[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Sun Sep 27 08:13:20 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e35282e5 by security tracker role at 2026-09-27T07:13:12+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,159 @@
+CVE-2026-97319 (The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11 ...)
+	TODO: check
+CVE-2026-97227 (The NextScripts: Social Networks Auto-Poster WordPress plugin before 4 ...)
+	TODO: check
+CVE-2026-96899 (The Optima Express IDX WordPress plugin before 8.7.6 does not properly ...)
+	TODO: check
+CVE-2026-96897 (The Optima Express IDX WordPress plugin before 8.7.6 does not perform  ...)
+	TODO: check
+CVE-2026-96896 (The Malcure Malware Shield \u2014 Removal, Repair, Monitor WordPress p ...)
+	TODO: check
+CVE-2026-96895 (The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape som ...)
+	TODO: check
+CVE-2026-94408 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead  ...)
+	TODO: check
+CVE-2026-94400 (Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial  ...)
+	TODO: check
+CVE-2026-94399 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead  ...)
+	TODO: check
+CVE-2026-94398 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead  ...)
+	TODO: check
+CVE-2026-94397 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead  ...)
+	TODO: check
+CVE-2026-94396 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead  ...)
+	TODO: check
+CVE-2026-92995 (The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0  ...)
+	TODO: check
+CVE-2026-92436 (The Mailchimp for WooCommerce WordPress plugin before 6.3 does not req ...)
+	TODO: check
+CVE-2026-89006 (The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not ...)
+	TODO: check
+CVE-2026-89003 (The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not ...)
+	TODO: check
+CVE-2026-89001 (The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not ...)
+	TODO: check
+CVE-2026-89000 (The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not ...)
+	TODO: check
+CVE-2026-86841 (The Online Scheduling and Appointment Booking System  WordPress plugin ...)
+	TODO: check
+CVE-2026-86839 (The Online Scheduling and Appointment Booking System  WordPress plugin ...)
+	TODO: check
+CVE-2026-86609 (The Download Manager WordPress plugin before 7.5.6 does not sanitise a ...)
+	TODO: check
+CVE-2026-85002 (The EmbedPress  WordPress plugin before 4.6.7 does not escape one of i ...)
+	TODO: check
+CVE-2026-84069 (The WebFacing\u2122  WordPress plugin before 5.4 does not restrict acc ...)
+	TODO: check
+CVE-2026-82841 (The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before  ...)
+	TODO: check
+CVE-2026-82300 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead  ...)
+	TODO: check
+CVE-2026-82294 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead  ...)
+	TODO: check
+CVE-2026-81655 (The Ad Inserter  WordPress plugin before 2.8.19 does not correctly res ...)
+	TODO: check
+CVE-2026-78582 (Missing Authorization (CWE-862) in Kibana can lead to unauthorized del ...)
+	TODO: check
+CVE-2026-72668 (Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kiba ...)
+	TODO: check
+CVE-2026-72662 (Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana c ...)
+	TODO: check
+CVE-2026-100865 (Heym before 0.0.53 contains multiple independent vulnerabilities. (1)  ...)
+	TODO: check
+CVE-2026-100864 (heym before 0.0.91 contains a sandbox escape vulnerability in the expr ...)
+	TODO: check
+CVE-2026-100863 (Heym versions 0.0.90 and earlier contain two server-side request forge ...)
+	TODO: check
+CVE-2026-100862 (heym, a workflow automation platform, stores and returns multiple capa ...)
+	TODO: check
+CVE-2026-100861 (heym before 0.0.105 fails to apply egress guards to integration servic ...)
+	TODO: check
+CVE-2026-100860 (heym before 0.0.105 does not act on the result of the credential autho ...)
+	TODO: check
+CVE-2026-100859 (Heym before 0.0.106 contains a credential exfiltration vulnerability i ...)
+	TODO: check
+CVE-2026-100858 (heym before 0.0.109 contains a server-side request forgery vulnerabili ...)
+	TODO: check
+CVE-2026-100857 (AzuraCast before 0.23.4 contains a code injection vulnerability in the ...)
+	TODO: check
+CVE-2026-100856 (AzuraCast before 0.23.6 contains a code injection vulnerability in the ...)
+	TODO: check
+CVE-2026-100855 (AzuraCast before 0.23.6 contains a missing permission check vulnerabil ...)
