[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Sep 30 08:14:30 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
71d37cca by security tracker role at 2026-09-30T07:14:23+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,70 +1,444 @@
+CVE-2026-97316 (The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-v ...)
+ TODO: check
+CVE-2026-97196 (Improper Validation of Unsafe Equivalence in Input vulnerability in Li ...)
+ TODO: check
+CVE-2026-96886 (The Course Booking System WordPress plugin before 7.0.9 does not restr ...)
+ TODO: check
+CVE-2026-96649 (The Frontend Post Submission Manager Lite \u2013 Frontend Posting Word ...)
+ TODO: check
+CVE-2026-96587 (The Viidure Android application embeds permanent, plaintext cloud stor ...)
+ TODO: check
+CVE-2026-96274 (In Baicells Nova 430H, an unauthenticated device within radio range ca ...)
+ TODO: check
+CVE-2026-94953 (A stack-based buffer overflow vulnerability exists in the web manageme ...)
+ TODO: check
+CVE-2026-94952 (A stack-based buffer overflow vulnerability exists in the web manageme ...)
+ TODO: check
+CVE-2026-94297 (The Media Library Organizer WordPress plugin before 2.1.4 does not ve ...)
+ TODO: check
+CVE-2026-94274 (The YayReviews WordPress plugin before 1.4.1 does not restrict access ...)
+ TODO: check
+CVE-2026-94204 (The central cloud storage backend for the entire dashcam platform is m ...)
+ TODO: check
+CVE-2026-93853 (Unverified ownership in Barman snapshot backup deletion allows a princ ...)
+ TODO: check
+CVE-2026-93580 (The InPost PL WordPress plugin before 1.9.8 does not verify the authen ...)
+ TODO: check
+CVE-2026-92994 (The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 d ...)
+ TODO: check
+CVE-2026-92424 (The Content Egg WordPress plugin before 11.9.0 does not verify that a ...)
+ TODO: check
+CVE-2026-91832 (The WP Mobile Menu WordPress plugin before 2.9 does not correctly ver ...)
+ TODO: check
+CVE-2026-91191 (The device's update mechanism includes conditions that allow unauthori ...)
+ TODO: check
+CVE-2026-91072 (The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confin ...)
+ TODO: check
+CVE-2026-91051 (The EWWW Image Optimizer WordPress plugin before 8.8.0 does not preven ...)
+ TODO: check
+CVE-2026-90953 (The Image Optimizer WordPress plugin before 1.7.7 does not enforce it ...)
+ TODO: check
+CVE-2026-90441 (A missing authorization vulnerability in the wgagent management daemon ...)
+ TODO: check
+CVE-2026-89294 (The Simply Schedule Appointments plugin for WordPress is vulnerable to ...)
+ TODO: check
+CVE-2026-89193 (The Robin Image Optimizer WordPress plugin before 2.0.8 does not esca ...)
+ TODO: check
+CVE-2026-89190 (The Robin Image Optimizer WordPress plugin before 2.0.8 does not chec ...)
+ TODO: check
+CVE-2026-88797 (The Vayu X WordPress theme before 1.0.6 does not perform any capabilit ...)
+ TODO: check
+CVE-2026-88791 (The Safe Redirect Manager WordPress plugin before 2.3.0 does not prope ...)
+ TODO: check
+CVE-2026-87777 (The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize a ...)
+ TODO: check
+CVE-2026-86789 (The Connections Business Directory WordPress plugin through 10.4.67 do ...)
+ TODO: check
+CVE-2026-86556 (There is an information disclosure vulnerability in ZTE U30 Air. Due t ...)
+ TODO: check
+CVE-2026-86136 (A missing authorization vulnerability in the wgagent management daemon ...)
+ TODO: check
+CVE-2026-86134 (A NULL pointer dereference vulnerability in the WatchGuard Fireware OS ...)
+ TODO: check
+CVE-2026-86133 (An integer underflow vulnerability in the WatchGuard Fireware OS IKE d ...)
+ TODO: check
+CVE-2026-86132 (An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 ...)
+ TODO: check
+CVE-2026-86131 (A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over ...)
+ TODO: check
+CVE-2026-86128 (A NULL pointer dereference vulnerability in Fireware OS's NetFlow pack ...)
+ TODO: check
+CVE-2026-86105 (An improper authorization vulnerability in Fireware OS's Access Portal ...)
