Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
e35282e5 by security tracker role at 2026-09-27T07:13:12+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,159 @@
+CVE-2026-97319 (The PowerPress Podcasting plugin by Blubrry WordPress plugin
before 11 ...)
+ TODO: check
+CVE-2026-97227 (The NextScripts: Social Networks Auto-Poster WordPress plugin
before 4 ...)
+ TODO: check
+CVE-2026-96899 (The Optima Express IDX WordPress plugin before 8.7.6 does not
properly ...)
+ TODO: check
+CVE-2026-96897 (The Optima Express IDX WordPress plugin before 8.7.6 does not
perform ...)
+ TODO: check
+CVE-2026-96896 (The Malcure Malware Shield \u2014 Removal, Repair, Monitor
WordPress p ...)
+ TODO: check
+CVE-2026-96895 (The WP YouTube Lyte WordPress plugin before 1.7.31 does not
escape som ...)
+ TODO: check
+CVE-2026-94408 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch
can lead ...)
+ TODO: check
+CVE-2026-94400 (Uncontrolled Resource Consumption (CWE-400) in Kibana can lead
denial ...)
+ TODO: check
+CVE-2026-94399 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch
can lead ...)
+ TODO: check
+CVE-2026-94398 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch
can lead ...)
+ TODO: check
+CVE-2026-94397 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch
can lead ...)
+ TODO: check
+CVE-2026-94396 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch
can lead ...)
+ TODO: check
+CVE-2026-92995 (The Verge3D Publishing and E-Commerce WordPress plugin through
4.13.0 ...)
+ TODO: check
+CVE-2026-92436 (The Mailchimp for WooCommerce WordPress plugin before 6.3 does
not req ...)
+ TODO: check
+CVE-2026-89006 (The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27
does not ...)
+ TODO: check
+CVE-2026-89003 (The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27
does not ...)
+ TODO: check
+CVE-2026-89001 (The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27
does not ...)
+ TODO: check
+CVE-2026-89000 (The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27
does not ...)
+ TODO: check
+CVE-2026-86841 (The Online Scheduling and Appointment Booking System
WordPress plugin ...)
+ TODO: check
+CVE-2026-86839 (The Online Scheduling and Appointment Booking System
WordPress plugin ...)
+ TODO: check
+CVE-2026-86609 (The Download Manager WordPress plugin before 7.5.6 does not
sanitise a ...)
+ TODO: check
+CVE-2026-85002 (The EmbedPress WordPress plugin before 4.6.7 does not escape
one of i ...)
+ TODO: check
+CVE-2026-84069 (The WebFacing\u2122 WordPress plugin before 5.4 does not
restrict acc ...)
+ TODO: check
+CVE-2026-82841 (The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin
before ...)
+ TODO: check
+CVE-2026-82300 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch
can lead ...)
+ TODO: check
+CVE-2026-82294 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch
can lead ...)
+ TODO: check
+CVE-2026-81655 (The Ad Inserter WordPress plugin before 2.8.19 does not
correctly res ...)
+ TODO: check
+CVE-2026-78582 (Missing Authorization (CWE-862) in Kibana can lead to
unauthorized del ...)
+ TODO: check
+CVE-2026-72668 (Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)
in Kiba ...)
+ TODO: check
+CVE-2026-72662 (Authorization Bypass Through User-Controlled Key (CWE-639) in
Kibana c ...)
+ TODO: check
+CVE-2026-100865 (Heym before 0.0.53 contains multiple independent
vulnerabilities. (1) ...)
+ TODO: check
+CVE-2026-100864 (heym before 0.0.91 contains a sandbox escape vulnerability in
the expr ...)
+ TODO: check
+CVE-2026-100863 (Heym versions 0.0.90 and earlier contain two server-side
request forge ...)
+ TODO: check
+CVE-2026-100862 (heym, a workflow automation platform, stores and returns
multiple capa ...)
+ TODO: check
+CVE-2026-100861 (heym before 0.0.105 fails to apply egress guards to
integration servic ...)
+ TODO: check
+CVE-2026-100860 (heym before 0.0.105 does not act on the result of the
credential autho ...)
+ TODO: check
+CVE-2026-100859 (Heym before 0.0.106 contains a credential exfiltration
vulnerability i ...)
+ TODO: check
+CVE-2026-100858 (heym before 0.0.109 contains a server-side request forgery
vulnerabili ...)
+ TODO: check
+CVE-2026-100857 (AzuraCast before 0.23.4 contains a code injection
vulnerability in the ...)
+ TODO: check
+CVE-2026-100856 (AzuraCast before 0.23.6 contains a code injection
vulnerability in the ...)
+ TODO: check
+CVE-2026-100855 (AzuraCast before 0.23.6 contains a missing permission check
vulnerabil ...)
+ TODO: check
+CVE-2026-100854 (AzuraCast before 0.23.6 lacks RequireInternalConnection
middleware on ...)
+ TODO: check
+CVE-2026-100853 (In AzuraCast before 0.23.8, the public On-Demand download
endpoint fai ...)
