[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Sep 26 08:12:58 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
7ab334fd by security tracker role at 2026-09-26T07:12:40+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,321 @@
+CVE-2026-9655
+ REJECTED
+CVE-2026-9652
+ REJECTED
+CVE-2026-9313
+ REJECTED
+CVE-2026-96879 (Improper removal of sensitive information before storage or transfer v ...)
+ TODO: check
+CVE-2026-96878 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-96877 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-96876 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-96875 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-96795 (Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exp ...)
+ TODO: check
+CVE-2026-96533 (The Testimonials Widget WordPress plugin through 4.0.4 does not valida ...)
+ TODO: check
+CVE-2026-96532 (The Testimonials Widget WordPress plugin through 4.0.4 does not perfor ...)
+ TODO: check
+CVE-2026-96531 (The Optimole WordPress plugin before 4.2.13 does not escape unrecogni ...)
+ TODO: check
+CVE-2026-96526 (The MCP Server for WordPress WordPress plugin before 1.8.2 does not p ...)
+ TODO: check
+CVE-2026-96525 (The MCP Server for WordPress WordPress plugin before 1.8.2 does not p ...)
+ TODO: check
+CVE-2026-96524 (The MCP Server for WordPress WordPress plugin before 1.8.2 does not c ...)
+ TODO: check
+CVE-2026-92411 (The WP Delicious WordPress plugin before 1.10.8 does not validate or ...)
+ TODO: check
+CVE-2026-89237 (The Bluff Post WordPress plugin through 1.1.1 does not sanitise and es ...)
+ TODO: check
+CVE-2026-88003 (InvoicePlane is a self-hosted open source application for managing inv ...)
+ TODO: check
+CVE-2026-86066 (Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_at ...)
+ TODO: check
+CVE-2026-85081 (The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPre ...)
+ TODO: check
+CVE-2026-84097 (The wp-review-slider-pro WordPress plugin before 12.7.12 does not sani ...)
+ TODO: check
+CVE-2026-84096 (The wp-review-slider-pro WordPress plugin before 12.7.12 does not perf ...)
+ TODO: check
+CVE-2026-84095 (The wp-review-slider-pro WordPress plugin before 12.7.12 does not perf ...)
+ TODO: check
+CVE-2026-7800
+ REJECTED
+CVE-2026-7799
+ REJECTED
+CVE-2026-71483 (Horilla is an HR and CRM software. Prior to 1.6.0, the search paramete ...)
+ TODO: check
+CVE-2026-63432 (Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, t ...)
+ TODO: check
+CVE-2026-63431 (Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/vi ...)
+ TODO: check
+CVE-2026-5267 (Ciena Navigator Network Control Suite (NCS) contains an information ex ...)
+ TODO: check
+CVE-2026-57864
+ REJECTED
+CVE-2026-57861
+ REJECTED
+CVE-2026-57449 (Actual is a local-first personal finance tool. Prior to 26.7.0, Actual ...)
+ TODO: check
+CVE-2026-57443 (SCBE-AETHERMOORE is a geometric AI governance and evaluation framework ...)
+ TODO: check
+CVE-2026-53990
+ REJECTED
+CVE-2026-53973
+ REJECTED
+CVE-2026-53972
+ REJECTED
+CVE-2026-53971
+ REJECTED
+CVE-2026-49118
+ REJECTED
+CVE-2026-49117
+ REJECTED
+CVE-2026-45241
+ REJECTED
+CVE-2026-45240
+ REJECTED
+CVE-2026-45239
+ REJECTED
+CVE-2026-45238
+ REJECTED
+CVE-2026-45237
+ REJECTED
+CVE-2026-45236
+ REJECTED
+CVE-2026-45235
+ REJECTED
+CVE-2026-45234
+ REJECTED
+CVE-2026-19708 (The File Manager WordPress plugin before 8.0.5 does not prevent unauth ...)
+ TODO: check
+CVE-2026-18143 (The Request a Quote for WooCommerce plugin for WordPress is vulnerable ...)
+ TODO: check
+CVE-2026-16591 (The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize a ...)
+ TODO: check
+CVE-2026-15273 (The Automatic.css plugin for WordPress is vulnerable to Stored Cross-S ...)
+ TODO: check
+CVE-2026-11871 (The Team Members WordPress plugin through 9.2 does not perform any au ...)
