource c ...)
+ TODO: check
+CVE-2026-119682 (An improper access control vulnerability exists in the multi-factor au ...)
+ TODO: check
+CVE-2026-119680 (A stored cross-site scripting (XSS) vulnerability exists in the chart ...)
+ TODO: check
+CVE-2026-119665 (WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnera ...)
+ TODO: check
+CVE-2026-119664 (Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization ...)
+ TODO: check
+CVE-2026-119663 (Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authori ...)
+ TODO: check
+CVE-2026-119662 (Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerab ...)
+ TODO: check
+CVE-2026-119661 (ShowDoc through 3.9.5 contains an authorization bypass vulnerability i ...)
+ TODO: check
+CVE-2026-119660 (MuseBot before 2.0.0 contains an authentication bypass vulnerability t ...)
+ TODO: check
+CVE-2026-119659 (Blossom through 1.17.1 contains an authorization bypass vulnerability ...)
+ TODO: check
+CVE-2026-119658 (PowerDNS-Admin through 2026.08.1 contains an authorization bypass vuln ...)
+ TODO: check
+CVE-2026-119657 (FilePress through 3.0.1 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-119656 (CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql in ...)
+ TODO: check
+CVE-2026-119655 (CoreShop through 1.5.5 contains an unauthenticated sql injection vulne ...)
+ TODO: check
+CVE-2026-119654 (DataCap through 2025.1.1 contains a missing authorization vulnerabilit ...)
+ TODO: check
+CVE-2026-119653 (Nging through 5.3.5 contains an information disclosure vulnerability t ...)
+ TODO: check
+CVE-2026-119652 (HuLa-Server through 3.0.7 contains an insecure direct object reference ...)
+ TODO: check
+CVE-2026-119651 (HuLa-Server through 3.0.7 contains an insecure direct object reference ...)
+ TODO: check
+CVE-2026-119650 (HuLa-Server through 3.0.7 contains an insecure direct object reference ...)
+ TODO: check
+CVE-2026-119649 (Orchard CMS 1.10.3 through 1.11 contains an improper authorization vul ...)
+ TODO: check
+CVE-2026-119648 (Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing auth ...)
+ TODO: check
+CVE-2026-119647 (RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerab ...)
+ TODO: check
+CVE-2026-119646 (Open Web Analytics before 1.14.1 contains an authorization vulnerabili ...)
+ TODO: check
+CVE-2026-119645 (ZenTao PMS through 22.6 contains a missing authorization vulnerability ...)
+ TODO: check
+CVE-2026-119644 (Blossom through 1.17.1 contains an authorization bypass vulnerability ...)
+ TODO: check
+CVE-2026-119620 (A vulnerability was determined in 37954679 cak-filemanagement-system u ...)
+ TODO: check
+CVE-2026-119619 (A vulnerability was found in 37954679 cak-filemanagement-system up to ...)
+ TODO: check
+CVE-2026-119602 (libmspack through 0.11alpha contains an uninitialized memory disclosur ...)
+ TODO: check
+CVE-2026-119601 (AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerabilit ...)
+ TODO: check
+CVE-2026-119600 (tcpflow through 1.6.1 contains an out-of-bounds read vulnerability tha ...)
+ TODO: check
+CVE-2026-119599 (AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerabi ...)
+ TODO: check
+CVE-2026-119598 (Miaomiaowu before 0.9.3 contains an insecure direct object reference v ...)
+ TODO: check
+CVE-2026-119597 (OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulne ...)
+ TODO: check
+CVE-2026-119596 (UNIT3D through 9.2.0 contains a missing authorization vulnerability in ...)
+ TODO: check
+CVE-2026-119591 (SQLite before 3.54.0 contains a stack exhaustion vulnerability in coun ...)
+ TODO: check
+CVE-2026-119586 (SQLite command-line shell through 3.54.1 contains a command injection ...)
+ TODO: check
+CVE-2026-119578 (MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnera ...)
+ TODO: check
+CVE-2026-119577 (ArcadeDB before 26.10.2 contains an improper authorization vulnerabili ...)
+ TODO: check
+CVE-2026-119576 (ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass ...)
+ TODO: check
+CVE-2026-119575 (ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request for ...)
+ TODO: check
+CVE-2026-119574 (Traefik from 3.2.0 before 3.7.15 contains a data race in the experimen ...)
+ TODO: check
+CVE-2026-119573 (Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the K ...)
+ TODO: check
+CVE-2026-119572 (Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypas ...)
+ TODO: check
+CVE-2026-119571 (Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorizati ...)
+ TODO: check
+CVE-2026-119570 (Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information ...)
+ TODO: check
+CVE-2026-119569 (Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a ...)
+ TODO: check
+CVE-2026-119568 (vsftpd through 3.0.5 contains an authentication bypass vulnerability i ...)
