Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
7ab334fd by security tracker role at 2026-09-26T07:12:40+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,321 @@
+CVE-2026-9655
+ REJECTED
+CVE-2026-9652
+ REJECTED
+CVE-2026-9313
+ REJECTED
+CVE-2026-96879 (Improper removal of sensitive information before storage or
transfer v ...)
+ TODO: check
+CVE-2026-96878 (Improper neutralization of input during web page generation
('cross-si ...)
+ TODO: check
+CVE-2026-96877 (Improper neutralization of input during web page generation
('cross-si ...)
+ TODO: check
+CVE-2026-96876 (Improper neutralization of input during web page generation
('cross-si ...)
+ TODO: check
+CVE-2026-96875 (Improper neutralization of input during web page generation
('cross-si ...)
+ TODO: check
+CVE-2026-96795 (Horilla is an HR and CRM software. Prior to 2.0.0,
HorillaListView.exp ...)
+ TODO: check
+CVE-2026-96533 (The Testimonials Widget WordPress plugin through 4.0.4 does
not valida ...)
+ TODO: check
+CVE-2026-96532 (The Testimonials Widget WordPress plugin through 4.0.4 does
not perfor ...)
+ TODO: check
+CVE-2026-96531 (The Optimole WordPress plugin before 4.2.13 does not escape
unrecogni ...)
+ TODO: check
+CVE-2026-96526 (The MCP Server for WordPress WordPress plugin before 1.8.2
does not p ...)
+ TODO: check
+CVE-2026-96525 (The MCP Server for WordPress WordPress plugin before 1.8.2
does not p ...)
+ TODO: check
+CVE-2026-96524 (The MCP Server for WordPress WordPress plugin before 1.8.2
does not c ...)
+ TODO: check
+CVE-2026-92411 (The WP Delicious WordPress plugin before 1.10.8 does not
validate or ...)
+ TODO: check
+CVE-2026-89237 (The Bluff Post WordPress plugin through 1.1.1 does not
sanitise and es ...)
+ TODO: check
+CVE-2026-88003 (InvoicePlane is a self-hosted open source application for
managing inv ...)
+ TODO: check
+CVE-2026-86066 (Horilla is an HR and CRM software. Prior to 2.0.0,
approve_validate_at ...)
+ TODO: check
+CVE-2026-85081 (The File Manager WordPress plugin before 8.0.5, FileOrganizer
WordPre ...)
+ TODO: check
+CVE-2026-84097 (The wp-review-slider-pro WordPress plugin before 12.7.12 does
not sani ...)
+ TODO: check
+CVE-2026-84096 (The wp-review-slider-pro WordPress plugin before 12.7.12 does
not perf ...)
+ TODO: check
+CVE-2026-84095 (The wp-review-slider-pro WordPress plugin before 12.7.12 does
not perf ...)
+ TODO: check
+CVE-2026-7800
+ REJECTED
+CVE-2026-7799
+ REJECTED
+CVE-2026-71483 (Horilla is an HR and CRM software. Prior to 1.6.0, the search
paramete ...)
+ TODO: check
+CVE-2026-63432 (Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and
2.0.0, t ...)
+ TODO: check
+CVE-2026-63431 (Horilla is an HR and CRM software. In 1.5.0-85 and earlier,
payroll/vi ...)
+ TODO: check
+CVE-2026-5267 (Ciena Navigator Network Control Suite (NCS) contains an
information ex ...)
+ TODO: check
+CVE-2026-57864
+ REJECTED
+CVE-2026-57861
+ REJECTED
+CVE-2026-57449 (Actual is a local-first personal finance tool. Prior to
26.7.0, Actual ...)
+ TODO: check
+CVE-2026-57443 (SCBE-AETHERMOORE is a geometric AI governance and evaluation
framework ...)
+ TODO: check
+CVE-2026-53990
+ REJECTED
+CVE-2026-53973
+ REJECTED
+CVE-2026-53972
+ REJECTED
+CVE-2026-53971
+ REJECTED
+CVE-2026-49118
+ REJECTED
+CVE-2026-49117
+ REJECTED
+CVE-2026-45241
+ REJECTED
+CVE-2026-45240
+ REJECTED
+CVE-2026-45239
+ REJECTED
+CVE-2026-45238
+ REJECTED
+CVE-2026-45237
+ REJECTED
+CVE-2026-45236
+ REJECTED
+CVE-2026-45235
+ REJECTED
+CVE-2026-45234
+ REJECTED
+CVE-2026-19708 (The File Manager WordPress plugin before 8.0.5 does not
prevent unauth ...)
