Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ddad2f59 by security tracker role at 2026-08-20T19:14:18+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,577 @@
+CVE-2026-9033 (An unauthenticated attacker with network access to the captive
portal ...)
+ TODO: check
+CVE-2026-8717
+ REJECTED
+CVE-2026-7485 (Incorrect authorization in frozen BI aggregations in Checkmk
<2.5.0p2, ...)
+ TODO: check
+CVE-2026-77176 (A flaw was found in Kata Containers. In configurations
utilizing genpo ...)
+ TODO: check
+CVE-2026-77148 (A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This
impacts the ...)
+ TODO: check
+CVE-2026-77118 (A heap out-of-bounds write exists in the Photo CD (PCD)
decoder of Gra ...)
+ TODO: check
+CVE-2026-77085 (n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF
protection ...)
+ TODO: check
+CVE-2026-77084 (n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains
a code e ...)
+ TODO: check
+CVE-2026-77083 (n8n is a workflow automation platform. In versions prior to
1.123.69, ...)
+ TODO: check
+CVE-2026-77082 (n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before
2.34.1 conta ...)
+ TODO: check
+CVE-2026-77081 (n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1
contain ...)
+ TODO: check
+CVE-2026-77080 (n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before
2.34.1 conta ...)
+ TODO: check
+CVE-2026-77079 (n8n before 2.34.1 and 2.33.4 contains an authorization bypass
in the c ...)
+ TODO: check
+CVE-2026-77077 (n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a
JavaScript ...)
+ TODO: check
+CVE-2026-77076 (n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an
informatio ...)
+ TODO: check
+CVE-2026-77075 (n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before
2.34.1 conta ...)
+ TODO: check
+CVE-2026-77074 (n8n versions before 1.123.69 contain a server-side request
forgery vul ...)
+ TODO: check
+CVE-2026-77073 (n8n versions before 2.34.1 contain a credential validation
bypass in t ...)
+ TODO: check
+CVE-2026-77072 (n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored
cross-site s ...)
+ TODO: check
+CVE-2026-77071 (n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST
filter in ...)
+ TODO: check
+CVE-2026-77070 (n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL
injection vul ...)
+ TODO: check
+CVE-2026-77069 (n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF
protection by ...)
+ TODO: check
+CVE-2026-77068 (n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote
code execu ...)
+ TODO: check
+CVE-2026-77067 (The setWebhookResolver in
packages/api/src/resolvers/webhooks/index.ts ...)
+ TODO: check
+CVE-2026-77066 (The scanFeedsResolver in
packages/api/src/resolvers/subscriptions/inde ...)
+ TODO: check
+CVE-2026-77036 (A vulnerability was found in elunez eladmin up to 2.7. The
impacted el ...)
+ TODO: check
+CVE-2026-77031 (A vulnerability has been found in Tenda CH22 1.0.0.1. The
affected ele ...)
+ TODO: check
+CVE-2026-77026 (Joomla Extension - tassos.gr - Client-controlled validation
bypass in ...)
+ TODO: check
+CVE-2026-77025 (A weakness has been identified in itsourcecode Hospital
Management Sys ...)
+ TODO: check
+CVE-2026-77022 (A security flaw has been discovered in Comfast CF-N1-S
2.6.0.1. Affect ...)
+ TODO: check
+CVE-2026-77020 (A vulnerability was identified in CodeAstro Apartment Visitor
Manageme ...)
+ TODO: check
+CVE-2026-77019 (A vulnerability was determined in CodeAstro Apartment Visitor
Manageme ...)
+ TODO: check
+CVE-2026-77014 (A flaw was found in libsoup's SoupServer HTTP Range header
processing. ...)
+ TODO: check
+CVE-2026-77004 (A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts
the fun ...)
+ TODO: check
+CVE-2026-76999 (A vulnerability was detected in SourceCodester CET Automated
Grading S ...)
+ TODO: check
+CVE-2026-76998 (A security vulnerability has been detected in SourceCodester
Simple On ...)
+ TODO: check
+CVE-2026-76997 (A weakness has been identified in SourceCodester Simple Online
Food Or ...)
+ TODO: check
+CVE-2026-76996 (A security flaw has been discovered in SourceCodester Simple
Online Fo ...)
+ TODO: check
+CVE-2026-76995 (A vulnerability was identified in SourceCodester Simple Online
Food Or ...)
+ TODO: check
+CVE-2026-76993 (A vulnerability was determined in GreyDGL PentestGPT up to
1.0.0. This ...)
+ TODO: check
+CVE-2026-76991 (A vulnerability was found in itsourcecode Hospital Management
System 1 ...)
+ TODO: check
+CVE-2026-76990 (A vulnerability has been found in code-projects Simple
Inventory Syste ...)
+ TODO: check
+CVE-2026-76989 (A security vulnerability has been detected in liftoff-sr
CIPster 18025 ...)
+ TODO: check
+CVE-2026-76988 (A weakness has been identified in liftoff-sr CIPster
1802525be27d33e19 ...)
+ TODO: check
+CVE-2026-76987 (A security flaw has been discovered in liftoff-sr CIPster
1802525be27d ...)
+ TODO: check
+CVE-2026-76833 (@cgauge/yaml npm package contains an arbitrary code execution
vulnerab ...)
+ TODO: check
+CVE-2026-76641 (Expat through 2.8.3 contains an out-of-bounds read
vulnerability that ...)