+ TODO: check
+CVE-2026-86104 (An uncontrolled resource consumption vulnerability in the Fireware OS ...)
+ TODO: check
+CVE-2026-86101 (An improper authorization vulnerability in WatchGuard Fireware OS's SA ...)
+ TODO: check
+CVE-2026-85576 (The All in One Files Upload WordPress plugin before 2.0.17 does not ha ...)
+ TODO: check
+CVE-2026-85573 (The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to ...)
+ TODO: check
+CVE-2026-85415 (The Audio Player Block WordPress plugin before 1.6.3 does not validat ...)
+ TODO: check
+CVE-2026-85001 (The EmbedPress WordPress plugin before 4.6.7 does not sanitise and es ...)
+ TODO: check
+CVE-2026-84409 (The device's update mechanism retrieves metadata for software updates ...)
+ TODO: check
+CVE-2026-83560 (The New User Approve WordPress plugin before 3.2.10 does not properly ...)
+ TODO: check
+CVE-2026-82127 (The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 ...)
+ TODO: check
+CVE-2026-81842 (An authenticated user with edit permission on one folder can move a li ...)
+ TODO: check
+CVE-2026-81841 (Pausing a shared (public) dashboard did not revoke its access token fo ...)
+ TODO: check
+CVE-2026-81433 (A stack-based buffer overflow vulnerability in WatchGuard Fireware OS' ...)
+ TODO: check
+CVE-2026-81310 (Image Scanner Driver for Linux contains a link following vulnerability ...)
+ TODO: check
+CVE-2026-80333 (The Solace Extra WordPress plugin before 1.7.2 does not perform any au ...)
+ TODO: check
+CVE-2026-79538 (metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code E ...)
+ TODO: check
+CVE-2026-79537 (metatool-ai MetaMCP through 2.4.22 contains an insecure direct object ...)
+ TODO: check
+CVE-2026-79536 (bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulner ...)
+ TODO: check
+CVE-2026-79535 (mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The ...)
+ TODO: check
+CVE-2026-79534 (mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Tra ...)
+ TODO: check
+CVE-2026-79417 (Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMo ...)
+ TODO: check
+CVE-2026-79403 (An issue in Kilo Code before v7.4.1 allows a local attacker to execute ...)
+ TODO: check
+CVE-2026-79348 (KitchenAsty through 0.3.0 contains a broken object level authorization ...)
+ TODO: check
+CVE-2026-78229 (Image Scanner Driver for Linux contains an OS command injection vulner ...)
+ TODO: check
+CVE-2026-76738 (A buffer overflow vulnerability exists in the API endpoint of HPE Netw ...)
+ TODO: check
+CVE-2026-76737 (An authenticated path traversal vulnerability exists in the command li ...)
+ TODO: check
+CVE-2026-76736 (A buffer overflow vulnerability exists in the underlying operating sys ...)
+ TODO: check
+CVE-2026-76735 (A sensitive information disclosure vulnerability exists in the underly ...)
+ TODO: check
+CVE-2026-76734 (A memory corruption vulnerability in the affected interface of HPE Net ...)
+ TODO: check
+CVE-2026-76733 (A denial-of-service vulnerability exists in the API endpoint of HPE Ne ...)
+ TODO: check
+CVE-2026-76732 (A local privilege-escalation vulnerability has been discovered in the ...)
+ TODO: check
+CVE-2026-76731 (An authentication bypass vulnerability in the captive portal of HPE Ne ...)
+ TODO: check
+CVE-2026-76730 (An authentication bypass vulnerability exists in the PAPI protocol of ...)
+ TODO: check
+CVE-2026-76729 (A format string vulnerability in the API endpoint of HPE Networking In ...)
+ TODO: check
+CVE-2026-76728 (A vulnerability in the API endpoint of HPE Networking Instant ON APs c ...)
+ TODO: check
+CVE-2026-76727 (Command injection vulnerabilities exist in the affected interface of H ...)
+ TODO: check
+CVE-2026-76726 (An authentication bypass vulnerability in the API endpoint of HPE Netw ...)
+ TODO: check
+CVE-2026-76725 (A vulnerability has been identified in a management protocol of HPE Ne ...)
+ TODO: check
+CVE-2026-76724 (A command injection vulnerability exists in CLI of the affected HPE Ne ...)
+ TODO: check
+CVE-2026-76723 (Buffer overflow vulnerabilities exist in the affected interface of HPE ...)