+ TODO: check
+CVE-2026-18143 (The Request a Quote for WooCommerce plugin for WordPress is
vulnerable ...)
+ TODO: check
+CVE-2026-16591 (The WP Directory Kit WordPress plugin before 1.5.8 does not
sanitize a ...)
+ TODO: check
+CVE-2026-15273 (The Automatic.css plugin for WordPress is vulnerable to Stored
Cross-S ...)
+ TODO: check
+CVE-2026-11871 (The Team Members WordPress plugin through 9.2 does not
perform any au ...)
+ TODO: check
+CVE-2026-10758 (Esri LERC is an open-source image or raster format which
supports rapi ...)
+ TODO: check
+CVE-2026-100599 (OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the
configur ...)
+ TODO: check
+CVE-2026-100598 (OpenClaw (npm package openclaw) before 2026.7.1 incorrectly
binds Sign ...)
+ TODO: check
+CVE-2026-100597 (OpenClaw (npm package 'openclaw') before 2026.7.1 is
vulnerable to a t ...)
+ TODO: check
+CVE-2026-100596 (OpenClaw versions before 2026.7.1 fail to properly authorize
non-owner ...)
+ TODO: check
+CVE-2026-100595 (OpenClaw versions before 2026.7.1 contain an authorization
bypass vuln ...)
+ TODO: check
+CVE-2026-100594 (OpenClaw versions before 2026.7.1 contain an authorization
bypass vuln ...)
+ TODO: check
+CVE-2026-100593 (OpenClaw (npm package `openclaw`) before 2026.7.1 does not
enforce the ...)
+ TODO: check
+CVE-2026-100592 (OpenClaw is an agent gateway distributed via npm. In versions
>= 2026. ...)
+ TODO: check
+CVE-2026-100591 (OpenClaw is an npm-distributed agent gateway. In versions
before 2026. ...)
+ TODO: check
+CVE-2026-100590 (OpenClaw before 2026.7.1 contains an authorization bypass
vulnerabilit ...)
+ TODO: check
+CVE-2026-100589 (OpenClaw versions before 2026.7.1 contain a sandbox bypass
vulnerabili ...)
+ TODO: check
+CVE-2026-100588 (OpenClaw (npm package 'openclaw') before 2026.7.1 does not
enforce the ...)
+ TODO: check
+CVE-2026-100587 (OpenClaw versions before 2026.7.1 fail to properly validate
owner auth ...)
+ TODO: check
+CVE-2026-100586 (OpenClaw Codex before 2026.7.1 fails to properly enforce
owner authori ...)
+ TODO: check
+CVE-2026-100585 (OpenClaw (npm package `openclaw`) before 2026.7.1 fails to
enforce the ...)
+ TODO: check
+CVE-2026-100584 (OpenClaw is an npm-distributed agent runtime. In versions >=
2026.2.26 ...)
+ TODO: check
+CVE-2026-100583 (OpenClaw Discord versions before 2026.7.1 contain an
authorization byp ...)
+ TODO: check
+CVE-2026-100582 (OpenClaw channel plugins (@openclaw/msteams,
@openclaw/feishu, @opencl ...)
+ TODO: check
+CVE-2026-100581 (OpenClaw for iOS before 2026.8.11 stores Gateway credentials
as cleart ...)
+ TODO: check
+CVE-2026-100580 (OpenClaw (npm package 'openclaw') before 2026.7.1 improperly
handles c ...)
+ TODO: check
+CVE-2026-100579 (OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly
trusts r ...)
+ TODO: check
+CVE-2026-100578 (OpenClaw (npm package `openclaw`) before 2026.7.1 fails to
restrict ow ...)
+ TODO: check
+CVE-2026-100577 (OpenClaw versions before 2026.8.1 fail to validate video
asset URLs re ...)
