Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ede2c45d by security tracker role at 2026-03-31T07:13:34+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,157 @@
+CVE-2026-5185 (A security flaw has been discovered in Nothings stb_image up to
2.30. ...)
+ TODO: check
+CVE-2026-5184 (A vulnerability was identified in TRENDnet TEW-713RE up to
1.02. The i ...)
+ TODO: check
+CVE-2026-5183 (A vulnerability was determined in TRENDnet TEW-713RE up to
1.02. The a ...)
+ TODO: check
+CVE-2026-5182 (A vulnerability was found in SourceCodester Teacher Record
System 1.0. ...)
+ TODO: check
+CVE-2026-5181 (A vulnerability has been found in SourceCodester Simple Doctors
Appoin ...)
+ TODO: check
+CVE-2026-5180 (A flaw has been found in SourceCodester Simple Doctors
Appointment Sys ...)
+ TODO: check
+CVE-2026-5179 (A vulnerability was detected in SourceCodester Simple Doctors
Appointm ...)
+ TODO: check
+CVE-2026-5178 (A security vulnerability has been detected in Totolink A3300R
17.0.0cu ...)
+ TODO: check
+CVE-2026-5177 (A weakness has been identified in Totolink A3300R
17.0.0cu.557_b202210 ...)
+ TODO: check
+CVE-2026-5176 (A security flaw has been discovered in Totolink A3300R
17.0.0cu.557_b2 ...)
+ TODO: check
+CVE-2026-5157 (A vulnerability was identified in code-projects Online Food
Ordering S ...)
+ TODO: check
+CVE-2026-5156 (A vulnerability was determined in Tenda CH22 1.0.0.1. This
impacts the ...)
+ TODO: check
+CVE-2026-5155 (A vulnerability was found in Tenda CH22 1.0.0.1. This affects
the func ...)
+ TODO: check
+CVE-2026-5154 (A vulnerability has been found in Tenda CH22 1.0.0.1/1.If. The
impacte ...)
+ TODO: check
+CVE-2026-5153 (A flaw has been found in Tenda CH22 1.0.0.1. The affected
element is t ...)
+ TODO: check
+CVE-2026-5152 (A vulnerability was detected in Tenda CH22 1.0.0.1. Impacted is
the fu ...)
+ TODO: check
+CVE-2026-5150 (A security vulnerability has been detected in code-projects
Accounting ...)
+ TODO: check
+CVE-2026-5148 (A weakness has been identified in YunaiV yudao-cloud up to
2026.01. Th ...)
+ TODO: check
+CVE-2026-5130 (The Debugger & Troubleshooter plugin for WordPress was
vulnerable to U ...)
+ TODO: check
+CVE-2026-5115 (The PaperCut NG/MF (specifically, the embedded application for
Konica ...)
+ TODO: check
+CVE-2026-4794 (Multiple cross-site scripting (XSS) vulnerabilities in PaperCut
NG/MF ...)
+ TODO: check
+CVE-2026-4789 (Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due
to unre ...)
+ TODO: check
+CVE-2026-4257 (The Contact Form by Supsystic plugin for WordPress is
vulnerable to Se ...)
+ TODO: check
+CVE-2026-4146 (The Loco Translate plugin for WordPress is vulnerable to
Reflected Cro ...)
+ TODO: check
+CVE-2026-4020 (The Gravity SMTP plugin for WordPress is vulnerable to
Sensitive Infor ...)
+ TODO: check
+CVE-2026-3881 (The Performance Monitor WordPress plugin through 1.0.6 does not
valida ...)
+ TODO: check
+CVE-2026-3300 (The Everest Forms Pro plugin for WordPress is vulnerable to
Remote Cod ...)
+ TODO: check
+CVE-2026-34881 (OpenStack Glance <29.1.1, >=30.0.0 <30.1.1, ==31.0.0 is
affected by Se ...)
+ TODO: check
+CVE-2026-34558 (CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a
production ...)
+ TODO: check
+CVE-2026-34557 (CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a
production ...)
+ TODO: check
+CVE-2026-34073 (cryptography is a package designed to expose cryptographic
primitives ...)
+ TODO: check
+CVE-2026-34070 (LangChain is a framework for building agents and LLM-powered
applicati ...)
+ TODO: check
+CVE-2026-34060 (Ruby LSP is an implementation of the language server protocol
for Ruby ...)
