[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Thu Sep 10 20:14:18 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7cce2d77 by security tracker role at 2026-09-10T19:14:09+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,477 @@
+CVE-2026-9338 (IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denia ...)
+	TODO: check
+CVE-2026-9336 (IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denia ...)
+	TODO: check
+CVE-2026-9166 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
+	TODO: check
+CVE-2026-9163 (Improper neutralization of special elements used in an SQL command ('S ...)
+	TODO: check
+CVE-2026-9161 (Observable response discrepancy vulnerability in DernekPlus Website Te ...)
+	TODO: check
+CVE-2026-8323 (URL redirection to untrusted site ('open redirect') vulnerability in A ...)
+	TODO: check
+CVE-2026-89049 (A server-side request forgery issue due to improper validation of equi ...)
+	TODO: check
+CVE-2026-89046 (zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds re ...)
+	TODO: check
+CVE-2026-89045 (zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative l ...)
+	TODO: check
+CVE-2026-89044 (Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final th ...)
+	TODO: check
+CVE-2026-89043 (passport-saml-encrypted through 0.1.13 contains an XML signature wrapp ...)
+	TODO: check
+CVE-2026-89042 (passport-saml-encrypted through 0.1.13 makes SAML signature verificati ...)
+	TODO: check
+CVE-2026-88959 (Anchor CMS through 0.12.7 fails to enforce role-based access control i ...)
+	TODO: check
+CVE-2026-88940 (knowns through 0.33.0 fails to validate the path query parameter in th ...)
+	TODO: check
+CVE-2026-88939 (knowns through 0.33.0 exempts the project.set action from permission g ...)
+	TODO: check
+CVE-2026-88938 (knowns through 0.33.0 fails to confine the path argument of the code.f ...)
+	TODO: check
+CVE-2026-88937 (knowns through 0.33.0 fails to properly validate template destination  ...)
+	TODO: check
+CVE-2026-88924 (A flaw was found in the admin backend of gvfs. The privileged gvfsd-ad ...)
+	TODO: check
+CVE-2026-88921 (MISP contains an HTML injection vulnerability in the MISPElementHTMLFo ...)
+	TODO: check
+CVE-2026-88915 (Affected versions of MISP do not consistently enforce the acting user' ...)
+	TODO: check
+CVE-2026-88899 (knowns versions before 0.31.0 fail to properly validate the x-opencode ...)
+	TODO: check
+CVE-2026-88898 (AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers ...)
+	TODO: check
+CVE-2026-88897 (Flextype CMS through 1.0.0-alpha.3 accepts API authentication credenti ...)
+	TODO: check
+CVE-2026-88896 (EspoCRM before 10.0.4 is vulnerable to server-side request forgery. Ho ...)
+	TODO: check
+CVE-2026-88895 (CyberPanel before 3.0.5 fails to enforce two-factor authentication on  ...)
+	TODO: check
+CVE-2026-88894 (Snipe-IT's predefined kit checkout path does not enforce Full Multiple ...)
+	TODO: check
+CVE-2026-88893 (OpenPanel share lookup procedures fail to validate access controls and ...)
+	TODO: check
+CVE-2026-88892 (OpenPanel is an analytics platform. In all versions (no patched releas ...)
+	TODO: check
+CVE-2026-88891 (OpenPanel fails to enforce read-only project access level on 26 of 29  ...)
+	TODO: check
+CVE-2026-88890 (OpenPanel through commit cd24bb8 contains an SQL injection vulnerabili ...)
+	TODO: check
+CVE-2026-88889 (Renovate before 44.14.7 contains a command injection vulnerability in  ...)
+	TODO: check
+CVE-2026-88888 (Renovate before 44.14.7 contains a command injection vulnerability in  ...)
+	TODO: check
+CVE-2026-88887 (Renovate is a dependency update automation tool. When listing tags/dig ...)
