[Git][security-tracker-team/security-tracker][master] Add CVE-2026-68006/puma

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
abc06a3d by Salvatore Bonaccorso at 2026-09-12T11:20:55+02:00
Add CVE-2026-68006/puma

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2927,7 +2927,8 @@ CVE-2026-68488 (A Time-of-check Time-of-use (TOCTOU) race condition leading to i
 CVE-2026-68487 (Path traversal in Plesk's Backup Manager causes arbitrary file write a ...)
 	NOT-FOR-US: Plesk
 CVE-2026-68006 (An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to exec ...)
-	TODO: check
+	- puma <unfixed>
+	TODO: check, unclear if https://github.com/czx1111/cve/issues/1 properly reported upstream
 CVE-2026-66674 (Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-66632 (Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1. ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/abc06a3d511e619d70bb21baf4d384645f910f37

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/abc06a3d511e619d70bb21baf4d384645f910f37
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260912/c5b9a80e/attachment.htm>