[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Sep 12 20:13:35 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
af616520 by security tracker role at 2026-09-12T19:13:29+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,89 @@
+CVE-2026-90560 (zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read ...)
+ TODO: check
+CVE-2026-90559 (snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerabi ...)
+ TODO: check
+CVE-2026-90558 (sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in ...)
+ TODO: check
+CVE-2026-90557 (Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vul ...)
+ TODO: check
+CVE-2026-90556 (Freeciv versions before 3.2.6 contain a heap buffer overflow in workli ...)
+ TODO: check
+CVE-2026-90555 (vLLM versions before 0.28.0 fail to validate audio sample rate headers ...)
+ TODO: check
+CVE-2026-90554 (vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size ...)
+ TODO: check
+CVE-2026-90553 (vLLM before 0.28.0 contains a remote code execution vulnerability in t ...)
+ TODO: check
+CVE-2026-90552 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90551 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90550 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90549 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90548 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90547 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90546 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90545 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90544 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90543 (WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and ear ...)
+ TODO: check
+CVE-2026-90542 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90541 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90540 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90539 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 co ...)
+ TODO: check
+CVE-2026-90538 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 co ...)
+ TODO: check
+CVE-2026-90537 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 co ...)
+ TODO: check
+CVE-2026-90536 (WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90535 (Flowise versions before 3.1.4 contain an unauthenticated denial of ser ...)
+ TODO: check
+CVE-2026-90534 (Flowise is a low-code platform for building LLM applications. In versi ...)
+ TODO: check
+CVE-2026-90533 (Flowise before 3.1.4 contains a broken access control vulnerability in ...)
+ TODO: check
+CVE-2026-90474 (MCPHub before 1.0.32 contains an authentication bypass vulnerability i ...)
+ TODO: check
+CVE-2026-90473 (msgpack-java through 0.9.12 contains an integer overflow vulnerability ...)
+ TODO: check
+CVE-2026-90472 (msgpack-java through 0.9.12 contains a stack overflow vulnerability in ...)
+ TODO: check
+CVE-2026-89172 (Improper protection of physical side channels vulnerability in Microch ...)
+ TODO: check
+CVE-2026-85200 (The GEO my WP plugin for WordPress is vulnerable to Local File Inclusi ...)
+ TODO: check
+CVE-2026-85198 (The MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programma ...)
+ TODO: check
+CVE-2026-78175 (The Tutor LMS \u2013 eLearning and online course solution plugin for W ...)
+ TODO: check
+CVE-2026-78159 (The The Events Calendar plugin for WordPress is vulnerable to Remote C ...)
+ TODO: check
+CVE-2026-78006 (The The Events Calendar plugin for WordPress is vulnerable to Remote C ...)
+ TODO: check
+CVE-2026-77161 (The Smart Marketing SMS and Newsletters Forms plugin for WordPress is ...)
+ TODO: check
+CVE-2026-17585 (The Royal Addons for Elementor \u2013 Addons and Templates Kit for Ele ...)
+ TODO: check
+CVE-2026-16482 (The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress ...)
+ TODO: check
+CVE-2026-15451 (The MemberPress Corporate Accounts plugin for WordPress is vulnerable ...)
+ TODO: check
+CVE-2026-11355 (The DT LMS \u2013 elearning, WordPress LMS plugin for WordPress is vul ...)
+ TODO: check
+CVE-2026-10148 (The Booking for Appointments and Events Calendar plugin for WordPress ...)
+ TODO: check
CVE-2026-90467 (aiosmtplib before 5.1.3 fails to properly validate email addresses sup ...)
- aiosmtplib <unfixed> (bug #1147474)
NOTE: Fixed by: https://github.com/cole/aiosmtplib/commit/2e1b210714974ccc9efd0d09a8f846cb9aeaaec2 (v5.1.3)
@@ -67737,6 +67823,7 @@ CVE-2026-60065 (When NGINX Plus is configured to use the Message Queuing Telemet
CVE-2026-60062 (The NGINX Agent config_dirsdirective allows a low-privileged attacker ...)
NOT-FOR-US: F5
CVE-2026-60005 (NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ ...)
+ {DSA-6496-1}
- nginx 1.30.1-7
NOTE: https://my.f5.com/manage/s/article/K000162100
CVE-2026-59955 (Apollo is a reliable configuration management system suitable for micr ...)
@@ -67811,6 +67898,7 @@ CVE-2026-56699
CVE-2026-56687 (Dell ThinOS 10, versions prior to 2605_10.2100, contain an Obsolete Fe ...)
NOT-FOR-US: Dell / EMC
CVE-2026-56434 (NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ ...)
+ {DSA-6496-1}
- nginx 1.30.1-7
NOTE: https://my.f5.com/manage/s/article/K000162098
CVE-2026-56400 (open-webui before 0.3.14 contains a cross-origin resource sharing misc ...)
@@ -67917,6 +68005,7 @@ CVE-2026-44986 (Penpot is an open-source design tool for design and code collabo
CVE-2026-43637 (Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability ...)
NOT-FOR-US: Cornac
CVE-2026-42533 (A vulnerability exists in NGINX Plus and NGINX Open Source when a mapd ...)
+ {DSA-6496-1}
- nginx 1.30.4-3
NOTE: https://my.f5.com/manage/s/article/K000162097
CVE-2026-41580 (Stirling-PDF is a locally hosted web application that facilitates vari ...)
@@ -74146,6 +74235,7 @@ CVE-2026-56001 (A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before
NOTE: https://www.openwall.com/lists/oss-security/2026/07/08/1
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/be0b08e2d354138d3222b4490e2a77c6ee42f778 (libXfont2-2.0.8)
CVE-2026-56000 (Local attackers with a X connection able to provide GLX commit to the ...)
+ {DSA-6497-1}
- xorg-server 2:21.1.24-1 (bug #1141703)
- xwayland 2:24.1.13-1
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
@@ -74154,6 +74244,7 @@ CVE-2026-56000 (Local attackers with a X connection able to provide GLX commit t
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/d6d96084f305a142eb3db7f720d7edd21e4c98b4 (xorg-server-21.1.24)
CVE-2026-55999 (Local attackers with a X connection able to provide PCX fonts to the X ...)
+ {DSA-6497-1}
- xorg-server 2:21.1.24-1 (bug #1141703)
- xwayland 2:24.1.13-1
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/af6165208dfc8ad9ba997bbdfe1bd712e4649884
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/af6165208dfc8ad9ba997bbdfe1bd712e4649884
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260912/96a52960/attachment.htm>
More information about the debian-security-tracker-commits
mailing list