Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 8a69a0ea by Salvatore Bonaccorso at 2026-10-01T08:16:18+02:00 Add new modsecurity issues - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -1,3 +1,40 @@ +CVE-2026-XXXX [GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses multipart filename rules] + - modsecurity <unfixed> + - modsecurity-apache <unfixed> + NOTE: https://github.com/advisories/GHSA-5pww-8rfg-9crf + NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/ +CVE-2026-XXXX [GHSA-4j47-8qcr-jf59: t:base64DecodeExt does not decode - and _, bypassing rules on URL-safe encoded payloads] + - modsecurity <unfixed> + - modsecurity-apache <unfixed> + NOTE: https://github.com/advisories/GHSA-4j47-8qcr-jf59 + NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/ +CVE-2026-XXXX [GHSA-qrch-pjfr-9g47: t:removeComments mishandles the character after a comment terminator, bypassing rules] + - modsecurity <unfixed> + - modsecurity-apache <unfixed> + NOTE: https://github.com/advisories/GHSA-qrch-pjfr-9g47 + NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/ +CVE-2026-XXXX [GHSA-5m93-4h75-3p2w: @rxGlobal PCRE2 error handling: match-limit fail-open and invalid-pattern crash] + - modsecurity <unfixed> + NOTE: https://github.com/advisories/GHSA-5m93-4h75-3p2w + NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/ +CVE-2026-73856 [GHSA-vmg8-j66p-vgvw: Response body inspection bypass via non-canonical Content-Type casing] + - modsecurity <unfixed> + NOTE: https://github.com/advisories/GHSA-vmg8-j66p-vgvw + NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/ +CVE-2026-73857 [GHSA-jx3r-phvx-2jmj: XML request body processor dereferences an uninitialized parser context pointer] + - modsecurity <unfixed> + NOTE: https://github.com/advisories/GHSA-jx3r-phvx-2jmj + NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/ +CVE-2026-61813 [GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting when fetching over HTTPS] + - modsecurity <unfixed> + - modsecurity-apache <unfixed> + NOTE: https://github.com/advisories/GHSA-2vqc-36qp-ccmw + NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/ +CVE-2026-61812 [GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion] + - modsecurity <unfixed> + - modsecurity-apache <unfixed> + NOTE: https://github.com/advisories/GHSA-cxqf-vgrr-xxrv + NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/ CVE-2026-97347 (The Post Views Stats Counter plugin for WordPress is vulnerable to Sto ...) NOT-FOR-US: WordPress plugin CVE-2026-97302 (Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8a69a0eaca446d0f8a40c0747934facd8661d396 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8a69a0eaca446d0f8a40c0747934facd8661d396 You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
_______________________________________________ debian-security-tracker-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
