Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d63d8b2c by security tracker role at 2026-01-21T20:13:28+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,4 +1,166 @@
-CVE-2026-22977 [net: sock: fix hardened usercopy panic in sock_recv_errqueue]
+CVE-2026-23955 (EVerest is an EV charging software stack. Prior to version
2025.9.0, i ...)
+ TODO: check
+CVE-2026-23755 (D-Link D-View 8 versions 2.0.1.107 and below contain an
uncontrolled s ...)
+ TODO: check
+CVE-2026-23754 (D-Link D-View 8 versions 2.0.1.107 and below contain an
improper acces ...)
+ TODO: check
+CVE-2026-20109 (Multiple vulnerabilities in the web-based management interface
of Cisc ...)
+ TODO: check
+CVE-2026-20092 (A vulnerability in the read-only maintenance shell of Cisco
Intersight ...)
+ TODO: check
+CVE-2026-20080 (A vulnerability in the SSH service of Cisco IEC6400 Wireless
Backhaul ...)
+ TODO: check
+CVE-2026-20055 (Multiple vulnerabilities in the web-based management interface
of Cisc ...)
+ TODO: check
+CVE-2026-20045 (A vulnerability in Cisco Unified Communications Manager
(Unified CM), ...)
+ TODO: check
+CVE-2026-1290 (Authentication Bypass by Primary Weakness vulnerability in Jamf
Jamf P ...)
+ TODO: check
+CVE-2026-0834 (Logic vulnerability in TP-Link Archer C20 v6.0 and Archer AX53
v1.0 (T ...)
+ TODO: check
+CVE-2026-0663 (Denial-of-service vulnerability in M-Files Server versions
before26.1. ...)
+ TODO: check
+CVE-2025-70651 (Tenda AX-1803 v1.0.0.1 was discovered to contain a stack
overflow in t ...)
+ TODO: check
+CVE-2025-70650 (Tenda AX-1806 v1.0.0.1 was discovered to contain a stack
overflow in t ...)
+ TODO: check
+CVE-2025-70648 (Tenda AX1803 v1.0.0.1 was discovered to contain a stack
overflow in th ...)
+ TODO: check
+CVE-2025-70646 (Tenda AX1803 v1.0.0.1 was discovered to contain a stack
overflow in th ...)
+ TODO: check
+CVE-2025-70645 (Tenda AX-1806 v1.0.0.1 was discovered to contain a stack
overflow in t ...)
+ TODO: check
+CVE-2025-70644 (Tenda AX-1806 v1.0.0.1 was discovered to contain a stack
overflow in t ...)
+ TODO: check
+CVE-2025-69766 (Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer
overflow ...)
+ TODO: check
+CVE-2025-69763 (Tenda AX3 firmware v16.03.12.11 contains a stack overflow in
formSetIp ...)
+ TODO: check
+CVE-2025-69762 (Tenda AX3 firmware v16.03.12.11 contains a stack overflow in
formSetIp ...)
+ TODO: check
+CVE-2025-69209 (ArduinoCore-avr contains the source code and configuration
files of th ...)
+ TODO: check
+CVE-2025-68141 (EVerest is an EV charging software stack. Prior to version
2025.10.0, ...)
+ TODO: check
+CVE-2025-68140 (EVerest is an EV charging software stack. Prior to version
2025.9.0, o ...)
+ TODO: check
+CVE-2025-68139 (EVerest is an EV charging software stack. In all versions up
to and in ...)
+ TODO: check
+CVE-2025-68138 (EVerest is an EV charging software stack, and EVerest libocpp
is a C++ ...)
+ TODO: check
+CVE-2025-68137 (EVerest is an EV charging software stack. Prior to version
2025.10.0, ...)
+ TODO: check
+CVE-2025-68136 (EVerest is an EV charging software stack. Prior to version
2025.10.0, ...)
+ TODO: check
+CVE-2025-68135 (EVerest is an EV charging software stack. Prior to version
2025.10.0, ...)
+ TODO: check
+CVE-2025-68134 (EVerest is an EV charging software stack. Prior to version
2025.10.0, ...)
+ TODO: check
+CVE-2025-68132 (EVerest is an EV charging software stack. Prior to version
2025.12.0, ...)
+ TODO: check
+CVE-2025-66960 (An issue in ollama v.0.12.10 allows a remote attacker to cause
a denia ...)
+ TODO: check
+CVE-2025-66959 (An issue in ollama v.0.12.10 allows a remote attacker to cause
a denia ...)
