Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
a84a2ba7 by security tracker role at 2026-10-01T07:12:54+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,351 @@
+CVE-2026-96561 (The AI Engine \u2013 The Chatbot, AI Framework & MCP for
WordPress plu ...)
+ TODO: check
+CVE-2026-96255 (The Payments for Hubtel WordPress plugin before 1.0.2 does not
prevent ...)
+ TODO: check
+CVE-2026-96200 (The Payments for Hubtel WordPress plugin before 1.0.2 does not
verify ...)
+ TODO: check
+CVE-2026-96173 (The Payments for Hubtel WordPress plugin before 1.0.2 does not
verify ...)
+ TODO: check
+CVE-2026-93495 (Improper initialization in an ASUS certain motherboard allows
an physi ...)
+ TODO: check
+CVE-2026-92966 (The The Appointment Booking Plugin \u2013 LatePoint | Calendar
& Sched ...)
+ TODO: check
+CVE-2026-92548 (The WP Popular Posts plugin for WordPress is vulnerable to
Sensitive I ...)
+ TODO: check
+CVE-2026-92537 (The Newsletter \u2013 Send awesome emails from WordPress
plugin for Wo ...)
+ TODO: check
+CVE-2026-92412 (The Five Star Restaurant Reviews WordPress plugin before
2.3.14 does n ...)
+ TODO: check
+CVE-2026-92245 (The Simply Schedule Appointments plugin for WordPress is
vulnerable to ...)
+ TODO: check
+CVE-2026-92173 (Prior to v74.0.0.878.1682 of Meta Horizon OS,
MediaSyncJobReceiver cou ...)
+ TODO: check
+CVE-2026-92172 (Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService
could be ...)
+ TODO: check
+CVE-2026-91109 (The Simply Schedule Appointments plugin for WordPress is
vulnerable to ...)
+ TODO: check
+CVE-2026-90974 (The WP Fusion Lite WordPress plugin before 3.48.0 does not
require au ...)
+ TODO: check
+CVE-2026-90972 (The WP Fusion Lite WordPress plugin before 3.48.0 does not
perform a ...)
+ TODO: check
+CVE-2026-89296 (The Pro Like Button WordPress plugin before 2.0 does not
properly sani ...)
+ TODO: check
+CVE-2026-88999 (The Redux Framework plugin for WordPress is vulnerable to
authorizatio ...)
+ TODO: check
+CVE-2026-87973 (The If-So Dynamic Content WordPress plugin before 1.10.2 does
not san ...)
+ TODO: check
+CVE-2026-87970 (The If-So Dynamic Content WordPress plugin before 1.10.2 does
not esc ...)
+ TODO: check
+CVE-2026-86610 (The Download Manager WordPress plugin before 3.3.71 does not
sufficien ...)
+ TODO: check
+CVE-2026-85679 (The Extendify plugin for WordPress is vulnerable to Stored
Cross-Site ...)
+ TODO: check
+CVE-2026-82829 (Hitachi Coding Software Suite contains a vulnerability related
to Hidd ...)
+ TODO: check
+CVE-2026-82828 (Hitachi Coding Software Suite contains an Incorrect
Authorization vuln ...)
+ TODO: check
+CVE-2026-82827 (Hitachi Coding Software Suite contains a vulnerability related
to Use ...)
+ TODO: check
+CVE-2026-82826 (Hitachi Coding Software Suite contains a vulnerability related
to the ...)
+ TODO: check
+CVE-2026-82825 (Hitachi Coding Software Suite contains a vulnerability related
to Miss ...)
+ TODO: check
+CVE-2026-82824 (Hitachi Coding Software Suite contains a vulnerability related
to Path ...)
+ TODO: check
+CVE-2026-81809 (The Paytm Payment Gateway WordPress plugin before 2.8.9 does
not prope ...)
+ TODO: check
+CVE-2026-81739 (The Paytm Payment Gateway WordPress plugin before 2.8.9 does
not sanit ...)
+ TODO: check
+CVE-2026-80276 (Comelit Multi-User Gateway for VIP System (model 1456B)
firmware versi ...)
+ TODO: check
+CVE-2026-80275 (Comelit Multi-User Gateway for VIP System (model 1456B)
firmware versi ...)
+ TODO: check
+CVE-2026-78210 (In affected versions of Octopus Server, users with certain
scoped perm ...)