+ TODO: check
+CVE-2026-10758 (Esri LERC is an open-source image or raster format which supports rapi ...)
+ TODO: check
+CVE-2026-100599 (OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configur ...)
+ TODO: check
+CVE-2026-100598 (OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Sign ...)
+ TODO: check
+CVE-2026-100597 (OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a t ...)
+ TODO: check
+CVE-2026-100596 (OpenClaw versions before 2026.7.1 fail to properly authorize non-owner ...)
+ TODO: check
+CVE-2026-100595 (OpenClaw versions before 2026.7.1 contain an authorization bypass vuln ...)
+ TODO: check
+CVE-2026-100594 (OpenClaw versions before 2026.7.1 contain an authorization bypass vuln ...)
+ TODO: check
+CVE-2026-100593 (OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the ...)
+ TODO: check
+CVE-2026-100592 (OpenClaw is an agent gateway distributed via npm. In versions >= 2026. ...)
+ TODO: check
+CVE-2026-100591 (OpenClaw is an npm-distributed agent gateway. In versions before 2026. ...)
+ TODO: check
+CVE-2026-100590 (OpenClaw before 2026.7.1 contains an authorization bypass vulnerabilit ...)
+ TODO: check
+CVE-2026-100589 (OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerabili ...)
+ TODO: check
+CVE-2026-100588 (OpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the ...)
+ TODO: check
+CVE-2026-100587 (OpenClaw versions before 2026.7.1 fail to properly validate owner auth ...)
+ TODO: check
+CVE-2026-100586 (OpenClaw Codex before 2026.7.1 fails to properly enforce owner authori ...)
+ TODO: check
+CVE-2026-100585 (OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the ...)
+ TODO: check
+CVE-2026-100584 (OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 ...)
+ TODO: check
+CVE-2026-100583 (OpenClaw Discord versions before 2026.7.1 contain an authorization byp ...)
+ TODO: check
+CVE-2026-100582 (OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @opencl ...)
+ TODO: check
+CVE-2026-100581 (OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleart ...)
+ TODO: check
+CVE-2026-100580 (OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles c ...)
+ TODO: check
+CVE-2026-100579 (OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts r ...)
+ TODO: check
+CVE-2026-100578 (OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict ow ...)
+ TODO: check
+CVE-2026-100577 (OpenClaw versions before 2026.8.1 fail to validate video asset URLs re ...)
+ TODO: check
+CVE-2026-100576 (OpenClaw versions before 2026.8.1 contain a server-side request forger ...)
+ TODO: check
+CVE-2026-100575 (OpenClaw Slack versions before 2026.8.1 fail to properly enforce sende ...)
+ TODO: check
+CVE-2026-100574 (OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-si ...)
+ TODO: check
+CVE-2026-100573 (OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vuln ...)
+ TODO: check
+CVE-2026-100572 (OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate ...)
+ TODO: check
+CVE-2026-100571 (OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 ...)
+ TODO: check
+CVE-2026-100570 (OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 ...)
+ TODO: check
+CVE-2026-100569 (OpenClaw is an npm-distributed application. In versions >= 2026.4.25 a ...)
+ TODO: check
+CVE-2026-100568 (OpenClaw versions before 2026.8.1 fail to properly restrict access to ...)
+ TODO: check
+CVE-2026-100567 (OpenClaw is an agent gateway distributed as the npm package 'openclaw' ...)
+ TODO: check
+CVE-2026-100566 (OpenClaw LINE versions before 2026.8.1 contain an access control vulne ...)
+ TODO: check
+CVE-2026-100564 (OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formu ...)
+ TODO: check
+CVE-2026-100563 (OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize ...)
+ TODO: check
+CVE-2026-100562 (OpenClaw versions before 2026.8.1 contain an authorization bypass vuln ...)
+ TODO: check
+CVE-2026-100561 (OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 ...)
+ TODO: check
+CVE-2026-100560 (OpenClaw versions before 2026.8.1 contain an authorization bypass vuln ...)
+ TODO: check
+CVE-2026-100559 (OpenClaw versions before 2026.8.1 contain a command parser vulnerabili ...)
+ TODO: check
+CVE-2026-100558 (OpenClaw versions before 2026.8.1 contain a resource exhaustion vulner ...)