+	TODO: check
+CVE-2026-88886 (Renovate is a dependency update automation tool. In versions before 44 ...)
+	TODO: check
+CVE-2026-88885 (Renovate before 44.14.7 contains a command injection vulnerability in  ...)
+	TODO: check
+CVE-2026-88884 (Renovate is a dependency update automation tool. In versions before 44 ...)
+	TODO: check
+CVE-2026-88883 (Renovate is an automated dependency update tool. In versions before 44 ...)
+	TODO: check
+CVE-2026-88882 (Renovate is a dependency update automation tool. In versions before 44 ...)
+	TODO: check
+CVE-2026-88881 (Renovate, a dependency update tool, follows pagination links supplied  ...)
+	TODO: check
+CVE-2026-88880 (Renovate before 44.11.3 fails to validate Link header destinations whe ...)
+	TODO: check
+CVE-2026-88879 (Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v ...)
+	TODO: check
+CVE-2026-88878 (Traefik is an HTTP reverse proxy and load balancer. In versions >= v2. ...)
+	TODO: check
+CVE-2026-88877 (Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7 ...)
+	TODO: check
+CVE-2026-88876 (AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 conta ...)
+	TODO: check
+CVE-2026-88875 (AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (mast ...)
+	TODO: check
+CVE-2026-88874 (AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (mast ...)
+	TODO: check
+CVE-2026-88873 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 co ...)
+	TODO: check
+CVE-2026-88872 (AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contain ...)
+	TODO: check
+CVE-2026-88871 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (m ...)
+	TODO: check
+CVE-2026-88870 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 co ...)
+	TODO: check
+CVE-2026-88869 (AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contain ...)
+	TODO: check
+CVE-2026-88868 (AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contain ...)
+	TODO: check
+CVE-2026-88867 (WWBN AVideo, in versions up to and including commit c3edcc274c389816d4 ...)
+	TODO: check
+CVE-2026-88866 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 co ...)
+	TODO: check
+CVE-2026-88865 (AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails t ...)
+	TODO: check
+CVE-2026-88864 (Capgo (capgo.app) fails to restrict direct write access to the public. ...)
+	TODO: check
+CVE-2026-88863 (capgo.app (npm package `capgo`) through version 12.207.1 does not comp ...)
+	TODO: check
+CVE-2026-88862 (Capgo (capgo.app) backend through 12.242.4 does not validate parent-ch ...)
+	TODO: check
+CVE-2026-88861 (Capgo (Cap-go/capgo.app) contains an authentication bypass affecting a ...)
+	TODO: check
+CVE-2026-88860 (Capgo fails to clean up channel permission overrides when a user's las ...)
+	TODO: check
+CVE-2026-88859 (A flaw was found in Evolution. A remote attacker can exploit this vuln ...)
+	TODO: check
+CVE-2026-88790 (A security vulnerability has been detected in proma-ai Proma up to 0.1 ...)
+	TODO: check
+CVE-2026-88770 (A flaw was found in the Device Authorization Grant flow of Keycloak, a ...)
+	TODO: check
+CVE-2026-88763 (A flaw was found in the skupper-router component of Red Hat Service In ...)
+	TODO: check
+CVE-2026-88290 (GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to  ...)
+	TODO: check
+CVE-2026-88289 (GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-control ...)
+	TODO: check
+CVE-2026-88288 (GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to  ...)
+	TODO: check
+CVE-2026-88287 (GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens  ...)
+	TODO: check
+CVE-2026-88286 (GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, al ...)
+	TODO: check
+CVE-2026-88285 (GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control se ...)
+	TODO: check
+CVE-2026-88284 (GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ON ...)
+	TODO: check
+CVE-2026-88283 (GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ON ...)
+	TODO: check
+CVE-2026-88282 (GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP user ...)
+	TODO: check
+CVE-2026-88281 (GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements i ...)
+	TODO: check
+CVE-2026-88280 (GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password  ...)
+	TODO: check
+CVE-2026-88279 (GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username ...)
