[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues

Salvatore Bonaccorso (@carnil) carnil at debian.org
Sat Sep 19 16:17:42 BST 2026



Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
193bb991 by Salvatore Bonaccorso at 2026-09-19T17:17:00+02:00
Add Debian bug references for various issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -353,10 +353,10 @@ CVE-2025-15698 (The Business Name Generator WordPress plugin through 1.3 does no
 CVE-2017-20284 (Caucho Resin contains a path traversal vulnerability in the documentat ...)
 	TODO: check
 CVE-2026-93854 (In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce o ...)
-	- blazar <unfixed>
+	- blazar <unfixed> (bug #1148408)
 	NOTE: https://launchpad.net/bugs/2162719
 CVE-2026-93852 (In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET ...)
-	- blazar <unfixed>
+	- blazar <unfixed> (bug #1148408)
 	NOTE: https://launchpad.net/bugs/2162719
 CVE-2026-93765 (Mongoid contains an unsafe reflection weakness in the document persist ...)
 	NOT-FOR-US: Mongoid
@@ -375,23 +375,23 @@ CVE-2026-93759 (Mongoid does not neutralize a string-typed query criterion suppl
 CVE-2026-93758 (An insecure direct object reference in the nested attributes handling  ...)
 	NOT-FOR-US: Mongoid
 CVE-2026-93753 (deepmerge through 4.3.1 contains a prototype poisoning vulnerability i ...)
-	- node-deepmerge <unfixed>
+	- node-deepmerge <unfixed> (bug #1148407)
 	NOTE: https://github.com/TehShrike/deepmerge/issues/273
 CVE-2026-93752 (CSSOM through 0.5.0 contains a denial of service vulnerability in CSSS ...)
 	NOT-FOR-US: CSSOM
 CVE-2026-93751 (uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability ...)
-	- node-uri-js <unfixed>
+	- node-uri-js <unfixed> (bug #1148403)
 	NOTE: https://github.com/garycourt/uri-js/issues/106
 CVE-2026-93750 (http-cache-semantics through 4.2.0 contains a cache validation vulnera ...)
-	- node-got <unfixed>
+	- node-got <unfixed> (bug #1148406)
 	NOTE: https://github.com/kornelski/http-cache-semantics/issues/57
 	NOTE: node-got embeds and provides node-http-cache-semantics
 CVE-2026-93749 (source-map-js through 1.2.1 fails to validate the per-section offset l ...)
-	- node-postcss <unfixed>
+	- node-postcss <unfixed> (bug #1148404)
 	NOTE: https://github.com/7rulnik/source-map-js/issues/76
 	NOTE: node-postcss embeds and provides node-source-map-js
 CVE-2026-93748 (http-cache-semantics through 4.2.0 fails to properly validate security ...)
-	- node-got <unfixed>
+	- node-got <unfixed> (bug #1148405)
 	NOTE: https://github.com/kornelski/http-cache-semantics/issues/56
 	NOTE: node-got embeds and provides node-http-cache-semantics
 CVE-2026-93737 (Azkaban through 4.0.0 omits project permission checks in the ScheduleS ...)
@@ -399,14 +399,14 @@ CVE-2026-93737 (Azkaban through 4.0.0 omits project permission checks in the Sch
 CVE-2026-93736 (Mealie before 3.21.0 fails to validate user ownership in the ratings a ...)
 	NOT-FOR-US: Mealie
 CVE-2026-93690 (uri-js through 4.4.1 contains a denial of service vulnerability in the ...)
-	- node-uri-js <unfixed>
+	- node-uri-js <unfixed> (bug #1148402)
 	NOTE: https://github.com/garycourt/uri-js/issues/105
 CVE-2026-93689 (WinFsp through 2.2.26215 contains a null pointer dereference vulnerabi ...)
 	NOT-FOR-US: WinFsp
 CVE-2026-93688 (SGLang through 0.5.19 in prefill/decode disaggregation mode with Moonc ...)
 	NOT-FOR-US: SGLang
 CVE-2026-93687 (braces through 3.0.3 contains a stack overflow vulnerability in the re ...)
-	- node-braces <unfixed>
+	- node-braces <unfixed> (bug #1148400)
 	NOTE: https://github.com/micromatch/braces/issues/70