+ TODO: check
+CVE-2026-119567 (vsftpd through 3.0.5 contains an access control bypass vulnerability t ...)
+ TODO: check
+CVE-2026-119566 (Prometheus through 3.15.1 contains a credential leak vulnerability tha ...)
+ TODO: check
+CVE-2026-119565 (Plausible Analytics through 3.2.1 contains a mass assignment vulnerabi ...)
+ TODO: check
+CVE-2026-119564 (Plausible Analytics Community Edition through 3.2.1 contains an inform ...)
+ TODO: check
+CVE-2026-119563 (phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulner ...)
+ TODO: check
+CVE-2026-119562 (phpMyAdmin through 5.2.3 contains an sql injection vulnerability that ...)
+ TODO: check
+CVE-2026-119561 (phpMyAdmin through 5.2.3 contains an authentication bypass vulnerabili ...)
+ TODO: check
+CVE-2026-119560 (OPNsense core through 26.7.8 contains a configuration injection vulner ...)
+ TODO: check
+CVE-2026-119559 (OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerab ...)
+ TODO: check
+CVE-2026-119558 (OpenCart through 4.1.0.4 contains a business logic vulnerability that ...)
+ TODO: check
+CVE-2026-119557 (n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability ...)
+ TODO: check
+CVE-2026-119556 (Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8 ...)
+ TODO: check
+CVE-2026-119555 (Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8 ...)
+ TODO: check
+CVE-2026-119554 (Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through ...)
+ TODO: check
+CVE-2026-119553 (Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through ...)
+ TODO: check
+CVE-2026-119552 (Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO f ...)
+ TODO: check
+CVE-2026-119551 (Jellyfin through 12.4 contains an authorization bypass vulnerability i ...)
+ TODO: check
+CVE-2026-119550 (Jellyfin through 12.4 contains an information disclosure vulnerability ...)
+ TODO: check
+CVE-2026-119549 (Jellyfin through 12.4 contains a server-side request forgery vulnerabi ...)
+ TODO: check
+CVE-2026-119548 (Lago through 1.55.0 contains an authorization bypass vulnerability in ...)
+ TODO: check
+CVE-2026-119547 (Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17. ...)
+ TODO: check
+CVE-2026-119546 (Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17. ...)
+ TODO: check
+CVE-2026-119545 (Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17. ...)
+ TODO: check
+CVE-2026-119542 (A flaw was found in the Ickle query parser in Infinispan. A query cont ...)
+ TODO: check
+CVE-2026-119528 (A flaw was found in GIMP. The PSD plug-in\u2019s image resource header ...)
+ TODO: check
+CVE-2026-119526 (Deserialization of Untrusted Data vulnerability in ThemeREX Royal Even ...)
+ TODO: check
+CVE-2026-119482 (Missing Authorization vulnerability in Crocoblock JetFormBuilder jetfo ...)
+ TODO: check
+CVE-2026-119479 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
+ TODO: check
+CVE-2026-119466 (Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExpert ...)
+ TODO: check
+CVE-2026-119429 (phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerab ...)
+ TODO: check
+CVE-2026-119428 (phpMyAdmin through 5.2.3 contains a server-side request forgery vulner ...)
+ TODO: check
+CVE-2026-119427 (phpMyAdmin through 5.2.3 contains an sql injection vulnerability in De ...)
+ TODO: check
+CVE-2026-119426 (phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnera ...)
+ TODO: check
+CVE-2026-119425 (OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass ...)
+ TODO: check
+CVE-2026-119424 (OPNsense core before 26.7.8 contains a configuration line injection vu ...)
+ TODO: check
+CVE-2026-119423 (OPNsense core before 26.7.8 contains a log injection vulnerability tha ...)
+ TODO: check
+CVE-2026-119422 (Juspay Hyperswitch before 1.128.0 contains an authentication bypass vu ...)
+ TODO: check
+CVE-2026-119421 (Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) co ...)
+ TODO: check
+CVE-2026-119420 (Lago through 1.55.0 contains an authentication bypass vulnerability th ...)
+ TODO: check
+CVE-2026-119419 (CakePHP through 5.4.3 contains an sql injection vulnerability that all ...)
+ TODO: check
+CVE-2026-119418 (CakePHP through 5.4.3 contains an sql injection vulnerability that all ...)
+ TODO: check
+CVE-2026-119417 (CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5. ...)
+ TODO: check
+CVE-2026-119416 (CakePHP through 5.4.3 contains an improper cookie domain validation vu ...)
+ TODO: check
+CVE-2026-119415 (CakePHP through 5.4.3 contains a header injection vulnerability in For ...)
+ TODO: check
+CVE-2026-119414 (Bitwarden Server before 2026.10.1 on Entity Framework backends contain ...)
+ TODO: check
+CVE-2026-119409 (OPNsense before 26.7.8 contains a command injection vulnerability that ...)