+ TODO: check
+CVE-2026-76722 (Uncontrolled Format string vulnerabilities exist in the affected inter ...)
+ TODO: check
+CVE-2026-76721 (Buffer overflow vulnerability exists in the affected interface of HPE ...)
+ TODO: check
+CVE-2026-75873 (The Zella Theme WordPress theme before 2.6.3 does not perform any capa ...)
+ TODO: check
+CVE-2026-75824 (The User Frontend WordPress plugin before 4.3.12 does not check wheth ...)
+ TODO: check
+CVE-2026-75823 (The User Frontend WordPress plugin before 4.3.12 does not prevent tam ...)
+ TODO: check
+CVE-2026-74225 (U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp ...)
+ TODO: check
+CVE-2026-74222 (U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in t ...)
+ TODO: check
+CVE-2026-74221 (U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_r ...)
+ TODO: check
+CVE-2026-74220 (U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply ...)
+ TODO: check
+CVE-2026-72510 (The "supplier_no" parameter used in the business allocation search fea ...)
+ TODO: check
+CVE-2026-72507 (The "reportType" parameter in the product summary report feature withi ...)
+ TODO: check
+CVE-2026-71974 (U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerabilit ...)
+ TODO: check
+CVE-2026-71973 (U-Boot before 2026.10-rc4 contains an integer overflow vulnerability i ...)
+ TODO: check
+CVE-2026-71972 (U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerabili ...)
+ TODO: check
+CVE-2026-71971 (U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an ou ...)
+ TODO: check
+CVE-2026-71379 (The file export endpoint allows any unauthenticated attacker to export ...)
+ TODO: check
+CVE-2026-71302 (The application accepts user-supplied session identifiers and does not ...)
+ TODO: check
+CVE-2026-71189 (An attacker can construct a request that, if issued by another applica ...)
+ TODO: check
+CVE-2026-70356 (The TMS file upload endpoint fails to enforce server-side file type re ...)
+ TODO: check
+CVE-2026-69662 (The application uses unsafe functions that allow execution of inline s ...)
+ TODO: check
+CVE-2026-68954 (The "pattern" parameter used in search function in the home page of th ...)
+ TODO: check
+CVE-2026-68068 (The "screenID" parameter in the electronic transaction queue viewer fe ...)
+ TODO: check
+CVE-2026-67993 (basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f co ...)
+ TODO: check
+CVE-2026-67987 (crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 cont ...)
+ TODO: check
+CVE-2026-63713 (The "search" parameter in the view audit logs feature within the utili ...)
+ TODO: check
+CVE-2026-61519 (Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulner ...)
+ TODO: check
+CVE-2026-53989 (Dockhand before 1.0.36 contains an open redirect vulnerability in the ...)
+ TODO: check
+CVE-2026-53988 (Dockhand before 1.0.40 contains an authentication bypass vulnerability ...)
+ TODO: check
+CVE-2026-51936 (Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_ex ...)
+ TODO: check
+CVE-2026-39117 (An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-serve ...)
+ TODO: check
+CVE-2026-18145 (A stack-based buffer overflow vulnerability in the spamBlocker (spamd) ...)
+ TODO: check
+CVE-2026-18105 (An uncontrolled resource consumption vulnerability in Fireware OS's di ...)
+ TODO: check
+CVE-2026-15278
+ REJECTED
+CVE-2026-13224 (A path traversal vulnerability in the Fireware OS WebUI management age ...)
+ TODO: check
+CVE-2026-13046 (A deserialization of untrusted data vulnerability in WatchGuard Firewa ...)
+ TODO: check
+CVE-2026-11415
+ REJECTED
+CVE-2026-103111 (PCRE2 before 10.49, when there is an attacker-controlled regular expre ...)
+ TODO: check
+CVE-2026-103110 (Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by i ...)
+ TODO: check
+CVE-2026-103109 (Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by i ...)
+ TODO: check
+CVE-2026-103108 (Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by ...)
+ TODO: check
+CVE-2026-103106 (Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by ...)
+ TODO: check
+CVE-2026-103105 (Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by i ...)
+ TODO: check
+CVE-2026-103104 (Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by i ...)
+ TODO: check
+CVE-2026-103102 (Pexip Infinity before 41.0 is affected by improper input validation in ...)
+ TODO: check
+CVE-2026-103101 (Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper i ...)
+ TODO: check
+CVE-2026-103100 (Pexip Infinity before 40.1 is affected by improper input validation in ...)