+ TODO: check
+CVE-2026-76635 (baserCMS before 5.3.0 contains a SQL injection vulnerability
in BcData ...)
+ TODO: check
+CVE-2026-76634 (WeGIA before 3.9.2 contains an insecure direct object
reference vulner ...)
+ TODO: check
+CVE-2026-76633 (WeGIA before 3.9.2 contains an authorization bypass
vulnerability in t ...)
+ TODO: check
+CVE-2026-76632
+ REJECTED
+CVE-2026-76610 (Joomla Extension - yootheme.com - Unauthenticated tag
modifications in ...)
+ TODO: check
+CVE-2026-76569 (Joomla Extension - phoca.cz - Reflected XSS via the search GET
paramet ...)
+ TODO: check
+CVE-2026-76565 (Joomla Extension - phoca.cz - Reflected XSS via price_from &
price_to ...)
+ TODO: check
+CVE-2026-76564 (Joomla Extension - phoca.cz - Stored XSS via User-Agent
header in Adm ...)
+ TODO: check
+CVE-2026-75948 (Joomla Extension - icagenda.com - Authenticated Stored XSS in
iCagend ...)
+ TODO: check
+CVE-2026-75526 (django CMS is an easy-to-use and developer-friendly enterprise
content ...)
+ TODO: check
+CVE-2026-75514 (BunkerWeb is an open-source, next-generation Web Application
Firewall. ...)
+ TODO: check
+CVE-2026-75140 (jsoup through 1.23.2, fixed in commit 862ba2f, contains an
uncontrolle ...)
+ TODO: check
+CVE-2026-74021 (Unauthenticated Broken Access Control in Chaplin <= 2.6.8
versions.)
+ TODO: check
+CVE-2026-74020 (Unauthenticated Broken Access Control in Koji <= 2.2.1
versions.)
+ TODO: check
+CVE-2026-74019 (Unauthenticated Broken Access Control in EPROLO Dropshipping
<= 2.4.2 ...)
+ TODO: check
+CVE-2026-74018 (Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9
versions.)
+ TODO: check
+CVE-2026-74016 (Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6
versions.)
+ TODO: check
+CVE-2026-74014 (Subscriber Arbitrary File Upload in IT Residence <= 3.2.1
versions.)
+ TODO: check
+CVE-2026-74013 (Subscriber SQL Injection in eShipper Commerce <= 2.16.13
versions.)
+ TODO: check
+CVE-2026-74011 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-74001 (Unauthenticated Broken Authentication in User Registration &
Membershi ...)
+ TODO: check
+CVE-2026-73998 (Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.)
+ TODO: check
+CVE-2026-73993 (Unauthenticated PHP Object Injection in FundEngine <= 1.7.9
versions.)
+ TODO: check
+CVE-2026-73992 (Subscriber Remote Code Execution (RCE) in Query Wrangler <=
1.5.57 ver ...)
+ TODO: check
+CVE-2026-73402 (Subscriber Cross Site Scripting (XSS) in WP BASE Booking <=
6.3.2 vers ...)
+ TODO: check
+CVE-2026-73259 (Mongoose is an embedded web server and network library. Prior
to 7.22, ...)
+ TODO: check
+CVE-2026-73258 (Mongoose is an embedded web server and network library. Prior
to 7.22, ...)
+ TODO: check
+CVE-2026-73257 (Mongoose is an embedded web server and network library. Priro
to versi ...)
+ TODO: check
+CVE-2026-73256 (Mongoose is an embedded web server and network library. Prior
to 7.22, ...)
+ TODO: check
+CVE-2026-73255 (Mongoose is an embedded web server and network library. Prior
to 7.22, ...)
+ TODO: check
+CVE-2026-73254 (Mongoose is an embedded web server and network library. Prior
to 7.22, ...)
+ TODO: check
+CVE-2026-73253 (Mongoose is an embedded web server and network library. Prior
to versi ...)
+ TODO: check
+CVE-2026-73220 (CVAT is an open source interactive video and image annotation
tool for ...)
+ TODO: check
+CVE-2026-73199 (A flaw was found in the `ipa-enrollment` SLAPI plugin. A
remote authen ...)
+ TODO: check
+CVE-2026-73198 (A flaw was found in FreeIPA. A remote, unauthenticated
attacker can ex ...)
+ TODO: check
+CVE-2026-73197 (A flaw was found in FreeIPA. A remote, unauthenticated
attacker can ex ...)
+ TODO: check
+CVE-2026-73196 (A flaw was found in FreeIPA. A low-privilege authenticated
user can ex ...)
+ TODO: check
+CVE-2026-72854 (msgpack_unpacker_expand_buffer in src/unpack.c, reached
through the pu ...)
+ TODO: check
+CVE-2026-72852 (hank-ai/darknet sizes a convolutional layer's weight and
output heap b ...)
+ TODO: check
+CVE-2026-72847 (broot renders each file and directory name in its interactive
tree vie ...)
+ TODO: check
+CVE-2026-72845
+ REJECTED
+CVE-2026-72844 (The Lean 4 kernel does not verify that the structure named in
a projec ...)
+ TODO: check
+CVE-2026-71492 (Banks generates meaningful LLM prompts using a simple template
languag ...)
+ TODO: check
+CVE-2026-71428 (The unstructured library provides open-source components for
ingesting ...)