+	TODO: check
+CVE-2026-88278 (GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken  ...)
+	TODO: check
+CVE-2026-88277 (GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to injec ...)
+	TODO: check
+CVE-2026-88276 (GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key val ...)
+	TODO: check
+CVE-2026-88275 (GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK  ...)
+	TODO: check
+CVE-2026-88274 (GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless ...)
+	TODO: check
+CVE-2026-88273 (GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE us ...)
+	TODO: check
+CVE-2026-88272 (GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username ...)
+	TODO: check
+CVE-2026-88271 (GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device con ...)
+	TODO: check
+CVE-2026-88270 (GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware- ...)
+	TODO: check
+CVE-2026-88269 (GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent  ...)
+	TODO: check
+CVE-2026-88268 (GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer over ...)
+	TODO: check
+CVE-2026-88265 (A flaw was found in crun. After pivot_root, reopening /dev/null for st ...)
+	TODO: check
+CVE-2026-88264 (A flaw was found in crun. When the container configuration does not gi ...)
+	TODO: check
+CVE-2026-88060 (Angular is a development platform for building mobile and desktop web  ...)
+	TODO: check
+CVE-2026-88059 (Angular is a development platform for building mobile and desktop web  ...)
+	TODO: check
+CVE-2026-88058 (Angular is a development platform for building mobile and desktop web  ...)
+	TODO: check
+CVE-2026-88057 (Angular is a development platform for building mobile and desktop web  ...)
+	TODO: check
+CVE-2026-88056 (Angular is a development platform for building mobile and desktop web  ...)
+	TODO: check
+CVE-2026-88055 (AnythingLLM is an application that turns pieces of content into contex ...)
+	TODO: check
+CVE-2026-88054 (Tesseract is an open source OCR engine. In version 5.5.3 and earlier,  ...)
+	TODO: check
+CVE-2026-88053 (Tesseract is an open source OCR engine. In version 5.5.3 and earlier,  ...)
+	TODO: check
+CVE-2026-88052 (Tesseract is an open source OCR engine. In version 5.5.3 and earlier,  ...)
+	TODO: check
+CVE-2026-88051 (Tesseract is an open source OCR engine. In version 5.5.3 and earlier,  ...)
+	TODO: check
+CVE-2026-88050 (Tesseract is an open source OCR engine. In version 5.5.3 and earlier,  ...)
+	TODO: check
+CVE-2026-88049 (Tesseract is an open source OCR engine. In version 5.5.3 and earlier,  ...)
+	TODO: check
+CVE-2026-88048 (Tesseract is an open source OCR engine. In version 5.5.3 and earlier,  ...)
+	TODO: check
+CVE-2026-88047 (Tesseract is an open source OCR engine. In version 5.5.3 and earlier,  ...)
+	TODO: check
+CVE-2026-88046 (rclone is a command-line program to sync files and directories to and  ...)
+	TODO: check
+CVE-2026-88045 (rclone is a command-line program to sync files and directories to and  ...)
+	TODO: check
+CVE-2026-88044 (rclone is a command-line program to sync files and directories to and  ...)
+	TODO: check
+CVE-2026-88038 (cookies is a Node.js library for reading and writing HTTP cookies, use ...)
+	TODO: check
+CVE-2026-88036 (Improper neutralization of special elements in data query logic in the ...)
+	TODO: check
+CVE-2026-88035 (A size check in the client-side authentication path of the MongoDB C D ...)
+	TODO: check
+CVE-2026-88034 (Improper neutralization of special elements in data query logic in the ...)
+	TODO: check
+CVE-2026-88033 (Improper neutralization of special elements in data query logic in the ...)
+	TODO: check
+CVE-2026-88032 (A use-after-free in the reactive client-side encryption component of t ...)
+	TODO: check
+CVE-2026-88031 (Improper neutralization of special elements in data query logic in the ...)