+ TODO: check
+CVE-2026-119408 (n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains ...)
+ TODO: check
+CVE-2026-119407 (Element Web and Element Desktop before 1.12.32 accept guest credential ...)
+ TODO: check
+CVE-2026-119379 (SQLite before 3.54.0 built with the session extension contains a heap ...)
+ TODO: check
+CVE-2026-119378 (SQLite before 3.54.0 contains a use-after-free vulnerability in the R- ...)
+ TODO: check
+CVE-2026-119377 (SQLite before 3.54.0 contains an authorization bypass vulnerability in ...)
+ TODO: check
+CVE-2026-119376 (SQLite before 3.54.0 contains a stack exhaustion vulnerability that al ...)
+ TODO: check
+CVE-2026-119375 (SQLite before 3.54.0 contains an information disclosure vulnerability ...)
+ TODO: check
+CVE-2026-119374 (SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow i ...)
+ TODO: check
+CVE-2026-119373 (SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow i ...)
+ TODO: check
+CVE-2026-119372 (SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PAREN ...)
+ TODO: check
+CVE-2026-119371 (SQLite before 3.54.0 contains a stack exhaustion vulnerability that al ...)
+ TODO: check
+CVE-2026-119370 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-119369 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-119368 (Missing Authorization vulnerability in Liquid Web / StellarWP The Even ...)
+ TODO: check
+CVE-2026-119367 (Missing Authorization vulnerability in Liquid Web / StellarWP The Even ...)
+ TODO: check
+CVE-2026-119365 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
+ TODO: check
+CVE-2026-119364 (ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link ...)
+ TODO: check
+CVE-2026-119300 (Wekan is open source kanban built with Meteor. Prior to 11.11, the use ...)
+ TODO: check
+CVE-2026-119299 (gopacket provides packet processing capabilities for Go. Prior to 1.7. ...)
+ TODO: check
+CVE-2026-119298 (croc is a tool that allows any two computers to simply and securely tr ...)
+ TODO: check
+CVE-2026-119291 (Zuke is a code-first, strongly typed build automation system for Deno. ...)
+ TODO: check
+CVE-2026-119290 (Zuke is a code-first, strongly typed build automation system for Deno. ...)
+ TODO: check
+CVE-2026-119289 (Zuke is a code-first, strongly typed build automation system for Deno. ...)
+ TODO: check
+CVE-2026-119288 (Zuke is a code-first, strongly typed build automation system for Deno. ...)
+ TODO: check
+CVE-2026-119287 (Zuke is a code-first, strongly typed build automation system for Deno. ...)
+ TODO: check
+CVE-2026-119176 (The CP Multi View Events Calendar plugin for WordPress is vulnerable t ...)
+ TODO: check
+CVE-2026-119148 (Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0. ...)
+ TODO: check
+CVE-2026-119147 (ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass i ...)
+ TODO: check
+CVE-2026-119146 (ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnera ...)
+ TODO: check
+CVE-2026-119117 (Insertion of sensitive information into a log file in Amazon Kinesis P ...)
+ TODO: check
+CVE-2026-119116 (A use-after-free and double-free issue in the SetClient command handle ...)
+ TODO: check
+CVE-2026-119113 (The GeoDirectory \u2013 WP Business Directory Plugin and Classified Li ...)
+ TODO: check
+CVE-2026-119086 (Missing queue-set type validation in the queue-set selection system ca ...)
+ TODO: check
+CVE-2026-119038 (Business::GoCardless versions before 1.01 for Perl complete redirect f ...)
+ TODO: check
+CVE-2026-119037 (Business::GoCardless versions before 1.01 for Perl accept forged webho ...)
+ TODO: check
+CVE-2026-119036 (Business::GoCardless versions before 1.01 for Perl allow memory exhaus ...)
+ TODO: check
+CVE-2026-118996 (CallBackery versions before 0.62.0 for Perl send users their own passw ...)
+ TODO: check
+CVE-2026-118995 (CallBackery versions before 0.62.0 for Perl accept unintended values i ...)
+ TODO: check
+CVE-2026-118994 (CallBackery versions before 0.62.0 for Perl allow log injection via ne ...)
+ TODO: check
+CVE-2026-118993 (CallBackery versions before 0.62.0 for Perl allow denial of service vi ...)
+ TODO: check
+CVE-2026-118992 (CallBackery versions before 0.62.0 for Perl allow OS command execution ...)
+ TODO: check
+CVE-2026-118991 (CallBackery versions before 0.62.0 for Perl encrypt configuration back ...)
+ TODO: check
+CVE-2026-118990 (CallBackery versions before 0.62.0 for Perl leave a world-readable dum ...)
+ TODO: check
+CVE-2026-118988 (CallBackery versions before 0.60.1 for Perl let unauthenticated client ...)
