[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues

Salvatore Bonaccorso (@carnil) carnil at debian.org
Sat Oct 31 11:01:21 GMT 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
3b68d96b by Salvatore Bonaccorso at 2026-10-31T11:21:53+01:00
Add Debian bug references for various issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -45,7 +45,7 @@ CVE-2026-63414 (Shopify App is a Rails engine for building Shopify applications.
 CVE-2026-63410 (secp256k1-native is a native C secp256k1 implementation for Ruby. In a ...)
 	NOT-FOR-US: secp256k1-native Ruby gem
 CVE-2026-63402 (i18next is an internationalization framework for JavaScript. Prior to  ...)
-	- node-i18next <unfixed>
+	- node-i18next <unfixed> (bug #1152688)
 	NOTE: https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx
 	NOTE: Fixed by: https://github.com/i18next/i18next/commit/642137b7786d83661ec3ee53027798dc4b81d30a (v26.3.4)
 CVE-2026-63401 (Coop is an open source review and moderation tool from ROOST. Prior to ...)
@@ -364,7 +364,7 @@ CVE-2026-9239 (The Meow Gallery plugin for WordPress is vulnerable to Stored Cro
 CVE-2026-97638 (The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form B ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-97209 (Insecure Temporary File vulnerability in Mix deps.partition in Elixir  ...)
-	- elixir-lang <unfixed>
+	- elixir-lang <unfixed> (bug #1152683)
 	[trixie] - elixir-lang <not-affected> (Vulnerable code introduced later)
 	[bookworm] - elixir-lang <not-affected> (Vulnerable code introduced later)
 	NOTE: https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q
@@ -433,7 +433,7 @@ CVE-2026-64860
 CVE-2026-64618 (Improper Neutralization of Special Elements used in an SQL Command ("S ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-62303 (Pistache is a high-performance REST toolkit written in C++. From 0.0.5 ...)
-	- pistache <unfixed>
+	- pistache <unfixed> (bug #152687)
 	NOTE: https://github.com/pistacheio/pistache/security/advisories/GHSA-q474-pqcp-gqm5
 	NOTE: https://github.com/pistacheio/pistache/commit/935461352403696f3ca0dbb9a7de7d2609e7ce91
 CVE-2026-62298 (mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` dec ...)
@@ -1364,43 +1364,43 @@ CVE-2026-119210 (MariaDB Connector/J is used to connect applications developed i
 	NOTE: https://jira.mariadb.org/browse/CONJ-1387
 	NOTE: Fixed by: https://github.com/mariadb-corporation/mariadb-connector-j/commit/a4891f877f1c885a573194771c1ed0aacec0ce1d (3.5.11)
 CVE-2026-119209 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	- pypdf <unfixed>
+	- pypdf <unfixed> (bug #1152684)
 	- pypdf2 <removed>
 	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-x3rh-gjgm-fmqc
 	NOTE: https://github.com/py-pdf/pypdf/pull/4269
 	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/a93fe3a901fd00af38f0a105c3ba7175fa72dcb4 (6.21.3)
 CVE-2026-119208 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	- pypdf <unfixed>
+	- pypdf <unfixed> (bug #1152684)
 	- pypdf2 <removed>
 	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-62m5-6wh8-28x7
 	NOTE: https://github.com/py-pdf/pypdf/pull/4270
 	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/82b91951dc74496bb3efe6465434f041bb6a5e6b (6.21.3)
 CVE-2026-119207 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	- pypdf <unfixed>
+	- pypdf <unfixed> (bug #1152684)
 	- pypdf2 <removed>
 	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vqv-7265-gm2w
 	NOTE: https://github.com/py-pdf/pypdf/pull/4265
 	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/64270258c0eced720f7960aecf8cef31afd39f8d (6.21.3)