+ TODO: check
+CVE-2026-103099 (Pexip Infinity before 41.1 is affected by improper input validation in ...)
+ TODO: check
+CVE-2026-103088 (Handlebars.java before 4.5.5 allows directory traversal. In handlebars ...)
+ TODO: check
+CVE-2026-103087 (Uncontrolled recursion in the Gosub browser engine (gosub-engine) thro ...)
+ TODO: check
+CVE-2026-103057 (AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vu ...)
+ TODO: check
+CVE-2026-103056 (AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnera ...)
+ TODO: check
+CVE-2026-103055 (AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT v ...)
+ TODO: check
+CVE-2026-103054 (AiSOC versions before 12.0.0 contain an authorization bypass vulnerabi ...)
+ TODO: check
+CVE-2026-103053 (AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on t ...)
+ TODO: check
+CVE-2026-103051 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-103050 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-103049 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-103048 (URL redirection to untrusted site ('open redirect') vulnerability in T ...)
+ TODO: check
+CVE-2026-103047 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-103046 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-103045 (Improper neutralization of input during web page generation ('cross-si ...)
+ TODO: check
+CVE-2026-103044 (XML injection (aka blind XPath injection) vulnerability in The Wikimed ...)
+ TODO: check
+CVE-2026-103043 (anchorme through 3.0.8 contains a regular expression denial of service ...)
+ TODO: check
+CVE-2026-103042 (LightLLM through 1.2.0 contains a memory exhaustion vulnerability in t ...)
+ TODO: check
+CVE-2026-103041 (LightLLM through 1.2.0 multimodal deployments expose an unauthenticate ...)
+ TODO: check
+CVE-2026-103040 (LightLLM through 1.2.0 contains a remote code execution vulnerability ...)
+ TODO: check
+CVE-2026-102938 (virtualenv is a tool for creating isolated virtual python environments ...)
+ TODO: check
+CVE-2026-102937 (virtualenv is a tool for creating isolated virtual python environments ...)
+ TODO: check
+CVE-2026-102930 (virtualenv is a tool for creating isolated virtual python environments ...)
+ TODO: check
+CVE-2026-102925 (virtualenv is a tool for creating isolated virtual python environments ...)
+ TODO: check
+CVE-2026-102913 (A security flaw has been discovered in SourceCodester Car Driving Scho ...)
+ TODO: check
+CVE-2026-102912 (A vulnerability was identified in SourceCodester Online Leave Manageme ...)
+ TODO: check
+CVE-2026-102911 (A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is ...)
+ TODO: check
+CVE-2026-102910 (A security flaw has been discovered in SourceCodester Online Reviewer ...)
+ TODO: check
+CVE-2026-102909 (A vulnerability was identified in SourceCodester Online Reviewer Manag ...)
+ TODO: check
+CVE-2026-102908 (A vulnerability was determined in SourceCodester Online Reviewer Manag ...)
+ TODO: check
+CVE-2026-102906 (A vulnerability was identified in 0xshariq github-mcp-server up to 52e ...)
+ TODO: check
+CVE-2026-102904 (JupyterLab is an extensible environment for interactive and reproducib ...)
+ TODO: check
+CVE-2026-102879 (ClaraVerse through 0.3.1 contains server-side request forgery protecti ...)
+ TODO: check
+CVE-2026-102878 (mcp-chrome-bridge through 1.0.31 contains an origin validation error i ...)
+ TODO: check
+CVE-2026-102877 (Fider before 0.38.0 contains a server-side request forgery vulnerabili ...)
+ TODO: check
+CVE-2026-102876 (SurrealDB before 3.3.0 contains an authorization bypass in HTTP sessio ...)
+ TODO: check
+CVE-2026-102875 (VLC media player before 3.0.24 contains a path traversal vulnerability ...)
+ TODO: check
+CVE-2026-102874 (A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the ...)
+ TODO: check
+CVE-2026-102847 (A flaw has been found in gedelumbung HospitalManagement up to c2d45543 ...)
+ TODO: check
+CVE-2026-102846 (A vulnerability was detected in gedelumbung HospitalManagement up to c ...)
+ TODO: check
+CVE-2026-102845 (A security vulnerability has been detected in gedelumbung HospitalMana ...)
+ TODO: check
+CVE-2026-102844 (A weakness has been identified in gedelumbung HospitalManagement up to ...)