+ TODO: check
+CVE-2026-100576 (OpenClaw versions before 2026.8.1 contain a server-side
request forger ...)
+ TODO: check
+CVE-2026-100575 (OpenClaw Slack versions before 2026.8.1 fail to properly
enforce sende ...)
+ TODO: check
+CVE-2026-100574 (OpenClaw (npm package 'openclaw') before 2026.8.1 contains a
server-si ...)
+ TODO: check
+CVE-2026-100573 (OpenClaw versions before 2026.8.1 contain a sandbox policy
bypass vuln ...)
+ TODO: check
+CVE-2026-100572 (OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply
invalid-token rate ...)
+ TODO: check
+CVE-2026-100571 (OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and <
2026.8.1 ...)
+ TODO: check
+CVE-2026-100570 (OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and <
2026.8.1 ...)
+ TODO: check
+CVE-2026-100569 (OpenClaw is an npm-distributed application. In versions >=
2026.4.25 a ...)
+ TODO: check
+CVE-2026-100568 (OpenClaw versions before 2026.8.1 fail to properly restrict
access to ...)
+ TODO: check
+CVE-2026-100567 (OpenClaw is an agent gateway distributed as the npm package
'openclaw' ...)
+ TODO: check
+CVE-2026-100566 (OpenClaw LINE versions before 2026.8.1 contain an access
control vulne ...)
+ TODO: check
+CVE-2026-100564 (OpenClaw versions before 2026.8.1 fail to neutralize
spreadsheet formu ...)
+ TODO: check
+CVE-2026-100563 (OpenClaw (npm package `openclaw`) before 2026.8.1 does not
neutralize ...)
+ TODO: check
+CVE-2026-100562 (OpenClaw versions before 2026.8.1 contain an authorization
bypass vuln ...)
+ TODO: check
+CVE-2026-100561 (OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and <
2026.8.1 ...)
+ TODO: check
+CVE-2026-100560 (OpenClaw versions before 2026.8.1 contain an authorization
bypass vuln ...)
+ TODO: check
+CVE-2026-100559 (OpenClaw versions before 2026.8.1 contain a command parser
vulnerabili ...)
+ TODO: check
+CVE-2026-100558 (OpenClaw versions before 2026.8.1 contain a resource
exhaustion vulner ...)
+ TODO: check
+CVE-2026-100557 (OpenClaw versions before 2026.8.1 contain an authorization
bypass vuln ...)
+ TODO: check
+CVE-2026-100556 (OpenClaw (npm package openclaw) versions >= 2026.5.2 and <
2026.8.1 co ...)
+ TODO: check
+CVE-2026-100555 (OpenClaw is an npm-distributed gateway application. In
versions >= 202 ...)
+ TODO: check
+CVE-2026-100554 (OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and <
2026.8.1 ...)
+ TODO: check
+CVE-2026-100553 (OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare
the native ...)
+ TODO: check
+CVE-2026-100552 (OpenClaw (npm package 'openclaw') before 2026.8.1 does not
correctly e ...)
+ TODO: check
+CVE-2026-100551 (OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not
enforce s ...)
+ TODO: check
+CVE-2026-100550 (OpenClaw (npm package 'openclaw') before 2026.8.1 contains an
access-c ...)
+ TODO: check
+CVE-2026-100549 (OpenClaw versions before 2026.8.1 contain a path traversal
vulnerabili ...)
+ TODO: check
+CVE-2026-100548 (OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and <
2026.8.1 ...)
+ TODO: check
+CVE-2026-100547 (OpenClaw is a coding agent distributed as the npm package
`openclaw`. ...)
+ TODO: check
+CVE-2026-100546 (OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and <
2026.9.2 ...)
+ TODO: check
+CVE-2026-100545 (OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly
enforces ...)
+ TODO: check
+CVE-2026-100544 (openclaw's @openclaw/voice-call package before 2026.8.1
launches the c ...)
+ TODO: check
+CVE-2026-100543 (OpenClaw (npm package openclaw) before 2026.8.1 could include
determin ...)
+ TODO: check
+CVE-2026-100542 (OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and <
2026.8.1 ...)
+ TODO: check
+CVE-2026-100541 (OpenClaw's Matrix integration (npm package @openclaw/matrix)
versions ...)