+	TODO: check
+CVE-2026-88030 (Improper neutralization of special elements in data query logic in the ...)
+	TODO: check
+CVE-2026-88029 (Improper neutralization of special elements in data query logic in the ...)
+	TODO: check
+CVE-2026-88028 (Improper neutralization of special elements in data query logic in the ...)
+	TODO: check
+CVE-2026-88027 (Improper neutralization of special elements in data query logic in the ...)
+	TODO: check
+CVE-2026-88026 (Improper neutralization of regular-expression metacharacters in the LI ...)
+	TODO: check
+CVE-2026-88025 (Improper neutralization of special elements in data query logic in the ...)
+	TODO: check
+CVE-2026-88024 (Improper neutralization of special elements in data query logic in the ...)
+	TODO: check
+CVE-2026-88023 (Improper neutralization of special elements in data query logic in the ...)
+	TODO: check
+CVE-2026-88022 (Improper neutralization of special elements in data query logic in the ...)
+	TODO: check
+CVE-2026-88021 (Consul and Consul Enterprise are vulnerable to an authorization bypass ...)
+	TODO: check
+CVE-2026-88018 (rclone is a command-line program to sync files and directories to and  ...)
+	TODO: check
+CVE-2026-88017 (rclone is a command-line program to sync files and directories to and  ...)
+	TODO: check
+CVE-2026-88016 (rclone is a command-line program to sync files and directories to and  ...)
+	TODO: check
+CVE-2026-88015 (rclone is a command-line program to sync files and directories to and  ...)
+	TODO: check
+CVE-2026-88014 (rclone is a command-line program to sync files and directories to and  ...)
+	TODO: check
+CVE-2026-88013 (rclone is a command-line program to sync files and directories to and  ...)
+	TODO: check
+CVE-2026-88012 (Traefik is an open source HTTP reverse proxy and load balancer. From 2 ...)
+	TODO: check
+CVE-2026-88011 (Traefik is an open source HTTP reverse proxy and load balancer. Prior  ...)
+	TODO: check
+CVE-2026-88009 (Traefik is an open source HTTP reverse proxy and load balancer. Prior  ...)
+	TODO: check
+CVE-2026-88008 (Traefik is an open source HTTP reverse proxy and load balancer. From 2 ...)
+	TODO: check
+CVE-2026-88007 (Traefik is an open source HTTP reverse proxy and load balancer. From 2 ...)
+	TODO: check
+CVE-2026-88006 (Open WebUI is an extensible, feature-rich, and user-friendly self-host ...)
+	TODO: check
+CVE-2026-88005 (Open WebUI is an extensible, feature-rich, and user-friendly self-host ...)
+	TODO: check
+CVE-2026-88004 (Traefik is an open source HTTP reverse proxy and load balancer. From 3 ...)
+	TODO: check
+CVE-2026-87993 (The consul-template library is vulnerable to an information disclosure ...)
+	TODO: check
+CVE-2026-87962 (t-digest versions 3.1 through 3.3 contain a denial of service vulnerab ...)
+	TODO: check
+CVE-2026-87961 (ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-o ...)
+	TODO: check
+CVE-2026-87913 (A missing S3 bucket ownership verification in the AWS Security Agent M ...)
+	TODO: check
+CVE-2026-87912 (A missing S3 bucket ownership verification in the AWS Security Agent p ...)
+	TODO: check
+CVE-2026-87803 (An authorization bypass vulnerability exists in the Countly Server DBV ...)
+	TODO: check
+CVE-2026-87107 (Consul and Consul Enterprise are vulnerable to an authorization bypass ...)
+	TODO: check
+CVE-2026-87106 (Consul and Consul Enterprise are vulnerable to a denial of service in  ...)
+	TODO: check
+CVE-2026-87090 (Consul and Consul Enterprise are vulnerable to an authorization bypass ...)
+	TODO: check
+CVE-2026-85545 (There is an Vulnerability in some HikCentral Access Control versions.  ...)