+ TODO: check
+CVE-2025-57681 (The WorklogPRO - Timesheets for Jira plugin in Jira Data
Center before ...)
+ TODO: check
+CVE-2025-13878 (Malformed BRID/HHIT records can cause `named` to terminate
unexpectedl ...)
+ TODO: check
+CVE-2025-13465 (Lodash versions 4.0.0 through 4.17.22 are vulnerable to
prototype poll ...)
+ TODO: check
+CVE-2025-12781 (When passing data to the b64decode(), standard_b64decode(),
and urlsaf ...)
+ TODO: check
+CVE-2021-47887 (OKI Print Job Accounting 4.4.10 contains an unquoted service
path vuln ...)
+ TODO: check
+CVE-2021-47886 (Pingzapper 2.3.1 contains an unquoted service path
vulnerability in th ...)
+ TODO: check
+CVE-2021-47884 (OKI Configuration Tool 1.6.53 contains an unquoted service
path vulner ...)
+ TODO: check
+CVE-2021-47883 (Sandboxie Plus 0.7.2 contains an unquoted service path
vulnerability i ...)
+ TODO: check
+CVE-2021-47882 (FreeLAN 2.2 contains an unquoted service path vulnerability in
its Win ...)
+ TODO: check
+CVE-2021-47880 (Realtek Wireless LAN Utility 700.1631 contains an unquoted
service pat ...)
+ TODO: check
+CVE-2021-47879 (eBeam Interactive Suite 3.6 contains an unquoted service path
vulnerab ...)
+ TODO: check
+CVE-2021-47878 (eBeam Education Suite 2.5.0.9 contains an unquoted service
path vulner ...)
+ TODO: check
+CVE-2021-47877 (GeoGebra Graphing Calculator 6.0.631.0 contains a denial of
service vu ...)
+ TODO: check
+CVE-2021-47876 (GeoGebra Classic 5.0.631.0-d contains a denial of service
vulnerabilit ...)
+ TODO: check
+CVE-2021-47875 (GeoGebra CAS Calculator 6.0.631.0 contains a denial of service
vulnera ...)
+ TODO: check
+CVE-2021-47874 (VFS for Git 1.0.21014.1 contains an unquoted service path
vulnerabilit ...)
+ TODO: check
+CVE-2021-47873 (VestaCP versions prior to 0.9.8-25 contain a cross-site
scripting vuln ...)
+ TODO: check
+CVE-2021-47872 (SEO Panel versions prior to 4.9.0 contain a blind SQL
injection vulner ...)
+ TODO: check
+CVE-2021-47871 (Hestia Control Panel 1.3.2 contains an arbitrary file write
vulnerabil ...)
+ TODO: check
+CVE-2021-47870 (GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a
Stored Cross ...)
+ TODO: check
+CVE-2021-47869 (Brother BRAdmin Professional 3.75 contains an unquoted service
path vu ...)
+ TODO: check
+CVE-2021-47868 (WIN-PACK PRO 4.8 contains an unquoted service path
vulnerability in th ...)
+ TODO: check
+CVE-2021-47867 (WIN-PACK PRO4.8 contains an unquoted service path
vulnerability in the ...)
+ TODO: check
+CVE-2021-47866 (WIN-PACK PRO 4.8 contains an unquoted service path
vulnerability in th ...)
+ TODO: check
+CVE-2021-47865 (ProFTPD 1.3.7a contains a denial of service vulnerability that
allows ...)
+ TODO: check
+CVE-2021-47864 (OSAS Traverse Extension 11 contains an unquoted service path
vulnerabi ...)
+ TODO: check
+CVE-2021-47863 (MacPaw Encrypto 1.0.1 contains an unquoted service path
vulnerability ...)
+ TODO: check
+CVE-2021-47862 (Hi-Rez Studios 5.1.6.3 contains an unquoted service path
vulnerability ...)
+ TODO: check
+CVE-2021-47861 (Event Log Explorer 4.9.3 contains an unquoted service path
vulnerabili ...)
+ TODO: check
+CVE-2021-47860 (GetSimple CMS Custom JS 0.1 plugin contains a cross-site
request forge ...)
+ TODO: check
+CVE-2021-47859 (ActivIdentity 8.2 contains an unquoted service path
vulnerability in t ...)
+ TODO: check
+CVE-2021-47858 (Genexis Platinum-4410 P4410-V2-1.31A contains a stored
cross-site scri ...)
+ TODO: check
+CVE-2021-47857 (Moodle 3.10.3 contains a persistent cross-site scripting
vulnerability ...)