+ TODO: check
+CVE-2026-118987 (CallBackery versions before 0.62.0 for Perl accept session cookies of ...)
+ TODO: check
+CVE-2026-118986 (CallBackery versions before 0.62.0 for Perl allow session cookie forge ...)
+ TODO: check
+CVE-2026-118697 (In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before ...)
+ TODO: check
+CVE-2026-118696 (In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm b ...)
+ TODO: check
+CVE-2026-118635 (The The GeoDirectory \u2013 WP Business Directory Plugin and Classifie ...)
+ TODO: check
+CVE-2026-118238 (The Tenda W18E web management server is vulnerable to OS command injec ...)
+ TODO: check
+CVE-2026-118205 (The Essential Addons for Elementor \u2013 Popular Elementor Templates ...)
+ TODO: check
+CVE-2026-118090 (Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.)
+ TODO: check
+CVE-2026-118089 (Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 ve ...)
+ TODO: check
+CVE-2026-118086 (Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.)
+ TODO: check
+CVE-2026-117350 (Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OO ...)
+ TODO: check
+CVE-2026-117349 (Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OO ...)
+ TODO: check
+CVE-2026-117346 (Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo ...)
+ TODO: check
+CVE-2026-117184 (An issue in the GraphQL endpoint of traggo server v0.8.3 allows attack ...)
+ TODO: check
+CVE-2026-117183 (A path traversal vulnerability in the FeaturedImage component of astro ...)
+ TODO: check
+CVE-2026-117182 (An authenticated cross-site scripting (XSS) vulnerability in the /spin ...)
+ TODO: check
+CVE-2026-117028 (Skuul School Management System through version 2.6.5 is vulnerable to ...)
+ TODO: check
+CVE-2026-116862 (Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 ver ...)
+ TODO: check
+CVE-2026-116861 (Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 vers ...)
+ TODO: check
+CVE-2026-116860 (Missing Authorization vulnerability in Arraytics Timetics timetics all ...)
+ TODO: check
+CVE-2026-116854 (Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 ver ...)
+ TODO: check
+CVE-2026-116853 (Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.)
+ TODO: check
+CVE-2026-116852 (Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions ...)
+ TODO: check
+CVE-2026-116851 (Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalo ...)
+ TODO: check
+CVE-2026-116847 (Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 v ...)
+ TODO: check
+CVE-2026-116552 (The Like Button Rating \u2665 LikeBtn plugin for WordPress is vulnerab ...)
+ TODO: check
+CVE-2026-116410 (Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 ...)
+ TODO: check
+CVE-2026-116407 (Missing Authorization vulnerability in Webba Plugins Webba Booking web ...)
+ TODO: check
+CVE-2026-116405 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 vers ...)
+ TODO: check
+CVE-2026-116401 (Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.)
+ TODO: check
+CVE-2026-116386 (Unauthenticated Privilege Escalation in SMS Alert Order Notifications ...)
+ TODO: check
+CVE-2026-116366 (An issue has been discovered in ClickHouse Server that, under certain ...)
+ TODO: check
+CVE-2026-116130 (HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at a ...)
+ TODO: check
+CVE-2026-116128 (Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustio ...)
+ TODO: check
+CVE-2026-116127 (Starlet versions before 0.33 for Perl send a body in responses to HEAD ...)
+ TODO: check
+CVE-2026-115947 (Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.)
+ TODO: check
+CVE-2026-115869 (The Themify Builder plugin for WordPress is vulnerable to Stored Cross ...)
+ TODO: check
+CVE-2026-115866 (Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion v ...)
+ TODO: check
+CVE-2026-115865 (Starlet versions before 0.33 for Perl allow a request declaring a larg ...)
+ TODO: check
+CVE-2026-115820 (The Majestic Support \u2013 The Leading-Edge Help Desk & Customer Supp ...)
+ TODO: check
+CVE-2026-115604 (Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.)
+ TODO: check
+CVE-2026-115456 (A flaw was found in gcc. An attacker could cause a Denial of Service ( ...)
+ TODO: check
+CVE-2026-115455 (A flaw was found in GCC libstdc++. When an application extracts data i ...)
+ TODO: check
+CVE-2026-115346 (The Avada | Website Builder For WordPress & WooCommerce theme for Word ...)
+ TODO: check
+CVE-2026-115274 (Improper Validation of Specified Quantity in Input vulnerability in th ...)
+ TODO: check
+CVE-2026-114711 (Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versio ...)
+ TODO: check
+CVE-2026-114691 (A flaw was found in the libstdc++ component of GCC. An attacker who ca ...)
+ TODO: check
+CVE-2026-114690 (A flaw was found in GCC. An out-of-bounds memory access vulnerability ...)
+ TODO: check
+CVE-2026-112905 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
+ TODO: check
+CVE-2026-112816 (Improper certificate validation in the HTTPS listener in Canonical LXD ...)
+ TODO: check
+CVE-2026-112374 (FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnera ...)