+ TODO: check
+CVE-2026-70383 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
+ TODO: check
+CVE-2026-6822
+ REJECTED
+CVE-2026-6260
+ REJECTED
+CVE-2026-69183 (Monkeytype is a minimalistic and customizable typing test. In
26.26.0 ...)
+ TODO: check
+CVE-2026-68566 (Unauthenticated SQL Injection in BookingPress Appointment
Booking Pro ...)
+ TODO: check
+CVE-2026-68564 (Unauthenticated Cross Site Scripting (XSS) in NotificationX
Pro <= 3.1 ...)
+ TODO: check
+CVE-2026-66788 (A flaw was found in Lighthouse. A remote attacker, by
compromising a s ...)
+ TODO: check
+CVE-2026-66787 (A flaw was found in the lighthouse component of Red Hat
Advanced Clust ...)
+ TODO: check
+CVE-2026-66785 (A flaw was found in Submariner. This vulnerability allows a
malicious ...)
+ TODO: check
+CVE-2026-66682 (Unauthenticated Privilege Escalation in Abandoned Cart Pro for
WooComm ...)
+ TODO: check
+CVE-2026-66680 (Unauthenticated SQL Injection in Locatoraid Store Locator <=
3.9.72 ve ...)
+ TODO: check
+CVE-2026-66677 (Subscriber Broken Authentication in Leyka <= 3.32.3 versions.)
+ TODO: check
+CVE-2026-66673 (Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0
version ...)
+ TODO: check
+CVE-2026-66672 (Unauthenticated PHP Object Injection in Flatastic <= 2.0
versions.)
+ TODO: check
+CVE-2026-66649 (Unauthenticated SQL Injection in Directory Pro <= 2.5.8
versions.)
+ TODO: check
+CVE-2026-66647 (Subscriber Broken Access Control in Homlisti <= 3.1.2
versions.)
+ TODO: check
+CVE-2026-66616 (Unauthenticated Cross Site Scripting (XSS) in Form Maker by
10Web <= 1 ...)
+ TODO: check
+CVE-2026-66615 (Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast
Publishe ...)
+ TODO: check
+CVE-2026-66614 (Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by
Squirrly S ...)
+ TODO: check
+CVE-2026-66612 (Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19
versions.)
+ TODO: check
+CVE-2026-66611 (Unauthenticated Cross Site Scripting (XSS) in Paymob for
WooCommerce < ...)
+ TODO: check
+CVE-2026-66609 (Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3
versions ...)
+ TODO: check
+CVE-2026-66607 (Unauthenticated Cross Site Scripting (XSS) in Advance Product
Search < ...)
+ TODO: check
+CVE-2026-66606 (Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <=
1.2.0 versi ...)
+ TODO: check
+CVE-2026-66605 (Unauthenticated Cross Site Scripting (XSS) in Swatchly \u2013
WooComme ...)
+ TODO: check
+CVE-2026-66604 (Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <=
2.8.173 ...)
+ TODO: check
+CVE-2026-66601 (Subscriber Cross Site Scripting (XSS) in Media LIbrary
Assistant <= 3. ...)
+ TODO: check
+CVE-2026-66600 (Author Arbitrary File Upload in Media LIbrary Assistant <=
3.39 versio ...)
+ TODO: check
+CVE-2026-66598 (Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium
<= 5.6.0 ...)
+ TODO: check
+CVE-2026-66597 (Unauthenticated Cross Site Scripting (XSS) in wpDataTables <=
6.5.1.4 ...)
+ TODO: check
+CVE-2026-66595 (Unauthenticated Broken Access Control in WP Data Access <=
5.5.80 vers ...)
+ TODO: check
+CVE-2026-66594 (Subscriber SQL Injection in WordPress Persistent Login <=
3.1.0 versio ...)
+ TODO: check
+CVE-2026-66593 (Unauthenticated SQL Injection in Security & Malware scan by
CleanTalk ...)
+ TODO: check
+CVE-2026-66592 (Unauthenticated SQL Injection in rtMedia for WordPress,
BuddyPress and ...)
+ TODO: check
+CVE-2026-66590 (Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4
versions ...)
+ TODO: check
+CVE-2026-66586 (Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.)
+ TODO: check
+CVE-2026-66583 (Unauthenticated PHP Object Injection in Forminator <= 1.57.0
versions.)
+ TODO: check
+CVE-2026-66582 (Unauthenticated Cross Site Scripting (XSS) in TranslatePress
<= 3.3.2 ...)
+ TODO: check
+CVE-2026-66581 (Unauthenticated Cross Site Scripting (XSS) in JetEngine <=
3.8.14.1 ve ...)
+ TODO: check
+CVE-2026-66002 (Frappe is a full-stack web application framework. Prior to
15.115.0 an ...)
+ TODO: check
+CVE-2026-66001 (Frappe is a full-stack web application framework. Prior to
15.114.0 an ...)
+ TODO: check
+CVE-2026-65842 (Plate is a rich-text editor with AI and shadcn/ui. Prior to
53.3.2, @p ...)
+ TODO: check
+CVE-2026-64972 (ATutor is vulnerable to Reflected XSS via popup parameter in
preview.p ...)
+ TODO: check
+CVE-2026-64971 (ATutor is vulnerable to Reflected XSS in restore
functionality. An att ...)
+ TODO: check
+CVE-2026-64970 (ATutor is vulnerable to Stored Cross Site Scripting in
registration fu ...)
+ TODO: check
+CVE-2026-64969 (ATutor is vulnerable to InsecureDirect Object Reference (IDOR)
attack ...)
