[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Sep 2 20:14:59 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
a0715c8c by security tracker role at 2026-09-02T19:14:52+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,477 @@
+CVE-2026-8151 (The Simple Membership MailChimp Integration WordPress plugin before 1. ...)
+ TODO: check
+CVE-2026-84841 (A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5 ...)
+ TODO: check
+CVE-2026-84840 (A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. T ...)
+ TODO: check
+CVE-2026-84839 (A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. A ...)
+ TODO: check
+CVE-2026-84838 (A flaw was found in rpmuncompress. This command injection vulnerabilit ...)
+ TODO: check
+CVE-2026-84837 (A flaw was found in rpm. An attacker can exploit a command injection v ...)
+ TODO: check
+CVE-2026-84835 (Missing Authorization vulnerability in DimaFreund Rentsyst allows Expl ...)
+ TODO: check
+CVE-2026-84833 (A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa ...)
+ TODO: check
+CVE-2026-84811 (agentverus-scanner fails to analyze compiled Python bytecode files in ...)
+ TODO: check
+CVE-2026-84810 (claude-skill-antivirus fails to analyze executable files when scanning ...)
+ TODO: check
+CVE-2026-84809 (Tencent AI-Infra-Guard's skill-scan component excludes compiled Python ...)
+ TODO: check
+CVE-2026-84808 (Kimai versions before 2.65.0 contain an authorization bypass vulnerabi ...)
+ TODO: check
+CVE-2026-84807 (Kimai (kimai/kimai) through 2.65.0 contains a business logic / imprope ...)
+ TODO: check
+CVE-2026-84806 (Kimai before 2.63.0 contains an improper authorization vulnerability i ...)
+ TODO: check
+CVE-2026-84805 (Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only wo ...)
+ TODO: check
+CVE-2026-84804 (Kimai before 2.65.0 fails to properly validate permissions when removi ...)
+ TODO: check
+CVE-2026-84803 (SiYuan before v3.8.2 contains a stored cross-site scripting vulnerabil ...)
+ TODO: check
+CVE-2026-84802 (Craft CMS versions from 5.7.0 before 5.10.12 contain an information di ...)
+ TODO: check
+CVE-2026-84801 (Craft CMS versions before 5.10.11 fail to validate admin status in the ...)
+ TODO: check
+CVE-2026-84800 (Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing author ...)
+ TODO: check
+CVE-2026-84799 (Craft CMS before 5.11.0 fails to enforce user-group scope filters on n ...)
+ TODO: check
+CVE-2026-84798 (Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an indep ...)
+ TODO: check
+CVE-2026-84797 (Craft CMS versions before 5.10.11 contain an authorization bypass vuln ...)
+ TODO: check
+CVE-2026-84796 (Craft CMS versions before 5.10.11 contain a site scope bypass vulnerab ...)
+ TODO: check
+CVE-2026-84795 (Craft CMS before 5.10.11 fails to validate the admin flag during user ...)
+ TODO: check
+CVE-2026-84794 (Craft CMS versions before 5.10.11 lack authorization checks in the ass ...)
+ TODO: check
+CVE-2026-84793 (Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cros ...)
+ TODO: check
+CVE-2026-84792 (Craft CMS versions before 5.10.11 contain a broken access control vuln ...)
+ TODO: check
+CVE-2026-84781 (Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 ...)
+ TODO: check
+CVE-2026-84780 (Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 vers ...)
+ TODO: check
+CVE-2026-84775 (Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 ...)
+ TODO: check
+CVE-2026-84772 (Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2. ...)
+ TODO: check
+CVE-2026-84771 (Unauthenticated Insecure Direct Object References (IDOR) in PublishPre ...)
+ TODO: check
+CVE-2026-84770 (Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= ...)
+ TODO: check
+CVE-2026-84764 (Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule A ...)
+ TODO: check
+CVE-2026-84760 (Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCo ...)
+ TODO: check
+CVE-2026-84759 (Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2 ...)