+	TODO: check
+CVE-2026-85544 (There is an Improper Encryption Configuration Vulnerability in some Hi ...)
+	TODO: check
+CVE-2026-85543 (Some Wi-Fi series camera products have insufficient permission validat ...)
+	TODO: check
+CVE-2026-85310 (import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.)
+	TODO: check
+CVE-2026-85228 (An integer overflow in the tensor buffer validation component in Amazo ...)
+	TODO: check
+CVE-2026-85217 (A maliciously crafted add-in, when installed and executed in Autodesk  ...)
+	TODO: check
+CVE-2026-84828 (A flaw was found in PCS (Pacemaker Configuration System). A local atta ...)
+	TODO: check
+CVE-2026-84821 (Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82. ...)
+	TODO: check
+CVE-2026-84819 (Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versi ...)
+	TODO: check
+CVE-2026-84816 (Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.)
+	TODO: check
+CVE-2026-84042 (A flaw was found in crun. When crun is built with libkrun and a contai ...)
+	TODO: check
+CVE-2026-81805 (Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions.)
+	TODO: check
+CVE-2026-81804 (Unauthenticated Sensitive Data Exposure in ZHBackup \u2013 Backup, Res ...)
+	TODO: check
+CVE-2026-81803 (Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versio ...)
+	TODO: check
+CVE-2026-81801 (Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.)
+	TODO: check
+CVE-2026-81800 (Unauthenticated SQL Injection in Verified Reviews (Avis V\xe9rifi\xe9s ...)
+	TODO: check
+CVE-2026-81799 (Unauthenticated Broken Access Control in Return Refund and Exchange Fo ...)
+	TODO: check
+CVE-2026-81796 (Unauthenticated Broken Authentication in WP Travel <= 12.0.3 versions.)
+	TODO: check
+CVE-2026-81795 (Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter &#82 ...)
+	TODO: check
+CVE-2026-81794 (Unauthenticated Broken Access Control in Shirt Product Designer for Wo ...)
+	TODO: check
+CVE-2026-81793 (Unauthenticated Broken Access Control in Salon booking system <= 10.31 ...)
+	TODO: check
+CVE-2026-81791 (Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.)
+	TODO: check
+CVE-2026-81789 (Unauthenticated Arbitrary File Deletion in Advanced Product Fields Ext ...)
+	TODO: check
+CVE-2026-81788 (Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 ve ...)
+	TODO: check
+CVE-2026-81787 (Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3 ...)
+	TODO: check
+CVE-2026-81786 (Unauthenticated Broken Access Control in Thank You Page Customizer for ...)
+	TODO: check
+CVE-2026-81785 (Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.)
+	TODO: check
+CVE-2026-81784 (Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions.)
+	TODO: check
+CVE-2026-81783 (Subscriber Broken Authentication in MailMunch \u2013 Grow your Email L ...)
+	TODO: check
+CVE-2026-81782 (Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.)
+	TODO: check
+CVE-2026-81468 (Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper  ...)
+	TODO: check
+CVE-2026-81467 (Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper  ...)
+	TODO: check
+CVE-2026-81275 (Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.)
+	TODO: check
+CVE-2026-81052 (Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of  ...)
+	TODO: check
+CVE-2026-81051 (Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Ver ...)
+	TODO: check
+CVE-2026-81049 (Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Supp ...)
+	TODO: check
+CVE-2026-81048 (Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Ne ...)
+	TODO: check
+CVE-2026-81046 (Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection M ...)
+	TODO: check
+CVE-2026-80354 (Authorization bypass through User-Controlled key vulnerability in Apac ...)
+	TODO: check
+CVE-2026-80352 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
+	TODO: check
+CVE-2026-80351 (Improper neutralization of directives in dynamically evaluated code (' ...)
+	TODO: check
+CVE-2026-7188 (Improper neutralization of special elements used in an SQL command ('S ...)
