Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
752f0ed3 by Salvatore Bonaccorso at 2026-08-29T22:22:02+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -35,17 +35,17 @@ CVE-2026-82466 (Rodauth before 2.46.0 contains an
authentication bypass vulnerab
NOTE:
https://github.com/jeremyevans/rodauth/security/advisories/GHSA-3pvr-v35r-4r75
NOTE: Fixed by:
https://github.com/jeremyevans/rodauth/commit/35d74a9f07b2005a8ea75fc11a6539c04f3c2840
(2.46.0)
CVE-2026-82465 (pac4j-saml before 6.5.6 does not require signature validation
of SAML ...)
- TODO: check
+ NOT-FOR-US: pac4j-saml
CVE-2026-82464 (pac4j-core before 6.5.6 contains an open redirect
vulnerability in Def ...)
- TODO: check
+ NOT-FOR-US: pac4j-core
CVE-2026-82463 (pac4j-core before 6.5.6 contains an authentication bypass
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: pac4j-core
CVE-2026-82462 (pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only
an access ...)
- TODO: check
+ NOT-FOR-US: pac4j-oidc
CVE-2026-82461 (pac4j-oidc before 6.5.6 fails to verify access token
signatures, issue ...)
- TODO: check
+ NOT-FOR-US: pac4j-oidc
CVE-2026-82460 (Cloud Commander before 19.20.2 contains a directory traversal
vulnerab ...)
- TODO: check
+ NOT-FOR-US: Cloud Commander
CVE-2026-82457 (su-exec through 0.3 fails to validate numeric user and group
identifie ...)
- su-exec <itp> (bug #1003059)
CVE-2026-82456 (argocd-mcp 0.8.0 binds its HTTP transport to every network
interface a ...)
@@ -55,23 +55,23 @@ CVE-2026-82455 (RubyGems fails to re-validate path
containment after filesystem
NOTE: https://github.com/ruby/rubygems/pull/9493
NOTE: Fixed by (merge):
https://github.com/ruby/rubygems/commit/103ca4230deacb31b9fcd813de109e83b5fc71ac
CVE-2026-82454 (The Omnivore API (packages/api) before the fix in commit
abf53d6 conta ...)
- TODO: check
+ NOT-FOR-US: Omnivore API (packages/api)
CVE-2026-82453 (rust-iot-platform through commit 5df942ab stores user
passwords in cle ...)
- TODO: check
+ NOT-FOR-US: rust-iot-platform
CVE-2026-82452 (rust-iot-platform through commit 5df942ab contains an
authentication b ...)
- TODO: check
+ NOT-FOR-US: rust-iot-platform
CVE-2026-82451 (Formwork through 2.3.14 contains a stored cross-site scripting
vulnera ...)
- TODO: check
+ NOT-FOR-US: Formwork
CVE-2026-82450 (BookStack before 26.05.4 contains a remote code execution
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: BookStack
CVE-2026-82449 (Cockpit CMS before 2.14.1 contains an account enumeration
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Cockpit CMS
CVE-2026-82448 (Shinobi before commit 5a76c74f contains a hardcoded connection
key in ...)
- TODO: check
+ NOT-FOR-US: Shinobi
CVE-2026-82447 (Skyvern before 1.0.45 contains a sandbox escape vulnerability
in TextP ...)
- TODO: check
+ NOT-FOR-US: Skyvern
CVE-2026-82364 (A security vulnerability has been detected in macrozheng mall
up to 1. ...)
- TODO: check
+ NOT-FOR-US: macrozheng mall
CVE-2026-75807 (The SAML Single Sign On \u2013 SSO Login plugin for WordPress
is vulne ...)
NOT-FOR-US: WordPress plugin
CVE-2026-14494 (The Sigma Forms Pro plugin for WordPress is vulnerable to
Remote Code ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/752f0ed3f323cc9dd298b35585e62de089d0c66d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/752f0ed3f323cc9dd298b35585e62de089d0c66d
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