+ TODO: check
+CVE-2026-76147 (A path traversal (ZIP Slip) vulnerability caused by
insufficient autho ...)
+ TODO: check
+CVE-2026-76146 (An OS command injection vulnerability in Genian SSL PNS allows
an atta ...)
+ TODO: check
+CVE-2026-76145 (An improper privilege management vulnerability in Genian SSL
PNS allow ...)
+ TODO: check
+CVE-2026-76144 (An unrestricted file upload vulnerability caused by
insufficient file ...)
+ TODO: check
+CVE-2026-76143 (A missing authorization vulnerability in Genian SSL PNS allows
an atta ...)
+ TODO: check
+CVE-2026-76142 (Insufficient authentication and access control on the
internal-only IP ...)
+ TODO: check
+CVE-2026-67075 (HCL Digital Experience is affected by improper input
sanitation. This ...)
+ TODO: check
+CVE-2026-51872 (Devika v1.0 is vulnerable to Code Injection via the
Runner.run_code fu ...)
+ TODO: check
+CVE-2026-51871 (Devika v1.0 is vulnerable to Code Injection in the
Runner.execute func ...)
+ TODO: check
+CVE-2026-51870 (DeepTutor v1.4.0 is vulnerable to command execution in
/tutorbot/agent ...)
+ TODO: check
+CVE-2026-51869 (DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime
and exec ...)
+ TODO: check
+CVE-2026-51867 (agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in
next/src ...)
+ TODO: check
+CVE-2026-51866 (In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real
/api/v1/s ...)
+ TODO: check
+CVE-2026-51864 (DB-GPT v0.7.5 and v0.8.0 contains directory traversal in
python_file_u ...)
+ TODO: check
+CVE-2026-51862 (DB-GPT 0.8.0 contains directory traversal in skill_upload
(packages/db ...)
+ TODO: check
+CVE-2026-51861 (bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code
Injection ...)
+ TODO: check
+CVE-2026-51860 (bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to
Directory Trave ...)
+ TODO: check
+CVE-2026-51859 (bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to
directory trave ...)
+ TODO: check
+CVE-2026-51858 (In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3,
TerminalToolkit.s ...)
+ TODO: check
+CVE-2026-51857 (In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3,
CodeExecutionTool ...)
+ TODO: check
+CVE-2026-51856 (In agentscope 1.0.18, 1.0.19, and 1.0.19 when the
RealtimeAgent sessio ...)
+ TODO: check
+CVE-2026-51853 (agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory
Traversa ...)
+ TODO: check
+CVE-2026-51852 (agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory
Traversa ...)
+ TODO: check
+CVE-2026-51570 (modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path
Traversal in ...)
+ TODO: check
+CVE-2026-51568 (modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path
Traversal i ...)
+ TODO: check
+CVE-2026-47096 (AJA HELO Plus firmware before 2.1.7 contains a stored
cross-site scrip ...)
+ TODO: check
+CVE-2026-19253 (The Cache Enabler WordPress plugin before 1.8.17 does not
validate a U ...)
+ TODO: check
+CVE-2026-14157 (Use of an Externally Controlled Format String in the ASUS
Router modul ...)
+ TODO: check
+CVE-2026-13313 (An Active Debug Code vulnerability in certain ASUS router
models allow ...)
+ TODO: check
+CVE-2026-12241 (The Advanced Woo Labels \u2013 Product Labels & Badges for
WooCommerce ...)
+ TODO: check
+CVE-2026-103641 (A flaw was found in GEGL. The Radiance HDR loader reads past
the end o ...)
+ TODO: check
+CVE-2026-103592 (simple-php-router through 5.4.1.7 contains an IP restriction
bypass vu ...)
+ TODO: check
+CVE-2026-103591 (DeepWiki-Open through commit d92819a contains an
unauthenticated arbit ...)
+ TODO: check
+CVE-2026-103590 (QloApps through 1.7.0 contains a reflected cross-site
scripting vulner ...)
+ TODO: check
+CVE-2026-103589 (QloApps through 1.7.0 contains a reflected cross-site
scripting vulner ...)
+ TODO: check
+CVE-2026-103588 (QloApps through 1.7.0 contains a reflected cross-site
scripting vulner ...)