+ TODO: check
+CVE-2026-100557 (OpenClaw versions before 2026.8.1 contain an authorization bypass vuln ...)
+ TODO: check
+CVE-2026-100556 (OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 co ...)
+ TODO: check
+CVE-2026-100555 (OpenClaw is an npm-distributed gateway application. In versions >= 202 ...)
+ TODO: check
+CVE-2026-100554 (OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 ...)
+ TODO: check
+CVE-2026-100553 (OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native ...)
+ TODO: check
+CVE-2026-100552 (OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly e ...)
+ TODO: check
+CVE-2026-100551 (OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce s ...)
+ TODO: check
+CVE-2026-100550 (OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-c ...)
+ TODO: check
+CVE-2026-100549 (OpenClaw versions before 2026.8.1 contain a path traversal vulnerabili ...)
+ TODO: check
+CVE-2026-100548 (OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 ...)
+ TODO: check
+CVE-2026-100547 (OpenClaw is a coding agent distributed as the npm package `openclaw`. ...)
+ TODO: check
+CVE-2026-100546 (OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 ...)
+ TODO: check
+CVE-2026-100545 (OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces ...)
+ TODO: check
+CVE-2026-100544 (openclaw's @openclaw/voice-call package before 2026.8.1 launches the c ...)
+ TODO: check
+CVE-2026-100543 (OpenClaw (npm package openclaw) before 2026.8.1 could include determin ...)
+ TODO: check
+CVE-2026-100542 (OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 ...)
+ TODO: check
+CVE-2026-100541 (OpenClaw's Matrix integration (npm package @openclaw/matrix) versions ...)
+ TODO: check
+CVE-2026-100540 (OpenClaw Feishu before 2026.8.1 fails to validate whether a configured ...)
+ TODO: check
+CVE-2026-100539 (OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memo ...)
+ TODO: check
+CVE-2026-100538 (OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the o ...)
+ TODO: check
+CVE-2026-100537 (OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the o ...)
+ TODO: check
+CVE-2026-100536 (OpenClaw versions before 2026.8.1 fail to validate all source fields i ...)
+ TODO: check
+CVE-2026-100535 (OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 ...)
+ TODO: check
+CVE-2026-100534 (OpenClaw versions before 2026.8.1 contain an authorization bypass vuln ...)
+ TODO: check
+CVE-2026-100533 (OpenClaw versions before 2026.8.1 contain a path traversal vulnerabili ...)
+ TODO: check
+CVE-2026-100532 (@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login to ...)
+ TODO: check
+CVE-2026-100531 (The @openclaw/slack npm package before 2026.8.1 contains an authorizat ...)
+ TODO: check
+CVE-2026-100530 (OpenClaw versions before 2026.8.1 fail to bind working directory conte ...)
+ TODO: check
+CVE-2026-100529 (OpenClaw versions before 2026.8.1 contain an authorization scope widen ...)
+ TODO: check
+CVE-2026-100528 (OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-par ...)
+ TODO: check
+CVE-2026-100527 (OpenClaw before 2026.8.2 contains a denial of service vulnerability in ...)
+ TODO: check
+CVE-2026-100526 (OpenClaw's Discord integration (npm package @openclaw/discord) before ...)
+ TODO: check
+CVE-2026-100525 (The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prom ...)
+ TODO: check
+CVE-2026-100524 (Cotonti through 1.0.0 contains a cross-site request forgery vulnerabil ...)
+ TODO: check
+CVE-2026-100523 (Cotonti through 1.0.0 contains an open redirect vulnerability in messa ...)
+ TODO: check
+CVE-2026-100522 (Cotonti through 1.0.0 contains a reflected cross-site scripting vulner ...)
+ TODO: check
+CVE-2026-100521 (Cotonti through 1.0.0 contains a reflected cross-site scripting vulner ...)
+ TODO: check
+CVE-2026-100520 (Laranode versions before 1.2.1 contain a path traversal vulnerability ...)
+ TODO: check
+CVE-2026-100505 (Ghidra versions 11.2 through 12.1.4 contain a heap out-of-bounds read ...)
+ TODO: check
+CVE-2026-100504 (Ghidra versions through 12.1.4 contain a stack-based out-of-bounds wri ...)
+ TODO: check
+CVE-2026-100503 (Ghidra versions through 12.1.4 contain a heap use-after-free vulnerabi ...)