+	TODO: check
+CVE-2026-79987 (A remote, authenticated, non-admin Craft CMS Control Panel user with o ...)
+	TODO: check
+CVE-2026-78536 (Unauthenticated Broken Access Control in Robokassa payment gateway for ...)
+	TODO: check
+CVE-2026-78374 (Joomla Extension - joomlart.com - Open mail relay via contact AJAX end ...)
+	TODO: check
+CVE-2026-78303 (Joomla Extension - joomshaper.com - Unvalidated Email Destination & Fo ...)
+	TODO: check
+CVE-2026-78302 (Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site  ...)
+	TODO: check
+CVE-2026-78085 (Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Ma ...)
+	TODO: check
+CVE-2026-78084 (Joomla Extension - joomshaper.com - Missing Access Control in Gallery  ...)
+	TODO: check
+CVE-2026-78083 (Joomla Extension - joomshaper.com - Missing CSRF Token Verification in ...)
+	TODO: check
+CVE-2026-78082 (Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in P ...)
+	TODO: check
+CVE-2026-75584 (ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability th ...)
+	TODO: check
+CVE-2026-73699 (FileRun before 2026.3.0 contains a PHP object injection vulnerability  ...)
+	TODO: check
+CVE-2026-73698 (FileRun before 2026.3.0 contains a SQL injection vulnerability that al ...)
+	TODO: check
+CVE-2026-73694 (FileRun before 2026.3.0 contains an OS command injection vulnerability ...)
+	TODO: check
+CVE-2026-73693 (FileRun before 2026.3.0 contains an OS command injection vulnerability ...)
+	TODO: check
+CVE-2026-6285 (Weak Password Recovery Mechanism for Forgotten Password vulnerability  ...)
+	TODO: check
+CVE-2026-68527 (Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authori ...)
+	TODO: check
+CVE-2026-68488 (A Time-of-check Time-of-use (TOCTOU) race condition leading to insecur ...)
+	TODO: check
+CVE-2026-68487 (Path traversal in Plesk's Backup Manager causes arbitrary file write a ...)
+	TODO: check
+CVE-2026-68006 (An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to exec ...)
+	TODO: check
+CVE-2026-66674 (Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= ...)
+	TODO: check
+CVE-2026-66632 (Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1. ...)
+	TODO: check
+CVE-2026-65639 (OS command injection in the advanced-rule parser of ConfigServer Secur ...)
+	TODO: check
+CVE-2026-65638 (Improper escaping of a request URL in  ConfigServer Security & Firewal ...)
+	TODO: check
+CVE-2026-64838 (ICEcoder versions through 8.1 fail to properly validate the oldFileNam ...)
+	TODO: check
+CVE-2026-64837 (ICEcoder through 8.1 passes an unescaped filesystem path into a shell  ...)
+	TODO: check
+CVE-2026-64836 (ICEcoder versions through 8.1 contain a path traversal vulnerability i ...)
+	TODO: check
+CVE-2026-5399 (The Redux Framework plugin for WordPress is vulnerable to Stored Cross ...)
+	TODO: check
+CVE-2026-52098 (An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrar ...)
+	TODO: check
+CVE-2026-52097 (An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitr ...)
+	TODO: check
+CVE-2026-4130 (There is a storage of sensitive information in cleartext vulnerability ...)
+	TODO: check
+CVE-2026-4129 (There is an improper access control vulnerability in NI SystemLink tha ...)
+	TODO: check
+CVE-2026-46387 (Suricata is a network Intrusion Detection System, Intrusion Prevention ...)
+	TODO: check
+CVE-2026-45763 (Suricata is a network Intrusion Detection System, Intrusion Prevention ...)
+	TODO: check
+CVE-2026-45747 (Suricata is a network Intrusion Detection System, Intrusion Prevention ...)
+	TODO: check
+CVE-2026-42808 (An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 thr ...)
+	TODO: check
+CVE-2026-42807 (A heap-based buffer overflow vulnerability in the PC bridge protocol d ...)