+ TODO: check
+CVE-2026-112365 (The easy.jobs \u2013 AI powered Job Listing, Job Board, Career Page, R ...)
+ TODO: check
+CVE-2026-112348 (Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vu ...)
+ TODO: check
+CVE-2026-112347 (Kirki plugin for WordPress before 6.4.1 contains a broken object-level ...)
+ TODO: check
+CVE-2026-111505 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
+ TODO: check
+CVE-2026-111504 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
+ TODO: check
+CVE-2026-111503 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
+ TODO: check
+CVE-2026-111502 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insuf ...)
+ TODO: check
+CVE-2026-111501 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
+ TODO: check
+CVE-2026-111500 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missin ...)
+ TODO: check
+CVE-2026-111499 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incor ...)
+ TODO: check
+CVE-2026-111498 (OpenManage Enterprise, versions prior to 4.8.0, contains an Improper R ...)
+ TODO: check
+CVE-2026-111487 (An out-of-bounds write vulnerability in the Qt Framework assimp scene ...)
+ TODO: check
+CVE-2026-110972 (P\u0142atnik performs client-side authentication. An attacker with acc ...)
+ TODO: check
+CVE-2026-110971 (Use of a weak password encoding algorithm in P\u0142atnik software all ...)
+ TODO: check
+CVE-2026-110970 (P\u0142atnikuses HTTP protocol to downloadupdates, libraries and suppo ...)
+ TODO: check
+CVE-2026-110799 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
+ TODO: check
+CVE-2026-110533 (The FV Flowplayer Video Player plugin for WordPress is vulnerable to S ...)
+ TODO: check
+CVE-2026-110305 (The Advanced Custom Fields: Extended plugin for WordPress is vulnerabl ...)
+ TODO: check
+CVE-2026-110001 (The FV Flowplayer Video Player plugin for WordPress is vulnerable to S ...)
+ TODO: check
+CVE-2026-109984 (The FV Flowplayer Video Player plugin for WordPress is vulnerable to S ...)
+ TODO: check
+CVE-2026-109821 (Improper Validation of Specified Quantity in Input vulnerability in th ...)
+ TODO: check
+CVE-2026-109592 (The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin ...)
+ TODO: check
+CVE-2026-107868 (Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-O ...)
+ TODO: check
+CVE-2026-107630 (The Email Templates Customizer and Designer for WordPress and WooComme ...)
+ TODO: check
+CVE-2026-105924 (A NULL pointer dereference vulnerability in the Qt QCborValue to JSON ...)
+ TODO: check
+CVE-2026-105894 (The Ak Framework plugin for WordPress, included in the Newsy - Viral N ...)
+ TODO: check
+CVE-2026-105456 (RTIR extends RT's HTML scrubber to allow an internal link placeh ...)
+ TODO: check
+CVE-2026-105455 (RTIR's ticket creation forms show the subject of the related tic ...)
+ TODO: check
+CVE-2026-105077 (Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 ve ...)
+ TODO: check
+CVE-2026-104744 (The Independent Analytics Pro plugin for WordPress is vulnerable to St ...)
+ TODO: check
+CVE-2026-104739 (The JS Help Desk \u2013 AI-Powered Support & Ticketing System plugin f ...)
+ TODO: check
+CVE-2026-104674 (Missing Authorization vulnerability in Arraytics Booktics booktics all ...)
+ TODO: check
+CVE-2026-104623 (A security vulnerability exists in the authorization handling for the ...)
+ TODO: check
+CVE-2026-104615 (A security vulnerability was discovered in SUSE Rancher Fleet's cluste ...)
+ TODO: check
+CVE-2026-104067 (Scribus before 1.6.7 contains an out-of-bounds memory access vulnerabi ...)
+ TODO: check
+CVE-2026-104066 (Scribus before 1.6.7 contains a heap buffer overflow vulnerability in ...)
+ TODO: check
+CVE-2026-104065 (Scribus before 1.6.7 contains an out-of-bounds write vulnerability in ...)
+ TODO: check
+CVE-2026-104064 (Scribus before 1.6.7 contains an integer overflow vulnerability in the ...)
+ TODO: check
+CVE-2026-104063 (Scribus before 1.6.7 contains an out-of-bounds read vulnerability in t ...)
+ TODO: check
+CVE-2026-104062 (Scribus before 1.6.7 contains a heap buffer overflow vulnerability in ...)
+ TODO: check
+CVE-2026-104061 (Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability ...)
+ TODO: check
+CVE-2026-102918 (The Redux Framework plugin for WordPress is vulnerable to Stored Cross ...)
+ TODO: check
+CVE-2026-102905 (The The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for WordPre ...)
+ TODO: check
+CVE-2026-101214 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
+ TODO: check
+CVE-2026-101213 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
+ TODO: check
+CVE-2026-101210 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
+ TODO: check
+CVE-2026-101209 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server ...)