+ TODO: check
+CVE-2026-102843 (A security flaw has been discovered in gedelumbung HospitalManagement ...)
+ TODO: check
+CVE-2026-102842 (A vulnerability was identified in gedelumbung HospitalManagement up to ...)
+ TODO: check
+CVE-2026-102805 (A flaw has been found in Nothings stb up to 1.16. This affects the fun ...)
+ TODO: check
+CVE-2026-102804 (A vulnerability was detected in Nothings stb up to 2c980bb59875b0d3214 ...)
+ TODO: check
+CVE-2026-102794 (A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This iss ...)
+ TODO: check
+CVE-2026-102793 (A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerabilit ...)
+ TODO: check
+CVE-2026-102792 (A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affec ...)
+ TODO: check
+CVE-2026-102771 (A security vulnerability has been detected in Naichen ThinkCMF up to 8 ...)
+ TODO: check
+CVE-2026-102621 (A vulnerability was identified in Freedesktop Poppler up to 26.08.0. A ...)
+ TODO: check
+CVE-2026-102620 (A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/ ...)
+ TODO: check
+CVE-2026-102253 (iperf3 versions prior to 3.22 contains a denial of service vulnerabili ...)
+ TODO: check
+CVE-2026-102252 (A path traversal vulnerability (CWE-22) in the embedded VMDK filesyste ...)
+ TODO: check
+CVE-2026-100299 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, the devi ...)
+ TODO: check
+CVE-2026-100298 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, two user ...)
+ TODO: check
+CVE-2026-100297 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, an unaut ...)
+ TODO: check
+CVE-2026-100296 (In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST ...)
+ TODO: check
+CVE-2026-100295 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, an inter ...)
+ TODO: check
+CVE-2026-100294 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, the firm ...)
+ TODO: check
+CVE-2026-100293 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, both the ...)
+ TODO: check
+CVE-2026-100292 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, a hidden ...)
+ TODO: check
+CVE-2026-100291 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, several ...)
+ TODO: check
+CVE-2026-100143 (The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 d ...)
+ TODO: check
+CVE-2024-31027 (Cross Site Scripting vulnerability in Greek Universities Network (GUne ...)
+ TODO: check
+CVE-2024-31026 (An issue in Greek Universities Network (GUnet) Open eClass Platform v. ...)
+ TODO: check
CVE-2026-XXXX [GHSA-5rfj-p5qw-w48g: Unauthenticated remote DoS via attacker-controlled reverse-DNS hostname in auto-hosts parsing]
- sshuttle 2.0.0-1
NOTE: https://github.com/sshuttle/sshuttle/security/advisories/GHSA-5rfj-p5qw-w48g
NOTE: Fixed by: https://github.com/sshuttle/sshuttle/commit/baea31a6769baeb52e8837ad6cc582017d74676c (v2.0.0)
-CVE-2026-102331
+CVE-2026-102331 (Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0 ...)
- chromium <unfixed>
-CVE-2026-102317
+CVE-2026-102317 (Improper privilege management in Mojo in Google Chrome on on Windows p ...)
- chromium <unfixed>
-CVE-2026-102312
+CVE-2026-102312 (UI misrepresentation in Omnibox in Google Chrome on on Android prior t ...)
- chromium <unfixed>
-CVE-2026-102313
+CVE-2026-102313 (Uninitialized resource in ANGLE in Google Chrome on on Windows prior t ...)
- chromium <unfixed>
-CVE-2026-102299
+CVE-2026-102299 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
- chromium <unfixed>
-CVE-2026-102306
+CVE-2026-102306 (Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 al ...)
- chromium <unfixed>
-CVE-2026-102307
+CVE-2026-102307 (Uninitialized resource in Dawn in Google Chrome on on Android prior to ...)
- chromium <unfixed>
-CVE-2026-102323
+CVE-2026-102323 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
- chromium <unfixed>
-CVE-2026-102303
+CVE-2026-102303 (Uninitialized resource in GPU in Google Chrome on on Android prior to ...)
- chromium <unfixed>
-CVE-2026-102311
+CVE-2026-102311 (Uninitialized resource in GPU in Google Chrome on on Android prior to ...)
- chromium <unfixed>
-CVE-2026-102300
+CVE-2026-102300 (Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037. ...)
- chromium <unfixed>
-CVE-2026-102326
+CVE-2026-102326 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
- chromium <unfixed>
-CVE-2026-102316
+CVE-2026-102316 (Use after free in Views in Google Chrome prior to 154.0.8037.92 allowe ...)
