[Git][security-tracker-team/security-tracker][master] Add new wss4j issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8ce2efb1 by Salvatore Bonaccorso at 2026-09-30T22:11:53+02:00
Add new wss4j issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -179,7 +179,8 @@ CVE-2026-96342 (Missing Authorization vulnerability in Amauri.IO WPMobile.App wp
 CVE-2026-96338 (Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 vers ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-95616 (An integer overflow in WSS4J's DER bounds check lets an oversized allo ...)
-	TODO: check
+	- wss4j <unfixed>
+	NOTE: https://lists.apache.org/thread.html/sdf0fsphkg4qbj7nh2brjgwvcmd67hct
 CVE-2026-95587 (Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 ver ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-95531 (Subscriber PHP Object Injection in Conversational Forms for ChatBot <= ...)
@@ -263,7 +264,8 @@ CVE-2026-93462 (Missing authentication for critical function vulnerability exist
 CVE-2026-93460 (Stored Cross-site scripting via appended strings in email form fields  ...)
 	NOT-FOR-US: baserCMS
 CVE-2026-92899 (Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so  ...)
-	TODO: check
+	- wss4j <unfixed>
+	NOTE: https://lists.apache.org/thread.html/nrzngsz1xm2lztq3t873663xx9wnrwm7
 CVE-2026-92873 (Pgpool-II contains an incorrect implementation of an authentication al ...)
 	- pgpool2 <unfixed>
 	NOTE: https://pgpool.net/news/2026-09-29/
@@ -288,23 +290,28 @@ CVE-2026-92867 (An out-of-bounds write vulnerability exists in Pgpool-II , which
 CVE-2026-92712 (The ReactPress \u2013 Create React App for WordPress plugin for WordPr ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-92121 (In the WSS4J streaming (StAX) code, a signature reference using the WS ...)
-	TODO: check
+	- wss4j <unfixed>
+	NOTE: https://lists.apache.org/thread.html/oop9p4hpl5o9byosb1qg3z7q1sgnn4pc
 CVE-2026-91860 (A prototype pollution vulnerability exists in the deep merge helpers o ...)
 	TODO: check
 CVE-2026-89238 (WSS4J EncryptedHeader child confusion could promote an attacker-contro ...)
-	TODO: check
+	- wss4j <unfixed>
+	NOTE: https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w
 CVE-2026-88920 (An authentication bypass in the DOM security processor in Apache WSS4J ...)
-	TODO: check
+	- wss4j <unfixed>
+	NOTE: https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9
 CVE-2026-88037 (The Bold Page Builder plugin for WordPress is vulnerable to Stored Cro ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-87830 (In the StAX streaming WS-SecurityPolicy validator, certain relative or ...)
-	TODO: check
+	- wss4j <unfixed>
+	NOTE: https://lists.apache.org/thread.html/lwlozb1x20d16f9dnyvoygc9rrhzq2vn
 CVE-2026-87004 (Tugtainer is a self-hosted app for automating updates of Docker contai ...)
 	TODO: check
 CVE-2026-86778 (Observable response discrepancy vulnerability in Maksisoft Technology, ...)
 	TODO: check
 CVE-2026-85532 (Apache WSS4J accepted attacker-controlled derived-key lengths and offs ...)
-	TODO: check
+	- wss4j <unfixed>
+	NOTE: https://lists.apache.org/thread.html/7jllcpbf4nbzhdp2vchz5yplnl5w6vd6
 CVE-2026-82307 (Improper neutralization of special elements used in an SQL command ('S ...)
 	TODO: check
 CVE-2026-79625 (Affected products do not properly synchronize access to their monitori ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8ce2efb12e634f4ac6aa0bce9778bbd76cf50895

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8ce2efb12e634f4ac6aa0bce9778bbd76cf50895
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/d7b01b9c/attachment-0001.htm>