+ TODO: check
+CVE-2026-100540 (OpenClaw Feishu before 2026.8.1 fails to validate whether a
configured ...)
+ TODO: check
+CVE-2026-100539 (OpenClaw (npm package 'openclaw') before 2026.8.1 fails to
revoke memo ...)
+ TODO: check
+CVE-2026-100538 (OpenClaw (npm package 'openclaw') before 2026.8.1 does not
apply the o ...)
+ TODO: check
+CVE-2026-100537 (OpenClaw (npm package 'openclaw') before 2026.8.1 fails to
apply the o ...)
+ TODO: check
+CVE-2026-100536 (OpenClaw versions before 2026.8.1 fail to validate all source
fields i ...)
+ TODO: check
+CVE-2026-100535 (OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and <
2026.8.1 ...)
+ TODO: check
+CVE-2026-100534 (OpenClaw versions before 2026.8.1 contain an authorization
bypass vuln ...)
+ TODO: check
+CVE-2026-100533 (OpenClaw versions before 2026.8.1 contain a path traversal
vulnerabili ...)
+ TODO: check
+CVE-2026-100532 (@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp
login to ...)
+ TODO: check
+CVE-2026-100531 (The @openclaw/slack npm package before 2026.8.1 contains an
authorizat ...)
+ TODO: check
+CVE-2026-100530 (OpenClaw versions before 2026.8.1 fail to bind working
directory conte ...)
+ TODO: check
+CVE-2026-100529 (OpenClaw versions before 2026.8.1 contain an authorization
scope widen ...)
+ TODO: check
+CVE-2026-100528 (OpenClaw (npm package 'openclaw') before 2026.8.1 could send
third-par ...)
+ TODO: check
+CVE-2026-100527 (OpenClaw before 2026.8.2 contains a denial of service
vulnerability in ...)
+ TODO: check
+CVE-2026-100526 (OpenClaw's Discord integration (npm package
@openclaw/discord) before ...)
+ TODO: check
+CVE-2026-100525 (The OpenClaw Prometheus diagnostics plugin
(@openclaw/diagnostics-prom ...)
+ TODO: check
+CVE-2026-100524 (Cotonti through 1.0.0 contains a cross-site request forgery
vulnerabil ...)
+ TODO: check
+CVE-2026-100523 (Cotonti through 1.0.0 contains an open redirect vulnerability
in messa ...)
+ TODO: check
+CVE-2026-100522 (Cotonti through 1.0.0 contains a reflected cross-site
scripting vulner ...)
+ TODO: check
+CVE-2026-100521 (Cotonti through 1.0.0 contains a reflected cross-site
scripting vulner ...)
+ TODO: check
+CVE-2026-100520 (Laranode versions before 1.2.1 contain a path traversal
vulnerability ...)
+ TODO: check
+CVE-2026-100505 (Ghidra versions 11.2 through 12.1.4 contain a heap
out-of-bounds read ...)
+ TODO: check
+CVE-2026-100504 (Ghidra versions through 12.1.4 contain a stack-based
out-of-bounds wri ...)
+ TODO: check
+CVE-2026-100503 (Ghidra versions through 12.1.4 contain a heap use-after-free
vulnerabi ...)
+ TODO: check
+CVE-2026-100502 (Flame through 2.4.0 contains an insufficient session
expiration vulner ...)
+ TODO: check
+CVE-2026-100501 (Flame through 2.4.0 contains an improper restriction of
excessive auth ...)
+ TODO: check
+CVE-2026-100419 (gitoxide gix-fs before 0.23.0 contains a path validation
bypass vulner ...)
+ TODO: check
+CVE-2026-100418 (Flame through 2.4.0 contains an information exposure
vulnerability in ...)
+ TODO: check
+CVE-2026-100417 (RustDesk before 1.5.0 on Windows fails to enforce the one-way
file tra ...)
+ TODO: check
+CVE-2026-100391 (MediaFlow Proxy through 2.4.9 contains a server-side request
forgery v ...)
+ TODO: check
+CVE-2026-100390 (Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse
IPv6 addres ...)