+ TODO: check
+CVE-2026-34054 (vcpkg is a free and open-source C/C++ package manager. Prior
to versio ...)
+ TODO: check
+CVE-2026-34043 (Serialize JavaScript to a superset of JSON that includes
regular expre ...)
+ TODO: check
+CVE-2026-34042 (act is a project which allows for local running of github
actions. Pri ...)
+ TODO: check
+CVE-2026-34041 (act is a project which allows for local running of github
actions. Pri ...)
+ TODO: check
+CVE-2026-34040 (Moby is an open source container framework. Prior to version
29.3.1, a ...)
+ TODO: check
+CVE-2026-34036 (Dolibarr is an enterprise resource planning (ERP) and customer
relatio ...)
+ TODO: check
+CVE-2026-33997 (Moby is an open source container framework. Prior to version
29.3.1, a ...)
+ TODO: check
+CVE-2026-33026 (Nginx UI is a web user interface for the Nginx web server.
Prior to ve ...)
+ TODO: check
+CVE-2026-32884 (Botan is a C++ cryptography library. Prior to version 3.11.0,
during p ...)
+ TODO: check
+CVE-2026-32883 (Botan is a C++ cryptography library. From version 3.0.0 to
before vers ...)
+ TODO: check
+CVE-2026-32877 (Botan is a C++ cryptography library. From version 2.3.0 to
before vers ...)
+ TODO: check
+CVE-2026-32794 (Improper Certificate Validation vulnerability in Apache
Airflow Provid ...)
+ TODO: check
+CVE-2026-32734 (baserCMS is a website development framework. Prior to version
5.2.3, b ...)
+ TODO: check
+CVE-2026-32727 (SciTokens is a reference library for generating and using
SciTokens. P ...)
+ TODO: check
+CVE-2026-32716 (SciTokens is a reference library for generating and using
SciTokens. P ...)
+ TODO: check
+CVE-2026-32714 (SciTokens is a reference library for generating and using
SciTokens. P ...)
+ TODO: check
+CVE-2026-32696 (NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging
Platform. ...)
+ TODO: check
+CVE-2026-32275 (Tautulli is a Python based monitoring and tracking tool for
Plex Media ...)
+ TODO: check
+CVE-2026-31946 (OpenOlat is an open source web-based e-learning platform for
teaching, ...)
+ TODO: check
+CVE-2026-31831 (Tautulli is a Python based monitoring and tracking tool for
Plex Media ...)
+ TODO: check
+CVE-2026-31804 (Tautulli is a Python based monitoring and tracking tool for
Plex Media ...)
+ TODO: check
+CVE-2026-31799 (Tautulli is a Python based monitoring and tracking tool for
Plex Media ...)
+ TODO: check
+CVE-2026-30940 (baserCMS is a website development framework. Prior to version
5.2.3, a ...)
+ TODO: check
+CVE-2026-30880 (baserCMS is a website development framework. Prior to version
5.2.3, b ...)
+ TODO: check
+CVE-2026-30879 (baserCMS is a website development framework. Prior to version
5.2.3, b ...)
+ TODO: check
+CVE-2026-30878 (baserCMS is a website development framework. Prior to version
5.2.3, a ...)
+ TODO: check
+CVE-2026-30877 (baserCMS is a website development framework. Prior to version
5.2.3, t ...)
+ TODO: check
+CVE-2026-30313 (DSAI-Cline's command auto-approval module contains a critical
OS comma ...)
+ TODO: check
+CVE-2026-30308 (In its design for automatic terminal command execution, HAI
Build Code ...)
+ TODO: check
+CVE-2026-30307 (Roo Code's command auto-approval module contains a critical OS
command ...)
+ TODO: check
+CVE-2026-30306 (In its design for automatic terminal command execution,
SakaDev offers ...)
+ TODO: check
+CVE-2026-30305 (Syntx's command auto-approval module contains a critical OS
command in ...)
+ TODO: check
+CVE-2026-28505 (Tautulli is a Python based monitoring and tracking tool for
Plex Media ...)
+ TODO: check
+CVE-2026-28228 (OpenOlat is an open source web-based e-learning platform for
teaching, ...)
+ TODO: check
+CVE-2026-27697 (baserCMS is a website development framework. Prior to version
5.2.3, b ...)
