[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Mon Sep 28 08:13:29 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
6d273c0b by security tracker role at 2026-09-28T07:13:21+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,125 @@
+CVE-2026-93000 (The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the sea ...)
+ TODO: check
+CVE-2026-92996 (The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify ...)
+ TODO: check
+CVE-2026-89411 (The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not veri ...)
+ TODO: check
+CVE-2026-89303 (The Post Voting System WordPress plugin through 1.0 does not properly ...)
+ TODO: check
+CVE-2026-89300 (The WP Verify API WordPress plugin through 1.0.0 does not have any aut ...)
+ TODO: check
+CVE-2026-88828 (The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2 ...)
+ TODO: check
+CVE-2026-87723 (In Google fuse-archive versions prior to 1.24, an attacker who can pre ...)
+ TODO: check
+CVE-2026-86838 (The Bookly WordPress plugin before 28.3 does not validate client-suppl ...)
+ TODO: check
+CVE-2026-84744 (The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remov ...)
+ TODO: check
+CVE-2026-101090 (Nezha 2.2.3 contains a Host header injection regression in the OAuth2 ...)
+ TODO: check
+CVE-2026-101089 (Nezha before 2.2.7 contains an information disclosure vulnerability in ...)
+ TODO: check
+CVE-2026-101088 (Nezha is a server and website monitoring tool. In versions >= 2.2.11 a ...)
+ TODO: check
+CVE-2026-101087 (Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to va ...)
+ TODO: check
+CVE-2026-101086 (Nezha Dashboard versions before 2.3.5 fail to restrict service monitor ...)
+ TODO: check
+CVE-2026-101085 (Nezha before 2.3.8 fails to validate alert rule type and duration boun ...)
+ TODO: check
+CVE-2026-101084 (obot versions before v0.21.1 fail to enforce Access Control Rules on t ...)
+ TODO: check
+CVE-2026-101065 (Obot is an open-source AI agent/MCP platform. In all versions up to an ...)
+ TODO: check
+CVE-2026-101064 (Obot before v0.23.0 contains a server-side request forgery vulnerabili ...)
+ TODO: check
+CVE-2026-101063 (Obot versions before v0.23.0 fail to enforce authentication on MCP Reg ...)
+ TODO: check
+CVE-2026-101062 (Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_S ...)
+ TODO: check
+CVE-2026-101007 (A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This iss ...)
+ TODO: check
+CVE-2026-101006 (A flaw has been found in Frappe HR up to 16.15.0. This vulnerability a ...)
+ TODO: check
+CVE-2026-101005 (A vulnerability was detected in October CMS up to 4.3.4. This affects ...)
+ TODO: check
+CVE-2026-101004 (A security vulnerability has been detected in notionnext-org NotionNex ...)
+ TODO: check
+CVE-2026-101003 (A weakness has been identified in Cesanta Mongoose up to 7.21. Affecte ...)
+ TODO: check
+CVE-2026-101002 (A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071 ...)
+ TODO: check
+CVE-2026-101001 (A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. ...)
+ TODO: check
+CVE-2026-101000 (A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. ...)
+ TODO: check
+CVE-2026-100909 (A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The ...)
+ TODO: check
+CVE-2026-100908 (A vulnerability has been found in Eyeplus 57.0.0.0308. This affects an ...)
+ TODO: check
+CVE-2026-100907 (A flaw has been found in Eyeplus 57.0.0.0308. The impacted element is ...)
+ TODO: check
+CVE-2026-100906 (A vulnerability was detected in Eyeplus 57.0.0.0308. The affected elem ...)
+ TODO: check
+CVE-2026-100904 (A security vulnerability has been detected in amirsanni mini-inventory ...)
+ TODO: check
+CVE-2026-100903 (A vulnerability was identified in \u041e\u041e\u041e \u041d\u041f\u041 ...)
+ TODO: check
+CVE-2026-100902 (A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02 ...)
+ TODO: check
+CVE-2026-100901 (A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1 ...)
+ TODO: check
+CVE-2026-100900 (A vulnerability has been found in DevaslanPHP project-management 1.2.1 ...)
+ TODO: check
+CVE-2026-100899 (A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1. ...)
+ TODO: check
+CVE-2026-100898 (A vulnerability was detected in DevaslanPHP project-management 1.2.1/1 ...)
+ TODO: check
+CVE-2026-100897 (A security vulnerability has been detected in fuzui StudentInfo up to ...)
+ TODO: check
+CVE-2026-100896 (A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The ...)
+ TODO: check
+CVE-2026-100895 (A security flaw has been discovered in Trusted Domain Project OpenARC ...)