+ TODO: check
+CVE-2026-84677 (Jenkins update-center2 3.18.3 and earlier does not escape plugin-provi ...)
+ TODO: check
+CVE-2026-84676 (Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores t ...)
+ TODO: check
+CVE-2026-84675 (OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and ...)
+ TODO: check
+CVE-2026-84674 (Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 ...)
+ TODO: check
+CVE-2026-84673 (Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier al ...)
+ TODO: check
+CVE-2026-84672 (Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9c ...)
+ TODO: check
+CVE-2026-84671 (Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows w ...)
+ TODO: check
+CVE-2026-84670 (Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not r ...)
+ TODO: check
+CVE-2026-84669 (A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and ear ...)
+ TODO: check
+CVE-2026-84668 (Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriti ...)
+ TODO: check
+CVE-2026-84667 (Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plu ...)
+ TODO: check
+CVE-2026-84666 (Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earl ...)
+ TODO: check
+CVE-2026-84665 (Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL ...)
+ TODO: check
+CVE-2026-84664 (Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global ...)
+ TODO: check
+CVE-2026-84663 (A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: ...)
+ TODO: check
+CVE-2026-84662 (Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecti ...)
+ TODO: check
+CVE-2026-84661 (A missing permission check in Jenkins Pipeline: Build Step Plugin 599. ...)
+ TODO: check
+CVE-2026-84660 (A missing permission check in Jenkins Pipeline: Build Step Plugin 599. ...)
+ TODO: check
+CVE-2026-84659 (Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does no ...)
+ TODO: check
+CVE-2026-84658 (Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses th ...)
+ TODO: check
+CVE-2026-84657 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI c ...)
+ TODO: check
+CVE-2026-84656 (A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 a ...)
+ TODO: check
+CVE-2026-84655 (Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map ...)
+ TODO: check
+CVE-2026-84654 (In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e580 ...)
+ TODO: check
+CVE-2026-84653 (Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.56 ...)
+ TODO: check
+CVE-2026-84652 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does no ...)
+ TODO: check
+CVE-2026-84651 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API an ...)
+ TODO: check
+CVE-2026-84650 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient field ...)
+ TODO: check
+CVE-2026-84649 (In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inc ...)
+ TODO: check
+CVE-2026-84648 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log ...)
+ TODO: check
+CVE-2026-84647 (In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e580 ...)
+ TODO: check
+CVE-2026-84646 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects ca ...)
+ TODO: check
+CVE-2026-84645 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of type ...)
+ TODO: check
+CVE-2026-84382 (HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, t ...)
+ TODO: check
+CVE-2026-84381 (HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, h ...)
+ TODO: check
+CVE-2026-84380 (HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, R ...)
+ TODO: check
+CVE-2026-84379 (HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, F ...)
+ TODO: check
+CVE-2026-84378 (HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2 ...)
+ TODO: check
+CVE-2026-84377 (LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or ...)
+ TODO: check
+CVE-2026-84376 (Astro is a web framework for content-driven websites. Prior to 7.2.4, ...)
+ TODO: check
+CVE-2026-84217 (Missing Authorization vulnerability in Mamunur Rashid Classified Listi ...)
+ TODO: check
+CVE-2026-84175 (In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches W ...)
+ TODO: check
+CVE-2026-83562 (Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 ve ...)
+ TODO: check
+CVE-2026-83547 (The Xpro Addons WordPress plugin before 1.7.4 does not properly escape ...)
+ TODO: check
+CVE-2026-83533 (The WP Express Checkout WordPress plugin before 2.4.9 does not verify ...)
+ TODO: check
+CVE-2026-82958 (In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMes ...)
+ TODO: check
+CVE-2026-82955 (In the current development version of Eclipse aeriOS, which has not ye ...)
+ TODO: check
+CVE-2026-82884 (The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise a ...)
+ TODO: check
+CVE-2026-82522 (libjxl before 0.12 contains an integer underflow vulnerability in the ...)