+ TODO: check
+CVE-2026-100502 (Flame through 2.4.0 contains an insufficient session expiration vulner ...)
+ TODO: check
+CVE-2026-100501 (Flame through 2.4.0 contains an improper restriction of excessive auth ...)
+ TODO: check
+CVE-2026-100419 (gitoxide gix-fs before 0.23.0 contains a path validation bypass vulner ...)
+ TODO: check
+CVE-2026-100418 (Flame through 2.4.0 contains an information exposure vulnerability in ...)
+ TODO: check
+CVE-2026-100417 (RustDesk before 1.5.0 on Windows fails to enforce the one-way file tra ...)
+ TODO: check
+CVE-2026-100391 (MediaFlow Proxy through 2.4.9 contains a server-side request forgery v ...)
+ TODO: check
+CVE-2026-100390 (Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addres ...)
+ TODO: check
+CVE-2026-100389 (GestSup versions before 3.2.61 contain a remote code execution vulnera ...)
+ TODO: check
+CVE-2026-100388 (RustDesk versions before 1.5.0 fail to properly validate file transfer ...)
+ TODO: check
+CVE-2026-100387 (pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerab ...)
+ TODO: check
+CVE-2026-100383 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
+ TODO: check
+CVE-2026-100382 (Improper Neutralization of Special Elements used in an OS Command ('OS ...)
+ TODO: check
+CVE-2026-100381 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
+ TODO: check
+CVE-2026-100380 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
+ TODO: check
+CVE-2026-100379 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
+ TODO: check
+CVE-2026-100378 (Missing Authorization vulnerability in Wikimedia Foundation Mediawiki ...)
+ TODO: check
+CVE-2026-100377 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
+ TODO: check
+CVE-2026-100376 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
+ TODO: check
+CVE-2026-100373 (OpenMetadata through 2.0.2 contains a server-side request forgery vuln ...)
+ TODO: check
+CVE-2026-100372 (ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerabilit ...)
+ TODO: check
+CVE-2026-100369 (CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are ...)
+ TODO: check
+CVE-2026-100368 (CliInvoke is a .NET library for invoking command-line programs, and it ...)
+ TODO: check
+CVE-2026-100310 (GNU libextractor before 1.16 loads plugins from an untrusted search pa ...)
+ TODO: check
+CVE-2026-100208 (Integer overflow or wraparound in Microsoft Office Outlook allows an u ...)
+ TODO: check
CVE-2026-XXXX [Heap OOB read/write in MS-MPPE key re-encryption]
- radsecproxy 1.11.4-1
NOTE: https://github.com/radsecproxy/radsecproxy/security/advisories/GHSA-wj29-mxmc-q98c
@@ -16830,6 +17148,7 @@ CVE-2026-XXXX [Type 1 font-loader `.forceput` save/restore UAF yields native rea
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=709684
NOTE: Fixed by: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1484854e0c8ddfda1baa4ad4cd965b8a9790aa81 (ghostpdl-10.08.0)
CVE-2026-39919 (Ghostscript before 10.08.0 contains a heap-based buffer overflow vulne ...)
+ {DSA-6516-1}
- ghostscript 10.08.0~dfsg-1
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=709666
NOTE: Fixed by: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=8ddaa67d13daeca55aa13e9e3262172fa93b72f7 (ghostpdl-10.08.0)
@@ -23345,6 +23664,7 @@ CVE-2026-74761 (Improper input validation in TopicRegion in Apache ActiveMQ, Apa
CVE-2026-73334 (Potential problem for users of theorg.apache.parquet.crypto.keytools p ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73324 (Certain VLC media player builds in versions 3.0.0 through 3.0.23 conta ...)
+ {DSA-6515-1}
- vlc 3.0.24-1
CVE-2026-70425 (Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8. ...)
NOT-FOR-US: Dell / EMC
@@ -23365,6 +23685,7 @@ CVE-2026-61907 (An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze
CVE-2026-57866 (Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-56711 (VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety ...)
+ {DSA-6515-1}
- vlc 3.0.24-1
CVE-2026-56207 (Signature of Bearer token is not verified in last step of SAML2 authen ...)