- chromium <unfixed>
-CVE-2026-102304
+CVE-2026-102304 (Use after free in Passwords in Google Chrome prior to 154.0.8037.92 al ...)
- chromium <unfixed>
-CVE-2026-102328
+CVE-2026-102328 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
- chromium <unfixed>
-CVE-2026-102309
+CVE-2026-102309 (Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 a ...)
- chromium <unfixed>
-CVE-2026-102325
+CVE-2026-102325 (Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 ...)
- chromium <unfixed>
-CVE-2026-102308
+CVE-2026-102308 (Use after free in Views in Google Chrome prior to 154.0.8037.92 allowe ...)
- chromium <unfixed>
-CVE-2026-102301
+CVE-2026-102301 (Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 all ...)
- chromium <unfixed>
-CVE-2026-102319
+CVE-2026-102319 (Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 ...)
- chromium <unfixed>
-CVE-2026-102324
+CVE-2026-102324 (Use after free in PictureInPicture in Google Chrome prior to 154.0.803 ...)
- chromium <unfixed>
-CVE-2026-102318
+CVE-2026-102318 (Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 al ...)
- chromium <unfixed>
-CVE-2026-102329
+CVE-2026-102329 (Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 ...)
- chromium <unfixed>
-CVE-2026-102315
+CVE-2026-102315 (Uninitialized resource in Media in Google Chrome on on Windows prior t ...)
- chromium <unfixed>
-CVE-2026-102302
+CVE-2026-102302 (Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed ...)
- chromium <unfixed>
-CVE-2026-102321
+CVE-2026-102321 (Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a ...)
- chromium <unfixed>
-CVE-2026-102320
+CVE-2026-102320 (Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 ...)
- chromium <unfixed>
-CVE-2026-102310
+CVE-2026-102310 (Missing authorization in Payments in Google Chrome prior to 154.0.8037 ...)
- chromium <unfixed>
-CVE-2026-102327
+CVE-2026-102327 (Incorrect authorization in WebView in Google Chrome on on Android prio ...)
- chromium <unfixed>
-CVE-2026-102330
+CVE-2026-102330 (Incorrect authorization in SiteIsolation in Google Chrome prior to 154 ...)
- chromium <unfixed>
-CVE-2026-102314
+CVE-2026-102314 (UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037. ...)
- chromium <unfixed>
-CVE-2026-102305
+CVE-2026-102305 (UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154 ...)
- chromium <unfixed>
CVE-2026-94053
- mina2 <unfixed>
@@ -939,51 +1313,64 @@ CVE-2026-100832 (Use-after-free in the Graphics: Canvas2D component. This vulner
- firefox-esr 153.4.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100832
CVE-2026-84782 (Issue summary: The DTLS retransmission logic does not correctly handle ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-84783 (Issue summary: The first concurrent use of the same X.509 certificate ...)
- openssl <not-affected> (Vulnerable code not present)
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-35189 (Issue summary: A certificate with many nameRelativeToCRLIssuer CRL dis ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-35191 (Issue summary: The OpenSSL QUIC server, when configured to not preform ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
[bookworm] - openssl <not-affected> (Vulnerable code not present)
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-42772 (Issue summary: The QUIC stream reassembly algorithm performance deteri ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
[bookworm] - openssl <not-affected> (Vulnerable code not present)
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-54872 (Issue summary: The generic elliptic-curve scalar multiplication used f ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-54873 (Issue summary: QUIC process may keep memory for QUIC packet buffer for ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
[bookworm] - openssl <not-affected> (Vulnerable code not present)
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-54875 (Issue summary: A non-constant-time optimized implementation of scalar ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
[bookworm] - openssl <not-affected> (Vulnerable code not present)
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-72897 (Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a c ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
[bookworm] - openssl <not-affected> (Vulnerable code not present)
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-75804 (Issue summary: OpenSSL QUIC stack does not enforce connection level fl ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
[bookworm] - openssl <not-affected> (Vulnerable code not present)
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-75805 (Issue summary: A CMP client that requests certificate revocation on th ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-75806 (Issue summary: An established DTLS 1.2 association using an AEAD ciphe ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-77696 (Issue summary: SM2 signature generation uses non-constant-time arithme ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
NOTE: https://openssl-library.org/news/secadv/20260929.txt
CVE-2026-84784 (Issue summary: A malicious remote peer may flood the local QUIC stack ...)