+ TODO: check
+CVE-2026-64968 (ATutor is vulnerable toServer-Side request forgery in import
functiona ...)
+ TODO: check
+CVE-2026-64967 (A path traversal vulnerability in ATutor's error log viewer
allows an ...)
+ TODO: check
+CVE-2026-64966 (ATutor is vulnerable to a Path Traversal vulnerability in ZIP
extracti ...)
+ TODO: check
+CVE-2026-64965 (ATutor is vulnerable to Missing Authorization Check on Test
and Questi ...)
+ TODO: check
+CVE-2026-64964 (ATutor generates predictable email confirmation tokens due to
the use ...)
+ TODO: check
+CVE-2026-64963 (A path traversal vulnerability in ATutor allows an
authenticated user ...)
+ TODO: check
+CVE-2026-64962 (ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in
profile u ...)
+ TODO: check
+CVE-2026-64961 (ATutor is vulnerable to authentication bypass .Although a
token valida ...)
+ TODO: check
+CVE-2026-64960 (ATutor Gameme module allows users to upload files of any type
and exte ...)
+ TODO: check
+CVE-2026-64846 (Nix is a package manager for Linux and other Unix systems.
Prior to 2. ...)
+ TODO: check
+CVE-2026-64777 (A malicious builder peer may be able to request an in-context
file by ...)
+ TODO: check
+CVE-2026-63654 (Frappe is a full-stack web application framework. In version
16.31.0 a ...)
+ TODO: check
+CVE-2026-63495 (Libevent is an event notification library. From
2.2.0-alpha-dev until ...)
+ TODO: check
+CVE-2026-63490 (Handlebars.java provides logic-less and semantic Mustache
templates wi ...)
+ TODO: check
+CVE-2026-63481 (Hurl is a command line tool that runs and tests HTTP requests
defined ...)
+ TODO: check
+CVE-2026-63388 (Libevent is an event notification library. Prior to 2.1.13 and
2.2.2-a ...)
+ TODO: check
+CVE-2026-63387 (Libevent is an event notification library. Prior to 2.1.13 and
2.2.2-a ...)
+ TODO: check
+CVE-2026-63385 (Libevent is an event notification library. Prior to 2.1.13 and
2.2.2-a ...)
+ TODO: check
+CVE-2026-63384 (Libevent is an event notification library. Prior to 2.1.13 and
2.2.2-a ...)
+ TODO: check
+CVE-2026-63383 (Libevent is an event notification library. Prior to 2.1.13 and
2.2.2-a ...)
+ TODO: check
+CVE-2026-63382 (Libevent is an event notification library. Prior to 2.1.13 and
2.2.2-a ...)
+ TODO: check
+CVE-2026-63381 (Libevent is an event notification library. Prior to 2.1.13 and
2.2.2-a ...)
+ TODO: check
+CVE-2026-63380 (Libevent is an event notification library. Prior to
2.2.2-alpha, libev ...)
+ TODO: check
+CVE-2026-63379 (Libevent is an event notification library. Prior to 2.1.13 and
2.2.2-a ...)
+ TODO: check
+CVE-2026-63044 (Server-Side Request Forgery (SSRF) vulnerability in Apache
InLong.Any ...)
+ TODO: check
+CVE-2026-63043 (Relative Path Traversal vulnerability in Apache
InLong.Arbitrary file ...)
+ TODO: check
+CVE-2026-63042 (Files or Directories Accessible to External Parties
vulnerability in A ...)
+ TODO: check
+CVE-2026-63040 (Files or Directories Accessible to External Parties
vulnerability in A ...)
+ TODO: check
+CVE-2026-63039 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-63038 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-63037 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-63016 (Uncontrolled Resource Consumption vulnerability in Apache
InLong. User ...)
+ TODO: check
+CVE-2026-63015 (Uncontrolled Resource Consumption vulnerability in Apache
InLong.Non-t ...)
+ TODO: check
+CVE-2026-63003 (django CMS is an easy-to-use and developer-friendly enterprise
content ...)
+ TODO: check
+CVE-2026-62315 (Frappe is a full-stack web application framework. In version
16.31.0 a ...)
+ TODO: check
+CVE-2026-61704 (Link Preview JS extracts web links information. Prior to
4.0.4, the re ...)
+ TODO: check
+CVE-2026-61663 (django CMS is an easy-to-use and developer-friendly enterprise
content ...)
+ TODO: check
+CVE-2026-61625 (VictoriaMetrics is a scalable solution for monitoring and
managing tim ...)
+ TODO: check
+CVE-2026-55642 (dbx is a cross-platform database client for databases. Prior
to 0.5.51 ...)
+ TODO: check
+CVE-2026-55586 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and
earlier, ...)
+ TODO: check
+CVE-2026-55558 (aiosmtplib is an asynchronous SMTP client for use with
asyncio. Prior ...)
+ TODO: check
+CVE-2026-55095 (OpenProject is open-source, web-based project management
software. In ...)
+ TODO: check
+CVE-2026-54770 (WebOb provides objects for HTTP requests and responses. Prior
to 1.8.1 ...)
+ TODO: check
+CVE-2026-54625 (django CMS is a content management system powered by Django.
Prior to ...)
+ TODO: check
+CVE-2026-54624 (django CMS is an easy-to-use and developer-friendly enterprise
content ...)
+ TODO: check
+CVE-2026-54623 (django CMS is an easy-to-use and developer-friendly enterprise
content ...)