+ TODO: check
+CVE-2026-100355 (Campfire is a web-based chat application. In version 1.4.4 and earlier ...)
+ TODO: check
+CVE-2025-8574 (The Database Cleaner plugin for WordPress is vulnerable to arbitrary t ...)
+ TODO: check
+CVE-2025-68395 (ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor ...)
+ TODO: check
+CVE-2025-68394 (ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL ...)
+ TODO: check
+CVE-2025-68393 (ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL ...)
+ TODO: check
+CVE-2025-68392 (ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged u ...)
+ TODO: check
+CVE-2025-68391 (ARKETEAM Protectel modulesPROTECTELMAJ andBDF are vulnerable to arbitr ...)
+ TODO: check
+CVE-2025-49602 (An issue was discovered in Keyfactor EJBCA 9. When an administrator is ...)
+ TODO: check
+CVE-2025-31704 (A vulnerability has been found in the Dahua Intelligent Connection Cen ...)
+ TODO: check
+CVE-2015-20130 (Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected c ...)
+ TODO: check
+CVE-2010-20125 (DedeCMS before 5.7 contains a file inclusion vulnerability in plus/car ...)
+ TODO: check
CVE-2026-97645 (The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-S ...)
NOT-FOR-US: WordPress plugin
CVE-2026-96389 (Missing Authorization vulnerability in Drupal Xray Audit allows Forcef ...)
@@ -700,7 +1474,7 @@ CVE-2026-108281
- request-tracker5 <unfixed> (bug #1152514)
NOTE: https://github.com/bestpractical/rt/releases/tag/rt-5.0.11
TODO: check details from upstream and affected versions
-CVE-2026-105454
+CVE-2026-105454 (RT's automatic link creation for URLs in HTML ticket content does ...)
- request-tracker5 <unfixed> (bug #1152514)
NOTE: https://github.com/bestpractical/rt/releases/tag/rt-5.0.11
TODO: check details from upstream and affected versions
@@ -1562,7 +2336,7 @@ CVE-2026-XXXX [GHSA-c968-33g3-wh7p: Package names in vendor/composer/installed.j
CVE-2026-XXXX [GHSA-fm2w-xgf2-f9fh: Inline repository HTTP headers, such as API tokens, are written into composer.lock]
- composer 2.11.0-1
NOTE: https://github.com/composer/composer/security/advisories/GHSA-fm2w-xgf2-f9fh
-CVE-2026-115642 [OSSA-2026-050: keystonemiddleware access_rules bypass via X-Service-Token]
+CVE-2026-115642 (In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X ...)
- python-keystonemiddleware 13.0.1-5 (bug #1152543)
NOTE: https://security.openstack.org/ossa/OSSA-2026-050.html
CVE-2026-XXXX [TROVE-2026-072]
@@ -4086,7 +4860,7 @@ CVE-2013-20008 (Linksys WAG200G through 1.01.06 contains a weak password change
NOT-FOR-US: Linksys
CVE-2013-20007 (Linksys WAG200G through 1.01.06 contains an OS command injection vulne ...)
NOT-FOR-US: Linksys
-CVE-2026-119193 [GHSA-9vw2-f4vp-x7gf: PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling]
+CVE-2026-119193 (PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the ...)
- phpunit 13.4.5+ds-1
[trixie] - phpunit <not-affected> (Vulnerable code introduced later)
[bookworm] - phpunit <not-affected> (Vulnerable code introduced later)
@@ -8008,7 +8782,7 @@ CVE-2026-110928
- openssh <undetermined>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2553038
TODO: check, unclear if usptream is affected by the specific issue?
-CVE-2026-115683
+CVE-2026-115683 (A race condition in Epiphany allows a malicious website to bypass the ...)
- epiphany-browser <unfixed>
NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978
CVE-2026-110522
@@ -23985,6 +24759,7 @@ CVE-2026-94200 (Improper Validation of Consistency within Input vulnerability in
CVE-2026-94197 (An authentication and authorization bypass vulnerability exists in F5 ...)
NOT-FOR-US: F5
CVE-2026-93683 (A flaw was found in the DPDK vhost library. When handling a virtio ind ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2046
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
@@ -24073,54 +24848,66 @@ CVE-2026-88164 (Missing authorization in Microsoft Office SharePoint allows an a
CVE-2026-87093 (Incorrect Permission Assignment for Critical Resource vulnerability in ...)
