[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Sep 19 16:17:42 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
193bb991 by Salvatore Bonaccorso at 2026-09-19T17:17:00+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -353,10 +353,10 @@ CVE-2025-15698 (The Business Name Generator WordPress plugin through 1.3 does no
CVE-2017-20284 (Caucho Resin contains a path traversal vulnerability in the documentat ...)
TODO: check
CVE-2026-93854 (In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce o ...)
- - blazar <unfixed>
+ - blazar <unfixed> (bug #1148408)
NOTE: https://launchpad.net/bugs/2162719
CVE-2026-93852 (In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET ...)
- - blazar <unfixed>
+ - blazar <unfixed> (bug #1148408)
NOTE: https://launchpad.net/bugs/2162719
CVE-2026-93765 (Mongoid contains an unsafe reflection weakness in the document persist ...)
NOT-FOR-US: Mongoid
@@ -375,23 +375,23 @@ CVE-2026-93759 (Mongoid does not neutralize a string-typed query criterion suppl
CVE-2026-93758 (An insecure direct object reference in the nested attributes handling ...)
NOT-FOR-US: Mongoid
CVE-2026-93753 (deepmerge through 4.3.1 contains a prototype poisoning vulnerability i ...)
- - node-deepmerge <unfixed>
+ - node-deepmerge <unfixed> (bug #1148407)
NOTE: https://github.com/TehShrike/deepmerge/issues/273
CVE-2026-93752 (CSSOM through 0.5.0 contains a denial of service vulnerability in CSSS ...)
NOT-FOR-US: CSSOM
CVE-2026-93751 (uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability ...)
- - node-uri-js <unfixed>
+ - node-uri-js <unfixed> (bug #1148403)
NOTE: https://github.com/garycourt/uri-js/issues/106
CVE-2026-93750 (http-cache-semantics through 4.2.0 contains a cache validation vulnera ...)
- - node-got <unfixed>
+ - node-got <unfixed> (bug #1148406)
NOTE: https://github.com/kornelski/http-cache-semantics/issues/57
NOTE: node-got embeds and provides node-http-cache-semantics
CVE-2026-93749 (source-map-js through 1.2.1 fails to validate the per-section offset l ...)
- - node-postcss <unfixed>
+ - node-postcss <unfixed> (bug #1148404)
NOTE: https://github.com/7rulnik/source-map-js/issues/76
NOTE: node-postcss embeds and provides node-source-map-js
CVE-2026-93748 (http-cache-semantics through 4.2.0 fails to properly validate security ...)
- - node-got <unfixed>
+ - node-got <unfixed> (bug #1148405)
NOTE: https://github.com/kornelski/http-cache-semantics/issues/56
NOTE: node-got embeds and provides node-http-cache-semantics
CVE-2026-93737 (Azkaban through 4.0.0 omits project permission checks in the ScheduleS ...)
@@ -399,14 +399,14 @@ CVE-2026-93737 (Azkaban through 4.0.0 omits project permission checks in the Sch
CVE-2026-93736 (Mealie before 3.21.0 fails to validate user ownership in the ratings a ...)
NOT-FOR-US: Mealie
CVE-2026-93690 (uri-js through 4.4.1 contains a denial of service vulnerability in the ...)
- - node-uri-js <unfixed>
+ - node-uri-js <unfixed> (bug #1148402)
NOTE: https://github.com/garycourt/uri-js/issues/105
CVE-2026-93689 (WinFsp through 2.2.26215 contains a null pointer dereference vulnerabi ...)
NOT-FOR-US: WinFsp
CVE-2026-93688 (SGLang through 0.5.19 in prefill/decode disaggregation mode with Moonc ...)
NOT-FOR-US: SGLang
CVE-2026-93687 (braces through 3.0.3 contains a stack overflow vulnerability in the re ...)
- - node-braces <unfixed>
+ - node-braces <unfixed> (bug #1148400)
NOTE: https://github.com/micromatch/braces/issues/70
CVE-2026-93685 (A flaw was found in the multicluster-observability-addon. A remote att ...)
NOT-FOR-US: multicluster-observability-addon (Red Hat Advanced Cluster Management for Kubernetes 2)
@@ -1770,20 +1770,20 @@ CVE-2026-85999 (Soup Sieve is a CSS selector library designed to be used with Be
NOTE: https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f
NOTE: Fixed by: https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda (2.9)
CVE-2026-85721 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
- - async-http-client <unfixed>
+ - async-http-client <unfixed> (bug #1148410)
NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-7grg-jcf7-rpmx
NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6 (async-http-client-project-2.16.1)
NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14 (async-http-client-project-2.16.1)
NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59 (async-http-client-project-3.0.12)
NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/e1871a19972fb496be1b8ac6be11d79e22ff2162 (async-http-client-project-3.0.12)
CVE-2026-85720 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
- - async-http-client <unfixed>
+ - async-http-client <unfixed> (bug #1148410)
NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-xr57-gcx8-52hf
NOTE: https://github.com/AsyncHttpClient/async-http-client/pull/2234
NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/9dba5ac988b7e750551f59b2eab550b60ac8a0d6 (async-http-client-project-2.16.1)
NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/d07dbc79f5cf378f63c246f6101d7579ace55acc (async-http-client-project-3.0.12)
CVE-2026-85719 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
- - async-http-client <unfixed>
+ - async-http-client <unfixed> (bug #1148410)
NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x5w6-vm3f-pp6f
NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/718ed2e86126663a88ea3db7a88cbbf93f0069b5 (async-http-client-project-2.16.1)
NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/abaa8bd260beda3b85825ff95069ed11eaf4ca8d (async-http-client-project-2.16.1)
@@ -5558,10 +5558,10 @@ CVE-2026-84850 (Improper certificate validation in the shared HTTP client used b
CVE-2026-84829 (The Optimole WordPress plugin before 4.2.12 does not properly escape ...)
NOT-FOR-US: WordPress plugin
CVE-2026-84501 (An unauthenticated attacker can inject arbitrary fake log lines into A ...)
- - zookeeper <unfixed>
+ - zookeeper <unfixed> (bug #1148409)
NOTE: https://lists.apache.org/thread/ohby1g6zjt72p0w79rhbr41nczzvr33y
CVE-2026-84439 (When audit logging is enabled (zookeeper.audit.enable=true), an unauth ...)
- - zookeeper <unfixed>
+ - zookeeper <unfixed> (bug #1148409)
NOTE: https://lists.apache.org/thread/b7qnjvqjh393l0j07tmnb5ggg40sx3m6
CVE-2026-84408 (QND contains an improper access control vulnerability in a named pipe, ...)
NOT-FOR-US: QND
@@ -6478,7 +6478,7 @@ CVE-2026-7514 (GitLab has remediated an issue in GitLab CE/EE affecting all vers
CVE-2026-79994 (The guest-to-host Unix-domain socket relay in Docker Sandboxes validat ...)
TODO: check
CVE-2026-79993 (The `deleteContainer` opcode (0x14/20) is processed without verifying ...)
- - zookeeper <unfixed>
+ - zookeeper <unfixed> (bug #1148409)
NOTE: https://lists.apache.org/thread/9cw3rmrzhqpct26v8j18fy41bghlq8y5
CVE-2026-79708 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/193bb9916836a11b021ad2958037dff3287b9e83
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/193bb9916836a11b021ad2958037dff3287b9e83
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260919/e5999089/attachment.htm>
More information about the debian-security-tracker-commits
mailing list