+ TODO: check
+CVE-2026-54622 (django CMS is an easy-to-use and developer-friendly enterprise
content ...)
+ TODO: check
+CVE-2026-54616 (NanaZip is the 7-Zip derivative intended for the modern
Windows experi ...)
+ TODO: check
+CVE-2026-54449 (LangBot is a global IM bot platform designed for LLMs. In
version 4.10 ...)
+ TODO: check
+CVE-2026-54136 (Windmill is an open-source developer platform for internal
code: APIs, ...)
+ TODO: check
+CVE-2026-53993
+ REJECTED
+CVE-2026-53569 (Frappe is a full-stack web application framework. In version
16.31.0 a ...)
+ TODO: check
+CVE-2026-53425 (Insufficient Verification of Data Authenticity vulnerability
in dropbo ...)
+ TODO: check
+CVE-2026-53424 (Authentication Bypass by Capture-replay vulnerability in
dropbox samly ...)
+ TODO: check
+CVE-2026-49996 (SecureDrop Client is a desktop app for journalists to securely
communi ...)
+ TODO: check
+CVE-2026-49825 (lxml is a library for processing XML and HTML in the Python
language. ...)
+ TODO: check
+CVE-2026-46537
+ REJECTED
+CVE-2026-46536
+ REJECTED
+CVE-2026-46535
+ REJECTED
+CVE-2026-46534
+ REJECTED
+CVE-2026-46533
+ REJECTED
+CVE-2026-44725 (EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT,
and con ...)
+ TODO: check
+CVE-2026-43678 (An unauthenticated remote peer can crash any
NIOWebSocket-based server ...)
+ TODO: check
+CVE-2026-40345 (deepmerge-ts is a typescript library providing functionality
to deep m ...)
+ TODO: check
+CVE-2026-2334 (An issue was discovered in vsDesk v14.0101. An authenticated
attacker ...)
+ TODO: check
+CVE-2026-28164 (Cross-Site Request Forgery (CSRF) vulnerability in HashThemes
Easy Ele ...)
+ TODO: check
+CVE-2026-28163 (Missing Authorization vulnerability in myCred New User Approve
allows ...)
+ TODO: check
+CVE-2026-28150 (Unauthenticated Local File Inclusion in Golo Framework < 1.7.5
version ...)
+ TODO: check
+CVE-2026-21784 (HCL IntelliOps Event Management (IEM) is affected by missing
or insecu ...)
+ TODO: check
+CVE-2026-19683 (A vulnerability exists in the Dynamic DNS (DDNS) functionality
of TP-L ...)
+ TODO: check
+CVE-2026-19611 (A flaw was found in WildFly Elytron. Password hashing and
verification ...)
+ TODO: check
+CVE-2026-19586 (A pre-authentication OS command injection vulnerability has
been ident ...)
+ TODO: check
+CVE-2026-18917 (A flaw was found in libvirt. An unprivileged local user could
exploit ...)
+ TODO: check
+CVE-2026-18482 (Neo.mjs contains a command injection vulnerability within the
FileSyst ...)
+ TODO: check
+CVE-2026-18309 (GIMP APNG File Parsing Integer Overflow Remote Code Execution
Vulnerab ...)
+ TODO: check
+CVE-2026-18308 (GIMP TIF File Parsing Integer Overflow Remote Code Execution
Vulnerabi ...)
+ TODO: check
+CVE-2026-18307 (GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code
Execution ...)
+ TODO: check
+CVE-2026-18306 (GIMP SGI File Parsing Integer Overflow Remote Code Execution
Vulnerabi ...)
+ TODO: check
+CVE-2026-18305 (GIMP TIF File Parsing Integer Overflow Remote Code Execution
Vulnerabi ...)
+ TODO: check
+CVE-2026-18304 (GIMP TIF File Parsing Integer Overflow Remote Code Execution
Vulnerabi ...)
+ TODO: check
+CVE-2026-18303 (GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code
Executio ...)
+ TODO: check
+CVE-2026-18302 (GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code
Execution ...)
+ TODO: check
+CVE-2026-18301 (GIMP PSD File Parsing Integer Overflow Remote Code Execution
Vulnerabi ...)
+ TODO: check
+CVE-2026-18300 (GIMP HDR File Parsing Integer Overflow Remote Code Execution
Vulnerabi ...)
+ TODO: check
+CVE-2026-18299 (GStreamer rtpsbcdepay Use-After-Free Remote Code Execution
Vulnerabili ...)
+ TODO: check
+CVE-2026-18298 (GStreamer PNG File Parsing Heap-based Buffer Overflow Remote
Code Exec ...)
+ TODO: check
+CVE-2026-18297 (GStreamer OGG File Parsing Stack-based Buffer Overflow Remote
Code Exe ...)
+ TODO: check
+CVE-2026-18296 (GStreamer MRF File Parsing Heap-based Buffer Overflow Remote
Code Exec ...)
+ TODO: check
+CVE-2026-18295 (GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code
Execution V ...)
+ TODO: check
+CVE-2026-18294 (OriginLab Origin Viewer OGW File Parsing Memory Corruption
Remote Code ...)
+ TODO: check
+CVE-2026-18293 (OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write
Remote Co ...)
+ TODO: check
+CVE-2026-18292 (OriginLab OriginPro OGG File Parsing Memory Corruption Remote
Code Exe ...)