+	TODO: check
+CVE-2026-100854 (AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on  ...)
+	TODO: check
+CVE-2026-100853 (In AzuraCast before 0.23.8, the public On-Demand download endpoint fai ...)
+	TODO: check
+CVE-2026-100852 (AzuraCast through 0.23.x contains a command injection vulnerability in ...)
+	TODO: check
+CVE-2026-100851 (AzuraCast before 0.23.8 contains a broken access control vulnerability ...)
+	TODO: check
+CVE-2026-100850 (AzuraCast before 0.23.8 contains a server-side request forgery and loc ...)
+	TODO: check
+CVE-2026-100849 (AzuraCast is a self-hosted web radio management suite. In AzuraCast be ...)
+	TODO: check
+CVE-2026-100848 (AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validat ...)
+	TODO: check
+CVE-2026-100847 (AzuraCast before 0.23.8 contains a DQL injection vulnerability in the  ...)
+	TODO: check
+CVE-2026-100846 (MONAI before 1.5.2 contains a deserialization of untrusted data vulner ...)
+	TODO: check
+CVE-2026-100845 (MONAI before 1.6.0 contains an unsafe deserialization vulnerability in ...)
+	TODO: check
+CVE-2026-100844 (MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNet ...)
+	TODO: check
+CVE-2026-100843 (MONAI versions before 1.6.0 contain a remote code execution vulnerabil ...)
+	TODO: check
+CVE-2026-100842 (MONAI through 1.6.0 contains an eval injection vulnerability in _get_f ...)
+	TODO: check
+CVE-2026-100841 (In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly r ...)
+	TODO: check
+CVE-2026-100840 (MONAI through 1.6.0 contains a remote code execution vulnerability in  ...)
+	TODO: check
+CVE-2026-100839 (Contrast is a confidential-computing runtime for Kubernetes. In versio ...)
+	TODO: check
+CVE-2026-100838 (Contrast is a confidential-computing runtime for Kubernetes. In versio ...)
+	TODO: check
+CVE-2026-100837 (Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix  ...)
+	TODO: check
+CVE-2026-100836 (Contrast through 1.20.0 contains a panic vulnerability in the transit- ...)
+	TODO: check
+CVE-2026-100835 (Contrast before 1.16.0 is susceptible to remote attestation relay atta ...)
+	TODO: check
+CVE-2026-100834 (http4k's Digest authentication module (org.http4k:http4k-security-dige ...)
+	TODO: check
+CVE-2026-100833 (Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate ...)
+	TODO: check
+CVE-2026-100746 (A vulnerability was found in coollabsio Coolify up to 4.1.0. This affe ...)
+	TODO: check
+CVE-2026-100745 (A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted  ...)
+	TODO: check
+CVE-2026-100744 (A flaw has been found in coollabsio Coolify up to 4.1.2. The affected  ...)
+	TODO: check
+CVE-2026-100740 (A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is ...)
+	TODO: check
+CVE-2026-100739 (A vulnerability was detected in mathurvishal CloudClassroom-PHP-Projec ...)
+	TODO: check
+CVE-2026-100725 (http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0 ...)
+	TODO: check
+CVE-2026-100724 (http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0. ...)
+	TODO: check
+CVE-2026-100723 (vm2 before 3.12.2 does not apply its Buffer backing-store ownership in ...)
+	TODO: check
+CVE-2026-100722 (vm2 before 3.12.2 does not apply host-side Promise rejection handling  ...)
+	TODO: check
+CVE-2026-100721 (vm2 before 3.12.2 contains an authorization bypass in the NodeVM exter ...)
+	TODO: check
+CVE-2025-71426 (Contrast is a confidential-computing runtime for Kubernetes. In versio ...)
+	TODO: check
+CVE-2025-71425 (Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to s ...)
+	TODO: check
+CVE-2025-71424 (Contrast, Edgeless Systems' runtime for confidential containers on Kub ...)
+	TODO: check
+CVE-2025-71423 (Edgelesssys Contrast is a confidential-computing runtime for Kubernete ...)
+	TODO: check
+CVE-2025-71422 (Contrast is a Kubernetes runtime for confidential containers. In versi ...)
+	TODO: check
 CVE-2026-XXXX [TROVE-2026-051]
 	- tor <unfixed>
 	NOTE: https://gitlab.torproject.org/tpo/core/tor/-/work_items/41381



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e35282e5ec86486d4a233bcdb9556a8b43310759

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e35282e5ec86486d4a233bcdb9556a8b43310759
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260927/41b233b1/attachment.htm>

More information about the debian-security-tracker-commits mailing list