+ TODO: check
+CVE-2026-103587 (QloApps through 1.7.0 contains a reflected cross-site
scripting vulner ...)
+ TODO: check
+CVE-2026-103585 (Improper neutralization of Script-Related HTML tags in a web
page (bas ...)
+ TODO: check
+CVE-2026-103584 (Improper neutralization of Script-Related HTML tags in a web
page (bas ...)
+ TODO: check
+CVE-2026-103548 (Improperly stored passwords in the config file in Itron MV-90
xi 3.0 a ...)
+ TODO: check
+CVE-2026-103547 (In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before
errata 021, d ...)
+ TODO: check
+CVE-2026-103544 (A vulnerability was found in datadrivenconstruction
OpenConstructionER ...)
+ TODO: check
+CVE-2026-103543 (A vulnerability has been found in itsourcecode Leave
Management System ...)
+ TODO: check
+CVE-2026-103542 (A flaw has been found in formtools.org Form Tools up to
3.1.1. Impacte ...)
+ TODO: check
+CVE-2026-103541 (A vulnerability was detected in formtools.org Form Tools up
to 3.1.1. ...)
+ TODO: check
+CVE-2026-103540 (A security vulnerability has been detected in formtools.org
Form Tools ...)
+ TODO: check
+CVE-2026-103539 (A weakness has been identified in ZongXR SuperMarket 1.0.0.0.
This aff ...)
+ TODO: check
+CVE-2026-103538 (A security flaw has been discovered in ZongXR SuperMarket
1.0.0.0. Aff ...)
+ TODO: check
+CVE-2026-103536 (A vulnerability was identified in ZongXR Supermarket 1.0.0.0.
Affected ...)
+ TODO: check
+CVE-2026-103534 (A vulnerability was determined in David-Crty databasement up
to 1.7.1. ...)
+ TODO: check
+CVE-2026-103533 (A vulnerability was found in David-Crty databasement up to
1.7.1. This ...)
+ TODO: check
+CVE-2026-103532 (A vulnerability has been found in immich-app Immich up to
2.7.5. This ...)
+ TODO: check
+CVE-2026-103531 (A flaw has been found in OpenSC up to 0.27.1. The impacted
element is ...)
+ TODO: check
+CVE-2026-103530 (A vulnerability was detected in decolua 9Router up to 0.5.55.
The affe ...)
+ TODO: check
+CVE-2026-103387 (A weakness has been identified in garycourt uri-js up to
4.4.1. This a ...)
+ TODO: check
+CVE-2026-103001 (PyJWT is a Python implementation of JSON Web Token standards.
From 2.1 ...)
+ TODO: check
+CVE-2026-103000 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.19 ...)
+ TODO: check
+CVE-2026-102999 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.19 ...)
+ TODO: check
+CVE-2026-102998 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.19 ...)
+ TODO: check
+CVE-2026-102997 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.18 ...)
+ TODO: check
+CVE-2026-102996 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.18 ...)
+ TODO: check
+CVE-2026-102995 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.18 ...)
+ TODO: check
+CVE-2026-102994 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.18 ...)
+ TODO: check
+CVE-2026-102993 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.17 ...)
+ TODO: check
+CVE-2026-102992 (piscina is a node.js worker pool implementation. Prior to
4.9.4, 5.3.2 ...)
+ TODO: check
+CVE-2026-102991 (Mako is a template library written in Python. Prior to 1.4.2,
on Windo ...)
+ TODO: check
+CVE-2026-102990 (basic-ftp is an FTP client for Node.js. Prior to 6.2.1,
Client.list() ...)
+ TODO: check
+CVE-2026-102150 (A function in the Kiteworks Advanced Forms component was
reachable wit ...)
+ TODO: check
+CVE-2026-102149 (Kiteworks Email Protection Gateway did not sufficiently
restrict which ...)
+ TODO: check
+CVE-2026-102147 (A stored cross-site scripting (XSS) weakness in Kiteworks
Core could a ...)
+ TODO: check
+CVE-2026-102146 (An authenticated Email Protection Gateway administrator
holding only l ...)
+ TODO: check
+CVE-2026-102145 (An authenticated administrator could cause the server to
issue request ...)
+ TODO: check
+CVE-2026-102144 (A resource exhaustion vulnerability in Kiteworks Email
Protection Gate ...)