+ TODO: check
+CVE-2026-82404 (TOON is a compact, human-readable serialization of JSON data for LLM p ...)
+ TODO: check
+CVE-2026-82293 (Incorrect Authorization (CWE-863) in the Kibana machine learning featu ...)
+ TODO: check
+CVE-2026-82223 (Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 v ...)
+ TODO: check
+CVE-2026-81775 (Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 version ...)
+ TODO: check
+CVE-2026-81774 (Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachm ...)
+ TODO: check
+CVE-2026-81772 (Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles ...)
+ TODO: check
+CVE-2026-81771 (Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 ver ...)
+ TODO: check
+CVE-2026-81770 (Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= ...)
+ TODO: check
+CVE-2026-81769 (Incorrect Privilege Assignment vulnerability in LiquidThemes Booking H ...)
+ TODO: check
+CVE-2026-81571 (The Brave WordPress plugin before 0.8.8 does not prevent a URL paramet ...)
+ TODO: check
+CVE-2026-81294 (Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.)
+ TODO: check
+CVE-2026-81289 (Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Mus ...)
+ TODO: check
+CVE-2026-81288 (Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer ...)
+ TODO: check
+CVE-2026-81286 (Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.)
+ TODO: check
+CVE-2026-81283 (Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions ...)
+ TODO: check
+CVE-2026-81269 (Missing Authorization vulnerability in Drupal Data field allows Forcef ...)
+ TODO: check
+CVE-2026-81205 (Improper Neutralization of Special Elements used in an LDAP Query ('LD ...)
+ TODO: check
+CVE-2026-81201 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-81168 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
+ TODO: check
+CVE-2026-81167 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-81166 (Missing Authorization vulnerability in Drupal Digital Signage Framewor ...)
+ TODO: check
+CVE-2026-81165 (Incorrect Authorization vulnerability in Drupal Blazy allows Forceful ...)
+ TODO: check
+CVE-2026-81164 (Missing Authorization vulnerability in Drupal Entity PDF allows Forcef ...)
+ TODO: check
+CVE-2026-81162 (Insertion of Sensitive Information Into Sent Data vulnerability in Dru ...)
+ TODO: check
+CVE-2026-81161 (Privilege Defined With Unsafe Actions vulnerability in Drupal Content ...)
+ TODO: check
+CVE-2026-81160 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-81159 (Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSo ...)
+ TODO: check
+CVE-2026-81158 (Incorrect Authorization vulnerability in Drupal Entity API allows Forc ...)
+ TODO: check
+CVE-2026-79991 (Craft CMS GraphQL entry mutation resolvers (saveEntry,deleteEntry) rea ...)
+ TODO: check
+CVE-2026-79990 (Craft CMS GraphQL entry mutation resolvers (saveEntry,deleteEntry) rea ...)
+ TODO: check
+CVE-2026-79989 (The vulnerability allows any authenticated user to change their own pa ...)
+ TODO: check
+CVE-2026-79756 (Nuclio is a "Serverless" framework for Real-Time Events and Data Proce ...)
+ TODO: check
+CVE-2026-79755 (Nuclio is a "Serverless" framework for Real-Time Events and Data Proce ...)
+ TODO: check
+CVE-2026-79754 (Nuclio is a "Serverless" framework for Real-Time Events and Data Proce ...)
+ TODO: check
+CVE-2026-78689 (Description NGINX JavaScript (njs) has a vulnerability in the XML mo ...)
+ TODO: check
+CVE-2026-78609 (Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) ...)
+ TODO: check
+CVE-2026-78604 (Incorrect Permission Assignment for Critical Resource (CWE-732) in Ela ...)
+ TODO: check
+CVE-2026-78602 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
+ TODO: check
+CVE-2026-78601 (Missing Authorization (CWE-862) in Kibana can lead to information disc ...)
+ TODO: check
+CVE-2026-78600 (Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can ...)
+ TODO: check
+CVE-2026-78599 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
+ TODO: check
+CVE-2026-78598 (Incorrect Authorization (CWE-863) in the Kibana machine learning featu ...)