+ TODO: check
+CVE-2026-100389 (GestSup versions before 3.2.61 contain a remote code
execution vulnera ...)
+ TODO: check
+CVE-2026-100388 (RustDesk versions before 1.5.0 fail to properly validate file
transfer ...)
+ TODO: check
+CVE-2026-100387 (pgPointcloud through 1.2.5 contains a heap out-of-bounds read
vulnerab ...)
+ TODO: check
+CVE-2026-100383 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2026-100382 (Improper Neutralization of Special Elements used in an OS
Command ('OS ...)
+ TODO: check
+CVE-2026-100381 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2026-100380 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2026-100379 (Exposure of Sensitive Information to an Unauthorized Actor
vulnerabili ...)
+ TODO: check
+CVE-2026-100378 (Missing Authorization vulnerability in Wikimedia Foundation
Mediawiki ...)
+ TODO: check
+CVE-2026-100377 (Exposure of Sensitive Information to an Unauthorized Actor
vulnerabili ...)
+ TODO: check
+CVE-2026-100376 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2026-100373 (OpenMetadata through 2.0.2 contains a server-side request
forgery vuln ...)
+ TODO: check
+CVE-2026-100372 (ClipBucket v5 before 5.5.3-#197 contains a path traversal
vulnerabilit ...)
+ TODO: check
+CVE-2026-100369 (CliInvoke and its formerly named `AlastairLundy.CliInvoke`
package are ...)
+ TODO: check
+CVE-2026-100368 (CliInvoke is a .NET library for invoking command-line
programs, and it ...)
+ TODO: check
+CVE-2026-100310 (GNU libextractor before 1.16 loads plugins from an untrusted
search pa ...)
+ TODO: check
+CVE-2026-100208 (Integer overflow or wraparound in Microsoft Office Outlook
allows an u ...)
+ TODO: check
CVE-2026-XXXX [Heap OOB read/write in MS-MPPE key re-encryption]
- radsecproxy 1.11.4-1
NOTE:
https://github.com/radsecproxy/radsecproxy/security/advisories/GHSA-wj29-mxmc-q98c
@@ -16830,6 +17148,7 @@ CVE-2026-XXXX [Type 1 font-loader `.forceput`
save/restore UAF yields native rea
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=709684
NOTE: Fixed by:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1484854e0c8ddfda1baa4ad4cd965b8a9790aa81
(ghostpdl-10.08.0)
CVE-2026-39919 (Ghostscript before 10.08.0 contains a heap-based buffer
overflow vulne ...)
+ {DSA-6516-1}
- ghostscript 10.08.0~dfsg-1
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=709666
NOTE: Fixed by:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=8ddaa67d13daeca55aa13e9e3262172fa93b72f7
(ghostpdl-10.08.0)
@@ -23345,6 +23664,7 @@ CVE-2026-74761 (Improper input validation in
TopicRegion in Apache ActiveMQ, Apa
CVE-2026-73334 (Potential problem for users of
theorg.apache.parquet.crypto.keytools p ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73324 (Certain VLC media player builds in versions 3.0.0 through
3.0.23 conta ...)
+ {DSA-6515-1}
- vlc 3.0.24-1
CVE-2026-70425 (Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0,
Versions 9.8. ...)
NOT-FOR-US: Dell / EMC
@@ -23365,6 +23685,7 @@ CVE-2026-61907 (An issue was discovered in Cyrus IMAP
before 3.12.4. JMAP snooze
CVE-2026-57866 (Server side request forgery in Apache Impala versions 4.4.x
and 4.5.x. ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-56711 (VLC media player versions 3.0.0 through 3.0.23 contain a
memory-safety ...)
+ {DSA-6515-1}
- vlc 3.0.24-1
CVE-2026-56207 (Signature of Bearer token is not verified in last step of
SAML2 authen ...)
NOT-FOR-US: Apache software not packaged in Debian
@@ -25608,7 +25929,7 @@ CVE-2026-78518 (Out-of-bounds read in Microsoft Office
Excel allows an unauthori
NOT-FOR-US: Microsoft
CVE-2026-78517 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
NOT-FOR-US: Microsoft
-CVE-2026-78516 (Buffer over-read in Windows Storage allows an unauthorized
attacker to ...)