+ TODO: check
+CVE-2026-18291 (OriginLab OriginPro OGW File Parsing Memory Corruption Remote
Code Exe ...)
+ TODO: check
+CVE-2026-18290 (OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write
Remote Code E ...)
+ TODO: check
+CVE-2026-18289 (OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write
Remote Code E ...)
+ TODO: check
+CVE-2026-18288 (OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write
Remote Code ...)
+ TODO: check
+CVE-2026-18287 (Aeon load_time_series_segmentation_benchmark Code Injection
Remote Cod ...)
+ TODO: check
+CVE-2026-18286 (Aeon load_human_activity_segmentation_datasets Code Injection
Remote C ...)
+ TODO: check
+CVE-2026-18285 (Aeon load_rehab_pile_dataset Deserialization of Untrusted Data
Remote ...)
+ TODO: check
+CVE-2026-18284 (Sony XAV-9500ES Crash Dump Handler Command Injection Local
Privilege E ...)
+ TODO: check
+CVE-2026-18283 (Sony XAV-9500ES udev USB Rules Authorization Bypass
Vulnerability. Thi ...)
+ TODO: check
+CVE-2026-18282 (Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer
Overflow Re ...)
+ TODO: check
+CVE-2026-18281 (Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow
Remote Co ...)
+ TODO: check
+CVE-2026-18280 (Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution
Vulnerab ...)
+ TODO: check
+CVE-2026-18279 (Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code
Execution Vulne ...)
+ TODO: check
+CVE-2026-18278 (Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read
Information Di ...)
+ TODO: check
+CVE-2026-18274 (Heimdall Data Database Proxy uploadJar Directory Traversal
Remote Code ...)
+ TODO: check
+CVE-2026-18273 (Kenwood DNR1007XR USB Incorrect Default Permissions Local
Privilege Es ...)
+ TODO: check
+CVE-2026-18272 (Kenwood DNR1007XR startUpdateProcess Command Injection
Vulnerability. ...)
+ TODO: check
+CVE-2026-18271 (Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code
Executio ...)
+ TODO: check
+CVE-2026-18270 (Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local
Privile ...)
+ TODO: check
+CVE-2026-18269 (Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write
Code Execu ...)
+ TODO: check
+CVE-2026-18268 (Kenwood DNR1007XR JKGenService Command Injection Local
Privilege Escal ...)
+ TODO: check
+CVE-2026-18267 (Kenwood DNR1007XR Firmware Update Link Following Code
Execution Vulner ...)
+ TODO: check
+CVE-2026-18265 (OSNEXUS QuantaStor Missing Authentication Remote Code
Execution Vulner ...)
+ TODO: check
+CVE-2026-18264 (NoMachine getstat Command Injection Remote Code Execution
Vulnerabilit ...)
+ TODO: check
+CVE-2026-18263 (Parallels RAS Client RDP Backend Service Exposed Dangerous
Function Lo ...)
+ TODO: check
+CVE-2026-18262 (Parallels RAS Client RDP Backend Service Exposed Dangerous
Function Lo ...)
+ TODO: check
+CVE-2026-16932 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a
local atta ...)
+ TODO: check
+CVE-2026-16928 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a
remote att ...)
+ TODO: check
+CVE-2026-16927 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a
local atta ...)
+ TODO: check
+CVE-2026-16926 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a
remote att ...)
+ TODO: check
+CVE-2026-16925 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a
local atta ...)
+ TODO: check
+CVE-2026-16924 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a
remote att ...)
+ TODO: check
+CVE-2026-16923 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a
local atta ...)
+ TODO: check
+CVE-2026-16922 (IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a
local atta ...)
+ TODO: check
+CVE-2026-15743 (Catalyst::Plugin::Static::Simple versions through 0.38 for
Perl mark r ...)
+ TODO: check
+CVE-2026-15706 (Missing authentication for critical function vulnerability in
Baylan M ...)
+ TODO: check
+CVE-2026-15686 (Adminer multi_query Incorrect Check of Function Return Value
Remote Co ...)
+ TODO: check
+CVE-2026-15679 (Hugging Face PyTorch Image Models checkpoint Deserialization
of Untrus ...)
+ TODO: check
+CVE-2026-14953 (A low-privileged remote attacker can enumerate all configured
users an ...)
+ TODO: check
+CVE-2026-14952 (An unauthenticated remote attacker can retrieve sensible files
from th ...)
+ TODO: check
+CVE-2026-14951 (An low privileged remote attacker can cause authenticated
users to per ...)
+ TODO: check
+CVE-2026-14950 (An unauthenticated remote attacker in possession of a valid
session id ...)
+ TODO: check
+CVE-2026-14949 (A low privileged remote attacker with a valid session can
submit a req ...)
+ TODO: check
+CVE-2026-14948 (A low privileged remote attacker can hijack an active
administrative s ...)
+ TODO: check
+CVE-2026-14947 (A high-privileged remote attacker can upload malicious ZIP
archive con ...)
+ TODO: check
+CVE-2026-14946 (A high privileged remote attacker can upload a .php file and
then requ ...)
+ TODO: check
+CVE-2026-13121 (Parallels RAS Client RDP Backend Service Exposed Dangerous
Function Lo ...)
+ TODO: check
+CVE-2026-13097 (A privilege escalation flaw was found in FreeIPA. The
uniqueness const ...)
+ TODO: check
+CVE-2026-11861 (A flaw was found in FreeIPA. When a trust relationship is
configured b ...)