+ TODO: check
+CVE-2026-78594 (Improper Handling of Highly Compressed Data (CWE-409) in APM Server ca ...)
+ TODO: check
+CVE-2026-78591 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
+ TODO: check
+CVE-2026-78590 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
+ TODO: check
+CVE-2026-78588 (Allocation of Resources Without Limits or Throttling (CWE-770) in File ...)
+ TODO: check
+CVE-2026-78587 (Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial ...)
+ TODO: check
+CVE-2026-78586 (Allocation of Resources Without Limits or Throttling (CWE-770) in Kiba ...)
+ TODO: check
+CVE-2026-78584 (Observable Response Discrepancy (CWE-204) in the Kibana Osquery featur ...)
+ TODO: check
+CVE-2026-78410 (A flaw was found in util-linux. Restricted bind mounts take the source ...)
+ TODO: check
+CVE-2026-78409 (The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 ...)
+ TODO: check
+CVE-2026-78408 (The nsenter --join-cgroup option opens the target cgroup.procs file as ...)
+ TODO: check
+CVE-2026-78222 (A vulnerability exists in NGINX JavaScript where a malformed HTTP resp ...)
+ TODO: check
+CVE-2026-78153 (The Restrict User Access WordPress plugin before 2.8.1 does not normal ...)
+ TODO: check
+CVE-2026-77794 (The RegistrationMagic WordPress plugin before 6.0.9.9 does not validat ...)
+ TODO: check
+CVE-2026-77793 (The RegistrationMagic WordPress plugin before 6.0.9.9 does not validat ...)
+ TODO: check
+CVE-2026-77180 (When NGINX Ingress Controller is configured with Ingress annotations, ...)
+ TODO: check
+CVE-2026-77125 (A vulnerability was identified in Sonatype Nexus Repository 3 in which ...)
+ TODO: check
+CVE-2026-77124 (In affected versions of Nexus Repository 3, the script execution endpo ...)
+ TODO: check
+CVE-2026-77123 (Nexus Repository 3 contains a sensitive information disclosure vulnera ...)
+ TODO: check
+CVE-2026-77122 (An authorization flaw in the REST API repository details endpoint (GET ...)
+ TODO: check
+CVE-2026-77121 (A user account with permission to deploy artifacts to a hosted Maven r ...)
+ TODO: check
+CVE-2026-77009 (The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict ac ...)
+ TODO: check
+CVE-2026-76782 (Vulnerability in Drupal Screenshot. This issue affects Screenshot vers ...)
+ TODO: check
+CVE-2026-76759 (Vulnerability in Drupal Screenshot. This issue affects Screenshot vers ...)
+ TODO: check
+CVE-2026-76758 (Vulnerability in Drupal Link content parser. This issue affects Link c ...)
+ TODO: check
+CVE-2026-76757 (Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS ...)
+ TODO: check
+CVE-2026-76756 (Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS ...)
+ TODO: check
+CVE-2026-76755 (Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS ...)
+ TODO: check
+CVE-2026-75528 (The Broken Link Checker plugin for WordPress is vulnerable to Stored C ...)
+ TODO: check
+CVE-2026-73478 (Incorrect Authorization vulnerability in Drupal Diff allows Forceful B ...)
+ TODO: check
+CVE-2026-73477 (Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forc ...)
+ TODO: check
+CVE-2026-73476 (Improper Handling of Case Sensitivity vulnerability in Drupal External ...)
+ TODO: check
+CVE-2026-73475 (Incorrect Authorization vulnerability in Drupal Commerce PayPal allows ...)
+ TODO: check
+CVE-2026-73474 (Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Shar ...)
+ TODO: check
+CVE-2026-66842 (BIG-IP has a vulnerability where an authenticated user of any role may ...)
+ TODO: check
+CVE-2026-66652 (Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand To ...)
+ TODO: check
+CVE-2026-66362 (Description: When NGINX Plus is configured as the data plane for NGINX ...)