+ TODO: check
+CVE-2026-100894 (A vulnerability was identified in mathurvishal CloudClassroom-PHP-Proj ...)
+ TODO: check
+CVE-2026-100893 (A vulnerability was determined in Privoce VoceChat Server up to 0.5.36 ...)
+ TODO: check
+CVE-2026-100892 (A vulnerability was found in aligungr UERANSIM up to 3.3.0. This affec ...)
+ TODO: check
+CVE-2026-100891 (A vulnerability has been found in Trusted Domain Project OpenDMARC up ...)
+ TODO: check
+CVE-2026-100890 (A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. ...)
+ TODO: check
+CVE-2026-100889 (A vulnerability was detected in Trusted Domain Project OpenDKIM up to ...)
+ TODO: check
+CVE-2026-100888 (A weakness has been identified in Trusted Domain Project OpenDKIM up t ...)
+ TODO: check
+CVE-2026-100887 (A security flaw has been discovered in amirsanni Mini-Inventory-and-Sa ...)
+ TODO: check
+CVE-2026-100886 (A vulnerability was identified in Seetong T8108, T8108P, T8116 and T82 ...)
+ TODO: check
+CVE-2026-100885 (A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affe ...)
+ TODO: check
+CVE-2026-100884 (A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The ...)
+ TODO: check
+CVE-2026-100883 (A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected ...)
+ TODO: check
+CVE-2026-100882 (A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impact ...)
+ TODO: check
+CVE-2026-100881 (A security vulnerability has been detected in zhistaredu StarTraining ...)
+ TODO: check
+CVE-2026-100880 (A weakness has been identified in zhistaredu StarTraining up to 3.8.1. ...)
+ TODO: check
+CVE-2026-100879 (A security flaw has been discovered in zhistaredu StarTraining up to 3 ...)
+ TODO: check
+CVE-2026-100878 (A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. ...)
+ TODO: check
+CVE-2026-100877 (A vulnerability was determined in mathurvishal CloudClassroom-PHP-Proj ...)
+ TODO: check
+CVE-2026-100876 (A vulnerability was found in mathurvishal CloudClassroom-PHP-Project u ...)
+ TODO: check
CVE-2026-96577
NOT-FOR-US: openshift/oc-mirror
CVE-2026-96543
@@ -8279,10 +8401,12 @@ CVE-2026-94083 (Suricata before 8.0.7 has a DoH2 type confusion that can cause a
[trixie] - suricata <ignored> (Will be removed in next point release)
NOTE: Fixed by: https://github.com/OISF/suricata/commit/e574009add9c208f319e1d9d15b3bb1229c88074 (suricata-8.0.7)
CVE-2026-94057 (Exim before 4.100.1 allows SMTP smuggling in which the received messag ...)
+ {DSA-6522-1}
- exim4 4.100.1-1 (bug #1148506)
NOTE: https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html
NOTE: Fixed by: https://code.exim.org/exim/exim/commit/fb7ccaa78db25a5816a3c4413d2e6caa44aaf822
CVE-2026-94056 (Exim before 4.100.1, when Proxy-Protocol is used with an attacker-cont ...)
+ {DSA-6522-1}
- exim4 4.100.1-1 (bug #1148506)
NOTE: https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html
NOTE: Fixed by: https://code.exim.org/exim/exim/commit/2e3b687715f049bab7786c739a168b5842734d29
@@ -8293,6 +8417,7 @@ CVE-2026-94055 (Exim before 4.100.1, when certain non-default TLS settings are u
NOTE: https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html
NOTE: Fixed by: https://code.exim.org/exim/exim/commit/1c0c17d134cbf10dce3d883e10455b3aefd491e4
CVE-2026-94054 (Exim before 4.100.1, when Proxy-Protocol is used with an attacker-cont ...)
+ {DSA-6522-1}
- exim4 4.100.1-1 (bug #1148506)
NOTE: https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html
NOTE: Fixed by: https://code.exim.org/exim/exim/commit/8ead2b003af9225f712e85d246cd5544ef04ef91
@@ -63136,7 +63261,7 @@ CVE-2026-96276 (If a malicious SDK container declares an extension point with a
NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/619e75e7e453697b3f1d50d84e116e4df3d15df6 (branch flatpak-1.16.x)
NOTE: Additional requirement: https://github.com/flatpak/flatpak/commit/3d43a0f5fa602cc3edc557d8ab835030140792b1 (branch flatpak-1.16.x)
NOTE: Additional requirement: https://github.com/flatpak/flatpak/commit/68c12b9695eee4a94d896f0cf2f388f0d3c63df1 (branch flatpak-1.16.x)
-CVE-2026-96279 [GHSA-9rww-v4mm-x4jg]
+CVE-2026-96279 (A malicious OCI registry can hardlink arbitrary host files into the ex ...)
