Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
8ce2efb1 by Salvatore Bonaccorso at 2026-09-30T22:11:53+02:00
Add new wss4j issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -179,7 +179,8 @@ CVE-2026-96342 (Missing Authorization vulnerability in
Amauri.IO WPMobile.App wp
CVE-2026-96338 (Subscriber Cross Site Scripting (XSS) in Profile Builder <=
4.0.2 vers ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-95616 (An integer overflow in WSS4J's DER bounds check lets an
oversized allo ...)
- TODO: check
+ - wss4j <unfixed>
+ NOTE:
https://lists.apache.org/thread.html/sdf0fsphkg4qbj7nh2brjgwvcmd67hct
CVE-2026-95587 (Unauthenticated Broken Access Control in Hostinger Migrator <=
1.0 ver ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-95531 (Subscriber PHP Object Injection in Conversational Forms for
ChatBot <= ...)
@@ -263,7 +264,8 @@ CVE-2026-93462 (Missing authentication for critical
function vulnerability exist
CVE-2026-93460 (Stored Cross-site scripting via appended strings in email form
fields ...)
NOT-FOR-US: baserCMS
CVE-2026-92899 (Apache WSS4J remembers the Nonce of each UsernameToken it
accepts, so ...)
- TODO: check
+ - wss4j <unfixed>
+ NOTE:
https://lists.apache.org/thread.html/nrzngsz1xm2lztq3t873663xx9wnrwm7
CVE-2026-92873 (Pgpool-II contains an incorrect implementation of an
authentication al ...)
- pgpool2 <unfixed>
NOTE: https://pgpool.net/news/2026-09-29/
@@ -288,23 +290,28 @@ CVE-2026-92867 (An out-of-bounds write vulnerability
exists in Pgpool-II , which
CVE-2026-92712 (The ReactPress \u2013 Create React App for WordPress plugin
for WordPr ...)
NOT-FOR-US: WordPress plugin
CVE-2026-92121 (In the WSS4J streaming (StAX) code, a signature reference
using the WS ...)
- TODO: check
+ - wss4j <unfixed>
+ NOTE:
https://lists.apache.org/thread.html/oop9p4hpl5o9byosb1qg3z7q1sgnn4pc
CVE-2026-91860 (A prototype pollution vulnerability exists in the deep merge
helpers o ...)
TODO: check
CVE-2026-89238 (WSS4J EncryptedHeader child confusion could promote an
attacker-contro ...)
- TODO: check
+ - wss4j <unfixed>
+ NOTE:
https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w
CVE-2026-88920 (An authentication bypass in the DOM security processor in
Apache WSS4J ...)
- TODO: check
+ - wss4j <unfixed>
+ NOTE:
https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9
CVE-2026-88037 (The Bold Page Builder plugin for WordPress is vulnerable to
Stored Cro ...)
NOT-FOR-US: WordPress plugin
CVE-2026-87830 (In the StAX streaming WS-SecurityPolicy validator, certain
relative or ...)
- TODO: check
+ - wss4j <unfixed>
+ NOTE:
https://lists.apache.org/thread.html/lwlozb1x20d16f9dnyvoygc9rrhzq2vn
CVE-2026-87004 (Tugtainer is a self-hosted app for automating updates of
Docker contai ...)
TODO: check
CVE-2026-86778 (Observable response discrepancy vulnerability in Maksisoft
Technology, ...)
TODO: check
CVE-2026-85532 (Apache WSS4J accepted attacker-controlled derived-key lengths
and offs ...)
- TODO: check
+ - wss4j <unfixed>
+ NOTE:
https://lists.apache.org/thread.html/7jllcpbf4nbzhdp2vchz5yplnl5w6vd6
CVE-2026-82307 (Improper neutralization of special elements used in an SQL
command ('S ...)
TODO: check
CVE-2026-79625 (Affected products do not properly synchronize access to their
monitori ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8ce2efb12e634f4ac6aa0bce9778bbd76cf50895
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8ce2efb12e634f4ac6aa0bce9778bbd76cf50895
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