+ TODO: check
+CVE-2026-63020 (A vulnerability exists in an undisclosed BIG-IP Configuration utility ...)
+ TODO: check
+CVE-2026-55421 (Open edX Platform enables the authoring and delivery of online learnin ...)
+ TODO: check
+CVE-2026-55221 (Boruta is a standalone authorization server that aims to implement OAu ...)
+ TODO: check
+CVE-2026-53706 (PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interp ...)
+ TODO: check
+CVE-2026-53683 (reset_password.html parses query string parameters and uses the 'url' ...)
+ TODO: check
+CVE-2026-53671 (PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interp ...)
+ TODO: check
+CVE-2026-53670 (PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interp ...)
+ TODO: check
+CVE-2026-53649 (Joro is a web exploitation framework. Prior to version 1.1.1, Joro's d ...)
+ TODO: check
+CVE-2026-53636 (Open edX Platform enables the authoring and delivery of online learnin ...)
+ TODO: check
+CVE-2026-53635 (Open edX Platform enables the authoring and delivery of online learnin ...)
+ TODO: check
+CVE-2026-53611 (Looking Glass is a modern, stateless network-diagnostic platform \u201 ...)
+ TODO: check
+CVE-2026-53600 (async-tar is a tar archive reading/writing library for async Rust. Pri ...)
+ TODO: check
+CVE-2026-52833 (Nuclio is a "Serverless" framework for Real-Time Events and Data Proce ...)
+ TODO: check
+CVE-2026-52832 (Nuclio is a "Serverless" framework for Real-Time Events and Data Proce ...)
+ TODO: check
+CVE-2026-52831 (Nuclio is a "Serverless" framework for Real-Time Events and Data Proce ...)
+ TODO: check
+CVE-2026-4357 (The Embed HTML5 Game WordPress plugin through 1.3 does not properly re ...)
+ TODO: check
+CVE-2026-49833 (DSpace open source software is a repository application which provides ...)
+ TODO: check
+CVE-2026-49832 (DSpace open source software is a repository application which provides ...)
+ TODO: check
+CVE-2026-49831 (DSpace open source software is a repository application which provides ...)
+ TODO: check
+CVE-2026-49830 (DSpace open source software is a repository application which provides ...)
+ TODO: check
+CVE-2026-49249 (Boruta is a standalone authorization server that aims to implement OAu ...)
+ TODO: check
+CVE-2026-45730 (Nuclio is a "Serverless" framework for Real-Time Events and Data Proce ...)
+ TODO: check
+CVE-2026-32773 (There is a lack of XSS escaping in the Spark History Server prior to 3 ...)
+ TODO: check
+CVE-2026-2811 (The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP ...)
+ TODO: check
+CVE-2026-2688 (The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded aut ...)
+ TODO: check
+CVE-2026-23591
+ REJECTED
+CVE-2026-23590
+ REJECTED
+CVE-2026-23589
+ REJECTED
+CVE-2026-23588
+ REJECTED
+CVE-2026-23587
+ REJECTED
+CVE-2026-23586
+ REJECTED
+CVE-2026-23585
+ REJECTED
+CVE-2026-23584
+ REJECTED
+CVE-2026-23583
+ REJECTED
+CVE-2026-20355 (Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Exte ...)
+ TODO: check
+CVE-2026-20354 (Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Exte ...)
+ TODO: check
+CVE-2026-20281 (A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 a ...)
+ TODO: check
+CVE-2026-20280 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-20279 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-20278 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-20277 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-20276 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-20275 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-20274 (As part of Cisco's ongoing commitment to proactive security and produc ...)
+ TODO: check
+CVE-2026-20212 (A vulnerability in the Silicon One integration for Cisco Nexus 9000 Se ...)
+ TODO: check
+CVE-2026-19698 (The GutenKit WordPress plugin before 2.5.1 does not validate or escape ...)
+ TODO: check
+CVE-2026-19475 (An authenticated user with permission to query a SQL data source can b ...)