NOT-FOR-US: Progress Software
CVE-2026-86856 (A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers s ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2027
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86849 (A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in c ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2022
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86848 (A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descript ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2001
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2026
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86847 (A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain clea ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2023
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86846 (A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2529846
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2001
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2026
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86845 (A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can l ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2028
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86567 (A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalid ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2029
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86566 (A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors c ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2020
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86565 (A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueu ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2008
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86563 (A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log m ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2004
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86562 (A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-q ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2003
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2021
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86561 (A flaw was found in DPDK lib/vhost. Memory size is not adequately vali ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2002
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
@@ -25174,6 +25961,7 @@ CVE-2026-100404 (Zulip is an open-source team collaboration tool. In Zulip Serve
CVE-2026-100394 (Nezha Monitoring is a self-hostable, lightweight, servers and websites ...)
NOT-FOR-US: Nezha Monitoring
CVE-2026-100236 (A flaw was found in the DPDK GSO library. When software GSO copies pac ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2047
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
@@ -35297,7 +36085,7 @@ CVE-2026-107660 (FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper c
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29 (n9.0.2)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f (n8.1.3)
NOTE: mbedtls not enabled in Debian builds
-CVE-2026-118475 [EogMetadataReaderPng: Avoid buffer overflow with malformed iCCP chunks]
+CVE-2026-118475 (A flaw was found in Eye of GNOME. When parsing a specially crafted PNG ...)
- eog 50.4-1
NOTE: https://gitlab.gnome.org/GNOME/eog/-/issues/342
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/eog/-/commit/04e4f313421eacb9fc529781542bb7fb81a3cd1a (50.4)
@@ -36278,6 +37066,7 @@ CVE-2026-107227 (The AsyncHttpClient (AHC) library allows Java applications to e
CVE-2026-107176 (A flaw was found in the cluster-samples-operator. The RBAC Role coreos ...)
NOT-FOR-US: cluster-samples-operator
CVE-2026-107161 (A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_ ...)
+ {DLA-4871-1}
- cyrus-sasl2 2.1.28+dfsg1-12 (bug #1150516)
[trixie] - cyrus-sasl2 <no-dsa> (Will be fixed via point release; suggested patch taken for update)
NOTE: https://github.com/cyrusimap/cyrus-sasl/issues/889
@@ -77153,6 +77942,7 @@ CVE-2026-87050
CVE-2026-87049
NOT-FOR-US: operator-foundry
CVE-2026-86564 (A flaw was found in DPDK lib/vhost. Missing length validation before r ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1 (bug #1147518)
[bookworm] - dpdk <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2529682
@@ -109559,7 +110349,8 @@ CVE-2026-13197 (Nozomi Networks Labs identified a CWE-362: Concurrent Execution
NOT-FOR-US: KUNBUS
CVE-2026-13196 (Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnera ...)
NOT-FOR-US: KUNBUS
-CVE-2026-13002 (A flow has been identified into dnssec.c library, causing an infinite ...)
+CVE-2026-13002
+ REJECTED
- dnsmasq <unfixed> (bug #1144649)
[trixie] - dnsmasq <no-dsa> (Minor issue)
[bookworm] - dnsmasq <postponed> (Minor issue)
@@ -155069,7 +155860,7 @@ CVE-2026-11597 (The Surbma | Infusionsoft Shortcode plugin for WordPress is vuln
NOT-FOR-US: WordPress plugin
CVE-2026-11364 (The Product Specifications for WooCommerce plugin for WordPress is vul ...)
NOT-FOR-US: WordPress plugin
-CVE-2026-61626 [GHSA-5gf7-wjfm-vmvm: Out-of-bounds bit clears for negative Matroska ReadOrder values]
+CVE-2026-61626 (libass is a portable subtitle renderer for the ASS/SSA (Advanced Subst ...)
- libass 1:0.17.5-1
[trixie] - libass <not-affected> (Vulnerable code not present)
[bookworm] - libass <not-affected> (Vulnerable code not present)
@@ -155078,7 +155869,7 @@ CVE-2026-61626 [GHSA-5gf7-wjfm-vmvm: Out-of-bounds bit clears for negative Matro
NOTE: Introduced with: https://github.com/libass/libass/commit/dcc9eb722ebd485d2ed0e21c261b0a1b05497154 (0.17.4)
NOTE: Fixed with: https://github.com/libass/libass/commit/23da65a130bb8c5b2cf0c7df0dd7d424607f98f1 (0.17.5)
NOTE: https://github.com/libass/libass/issues/937
-CVE-2026-61627 [GHSA-pjjp-65r7-ppgm: Out-of-bounds read and write in wrap_lines_measure]
+CVE-2026-61627 (libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Sub ...)
{DLA-4769-1}
- libass 1:0.17.5-1
[trixie] - libass 1:0.17.3-1+deb13u1
@@ -170043,7 +170834,7 @@ CVE-2026-41448 (AdGuard Home, when started with the --glinet flag, contains an a
NOT-FOR-US: AdGuard Home
CVE-2026-3011 (The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stor ...)
NOT-FOR-US: WordPress plugin
-CVE-2026-39910 (STACKIT IaaS API contains a missing authorization check vulnerability ...)