+ TODO: check
+CVE-2025-62307 (HCL IntelliOps Event Management (IEM) is affected by
insufficient logg ...)
+ TODO: check
+CVE-2025-62306 (HCL IntelliOps Event Management (IEM) is affected by
information omiss ...)
+ TODO: check
+CVE-2025-62300 (HCL IntelliOps Event Management (IEM) is affected by a race
condition. ...)
+ TODO: check
+CVE-2025-62299 (HCL IntelliOps Event Management (IEM) is affected by a least
privilege ...)
+ TODO: check
+CVE-2025-53999 (Unauthenticated Broken Access Control in Altair <= 5.2.2
versions.)
+ TODO: check
+CVE-2025-15689 (Unauthenticated Privilege Escalation in Capella <= 2.5.5
versions.)
+ TODO: check
+CVE-2025-15688 (Unauthenticated SQL Injection in Capella <= 2.5.5 versions.)
+ TODO: check
+CVE-2025-15637 (Unauthenticated Local File Inclusion in Shuffle <= 1.8
versions.)
+ TODO: check
+CVE-2025-14601 (An OS command injection vulnerability in vsDesk allows an
authenticate ...)
+ TODO: check
CVE-2026-XXXX [OSSN-0103]
- manila 1:22.0.0-4 (bug #1143804)
[trixie] - manila <no-dsa> (Minor issue)
@@ -4100,7 +4674,7 @@ CVE-2026-74038 (Wazuh 4.0.0 before 4.14.6 contains a path
traversal vulnerabilit
NOT-FOR-US: Wazuh
CVE-2026-74015 (Unauthenticated SQL Injection in Readabler < 2.0.18 versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-74012 (Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.)
+CVE-2026-74012 (Deserialization of Untrusted Data vulnerability in TaxoPress
allows Ob ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-74009 (Unauthenticated Insecure Direct Object References (IDOR) in
Razorpay f ...)
NOT-FOR-US: WordPress plugin or theme
@@ -4943,6 +5517,7 @@ CVE-2026-64849 (MLflow is an open source AI engineering
platform for agents, lar
CVE-2026-64788 (The issue was addressed with improved memory handling. This
issue is f ...)
NOT-FOR-US: Apple
CVE-2026-64787 (A use-after-free issue was addressed with improved memory
management. ...)
+ {DSA-6398-1}
- webkit2gtk 2.52.5-1
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -5049,6 +5624,7 @@ CVE-2026-34398 (FreeCAD is a free and open-source
multiplatform 3D parametric mo
NOTE: https://github.com/FreeCAD/FreeCAD/pull/28610
NOTE: Fixed by:
https://github.com/FreeCAD/FreeCAD/commit/9ed351cc4700db0a94c46f020c34c58bbf1bdaba
(1.1.1)
CVE-2026-28984 (The issue was addressed with improved memory handling. This
issue is f ...)
+ {DSA-6398-1}
- webkit2gtk 2.52.4-1
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
@@ -11333,7 +11909,7 @@ CVE-2026-63626 [Built-in TCP/IP PPP IPV6CP option
parsing bounds check]
- mongoose 7.23+ds-1
CVE-2026-73252 [Built-in TLS short-record handling]
- mongoose 7.23+ds-1
-CVE-2026-73251 [Built-in TLS certificate-chain verification with CA bundles]
+CVE-2026-73251 (Mongoose is an embedded web server and network library. Prior
to 7.23, ...)
- mongoose 7.23+ds-1
CVE-2026-56865 (A malicious GOPROXY was previously capable of forging up to
two sumdb ...)
- golang-1.27 1.27~rc3-1 (bug #1144340)
@@ -13615,6 +14191,7 @@ CVE-2026-63134 (Malcolm is a network traffic analysis
tool suite. Prior to versi
CVE-2026-63133 (Malcolm is a network traffic analysis tool suite. Prior to
version 26. ...)
NOT-FOR-US: Malcolm
CVE-2026-5917 (libgit2 versions v0.27.0 through v1.9.0 built with the libssh2
SSH bac ...)
+ {DSA-6453-1}
- libgit2 1.9.7+ds-1 (bug #1144465)
NOTE: Fixed by:
https://github.com/libgit2/libgit2/commit/b2105b8e60798cb28086d4c648b1cb4854eadccb
(v1.9.7)
CVE-2026-55676 (Malcolm is a network traffic analysis tool suite. The
file-upload comp ...)
@@ -14292,7 +14869,7 @@ CVE-2026-71383 (is affected by an Incorrect
Authorization vulnerability that cou
NOT-FOR-US: Adobe
CVE-2026-71362 (Adobe Commerce is affected by an Incorrect Authorization
vulnerability ...)
NOT-FOR-US: Adobe
-CVE-2026-71331 (Integer overflow or wraparound in Microsoft Azure Attestation
service ...)
+CVE-2026-71331 (Integer overflow or wraparound in Windows Device Health
Attestation (D ...)
NOT-FOR-US: Microsoft
CVE-2026-71218 (A flaw was found in iperf3. A remote unauthenticated attacker
can expl ...)
- iperf3 3.18-1
@@ -18711,10 +19288,10 @@ CVE-2026-68083 (In the Linux kernel, the following
vulnerability has been resolv
[trixie] - linux 6.12.100-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/1c8951963d8ed357f70f59e0ad4ddce2199d2016 (7.2-rc1)
-CVE-2026-61897
+CVE-2026-61897 (An Ubuntu-specific patch to AccountsService before
23.13.9-8ubuntu7 on ...)