+ TODO: check
+CVE-2026-19219 (In Progress\xae Telerik\xae UI for AJAX prior to v2026.3.812, insuffic ...)
+ TODO: check
+CVE-2026-19117 (Under specific conditions, an attacker can register an attacker-contro ...)
+ TODO: check
+CVE-2026-18986 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
+ TODO: check
+CVE-2026-18672 (In Progress\xae Telerik\xae UI for AJAX prior to v2026.3.812, insuffic ...)
+ TODO: check
+CVE-2026-18329 (Description NGINX JavaScript (njs)and QuickJS (qjs) engineshave a vul ...)
+ TODO: check
+CVE-2026-18058 (The mobile Smart Connect dashboard UI was subject to manipulation by 3 ...)
+ TODO: check
+CVE-2026-17563 (The User Frontend WordPress plugin before 4.3.11 does not enforce its ...)
+ TODO: check
+CVE-2026-16647 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
+ TODO: check
+CVE-2026-14828 (Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM3 ...)
+ TODO: check
+CVE-2026-14326 (The Timetics WordPress plugin through 1.0.61 does not enforce per-obje ...)
+ TODO: check
+CVE-2026-14255 (A maliciously crafted IFC file, when parsed through certain Autodesk p ...)
+ TODO: check
+CVE-2026-14199 (Only self-managed Grafana instances with Auth Proxy authentication and ...)
+ TODO: check
+CVE-2026-12704 (When SAML IdP-initiated login is enabled in Grafana Enterprise, the SA ...)
+ TODO: check
+CVE-2026-10821 (The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize ...)
+ TODO: check
+CVE-2025-9314 (The Developer Tools WordPress plugin through 1.1.3 contains an unauthe ...)
+ TODO: check
+CVE-2025-8945 (The Wp Edit Password Protected WordPress plugin before 1.3.5 allows pr ...)
+ TODO: check
+CVE-2025-7963 (The Easy Waveform Player plugin for WordPress is vulnerable to Stored ...)
+ TODO: check
+CVE-2025-15692 (The Icegram Express WordPress plugin before 5.8.6 does not properly es ...)
+ TODO: check
+CVE-2025-15490 (The Passster WordPress plugin before 4.2.26 has a flaw in its global p ...)
+ TODO: check
+CVE-2025-15489 (The Passster WordPress plugin before 4.2.24 does not handle input prop ...)
+ TODO: check
+CVE-2025-15485 (The Auto x LINE WordPress plugin through 1.0.0 does not have authoriza ...)
+ TODO: check
+CVE-2025-15481 (The Notification Bar for WordPress plugin through 1.1.8 exposes an una ...)
+ TODO: check
+CVE-2025-13398
+ REJECTED
+CVE-2024-7956 (A vulnerability exists in the affected products that allows a threat a ...)
+ TODO: check
+CVE-2024-3773 (The LiveJournal Shortcode WordPress plugin through 1.1.1 does not vali ...)
+ TODO: check
+CVE-2023-3360 (The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the c ...)
+ TODO: check
CVE-2026-9055 (The Booking for Appointments and Events Calendar \u2013 Amelia (Premiu ...)
NOT-FOR-US: WordPress plugin
CVE-2026-84715 (FeatherPanel versions before 1.3.7.10 fail to validate permissions in ...)
@@ -1008,6 +1482,7 @@ CVE-2026-53682 (An unauthenticated client can query the Security Domain hosts in
- dogtag-pki <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2487511
CVE-2026-52295 (Buffer Overflow vulnerability in Ffmpeg v.7.0 and after allows an atta ...)
+ {DSA-6268-1}
- ffmpeg 7:8.1.1-1
[bookworm] - ffmpeg <not-affected> (Vulnerable code not present)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988
@@ -2124,7 +2599,7 @@ CVE-2026-82643 (WWBN AVideo contains an unauthenticated credential submission vu
NOT-FOR-US: WWBN AVideo
CVE-2026-82642 (Readest is an open-source e-book reader built on Tauri. In versions pr ...)