+ {DSA-6531-1}
- openssl 3.6.5-1
[bookworm] - openssl <not-affected> (Vulnerable code not present)
NOTE: https://openssl-library.org/news/secadv/20260929.txt
@@ -10548,17 +10935,17 @@ CVE-2026-93012 (Email::Sender::Transport::Sendmail versions before 2.602 for Per
- libemail-sender-perl <not-affected> (Only affects Email::Sender on Windows)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/43733017/
NOTE: Fixed by: https://github.com/rjbs/Email-Sender/commit/9a587bc9ff4edae13239190c2651da2c76b1e72c (2.602)
-CVE-2026-97687 [GHSA-8988-9cw3-xx77: HTTPS proxy TLS configuration may be ignored or overridden]
+CVE-2026-97687 (urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, ...)
- python-urllib3 2.8.0-1
NOTE: https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77
NOTE: https://github.com/urllib3/urllib3/pull/5093
NOTE: Fixed by: https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465 (2.8.0)
NOTE: Fixed by: https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3 (2.8.0)
-CVE-2026-97689 [GHSA-vxq7-64xx-v4gw: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory]
+CVE-2026-97689 (urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, ...)
- python-urllib3 2.8.0-1
NOTE: https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw
NOTE: Fixed by: https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed (2.8.0)
-CVE-2026-97688 [GHSA-gh4c-6fx4-qh6g: Chunked Deflate streaming can enter an infinite loop]
+CVE-2026-97688 (urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, ...)
- python-urllib3 2.8.0-1
[trixie] - python-urllib3 <not-affected> (Vulnerable code not present, introduced in 2.6.2)
[bookworm] - python-urllib3 <not-affected> (Vulnerable code not present, introduced in 2.6.2)
@@ -21073,6 +21460,7 @@ CVE-2026-19774 (BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vul
NOTE: https://github.com/bluez/bluez/pull/2251
NOTE: Fixed by: https://github.com/bluez/bluez/commit/912f5efb0dd9bb08e408d33371a57182c5678aef (5.87)
CVE-2026-19773 (libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Rem ...)
+ {DSA-6529-1}
- libwebsockets 4.3.5-7 (bug #1149178)
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-26-590/
NOTE: Fixed by: https://github.com/warmcat/libwebsockets/commit/824151862f37bc72f46d9a3e01d5b9408d313a0b (v5.0.0)
@@ -51122,7 +51510,7 @@ CVE-2026-76229 (Renovate versions from 39.218.0 before 40.33.0 contain an arbitr
NOT-FOR-US: Renovate
CVE-2026-76228 (Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/ ...)
NOT-FOR-US: Renovate
-CVE-2026-76227 (Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before ...)
+CVE-2026-76227 (Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 4 ...)
NOT-FOR-US: Renovate
CVE-2026-76226 (Renovate versions from 43.65.0 before 43.102.11 contain a remote code ...)
NOT-FOR-US: Renovate
@@ -99532,6 +99920,7 @@ CVE-2026-53877 (An issue was discovered in Django 6.0 before 6.0.7 and 5.2 befor
NOTE: https://www.djangoproject.com/weblog/2026/jul/07/security-releases/
NOTE: Fixed by: https://github.com/django/django/commit/6c66eb8cec52b303af85c2c6e4dd00aa37654dbc (5.2.16)
CVE-2026-48588 (An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2. ...)
+ {DLA-4802-1}
- python-django 3:5.2.16-1 (bug #1141629)
[trixie] - python-django <no-dsa> (Minor issue)
[bullseye] - python-django <postponed> (Minor issue)
@@ -125081,6 +125470,7 @@ CVE-2026-48019 (Laravel is a web application framework. Prior to versions 12.60.
[trixie] - php-laravel-framework <no-dsa> (Minor issue)
NOTE: https://github.com/laravel/framework/security/advisories/GHSA-5vg9-5847-vvmq
CVE-2026-48587 (An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0 ...)
+ {DLA-4802-1}
- python-django 3:5.2.15-1 (bug #1138775)
[trixie] - python-django <no-dsa> (Minor issue)
[bullseye] - python-django <postponed> (Minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/71d37ccaf4a9805ed4709a6543117e687dc14ecb
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/71d37ccaf4a9805ed4709a6543117e687dc14ecb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/ee1ca7cd/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list