+ TODO: check
+CVE-2026-27599 (CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a
production ...)
+ TODO: check
+CVE-2026-27018 (Gotenberg is an API for converting document formats. Prior to
version ...)
+ TODO: check
+CVE-2026-25627 (NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging
Platform. ...)
+ TODO: check
+CVE-2026-21861 (baserCMS is a website development framework. Prior to version
5.2.3, b ...)
+ TODO: check
+CVE-2026-1877 (The Auto Post Scheduler plugin for WordPress is vulnerable to
Cross-Si ...)
+ TODO: check
+CVE-2026-1834 (The Ibtana \u2013 WordPress Website Builder plugin for
WordPress is vu ...)
+ TODO: check
+CVE-2026-1797 (The Appointment Booking and Scheduler Plugin \u2013 Truebooker
plugin ...)
+ TODO: check
+CVE-2026-1710 (The WooPayments: Integrated WooCommerce Payments plugin for
WordPress ...)
+ TODO: check
+CVE-2025-32957 (baserCMS is a website development framework. Prior to version
5.2.3, t ...)
+ TODO: check
CVE-2026-5170 (A user with access to the cluster with a limited set of
privilege acti ...)
- mongodb <removed>
NOTE: https://jira.mongodb.org/browse/SERVER-101758
@@ -1775,39 +1929,39 @@ CVE-2025-14807 (IBM InfoSphere Information Server
11.7.0.0 through 11.7.1.6 is v
NOT-FOR-US: IBM
CVE-2025-14684 (IBM Maximo Application Suite - Monitor Component 9.1, 9.0,
8.11, and 8 ...)
NOT-FOR-US: IBM
-CVE-2026-33952 [DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks]
+CVE-2026-33952 (FreeRDP is a free implementation of the Remote Desktop
Protocol. Prior ...)
- freerdp3 3.24.2+dfsg-1
- freerdp2 <removed>
NOTE:
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4v4p-9v5x-hc93
-CVE-2026-33977 [DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)]
+CVE-2026-33977 (FreeRDP is a free implementation of the Remote Desktop
Protocol. Prior ...)
- freerdp3 3.24.2+dfsg-1
- freerdp2 <removed>
NOTE:
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8f2g-3q27-6xm5
-CVE-2026-33995 [double free in kerberos_AcceptSecurityContext and
kerberos_IntitalizeSecurityContextA]
+CVE-2026-33995 (FreeRDP is a free implementation of the Remote Desktop
Protocol. Prior ...)
- freerdp3 3.24.2+dfsg-1
- freerdp2 <removed>
NOTE:
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mv25-f4p2-5mxx
-CVE-2026-33984 [ClearCodec resize_vbar_entry() Heap OOB Write]
+CVE-2026-33984 (FreeRDP is a free implementation of the Remote Desktop
Protocol. Prior ...)
- freerdp3 3.24.2+dfsg-1
- freerdp2 <removed>
NOTE:
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8469-2xcx-frf6
-CVE-2026-33983 [Progressive Codec Quant BYTE Underflow - UB + CPU DoS]
+CVE-2026-33983 (FreeRDP is a free implementation of the Remote Desktop
Protocol. Prior ...)
- freerdp3 3.24.2+dfsg-1
- freerdp2 <removed>
NOTE:
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gfm-4p52-h478
-CVE-2026-33985 [ClearCodec Glyph Cache Count Desync - Heap OOB Read]
+CVE-2026-33985 (FreeRDP is a free implementation of the Remote Desktop
Protocol. Prior ...)
- freerdp3 3.24.2+dfsg-1
- freerdp2 <removed>
NOTE:
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x6gr-8p7h-5h85
-CVE-2026-33986 [H.264 YUV Buffer Dimension Desync - Heap OOB Write]
+CVE-2026-33986 (FreeRDP is a free implementation of the Remote Desktop
Protocol. Prior ...)
- freerdp3 3.24.2+dfsg-1
- freerdp2 <removed>
NOTE:
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h6qw-wxvm-hf97
-CVE-2026-33987 [Persistent Cache bmpSize Desync - Heap OOB Write]
+CVE-2026-33987 (FreeRDP is a free implementation of the Remote Desktop
Protocol. Prior ...)