- flatpak 1.18.1-1 (bug #1144130)
[trixie] - flatpak <not-affected> (Vulnerable code not present)
[bookworm] - flatpak <not-affected> (Vulnerable code not present)
@@ -63154,7 +63279,7 @@ CVE-2026-92162 [GHSA-v2gw-v9h5-9q4x]
NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/3716e0761ece68405d0a49328f7c74cb14f4a245 (branch flatpak-1.16.x)
NOTE: Additional tests: https://github.com/flatpak/flatpak/commit/e52c97fc2f307f695f5db16d8a5ba44b23d1d894 (branch flatpak-1.16.x)
NOTE: Test workaround for old meson: https://github.com/flatpak/flatpak/pull/6768
-CVE-2026-96280 [GHSA-jr92-2v97-wgvc]
+CVE-2026-96280 (The OCI delta stream parser read sizes as guint64 but passed them to G ...)
{DSA-6432-1}
- flatpak 1.18.1-1 (bug #1144130)
NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc
@@ -63176,7 +63301,7 @@ CVE-2026-96807 (In Flatpak before 1.18.1, a malicious sandboxed app can replace
NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/aa35286d1f8ca5ab04de01560aaef349108cc356 (branch flatpak-1.16.x)
NOTE: Additional requirement: https://github.com/flatpak/flatpak/commit/3d43a0f5fa602cc3edc557d8ab835030140792b1 (branch flatpak-1.16.x)
NOTE: Additional requirement: https://github.com/flatpak/flatpak/commit/68c12b9695eee4a94d896f0cf2f388f0d3c63df1 (branch flatpak-1.16.x)
-CVE-2026-96282 [GHSA-w69g-9x8j-7p8f]
+CVE-2026-96282 (A malicious Flatpak extension can probe the host filesystem to determi ...)
{DSA-6432-1}
- flatpak 1.18.1-1 (bug #1144130)
NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f
@@ -63186,7 +63311,7 @@ CVE-2026-96282 [GHSA-w69g-9x8j-7p8f]
NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/e1f2ef83cd7225906078635e3d7561e9bc2cbd5b (branch flatpak-1.16.x)
NOTE: Additional requirement: https://github.com/flatpak/flatpak/commit/3d43a0f5fa602cc3edc557d8ab835030140792b1 (branch flatpak-1.16.x)
NOTE: Additional requirement: https://github.com/flatpak/flatpak/commit/68c12b9695eee4a94d896f0cf2f388f0d3c63df1 (branch flatpak-1.16.x)
-CVE-2026-96281 [GHSA-q4gr-vc25-57m5]
+CVE-2026-96281 (On a multi-user system, a user with an active local login session coul ...)
{DSA-6432-1}
- flatpak 1.18.1-1 (bug #1144130)
NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-q4gr-vc25-57m5
@@ -110625,7 +110750,7 @@ CVE-2026-49081 (Unauthenticated Broken Access Control in User Registration Strip
NOT-FOR-US: WordPress plugin or theme
CVE-2026-49079 (Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-49076 (Unauthenticated SQL Injection in JetEngine <= 3.8.9.1 versions.)
+CVE-2026-49076 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-49075 (Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.)
NOT-FOR-US: WordPress plugin or theme
@@ -158107,11 +158232,11 @@ CVE-2026-39860 (Nix is a package manager for Linux and other Unix systems. A bug
NOTE: Fixed by: https://github.com/NixOS/nix/commit/2f13ee6dc4ade1d919c14757891d5d8a1001eee8 (2.34.5)
NOTE: CVE exists for guix because the fix for CVE-2024-27297 introduces the issue.
TODO: check, potentially affecting guix if same issue in backporting fix for CVE-2024-2729
-CVE-2026-96284 [GHSA-2fxp-43j9-pwvc: Arbitrary read-access to files readable by _flatpak user]
+CVE-2026-96284 (A malicious user can get read-access to files in the flatpak-system-he ...)
{DSA-6223-1 DSA-6207-1}
- flatpak 1.16.4-1 (bug #1132946)
NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-2fxp-43j9-pwvc
-CVE-2026-96283 [GHSA-89xm-3m96-w3jg: cross-user CancelPull orphans another user's ongoing pull]
+CVE-2026-96283 (By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another ...)
{DSA-6223-1}
- flatpak 1.16.4-1 (bug #1132945)
NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6d273c0be96680e8bcfa3b051f646c8b3ff14537
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6d273c0be96680e8bcfa3b051f646c8b3ff14537
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260928/e7c9c4e5/attachment.htm>
More information about the debian-security-tracker-commits
mailing list