Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
af616520 by security tracker role at 2026-09-12T19:13:29+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,89 @@
+CVE-2026-90560 (zstd-jni versions 1.2.0 through 1.5.7-13 contain an
out-of-bounds read ...)
+ TODO: check
+CVE-2026-90559 (snappy-java through 1.1.10.8 contains an out-of-bounds write
vulnerabi ...)
+ TODO: check
+CVE-2026-90558 (sngrep through 1.8.4 contains stack buffer overflow
vulnerabilities in ...)
+ TODO: check
+CVE-2026-90557 (Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds
read vul ...)
+ TODO: check
+CVE-2026-90556 (Freeciv versions before 3.2.6 contain a heap buffer overflow
in workli ...)
+ TODO: check
+CVE-2026-90555 (vLLM versions before 0.28.0 fail to validate audio sample rate
headers ...)
+ TODO: check
+CVE-2026-90554 (vLLM versions >=0.10.2 and <0.28.0 do not apply any audio
decode-size ...)
+ TODO: check
+CVE-2026-90553 (vLLM before 0.28.0 contains a remote code execution
vulnerability in t ...)
+ TODO: check
+CVE-2026-90552 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90551 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90550 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90549 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90548 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90547 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90546 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90545 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90544 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90543 (WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1
and ear ...)
+ TODO: check
+CVE-2026-90542 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90541 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90540 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90539 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 co ...)
+ TODO: check
+CVE-2026-90538 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 co ...)
+ TODO: check
+CVE-2026-90537 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 co ...)
+ TODO: check
+CVE-2026-90536 (WWBN AVideo through commit
c3edcc274c389816d434acadac07ee78eaf330c1 fa ...)
+ TODO: check
+CVE-2026-90535 (Flowise versions before 3.1.4 contain an unauthenticated
denial of ser ...)
+ TODO: check
+CVE-2026-90534 (Flowise is a low-code platform for building LLM applications.
In versi ...)
+ TODO: check
+CVE-2026-90533 (Flowise before 3.1.4 contains a broken access control
vulnerability in ...)
+ TODO: check
+CVE-2026-90474 (MCPHub before 1.0.32 contains an authentication bypass
vulnerability i ...)
+ TODO: check
+CVE-2026-90473 (msgpack-java through 0.9.12 contains an integer overflow
vulnerability ...)
+ TODO: check
+CVE-2026-90472 (msgpack-java through 0.9.12 contains a stack overflow
vulnerability in ...)
+ TODO: check
+CVE-2026-89172 (Improper protection of physical side channels vulnerability in
Microch ...)
+ TODO: check
+CVE-2026-85200 (The GEO my WP plugin for WordPress is vulnerable to Local File
Inclusi ...)
+ TODO: check
+CVE-2026-85198 (The MPG \u2013 Multiple Page Generator, Bulk Landing Pages &
Programma ...)
+ TODO: check
+CVE-2026-78175 (The Tutor LMS \u2013 eLearning and online course solution
plugin for W ...)
+ TODO: check
+CVE-2026-78159 (The The Events Calendar plugin for WordPress is vulnerable to
Remote C ...)
+ TODO: check
+CVE-2026-78006 (The The Events Calendar plugin for WordPress is vulnerable to
Remote C ...)
+ TODO: check
+CVE-2026-77161 (The Smart Marketing SMS and Newsletters Forms plugin for
WordPress is ...)
+ TODO: check
+CVE-2026-17585 (The Royal Addons for Elementor \u2013 Addons and Templates Kit
for Ele ...)
+ TODO: check
+CVE-2026-16482 (The rtMedia for WordPress, BuddyPress and bbPress plugin for
WordPress ...)
+ TODO: check
+CVE-2026-15451 (The MemberPress Corporate Accounts plugin for WordPress is
vulnerable ...)
+ TODO: check
+CVE-2026-11355 (The DT LMS \u2013 elearning, WordPress LMS plugin for
WordPress is vul ...)
+ TODO: check
+CVE-2026-10148 (The Booking for Appointments and Events Calendar plugin for
WordPress ...)
+ TODO: check
CVE-2026-90467 (aiosmtplib before 5.1.3 fails to properly validate email
addresses sup ...)
- aiosmtplib <unfixed> (bug #1147474)
NOTE: Fixed by:
https://github.com/cole/aiosmtplib/commit/2e1b210714974ccc9efd0d09a8f846cb9aeaaec2
(v5.1.3)
@@ -67737,6 +67823,7 @@ CVE-2026-60065 (When NGINX Plus is configured to use
the Message Queuing Telemet
CVE-2026-60062 (The NGINX Agent config_dirsdirective allows a low-privileged
attacker ...)
NOT-FOR-US: F5
CVE-2026-60005 (NGINX Plus and NGINX Open Source have a vulnerability in the
ngx_http_ ...)
+ {DSA-6496-1}
- nginx 1.30.1-7
NOTE: https://my.f5.com/manage/s/article/K000162100
CVE-2026-59955 (Apollo is a reliable configuration management system suitable
for micr ...)
@@ -67811,6 +67898,7 @@ CVE-2026-56699
CVE-2026-56687 (Dell ThinOS 10, versions prior to 2605_10.2100, contain an
Obsolete Fe ...)
NOT-FOR-US: Dell / EMC
CVE-2026-56434 (NGINX Plus and NGINX Open Source have a vulnerability in the
ngx_http_ ...)
+ {DSA-6496-1}
- nginx 1.30.1-7
NOTE: https://my.f5.com/manage/s/article/K000162098
CVE-2026-56400 (open-webui before 0.3.14 contains a cross-origin resource
sharing misc ...)
@@ -67917,6 +68005,7 @@ CVE-2026-44986 (Penpot is an open-source design tool
for design and code collabo
CVE-2026-43637 (Cornac before 2.6.0 contains a path traversal (Tar Slip)
vulnerability ...)
NOT-FOR-US: Cornac
CVE-2026-42533 (A vulnerability exists in NGINX Plus and NGINX Open Source
when a mapd ...)
+ {DSA-6496-1}
- nginx 1.30.4-3
NOTE: https://my.f5.com/manage/s/article/K000162097
CVE-2026-41580 (Stirling-PDF is a locally hosted web application that
facilitates vari ...)
@@ -74146,6 +74235,7 @@ CVE-2026-56001 (A heap buffer overflow in
BitmapScaleBitmaps in libXfont2 before
NOTE: https://www.openwall.com/lists/oss-security/2026/07/08/1
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/be0b08e2d354138d3222b4490e2a77c6ee42f778
(libXfont2-2.0.8)
CVE-2026-56000 (Local attackers with a X connection able to provide GLX commit
to the ...)
+ {DSA-6497-1}
- xorg-server 2:21.1.24-1 (bug #1141703)
- xwayland 2:24.1.13-1
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
@@ -74154,6 +74244,7 @@ CVE-2026-56000 (Local attackers with a X connection
able to provide GLX commit t
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/d6d96084f305a142eb3db7f720d7edd21e4c98b4
(xorg-server-21.1.24)
CVE-2026-55999 (Local attackers with a X connection able to provide PCX fonts
to the X ...)
+ {DSA-6497-1}
- xorg-server 2:21.1.24-1 (bug #1141703)
- xwayland 2:24.1.13-1
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/af6165208dfc8ad9ba997bbdfe1bd712e4649884
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/af6165208dfc8ad9ba997bbdfe1bd712e4649884
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