+ TODO: check
+CVE-2021-47855 (Openlitespeed 1.7.9 contains a stored cross-site scripting
vulnerabili ...)
+ TODO: check
+CVE-2021-47854 (DD-WRT version 45723 contains a buffer overflow vulnerability
in the U ...)
+ TODO: check
+CVE-2021-47853 (phpPgAdmin 7.13.0 contains a remote command execution
vulnerability th ...)
+ TODO: check
+CVE-2021-47852 (Rockstar Games Launcher 1.0.37.349 contains a privilege
escalation vul ...)
+ TODO: check
+CVE-2021-47851 (Mini Mouse 9.2.0 contains a remote code execution
vulnerability that a ...)
+ TODO: check
+CVE-2021-47850 (Mini Mouse 9.2.0 contains a path traversal vulnerability that
allows r ...)
+ TODO: check
+CVE-2021-47849 (Mini Mouse 9.3.0 contains a path traversal vulnerability that
allows a ...)
+ TODO: check
+CVE-2021-47848 (Blitar Tourism 1.0 contains an authentication bypass
vulnerability tha ...)
+ TODO: check
+CVE-2021-47846 (Digital Crime Report Management System 1.0 contains a critical
SQL inj ...)
+ TODO: check
+CVE-2021-47830 (GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a
cross-site reque ...)
+ TODO: check
+CVE-2021-47817 (OpenEMR 5.0.2.1 contains a cross-site scripting vulnerability
that all ...)
+ TODO: check
+CVE-2021-47802 (Tenda D151 and D301 routers contain an unauthenticated
configuration d ...)
+ TODO: check
+CVE-2021-47778 (GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code
injecti ...)
+ TODO: check
+CVE-2021-47770 (OpenPLC v3 contains an authenticated remote code execution
vulnerabili ...)
+ TODO: check
+CVE-2021-47748 (Hasura GraphQL 1.3.3 contains a remote code execution
vulnerability th ...)
+ TODO: check
+CVE-2021-47746 (NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write
vulnerabili ...)
+ TODO: check
+CVE-2026-22977 (In the Linux kernel, the following vulnerability has been
resolved: n ...)
- linux <unfixed>
NOTE:
https://git.kernel.org/linus/2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 (6.19-rc5)
CVE-2026-1200
@@ -238,7 +400,7 @@ CVE-2025-14559 (A flaw was found in the keycloak-services
component of Keycloak.
TODO: check
CVE-2025-11468 (When folding a long comment in an email header containing
exclusively ...)
TODO: check
-CVE-2026-24061 [inetutils: remote authentication by-pass in telnet]
+CVE-2026-24061 (telnetd in GNU Inetutils through 2.7 allows remote
authentication bypa ...)
- inetutils 2:2.7-2 (bug #1126047)
NOTE:
https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html
NOTE: Introduced with:
https://codeberg.org/inetutils/inetutils/commit/fa3245ac8c288b87139a0da8249d0a408c4dfb87
(inetutils-1_9_3)
@@ -329,7 +491,7 @@ CVE-2025-56005 (An undocumented and unsafe feature in the
PLY (Python Lex-Yacc)
- ply <undetermined>
NOTE: https://github.com/bohmiiidd/Undocumented-RCE-in-PLY
TODO: check, details
-CVE-2025-55423 (ipTIME routers A2003NS-MU 10.00.6 to 12.16.2 , N600 10.00.8 to
12.16.2 ...)
+CVE-2025-55423 (A command injection vulnerability exists in the upnp_relay()
function ...)
NOT-FOR-US: ipTIME
CVE-2025-55071 (A reflected cross-site scripting (xss) vulnerability exists in
the mod ...)
NOT-FOR-US: MedDream PACS Premium
@@ -468,9 +630,9 @@ CVE-2025-15281 (Calling wordexp with WRDE_REUSE in
conjunction with WRDE_APPEND
NOTE: https://www.openwall.com/lists/oss-security/2026/01/20/3
NOTE: Inroduced with:
https://sourceware.org/git/?p=glibc.git;a=commit;h=8f2ece695d8822e9ecc63ecd157e90bf17a6fe65
NOTE: Fixed by:
https://sourceware.org/git/?p=glibc.git;a=commit;h=80cc58ea2de214f85b0a1d902a3b668ad2ecb302
-CVE-2026-22022
+CVE-2026-22022 (Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on
Solr's "R ...)
- lucene-solr <not-affected> (Vulnerable code introduced later)
-CVE-2026-22444
+CVE-2026-22444 (The "create core" API of Apache Solr 8.6 through 9.10.0 lacks
sufficie ...)