+	TODO: check
+CVE-2026-42806 (An out-of-bounds read vulnerability was discovered in the Bosch BME690 ...)
+	TODO: check
+CVE-2026-42805 (A stack-based buffer overflow vulnerability exists in the Bosch Sensor ...)
+	TODO: check
+CVE-2026-42804 (A stack-based buffer overflow vulnerability exists in the Bosch Sensor ...)
+	TODO: check
+CVE-2026-38626 (Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/ ...)
+	TODO: check
+CVE-2026-17038 (DrEryk Gabinet before 11.5.0uses hard-coded API credentials in its tic ...)
+	TODO: check
+CVE-2026-15889 (The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored C ...)
+	TODO: check
+CVE-2026-15461 (The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, l ...)
+	TODO: check
+CVE-2026-15419 (In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a l ...)
+	TODO: check
+CVE-2026-15418 (In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a l ...)
+	TODO: check
+CVE-2026-15417 (In the silabser.sys Windows 8 driver for CP210x devices, a local unpri ...)
+	TODO: check
+CVE-2026-13745 (A vulnerability in the Gemini CLI and associated GitHub Action allowed ...)
+	TODO: check
+CVE-2026-12683 (Improper neutralization of input during web page generation ('cross-si ...)
+	TODO: check
+CVE-2026-12682 (Improper neutralization of input during web page generation ('cross-si ...)
+	TODO: check
 CVE-2026-88069 (Pandora contains a path traversal vulnerability in its archive extract ...)
 	NOT-FOR-US: Pandora
 CVE-2026-88002 (Open WebUI is an extensible, feature-rich, and user-friendly self-host ...)
@@ -44894,12 +45368,12 @@ CVE-2026-42170 (A heap-based buffer overflow vulnerability exists in the GIMP DD
 	NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16161
 	NOTE: https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2758
 	NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/7dff816fbd58fe17456405f19db332ef5d2a44a0 (GIMP_3_2_4)
-CVE-2026-44950 [Font Server Client Cumulative Glyph Data Heap Buffer Overflow]
+CVE-2026-44950 (fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) ...)
 	- libxfont 1:2.0.9-1 (unimportant)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/08/05/1
 	NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/c2d222bb22c623d8a40f3275077fc7e6617f2c8a (libXfont2-2.0.9)
 	NOTE: Disabled support to connect to font server since 1:1.4.7-1
-CVE-2026-59679 [Font Server Client encoding Out-Of-Bounds Read/Write]
+CVE-2026-59679 (fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) ...)
 	- libxfont 1:2.0.9-1 (unimportant)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/08/05/1
 	NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/668fea81f40bcb48ec67fb55d0b851049d265290 (libXfont2-2.0.9)
@@ -305714,11 +306188,13 @@ CVE-2024-48943
 	NOTE: https://nicmx.github.io/FORT-validator/CVE.html
 	NOTE: https://github.com/NICMx/FORT-validator/commit/4ee88d1c3fa7df763dd52312134cd93c1ce50870 (1.6.4)
 CVE-2024-56170 (A validation integrity issue was discovered in Fort through 1.6.4 befo ...)
+	{DSA-6490-1}
 	- fort-validator <unfixed> (bug #1090916)
 	[bookworm] - fort-validator <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - fort-validator <postponed> (Minor issue, wait until it's fixed upstream)
 	NOTE: https://github.com/NICMx/FORT-validator/issues/82
 CVE-2024-56169 (A validation integrity issue was discovered in Fort through 1.6.4 befo ...)
+	{DSA-6490-1}
 	- fort-validator <unfixed> (bug #1090916)
 	[bookworm] - fort-validator <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - fort-validator <postponed> (Minor issue, wait until it's fixed upstream)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7cce2d774864a3f032ce78351a1879ebea900cf2

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7cce2d774864a3f032ce78351a1879ebea900cf2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260910/266d8c6d/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list