+ TODO: check
+CVE-2026-100852 (AzuraCast through 0.23.x contains a command injection
vulnerability in ...)
+ TODO: check
+CVE-2026-100851 (AzuraCast before 0.23.8 contains a broken access control
vulnerability ...)
+ TODO: check
+CVE-2026-100850 (AzuraCast before 0.23.8 contains a server-side request
forgery and loc ...)
+ TODO: check
+CVE-2026-100849 (AzuraCast is a self-hosted web radio management suite. In
AzuraCast be ...)
+ TODO: check
+CVE-2026-100848 (AzuraCast (Composer package azuracast/azuracast) before
0.23.8 validat ...)
+ TODO: check
+CVE-2026-100847 (AzuraCast before 0.23.8 contains a DQL injection
vulnerability in the ...)
+ TODO: check
+CVE-2026-100846 (MONAI before 1.5.2 contains a deserialization of untrusted
data vulner ...)
+ TODO: check
+CVE-2026-100845 (MONAI before 1.6.0 contains an unsafe deserialization
vulnerability in ...)
+ TODO: check
+CVE-2026-100844 (MONAI before 1.6.0 is vulnerable to OS command injection in
the nnUNet ...)
+ TODO: check
+CVE-2026-100843 (MONAI versions before 1.6.0 contain a remote code execution
vulnerabil ...)
+ TODO: check
+CVE-2026-100842 (MONAI through 1.6.0 contains an eval injection vulnerability
in _get_f ...)
+ TODO: check
+CVE-2026-100841 (In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py)
explicitly r ...)
+ TODO: check
+CVE-2026-100840 (MONAI through 1.6.0 contains a remote code execution
vulnerability in ...)
+ TODO: check
+CVE-2026-100839 (Contrast is a confidential-computing runtime for Kubernetes.
In versio ...)
+ TODO: check
+CVE-2026-100838 (Contrast is a confidential-computing runtime for Kubernetes.
In versio ...)
+ TODO: check
+CVE-2026-100837 (Contrast (Edgeless Systems) through 1.20.0 performs
unanchored suffix ...)
+ TODO: check
+CVE-2026-100836 (Contrast through 1.20.0 contains a panic vulnerability in the
transit- ...)
+ TODO: check
+CVE-2026-100835 (Contrast before 1.16.0 is susceptible to remote attestation
relay atta ...)
+ TODO: check
+CVE-2026-100834 (http4k's Digest authentication module
(org.http4k:http4k-security-dige ...)
+ TODO: check
+CVE-2026-100833 (Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1
generate ...)
+ TODO: check
+CVE-2026-100746 (A vulnerability was found in coollabsio Coolify up to 4.1.0.
This affe ...)
+ TODO: check
+CVE-2026-100745 (A vulnerability has been found in Edimax BR-6428nC 1.16. The
impacted ...)
+ TODO: check
+CVE-2026-100744 (A flaw has been found in coollabsio Coolify up to 4.1.2. The
affected ...)
+ TODO: check
+CVE-2026-100740 (A vulnerability was detected in D-Link DIR-895L A1_102b07.
Impacted is ...)
+ TODO: check
+CVE-2026-100739 (A vulnerability was detected in mathurvishal
CloudClassroom-PHP-Projec ...)
+ TODO: check
+CVE-2026-100725 (http4k (Maven artifact org.http4k:http4k-core) before
6.48.0.0, 5.42.0 ...)
+ TODO: check
+CVE-2026-100724 (http4k (Maven package org.http4k:http4k-core) before
6.49.0.0, 5.42.0. ...)
+ TODO: check
+CVE-2026-100723 (vm2 before 3.12.2 does not apply its Buffer backing-store
ownership in ...)
+ TODO: check
+CVE-2026-100722 (vm2 before 3.12.2 does not apply host-side Promise rejection
handling ...)
+ TODO: check
+CVE-2026-100721 (vm2 before 3.12.2 contains an authorization bypass in the
NodeVM exter ...)
+ TODO: check
+CVE-2025-71426 (Contrast is a confidential-computing runtime for Kubernetes.
In versio ...)
+ TODO: check
+CVE-2025-71425 (Contrast (Edgeless Systems) before 1.8.1 logs the workload
secret to s ...)
+ TODO: check
+CVE-2025-71424 (Contrast, Edgeless Systems' runtime for confidential
containers on Kub ...)
+ TODO: check
+CVE-2025-71423 (Edgelesssys Contrast is a confidential-computing runtime for
Kubernete ...)
+ TODO: check
+CVE-2025-71422 (Contrast is a Kubernetes runtime for confidential containers.
In versi ...)
+ TODO: check
CVE-2026-XXXX [TROVE-2026-051]
- tor <unfixed>
NOTE: https://gitlab.torproject.org/tpo/core/tor/-/work_items/41381
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e35282e5ec86486d4a233bcdb9556a8b43310759
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e35282e5ec86486d4a233bcdb9556a8b43310759
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