+CVE-2026-39910 (STACKIT IaaS API contains a missing authorization check in the PUT ser ...)
NOT-FOR-US: STACKIT
CVE-2026-39908 (OpenBullet2 through version 0.3.2 on Windows contains a credential dis ...)
NOT-FOR-US: OpenBullet2
@@ -1040122,7 +1040913,7 @@ CVE-2013-2058 (The host_start function in drivers/usb/chipidea/host.c in the Lin
NOTE: https://www.openwall.com/lists/oss-security/2013/05/03/2
CVE-2013-2057 (YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Includ ...)
NOT-FOR-US: YaBB
-CVE-2013-2056 (The Inter-Satellite Sync (ISS) operation in Red Hat Network (RHN) Sate ...)
+CVE-2013-2056 (A flaw was found in Red Hat Network Satellite. The Inter-Satellite Syn ...)
NOT-FOR-US: RHN Satellite
CVE-2013-2055 (Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x ...)
NOT-FOR-US: Apache Wicket
@@ -1040849,7 +1041640,7 @@ CVE-2013-1841 (Net-Server, when the reverse-lookups option is enabled, does not
NOTE: 2.011 upstream adds 'double_reverse_lookups' configuration and code as fix
NOTE: for the issue, but does not enable the checks by default. They need to be
NOTE: enabled by consumers by setting 'reverse_lookups=double' or double_reverse_lookups=1'.
-CVE-2013-1840 (The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Gr ...)
+CVE-2013-1840 (A flaw was found in OpenStack Glance. Remote authenticated users can e ...)
- glance 2012.1.1-5 (bug #703063)
CVE-2013-1839 (The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x befo ...)
- squid3 <not-affected> (the errors were introduced in trunk rev.11496 in 3.2.0.9)
@@ -1048395,7 +1049186,7 @@ CVE-2012-5606 (Multiple cross-site scripting (XSS) vulnerabilities in ownCloud b
- owncloud 4.0.8debian-1.1 (bug #693990)
[wheezy] - owncloud 4.0.4debian2-3.1
NOTE: https://www.openwall.com/lists/oss-security/2012/11/30/2
-CVE-2012-5605 (Grinder in Red Hat CloudForms before 1.1 uses world-writable permissio ...)
+CVE-2012-5605 (A flaw was found in Grinder, a component of Red Hat CloudForms. This v ...)
NOT-FOR-US: Red Hat CloudForms
CVE-2012-5604 (The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when u ...)
NOT-FOR-US: Red Hat CloudForms
@@ -1051254,7 +1052045,7 @@ CVE-2012-4576 (FreeBSD: Input Validation Flaw allows local users to gain elevate
CVE-2012-4575 (The add_database function in objects.c in the pgbouncer pooler 1.5.2 f ...)
- pgbouncer 1.5.2-4
[squeeze] - pgbouncer <no-dsa> (Minor issue)
-CVE-2012-4574 (Pulp in Red Hat CloudForms before 1.1 uses world-readable permissions ...)
+CVE-2012-4574 (A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerab ...)
NOT-FOR-US: Red Hat CloudForms
CVE-2012-4573 (The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (20 ...)
- glance 2012.1.1-2 (bug #692641)
@@ -1054271,7 +1055062,7 @@ CVE-2012-3429 (The dns_to_ldap_dn_escape function in src/ldap_convert.c in bind-
NOTE: https://pagure.io/bind-dyndb-ldap/c/f345805c73c294db42452ae966c48fbc36c48006 (v2.0)
CVE-2012-3428 (The IronJacamar container before 1.0.12.Final for JBoss Application Se ...)
- jbossas4 <not-affected> (Only builds a few libraries, not the full application server)
-CVE-2012-3427 (EC2 Amazon Machine Image (AMI) in JBoss Enterprise Application Platfor ...)
+CVE-2012-3427 (A flaw was found in JBoss Enterprise Application Platform (EAP) and EC ...)
- jbossas4 <not-affected> (Only builds a few libraries, not the full application server)
CVE-2012-3426 (OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before ...)
- keystone 2012.1.1-1
@@ -1144254,7 +1145045,7 @@ CVE-2006-4340 (Mozilla Network Security Service (NSS) library before 3.11.3, as
- firefox 1.5.dfsg+1.5.0.7-1 (high)
- thunderbird 1.5.0.7-1 (high)
- xulrunner 1.8.0.7-1 (high)
-CVE-2006-4339 (OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, wh ...)
+CVE-2006-4339 (A flaw was found in OpenSSL. When configured to use an RSA key with ex ...)
{DSA-1174-1 DSA-1173-1}
- openssl 0.9.8b-3 (medium)
- openssl097 0.9.7i-2 (medium)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/812babbbc1c97c76ce177c6a289c6fad702663a8
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/812babbbc1c97c76ce177c6a289c6fad702663a8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261030/958acf53/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list