- readest <itp> (bug #1107071)
-CVE-2026-82641 (keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP ...)
+CVE-2026-82641 (Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent ...)
NOT-FOR-US: keploy
CVE-2026-82640 (browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM A ...)
NOT-FOR-US: browser-use web-ui
@@ -5326,7 +5801,7 @@ CVE-2026-81203 (A vulnerability has been found in SourceCodester Simple Online F
CVE-2026-81202 (A flaw has been found in itsourcecode Payroll System 1.0. The impacted ...)
NOT-FOR-US: itsourcecode System
CVE-2026-80183 (In OpenStack Keystone before 29.0.3, any authenticated user holding ro ...)
- {DSA-6480-1}
+ {DSA-6480-1 DLA-4767-1}
- keystone 2:29.0.2-2 (bug #1145816)
NOTE: https://launchpad.net/bugs/2154645
CVE-2026-79939 (Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an U ...)
@@ -7826,7 +8301,7 @@ CVE-2026-18331 (The Formidable Forms \u2013 WordPress Form Builder for Contact F
NOT-FOR-US: WordPress plugin
CVE-2026-18261 (Vulnerability in Drupal Powerful Surveys. This issue affects Powerful ...)
NOT-FOR-US: Drupal core and addons
-CVE-2026-18260 (Vulnerability in Drupal Disable Login Page. This issue affects Disable ...)
+CVE-2026-18260 (Improper Restriction of Excessive Authentication Attempts vulnerabilit ...)
NOT-FOR-US: Drupal core and addons
CVE-2026-18259 (Observable Timing Discrepancy vulnerability in Drupal Token Content Ac ...)
NOT-FOR-US: Drupal core and addons
@@ -7877,12 +8352,12 @@ CVE-2026-13404 (The Royal Addons for Elementor WordPress plugin before 1.7.1066
CVE-2026-13172 (The Eventin WordPress plugin before 4.1.22 does not restrict access t ...)
NOT-FOR-US: WordPress plugin
CVE-2026-80184 (In OpenStack Keystone before 29.0.3, tokens obtained via delegated aut ...)
- {DSA-6480-1}
+ {DSA-6480-1 DLA-4767-1}
- keystone 2:29.0.2-1 (bug #1145669)
NOTE: https://www.openwall.com/lists/oss-security/2026/08/25/9
NOTE: https://bugs.launchpad.net/keystone/+bug/2158538
CVE-2026-80182 (In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access ...)
- {DSA-6480-1}
+ {DSA-6480-1 DLA-4767-1}
- keystone 2:29.0.2-1 (bug #1145669)
NOTE: https://www.openwall.com/lists/oss-security/2026/08/25/9
NOTE: https://bugs.launchpad.net/keystone/+bug/2153453
@@ -10480,7 +10955,7 @@ CVE-2026-77682 [Use a user message to trigger form autofill]
[trixie] - epiphany-browser <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2147
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/epiphany/-/commit/e85444e03490cff1584251028a11d5dfeb3accac (50.6)
-CVE-2026-66786
+CVE-2026-66786 (A flaw was found in submariner. In cert-auth mode, the connection conf ...)
NOT-FOR-US: Submariner
CVE-2026-9052
REJECTED
@@ -11107,6 +11582,7 @@ CVE-2026-55015 (Uncontrolled search path element in Windows Remote Help allows a
CVE-2026-55013 (Uncontrolled search path element in Windows Remote Help Defense allows ...)
NOT-FOR-US: Microsoft
CVE-2026-54789 (mod_auth_openidc is an OpenID Certified authentication and authorizati ...)
+ {DLA-4768-1}
- libapache2-mod-auth-openidc 2.4.19.4-1
NOTE: https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-vgr5-qcpp-x2pr
NOTE: Fixed by: https://github.com/OpenIDC/mod_auth_openidc/commit/8017478471cc071c49aa073c5c9be652a73a8630 (v2.4.19.4)
@@ -37585,14 +38061,14 @@ CVE-2024-40683 (IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.