 CVE-2026-119206 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	- pypdf <unfixed>
+	- pypdf <unfixed> (bug #1152684)
 	- pypdf2 <removed>
 	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw
 	NOTE: https://github.com/py-pdf/pypdf/pull/4251
 	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/b891fef37000cd86baa6e9848a3387d080b3b03e (6.21.3)
 CVE-2026-119205 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	- pypdf <unfixed>
+	- pypdf <unfixed> (bug #1152684)
 	- pypdf2 <removed>
 	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-mfr5-77xh-9j7h
 	NOTE: https://github.com/py-pdf/pypdf/pull/4288
 	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/f176db1a1f7f9af3e472e69a843ef1175653b044 (6.21.4)
 CVE-2026-119204 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	- pypdf <unfixed>
+	- pypdf <unfixed> (bug #1152684)
 	- pypdf2 <removed>
 	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-cggf-277g-3q54
 	NOTE: https://github.com/py-pdf/pypdf/pull/4290
 	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/ea4ac663133f1b3de1d7a8f2e6fa239802fde79e (6.21.4)
 CVE-2026-119203 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	- pypdf <unfixed>
+	- pypdf <unfixed> (bug #1152684)
 	- pypdf2 <removed>
 	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-5849-834g-hvw5
 	NOTE: https://github.com/py-pdf/pypdf/pull/4289
@@ -2355,7 +2355,7 @@ CVE-2026-118766 (Botan is a C++ cryptography library. Prior to 3.13.0, Botan's o
 CVE-2026-118765 (Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an appli ...)
 	TODO: check
 CVE-2026-118764 (minimatch is a minimal matching utility for converting glob expression ...)
-	- node-minimatch <unfixed>
+	- node-minimatch <unfixed> (bug #1152691)
 	NOTE: https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249
 	NOTE: Fixed by: https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8 (v11.0.1)
 CVE-2026-118763 (sigstore-js provides JavaScript libraries for interacting with Sigstor ...)
@@ -2942,7 +2942,7 @@ CVE-2026-118803 (Bricks Theme 2.4.3 and before contains an unauthenticated dynam
 CVE-2026-118757 (PiWeb Disable payment method / Partial payment for WooCommerce before  ...)
 	NOT-FOR-US: WooCommerce
 CVE-2026-118756 (gopass before 1.17.0 contains a path traversal vulnerability in the fi ...)
-	- golang-github-gopasspw-gopass <unfixed>
+	- golang-github-gopasspw-gopass <unfixed> (bug #1152690)
 	NOTE: https://github.com/gopasspw/gopass/security/advisories/GHSA-rw43-4vhf-hcvj
 	NOTE: Fixed by: https://github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2 (v1.17.0-rc.3)
 CVE-2026-118755 (Volmarg Personal Management System through 2.1.0 contains an OS comman ...)
@@ -2970,7 +2970,7 @@ CVE-2026-118689 (OvenMediaEngine through 0.21.0 contains a denial of service vul
 CVE-2026-118682 (KaringX ClashMi through 1.0.32.1801 disables TLS certificate validatio ...)
 	NOT-FOR-US: KaringX ClashMi
 CVE-2026-118669 (OAuthLib is an implementation of the OAuth request-signing logic for P ...)
-	- python-oauthlib <unfixed>
+	- python-oauthlib <unfixed> (bug #1152689)
 	NOTE: https://github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c
 	NOTE: https://github.com/oauthlib/oauthlib/pull/920
 	NOTE: Fixed by: https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d (v4.0.0)
@@ -3926,7 +3926,7 @@ CVE-2026-116796 (Highcharts JS is a JavaScript charting library based on SVG. Fr
 CVE-2026-116795 (RE2JS is the JavaScript port of RE2, a regular expression engine that  ...)
 	NOT-FOR-US: RE2JS
 CVE-2026-116794 (russh is a Rust SSH client and server library that includes an SSH age ...)