- accountsservice <not-affected> (Ubuntu-specific changes)
NOTE:
https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985
-CVE-2026-61898
+CVE-2026-61898 (The Ubuntu-specific language helper scripts (save-to-pam-env,
update-l ...)
- accountsservice <not-affected> (Ubuntu-specific changes)
NOTE:
https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985
CVE-2026-XXXX [Neutron sub-resource APIs do not verify parent ownership]
@@ -24959,23 +25536,28 @@ CVE-2026-60074 (Date::Manip versions through 6.99 for
Perl return corrupted date
[bullseye] - libdate-manip-perl <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/42266594/
NOTE:
https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60074-r1.patch
-CVE-2026-53587
+CVE-2026-53587 (libgit2 is a portable C implementation of the Git core methods
provide ...)
+ {DSA-6453-1}
- libgit2 1.9.6+ds-1
NOTE:
https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm
NOTE: Fixed by:
https://github.com/libgit2/libgit2/commit/affda60c10fcef16723451c0d7dc71b71dc20ad3
(v1.9.5)
-CVE-2026-53586
+CVE-2026-53586 (libgit2 is a portable C implementation of the Git core methods
provide ...)
+ {DSA-6453-1}
- libgit2 1.9.6+ds-1
NOTE:
https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x
NOTE: Fixed by:
https://github.com/libgit2/libgit2/commit/af2b29ad0a74d5bac9751376879ddaf848136d3b
(v1.9.5)
-CVE-2026-53585
+CVE-2026-53585 (libgit2 is a portable C implementation of the Git core methods
provide ...)
+ {DSA-6453-1}
- libgit2 1.9.6+ds-1
NOTE:
https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j
NOTE: Fixed by:
https://github.com/libgit2/libgit2/commit/0cdfdd5fa8f8514c82413025e1e0808866cf7c30
(v1.9.5)
-CVE-2026-53584
+CVE-2026-53584 (libgit2 is a portable C implementation of the Git core methods
provide ...)
+ {DSA-6453-1}
- libgit2 1.9.6+ds-1
NOTE:
https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm
NOTE: Fixed by:
https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4
(v1.9.5)
-CVE-2026-53583
+CVE-2026-53583 (libgit2 is a portable C implementation of the Git core methods
provide ...)
+ {DSA-6453-1}
- libgit2 1.9.6+ds-1
NOTE:
https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp
NOTE: Fixed by:
https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f
(v1.9.5)
@@ -42576,9 +43158,9 @@ CVE-2026-54121 (Improper authorization in Active
Directory Certificate Services
NOT-FOR-US: Microsoft
CVE-2026-54119 (Loop with unreachable exit condition ('infinite loop') in
Windows Acti ...)
NOT-FOR-US: Microsoft
-CVE-2026-54118 (Deserialization of untrusted data in SQL Server allows an
authorized a ...)
+CVE-2026-54118 (Deserialization of untrusted data in SQL Server allows an
unauthorized ...)
NOT-FOR-US: Microsoft
-CVE-2026-54117 (Deserialization of untrusted data in SQL Server allows an
authorized a ...)
+CVE-2026-54117 (Deserialization of untrusted data in SQL Server allows an
unauthorized ...)
NOT-FOR-US: Microsoft
CVE-2026-54116 (Access of resource using incompatible type ('type confusion')
in SQL S ...)
NOT-FOR-US: Microsoft
@@ -46558,7 +47140,7 @@ CVE-2026-59946 (Composer is a dependency Manager for
the PHP language. Prior to
NOTE: Fixed by:
https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0
(2.10.2)
NOTE: Fixed by:
https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1
(2.2.29)
CVE-2026-59939 (httplib2 is a comprehensive HTTP client library for Python.
Prior to 0 ...)
- {DSA-6441-1}
+ {DSA-6441-1 DLA-4748-1 DLA-4747-1}
- python-httplib2 0.32.0-1
NOTE:
https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3
NOTE: Fixed by:
https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427
(v0.32.0)
@@ -62229,7 +62811,7 @@ CVE-2026-XXXX [RUSTSEC-2026-0184]
[bullseye] - rust-git2 <postponed> (Minor issue)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0184.html
NOTE: https://github.com/rust-lang/git2-rs/pull/1254
-CVE-2026-50190
+CVE-2026-50190 (Shaarli is a personal bookmarking service. Versions prior to
0.16.3 ar ...)
- shaarli <unfixed> (bug #1140348)
[bookworm] - shaarli <postponed> (Minor issue, XSS)
NOTE:
https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv
@@ -595968,6 +596550,7 @@ CVE-2021-21241 (The Python "Flask-Security-Too"
package is used for adding secur
NOTE:
https://github.com/Flask-Middleware/flask-security/commit/c05afe837e83f20f59c0fb409ce1240341d1ec41
(master)
NOTE:
https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f
(3.4.5)
CVE-2021-21240 (httplib2 is a comprehensive HTTP client library for Python. In
httplib ...)
+ {DLA-4747-1}
- python-httplib2 0.20.2-1 (bug #982738)
[buster] - python-httplib2 <no-dsa> (Minor issue)
[stretch] - python-httplib2 <no-dsa> (Minor issue)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ddad2f5974692ea6009032142228b21b8e300c51
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ddad2f5974692ea6009032142228b21b8e300c51
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