 CVE-2026-93685 (A flaw was found in the multicluster-observability-addon. A remote att ...)
 	NOT-FOR-US: multicluster-observability-addon (Red Hat Advanced Cluster Management for Kubernetes 2)
@@ -1770,20 +1770,20 @@ CVE-2026-85999 (Soup Sieve is a CSS selector library designed to be used with Be
 	NOTE: https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f
 	NOTE: Fixed by: https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda (2.9)
 CVE-2026-85721 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- async-http-client <unfixed> (bug #1148410)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-7grg-jcf7-rpmx
 	NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6 (async-http-client-project-2.16.1)
 	NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14 (async-http-client-project-2.16.1)
 	NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59 (async-http-client-project-3.0.12)
 	NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/e1871a19972fb496be1b8ac6be11d79e22ff2162 (async-http-client-project-3.0.12)
 CVE-2026-85720 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- async-http-client <unfixed> (bug #1148410)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-xr57-gcx8-52hf
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/pull/2234
 	NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/9dba5ac988b7e750551f59b2eab550b60ac8a0d6 (async-http-client-project-2.16.1)
 	NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/d07dbc79f5cf378f63c246f6101d7579ace55acc (async-http-client-project-3.0.12)
 CVE-2026-85719 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
-	- async-http-client <unfixed>
+	- async-http-client <unfixed> (bug #1148410)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x5w6-vm3f-pp6f
 	NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/718ed2e86126663a88ea3db7a88cbbf93f0069b5 (async-http-client-project-2.16.1)
 	NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/abaa8bd260beda3b85825ff95069ed11eaf4ca8d (async-http-client-project-2.16.1)
@@ -5558,10 +5558,10 @@ CVE-2026-84850 (Improper certificate validation in the shared HTTP client used b
 CVE-2026-84829 (The Optimole  WordPress plugin before 4.2.12 does not properly escape  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-84501 (An unauthenticated attacker can inject arbitrary fake log lines into A ...)
-	- zookeeper <unfixed>
+	- zookeeper <unfixed> (bug #1148409)
 	NOTE: https://lists.apache.org/thread/ohby1g6zjt72p0w79rhbr41nczzvr33y
 CVE-2026-84439 (When audit logging is enabled (zookeeper.audit.enable=true), an unauth ...)
-	- zookeeper <unfixed>
+	- zookeeper <unfixed> (bug #1148409)
 	NOTE: https://lists.apache.org/thread/b7qnjvqjh393l0j07tmnb5ggg40sx3m6
 CVE-2026-84408 (QND contains an improper access control vulnerability in a named pipe, ...)
 	NOT-FOR-US: QND
@@ -6478,7 +6478,7 @@ CVE-2026-7514 (GitLab has remediated an issue in GitLab CE/EE affecting all vers
 CVE-2026-79994 (The guest-to-host Unix-domain socket relay in Docker Sandboxes validat ...)
 	TODO: check
 CVE-2026-79993 (The `deleteContainer` opcode (0x14/20) is processed without verifying  ...)
-	- zookeeper <unfixed>
+	- zookeeper <unfixed> (bug #1148409)
 	NOTE: https://lists.apache.org/thread/9cw3rmrzhqpct26v8j18fy41bghlq8y5
 CVE-2026-79708 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
 	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/193bb9916836a11b021ad2958037dff3287b9e83

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/193bb9916836a11b021ad2958037dff3287b9e83
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260919/e5999089/attachment.htm>


More information about the debian-security-tracker-commits mailing list