-	- rust-russh <unfixed>
+	- rust-russh <unfixed> (bug #1152685)
 	NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-vp5q-ff62-jwqv
 	NOTE: Fixed by: https://github.com/Eugeny/russh/commit/62db6e7defd6d244159da962ccccb029e785ce0f (v0.65.0)
 CVE-2026-116778 (FOG is a free open-source cloning/imaging/rescue suite/inventory manag ...)
@@ -5023,11 +5023,11 @@ CVE-2026-117605 (nopCommerce before 5.00.0 contains a missing authorization vuln
 CVE-2026-116775 (pageant provides a PageantStream type that implements AsyncRead and As ...)
 	NOT-FOR-US: pageant
 CVE-2026-116774 (russh is a Rust SSH client and server library that includes an SSH age ...)
-	- rust-russh <unfixed>
+	- rust-russh <unfixed> (bug #1152685)
 	NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-fw5c-8223-6h42
 	NOTE: Fixed by: https://github.com/Eugeny/russh/commit/39cb9dbaa37caf555d34c6c22efa3bbbff9e186c (v0.65.0)
 CVE-2026-116773 (russh is a Rust SSH client and server library that includes an SSH age ...)
-	- rust-russh <unfixed>
+	- rust-russh <unfixed> (bug #1152685)
 	NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg
 	NOTE: Fixed by: https://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75 (v0.65.0)
 CVE-2026-116761 (The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scrip ...)
@@ -5037,7 +5037,7 @@ CVE-2026-116750 (The VikRentCar Car Rental Management System plugin for WordPres
 CVE-2026-116749 (The VikRentCar Car Rental Management System plugin for WordPress is vu ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-116696 (russh is a Rust SSH client and server library that includes an SSH age ...)
-	- rust-russh <unfixed>
+	- rust-russh <unfixed> (bug #1152685)
 	NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-9wfm-jcj8-jfv9
 	NOTE: Fixed by: https://github.com/Eugeny/russh/commit/23aa5d28fe9601c5bdfe9e60b7ec5d4f882c3de6 (v0.65.0)
 CVE-2026-116695 (Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level ...)
@@ -10098,21 +10098,21 @@ CVE-2026-115586 (virtualenv is a tool for creating isolated virtual python envir
 	NOTE: https://github.com/pypa/virtualenv/pull/3466
 	NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4 (21.14.13)
 CVE-2026-115585 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	- pypdf <unfixed>
+	- pypdf <unfixed> (bug #1152684)
 	[trixie] - pypdf <no-dsa> (Minor issue)
 	- pypdf2 <removed>
 	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4
 	NOTE: https://github.com/py-pdf/pypdf/pull/4240
 	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b (6.21.2)
 CVE-2026-115580 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	- pypdf <unfixed>
+	- pypdf <unfixed> (bug #1152684)
 	[trixie] - pypdf <no-dsa> (Minor issue)
 	- pypdf2 <removed>
 	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5
 	NOTE: https://github.com/py-pdf/pypdf/pull/4239
 	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2 (6.21.2)
 CVE-2026-115572 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	- pypdf <unfixed>
+	- pypdf <unfixed> (bug #1152684)
 	[trixie] - pypdf <no-dsa> (Minor issue)
 	- pypdf2 <removed>
 	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw
@@ -25521,7 +25521,7 @@ CVE-2026-60010 (Gitea's repository-side team-link API allows a repository admini
 CVE-2026-60008 (Gitea's Jupyter notebook renderer inserts the notebook's language_info ...)
 	NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
 CVE-2026-59951 (The MCP Python SDK, called mcp on PyPI, is a Python implementation of  ...)
-	- python-mcp <unfixed>
+	- python-mcp <unfixed> (bug #1152686)
 	NOTE: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv
 	NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/3395
 	NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/3426



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3b68d96bcbdc3822f63b235a7d37e42a0e1ddaeb

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3b68d96bcbdc3822f63b235a7d37e42a0e1ddaeb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261031/71a0ef5a/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list