[Git][security-tracker-team/security-tracker][master] Add CVE-2026-86776/keepass2

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4e8d8ee6 by Salvatore Bonaccorso at 2026-09-11T05:53:46+02:00
Add CVE-2026-86776/keepass2

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -879,7 +879,9 @@ CVE-2026-87794 (bestzip versions 2.2.6 and 3.0.2 contain an argument injection v
 CVE-2026-86777 (AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authori ...)
 	NOT-FOR-US: AlchemyCMS
 CVE-2026-86776 (KeePass versions 2.35 through 2.61.1 fail to validate KDBX header fiel ...)
-	TODO: check
+	- keepass2 <unfixed>
+	NOTE: https://github.com/KSecur1ty/KDBX-Header-Size-Mirage-POC
+	TODO: check upstream details
 CVE-2026-86775 (knowns (npm package) versions <= 0.29.1 contain a path traversal vulne ...)
 	NOT-FOR-US: knowns-dev/knowns
 CVE-2026-86774 (Snipe-IT versions before 8.7.0 contain a broken access control vulnera ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4e8d8ee698c11356aa7c0681b3c07e9d9aa96419

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4e8d8ee698c11356aa7c0681b3c07e9d9aa96419
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260911/ae2b5a74/attachment.htm>