- lucene-solr <not-affected> (Vulnerable code introduced later)
CVE-2026-23952
- imagemagick <unfixed> (bug #1126077)
@@ -1119,7 +1281,7 @@ CVE-2025-68924 (In Umbraco UmbracoForms through 8.13.16,
an authenticated attack
NOT-FOR-US: Umbraco CMS
CVE-2025-68921 (SteelSeries Nahimic 3 1.10.7 allows Directory traversal.)
NOT-FOR-US: SteelSeries Nahimic
-CVE-2025-59870 (HCL MyXalytics v6.7 is affected by improper management of a
static JWT ...)
+CVE-2025-59870 (HCL MyXalytics is affected by improper management of a static
JWT sign ...)
NOT-FOR-US: HCL
CVE-2025-48647 (In cpm_fwtp_msg_handler of
cpm/google/lib/tracepoint/cpm_fwtp_ipc.c, t ...)
NOT-FOR-US: Android
@@ -1186,7 +1348,8 @@ CVE-2021-47834 (Schlix CMS 2.2.6-6 contains a persistent
cross-site scripting vu
NOT-FOR-US: Schlix CMS
CVE-2021-47833 (WifiHotSpot 1.0.0.0 contains an unquoted service path
vulnerability in ...)
NOT-FOR-US: WifiHotSpot
-CVE-2021-47832 (Sandboxie Plus 0.7.4 contains an unquoted service path
vulnerability i ...)
+CVE-2021-47832
+ REJECTED
NOT-FOR-US: Sandboxie Plus
CVE-2021-47831 (Sandboxie 5.49.7 contains a denial of service vulnerability
that allow ...)
NOT-FOR-US: Sandboxie
@@ -1558,7 +1721,7 @@ CVE-2025-68675 (In Apache Airflow versions before 3.1.6,
the proxies and proxy f
- airflow <itp> (bug #819700)
CVE-2025-68438 (In Apache Airflow versions before 3.1.6, when rendered
template fields ...)
- airflow <itp> (bug #819700)
-CVE-2026-0988
+CVE-2026-0988 (A flaw was found in glib. Missing validation of offset and
count param ...)
[experimental] - glib2.0 2.87.1-1
- glib2.0 <unfixed> (bug #1125752)
NOTE: https://gitlab.gnome.org/GNOME/glib/-/issues/3851
@@ -17739,7 +17902,7 @@ CVE-2020-36884 (BrightSign Digital Signage Diagnostic
Web Server 8.2.26 and less
NOT-FOR-US: BrightSign Digital Signage Diagnostic Web Server
CVE-2020-36883 (SpinetiX Fusion Digital Signage 3.4.8 and lower contains an
authentica ...)
NOT-FOR-US: SpinetiX Fusion Digital Signage
-CVE-2025-14083
+CVE-2025-14083 (A flaw was found in the Keycloak Admin REST API. This
vulnerability al ...)
- keycloak <itp> (bug #1088287)
CVE-2025-13327
- uv <itp> (bug #1069776)
@@ -38624,7 +38787,7 @@ CVE-2025-53476 (A denial of service vulnerability
exists in the ModbusTCP server
NOT-FOR-US: OpenPLC
CVE-2025-52021 (A SQL Injection vulnerability exists in the edit_product.php
file of P ...)
NOT-FOR-US: PuneethReddyHC Online Shopping System Advanced
-CVE-2025-50505 (Clash Verge Rev thru 2.2.3 forces the installation of system
services( ...)
+CVE-2025-50505 (Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the
installation of ...)
NOT-FOR-US: Clash Verge
CVE-2025-48981 (An insecure implementation of the proprietary protocol DNET in
Product ...)
NOT-FOR-US: CGM MEDICOI
@@ -303030,7 +303193,7 @@ CVE-2022-46766
RESERVED
CVE-2022-46765
RESERVED
-CVE-2022-46764 (A SQL injection issue in the web API in TrueConf Server
5.2.0.10225 al ...)
+CVE-2022-46764 (A SQL injection issue in the web API in TrueConf Server
5.2.0.10225 (f ...)
NOT-FOR-US: TrueConf Server
CVE-2022-46763 (A SQL injection issue in a database stored function in
TrueConf Server ...)
NOT-FOR-US: TrueConf Server
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d63d8b2c3366aa58d0fb3a4cec453458f653b279
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d63d8b2c3366aa58d0fb3a4cec453458f653b279
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
