Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
75aaca70 by Salvatore Bonaccorso at 2026-09-25T13:46:16+02:00
Add two more (not upstream reported?) web2py issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2027,7 +2027,8 @@ CVE-2026-80338 (The CMB2 WordPress plugin before 2.13.0
does not perform any cap
CVE-2026-79616 (Out-of-bounds read while parsing untrusted SVG path strings in
Qt Quic ...)
TODO: check
CVE-2026-79310 (webpy web.py 0.76 is vulnerable to server-side template
injection (SST ...)
- TODO: check
+ - web2py <unfixed>
+ NOTE:
https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79310.md
CVE-2026-79306 (CyberPanel v1.9.1 contains a path traversal vulnerability in
the compr ...)
NOT-FOR-US: CyberPanel
CVE-2026-79304 (CyberPanel 1.9.1 contains a path traversal vulnerability in
the readFi ...)
@@ -4417,7 +4418,8 @@ CVE-2026-79320 (Stencil core 4.43.5 contains a DOM-based
cross-site scripting (X
CVE-2026-79319 (Stencil core 4.43.5 is vulnerable to Incorrect Access Control.)
NOT-FOR-US: Stencil
CVE-2026-79318 (web2py 3.2.2-stable (commit
a7330a2bf21219fa77860b6665de927dd4f98e6d) ...)
- TODO: check
+ - web2py <unfixed>
+ NOTE:
https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79318.md
CVE-2026-79317 (A session invalidation flaw exists in x-ui 0.3.2. The full
user object ...)
NOT-FOR-US: x-ui
CVE-2026-79316 (An improper access control vulnerability exists in x-ui 0.3.2.
Any aut ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/75aaca70519a41f6e832eee9e51e4199dd44ddde
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/75aaca70519a41f6e832eee9e51e4199dd44ddde
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