NOT-FOR-US: IBM
CVE-2024-25039 (IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7 ...)
NOT-FOR-US: IBM
-CVE-2026-60075 (Date::Manip versions through 6.99 for Perl allow CPU exhaustion via qu ...)
+CVE-2026-60075 (Date::Manip versions through 7.00 for Perl allow CPU exhaustion via qu ...)
- libdate-manip-perl 6.99-2 (bug #1143125)
[trixie] - libdate-manip-perl <no-dsa> (Minor issue)
[bookworm] - libdate-manip-perl <postponed> (Minor issue)
[bullseye] - libdate-manip-perl <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/42266599/
NOTE: https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch
-CVE-2026-60074 (Date::Manip versions through 6.99 for Perl return corrupted dates via ...)
+CVE-2026-60074 (Date::Manip versions through 7.00 for Perl return corrupted dates via ...)
- libdate-manip-perl 6.99-2 (bug #1143125)
[trixie] - libdate-manip-perl <no-dsa> (Minor issue)
[bookworm] - libdate-manip-perl <postponed> (Minor issue)
@@ -67657,6 +68133,7 @@ CVE-2026-61626 [GHSA-5gf7-wjfm-vmvm: Out-of-bounds bit clears for negative Matro
NOTE: Fixed with: https://github.com/libass/libass/commit/23da65a130bb8c5b2cf0c7df0dd7d424607f98f1 (0.17.5)
NOTE: https://github.com/libass/libass/issues/937
CVE-2026-61627 [GHSA-pjjp-65r7-ppgm: Out-of-bounds read and write in wrap_lines_measure]
+ {DLA-4769-1}
- libass 1:0.17.5-1
[trixie] - libass 1:0.17.3-1+deb13u1
NOTE: https://github.com/libass/libass/security/advisories/GHSA-pjjp-65r7-ppgm
@@ -138563,7 +139040,7 @@ CVE-2026-29173 (Craft Commerce is an ecommerce platform for Craft CMS. Prior to
NOT-FOR-US: Craft Commerce
CVE-2026-29172 (Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 ...)
NOT-FOR-US: Craft Commerce
-CVE-2026-29113 (Craft is a content management system (CMS). Prior to 4.17.4 and 5.9.7, ...)
+CVE-2026-29113 (Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, ...)
NOT-FOR-US: Craft CMS
CVE-2026-28495 (GetSimple CMS is a content management system. The massiveAdmin plugin ...)
NOT-FOR-US: GetSimple CMS
@@ -157839,11 +158316,14 @@ CVE-2026-0769 (Langflow eval_custom_component_code Eval Injection Remote Code Ex
NOT-FOR-US: Langflow
CVE-2026-0768 (Langflow code Code Injection Remote Code Execution Vulnerability. This ...)
NOT-FOR-US: Langflow
-CVE-2026-0767 (Open WebUI Cleartext Transmission of Credentials Information Disclosur ...)
+CVE-2026-0767
+ REJECTED
NOT-FOR-US: Open WebUI
-CVE-2026-0766 (Open WebUI load_tool_module_by_id Command Injection Remote Code Execut ...)
+CVE-2026-0766
+ REJECTED
NOT-FOR-US: Open WebUI
-CVE-2026-0765 (Open WebUI PIP install_frontmatter_requirements Command Injection Remo ...)
+CVE-2026-0765
+ REJECTED
NOT-FOR-US: Open WebUI
CVE-2026-0764 (GPT Academic upload Deserialization of Untrusted Data Remote Code Exec ...)
NOT-FOR-US: GPT Academic
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a0715c8cf0a0d8fd06f8dbcdcbe0560a61e956fd
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a0715c8cf0a0d8fd06f8dbcdcbe0560a61e956fd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260902/eb4123c7/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list