- freerdp3 3.24.2+dfsg-1
- freerdp2 <removed>
NOTE:
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ff8h-p5vc-wcwc
-CVE-2026-33982 [Persistent Cache Allocator Mismatch - Heap OOB Read]
+CVE-2026-33982 (FreeRDP is a free implementation of the Remote Desktop
Protocol. Prior ...)
- freerdp3 3.24.2+dfsg-1
- freerdp2 <removed>
NOTE:
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jm9-2925-g4v2
@@ -3401,27 +3555,27 @@ CVE-2026-3889 (Spoofing issue in Thunderbird. This
vulnerability affects Thunder
CVE-2026-3836
- dnf5 <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2445770
-CVE-2026-21717
+CVE-2026-21717 (A flaw in V8's string hashing mechanism causes integer-like
strings to ...)
{DSA-6183-1}
- nodejs 22.22.2+dfsg+~cs22.19.15-1
NOTE:
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#hashdos-in-v8-cve-2026-21717---medium
NOTE: Fixed by:
https://github.com/nodejs/node/commit/af5c144ebcf9814ef5dc74555bbdcd2a4cb20a12
(v20.20.2)
-CVE-2026-21716
+CVE-2026-21716 (An incomplete fix for CVE-2024-36137 leaves
`FileHandle.chmod()` and ` ...)
{DSA-6183-1}
- nodejs 22.22.2+dfsg+~cs22.19.15-1
NOTE:
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#cve-2024-36137-patch-bypass---filehandlechmodchown-cve-2026-21716---low
NOTE: Fixed by:
https://github.com/nodejs/node/commit/012330956669e06864a674917de352d2d69ff51c
(v20.20.2)
-CVE-2026-21715
+CVE-2026-21715 (A flaw in Node.js Permission Model filesystem enforcement
leaves `fs.r ...)
{DSA-6183-1}
- nodejs 22.22.2+dfsg+~cs22.19.15-1
NOTE:
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#permission-model-bypass-in-realpathsyncnative-allows-file-existence-disclosure-cve-2026-21715---low
NOTE: Fixed by:
https://github.com/nodejs/node/commit/00830712bc623ba04b08856462a56b79e29f5cc3
(v20.20.2)
-CVE-2026-21714
+CVE-2026-21714 (A memory leak occurs in Node.js HTTP/2 servers when a client
sends WIN ...)
{DSA-6183-1}
- nodejs 22.22.2+dfsg+~cs22.19.15-1
NOTE:
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#memory-leak-in-nodejs-http2-server-via-window_update-on-stream-0-leads-to-resource-exhaustion-cve-2026-21714---medium
NOTE: Fixed by:
https://github.com/nodejs/node/commit/a0c73425da4c95fbcf6c13b7fe8921301290b8e6
(v20.20.2)
-CVE-2026-21713
+CVE-2026-21713 (A flaw in Node.js HMAC verification uses a non-constant-time
compariso ...)
{DSA-6183-1}
- nodejs 22.22.2+dfsg+~cs22.19.15-1
NOTE:
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#timing-side-channel-in-hmac-verification-via-memcmp-in-crypto_hmaccc-leads-to-potential-mac-forgery-cve-2026-21713---medium
@@ -3429,10 +3583,10 @@ CVE-2026-21713
CVE-2026-21712 (A flaw in Node.js URL processing causes an assertion failure
in native ...)
- nodejs <not-affected> (Vulnerable code not present)
NOTE:
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#assertion-error-in-node_urlcc-via-malformed-url-format-leads-to-nodejs-crash-cve-2026-21712---medium
-CVE-2026-21711
+CVE-2026-21711 (A flaw in Node.js Permission Model network enforcement leaves
Unix Dom ...)
- nodejs <not-affected> (Vulnerable code not present)
NOTE:
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#nodejs-permission-model-bypass-uds-server-bindlisten-works-without---allow-net-cve-2026-21711---medium
-CVE-2026-21710
+CVE-2026-21710 (A flaw in Node.js HTTP request handling causes an uncaught
`TypeError` ...)
{DSA-6183-1}
- nodejs 22.22.2+dfsg+~cs22.19.15-1
NOTE:
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#denial-of-service-via-__proto__-header-name-in-reqheadersdistinct-uncaught-typeerror-crashes-nodejs-process-cve-2026-21710---high
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ede2c45dca59f09a3a02f9d7f46012c3f9614176
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ede2c45dca59f09a3a02f9d7f46012c3f9614176
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