NOT-FOR-US: Apache software not packaged in Debian
@@ -25608,7 +25929,7 @@ CVE-2026-78518 (Out-of-bounds read in Microsoft Office Excel allows an unauthori
NOT-FOR-US: Microsoft
CVE-2026-78517 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
NOT-FOR-US: Microsoft
-CVE-2026-78516 (Buffer over-read in Windows Storage allows an unauthorized attacker to ...)
+CVE-2026-78516 (Insertion of sensitive information into externally-accessible file or ...)
NOT-FOR-US: Microsoft
CVE-2026-78515 (Out-of-bounds read in Microsoft Office Excel allows an unauthorized at ...)
NOT-FOR-US: Microsoft
@@ -25620,7 +25941,7 @@ CVE-2026-78512 (Numeric truncation error in Microsoft Office Word allows an unau
NOT-FOR-US: Microsoft
CVE-2026-78511 (Heap-based buffer overflow in Microsoft Office Word allows an unauthor ...)
NOT-FOR-US: Microsoft
-CVE-2026-78510 (A remote code execution vulnerability exists when Microsoft Office imp ...)
+CVE-2026-78510 (Heap-based buffer overflow in Microsoft Office allows an unauthorized ...)
NOT-FOR-US: Microsoft
CVE-2026-78509 (Heap-based buffer overflow in Microsoft Office Outlook allows an unaut ...)
NOT-FOR-US: Microsoft
@@ -61157,7 +61478,7 @@ CVE-2026-62701 (Use after free in Windows Telephony Service allows an authorized
NOT-FOR-US: Microsoft
CVE-2026-62700 (Heap-based buffer overflow in Windows NTFS allows an authorized attack ...)
NOT-FOR-US: Microsoft
-CVE-2026-62699 (Heap-based buffer overflow in Windows Universal Disk Format File Syste ...)
+CVE-2026-62699 (Null pointer dereference in Windows Universal Disk Format File System ...)
NOT-FOR-US: Microsoft
CVE-2026-62698 (Numeric truncation error in Microsoft Digest Authentication allows an ...)
NOT-FOR-US: Microsoft
@@ -96422,66 +96743,66 @@ CVE-2026-10055 (In Eclipse Theia since version 1.26.0, the backend /services/req
NOT-FOR-US: Eclipse
CVE-2026-10054 (In affected versions of Eclipse Theia (1.8.1 and later), the browser b ...)
NOT-FOR-US: Eclipse
-CVE-2026-17545
+CVE-2026-17545 (On Windows, PHP's filesystem and stream APIs do not reject reserved de ...)
- php8.4 <not-affected> (Only affects PHP on Windows)
- php8.2 <not-affected> (Only affects PHP on Windows)
NOTE: https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-91766
+CVE-2026-91766 (When the http:// stream wrapper follows a redirect it forwards the use ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-92842
+CVE-2026-92842 (The convert.base64-encode, convert.quoted-printable-encode and convert ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-93682
+CVE-2026-93682 (When the HTTP stream wrapper follows a redirect and the response carri ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2025-14181
+CVE-2025-14181 (The SOAP HTTP client guards its response buffer growth with a check th ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-91765
+CVE-2026-91765 (cleanup_xml_node() in the SOAP XML parser recurses once per XML nestin ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-6103
+CVE-2026-6103 (phar_tar_number() parses the octal size field of a TAR header into a u ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-91767
+CVE-2026-91767 (php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-91769
+CVE-2026-91769 (PHP's OpenSSL stream peer verification checks the certificate's subjec ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2025-1218
+CVE-2025-1218 (The mysqlnd wire protocol parser reads fields out of server packets be ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-91768
+CVE-2026-91768 (The IPv6 branch of the FastCGI client access check compares only the f ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
@@ -182541,7 +182862,7 @@ CVE-2025-15578 (Maypole versions from 2.10 through 2.13 for Perl generates sessi
CVE-2025-12062 (The WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,List ...)
NOT-FOR-US: WordPress plugin
CVE-2026-2604 (A flaw was found in evolution-data-server. Inconsistent comparison log ...)
- {DLA-4503-1}
+ {DLA-4796-1 DLA-4503-1}
- evolution-data-server 3.56.2-8 (bug #1128332)
[trixie] - evolution-data-server <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/627
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7ab334fde7e433f9b32ecc02f851017c241ef209
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7ab334fde7e433f9b32ecc02f851017c241ef209
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260926/dd8d5301/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list