+CVE-2026-78516 (Insertion of sensitive information into externally-accessible
file or ...)
NOT-FOR-US: Microsoft
CVE-2026-78515 (Out-of-bounds read in Microsoft Office Excel allows an
unauthorized at ...)
NOT-FOR-US: Microsoft
@@ -25620,7 +25941,7 @@ CVE-2026-78512 (Numeric truncation error in Microsoft
Office Word allows an unau
NOT-FOR-US: Microsoft
CVE-2026-78511 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
NOT-FOR-US: Microsoft
-CVE-2026-78510 (A remote code execution vulnerability exists when Microsoft
Office imp ...)
+CVE-2026-78510 (Heap-based buffer overflow in Microsoft Office allows an
unauthorized ...)
NOT-FOR-US: Microsoft
CVE-2026-78509 (Heap-based buffer overflow in Microsoft Office Outlook allows
an unaut ...)
NOT-FOR-US: Microsoft
@@ -61157,7 +61478,7 @@ CVE-2026-62701 (Use after free in Windows Telephony
Service allows an authorized
NOT-FOR-US: Microsoft
CVE-2026-62700 (Heap-based buffer overflow in Windows NTFS allows an
authorized attack ...)
NOT-FOR-US: Microsoft
-CVE-2026-62699 (Heap-based buffer overflow in Windows Universal Disk Format
File Syste ...)
+CVE-2026-62699 (Null pointer dereference in Windows Universal Disk Format File
System ...)
NOT-FOR-US: Microsoft
CVE-2026-62698 (Numeric truncation error in Microsoft Digest Authentication
allows an ...)
NOT-FOR-US: Microsoft
@@ -96422,66 +96743,66 @@ CVE-2026-10055 (In Eclipse Theia since version
1.26.0, the backend /services/req
NOT-FOR-US: Eclipse
CVE-2026-10054 (In affected versions of Eclipse Theia (1.8.1 and later), the
browser b ...)
NOT-FOR-US: Eclipse
-CVE-2026-17545
+CVE-2026-17545 (On Windows, PHP's filesystem and stream APIs do not reject
reserved de ...)
- php8.4 <not-affected> (Only affects PHP on Windows)
- php8.2 <not-affected> (Only affects PHP on Windows)
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-91766
+CVE-2026-91766 (When the http:// stream wrapper follows a redirect it forwards
the use ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-92842
+CVE-2026-92842 (The convert.base64-encode, convert.quoted-printable-encode and
convert ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-93682
+CVE-2026-93682 (When the HTTP stream wrapper follows a redirect and the
response carri ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2025-14181
+CVE-2025-14181 (The SOAP HTTP client guards its response buffer growth with a
check th ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-91765
+CVE-2026-91765 (cleanup_xml_node() in the SOAP XML parser recurses once per
XML nestin ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-6103
+CVE-2026-6103 (phar_tar_number() parses the octal size field of a TAR header
into a u ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-91767
+CVE-2026-91767 (php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c
underflows ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-91769
+CVE-2026-91769 (PHP's OpenSSL stream peer verification checks the
certificate's subjec ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2025-1218
+CVE-2025-1218 (The mysqlnd wire protocol parser reads fields out of server
packets be ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
-CVE-2026-91768
+CVE-2026-91768 (The IPv6 branch of the FastCGI client access check compares
only the f ...)
{DSA-6514-1}
- php8.4 <unfixed>
- php8.2 <removed>
@@ -182541,7 +182862,7 @@ CVE-2025-15578 (Maypole versions from 2.10 through
2.13 for Perl generates sessi
CVE-2025-12062 (The WP Maps \u2013 Store Locator,Google
Maps,OpenStreetMap,Mapbox,List ...)
NOT-FOR-US: WordPress plugin
CVE-2026-2604 (A flaw was found in evolution-data-server. Inconsistent
comparison log ...)
- {DLA-4503-1}
+ {DLA-4796-1 DLA-4503-1}
- evolution-data-server 3.56.2-8 (bug #1128332)
[trixie] - evolution-data-server <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/627
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7ab334fde7e433f9b32ecc02f851017c241ef209
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7ab334fde7e433f9b32ecc02f851017c241ef209
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