+ TODO: check
+CVE-2026-102143 (An unauthenticated attacker could cause a file with
attacker-controlle ...)
+ TODO: check
+CVE-2026-102142 (A system notification template on the Kiteworks appliance was
rendered ...)
+ TODO: check
+CVE-2026-102141 (Two Kiteworks Core cluster-management operations did not
validate file ...)
+ TODO: check
+CVE-2026-102140 (An authenticated administrator could initiate an
administrative import ...)
+ TODO: check
+CVE-2026-102139 (An authorization check in the large file exchange feature of
Kiteworks ...)
+ TODO: check
+CVE-2026-102138 (An authenticated administrator on a node with an optional,
separately ...)
+ TODO: check
+CVE-2026-102137 (An authenticated administrator could bypass the content
validation app ...)
+ TODO: check
+CVE-2026-102136 (In multi-node deployments, an attacker who had already
obtained code e ...)
+ TODO: check
+CVE-2026-102135 (On a Kiteworks Email Protection Gateway cluster with database
replicat ...)
+ TODO: check
+CVE-2026-102134 (Kiteworks Core did not apply its gateway-level API security
controls t ...)
+ TODO: check
+CVE-2026-102133 (An optional, separately licensed repository-connector feature
in Kitew ...)
+ TODO: check
+CVE-2026-102132 (An administrative import function in Kiteworks Core did not
verify tha ...)
+ TODO: check
+CVE-2026-102131 (Kiteworks Email Protection Gateway rejected certain
configuration sett ...)
+ TODO: check
+CVE-2026-102130 (Kiteworks Email Protection Gateway did not sufficiently
validate the c ...)
+ TODO: check
+CVE-2026-102129 (A user-provisioning interface in Kiteworks Core did not
verify that th ...)
+ TODO: check
+CVE-2026-102128 (An identity-verification weakness in Kiteworks Email
Protection Gatewa ...)
+ TODO: check
+CVE-2026-102127 (An XML parser used by Kiteworks Email Protection Gateway did
not restr ...)
+ TODO: check
+CVE-2026-102126 (A stored cross-site scripting (XSS) weakness in Kiteworks
Core could a ...)
+ TODO: check
+CVE-2026-102125 (The sandbox that isolates document conversion on a Kiteworks
appliance ...)
+ TODO: check
+CVE-2026-102124 (A Kiteworks appliance setup interface did not enforce
authentication o ...)
+ TODO: check
+CVE-2026-102123 (A Kiteworks appliance setup interface did not confine a
user-supplied ...)
+ TODO: check
+CVE-2026-102122 (Kiteworks did not correctly enforce which roles a shared
folder's mana ...)
+ TODO: check
+CVE-2026-102121 (A form-rendering interface in the Advanced Forms component is
reachabl ...)
+ TODO: check
+CVE-2026-102120 (A privilege escalation vulnerability in Kiteworks could have
allowed a ...)
+ TODO: check
+CVE-2026-102119 (A path traversal weakness in an optional, non-default
administrative f ...)
+ TODO: check
+CVE-2026-102118 (A local privilege escalation vulnerability in Kiteworks could
have all ...)
+ TODO: check
+CVE-2026-102117 (On deployments where the remote-support capability is
licensed and ena ...)
+ TODO: check
+CVE-2026-102116 (-A weakness could have allowed an authenticated Kiteworks
Email Protec ...)
+ TODO: check
+CVE-2026-102115 (Kiteworks Core did not correctly validate a parameter
submitted to the ...)
+ TODO: check
+CVE-2026-102114 (A command injection vulnerability in Kiteworks could allow a
high-priv ...)
+ TODO: check
+CVE-2026-102113 (A privilege escalation vulnerability in Kiteworks could allow
an attac ...)
+ TODO: check
+CVE-2026-102112 (A privilege escalation vulnerability in Kiteworks could allow
an attac ...)
+ TODO: check
+CVE-2026-102111 (Kiteworks did not enforce the maximum permitted value for a
configurab ...)
+ TODO: check
+CVE-2026-102110 (An endpoint used during initial appliance setup did not
require authen ...)
+ TODO: check
+CVE-2026-102109 (A SQL injection vulnerability existed in Kiteworks Secure
Data Forms, ...)
+ TODO: check
+CVE-2026-102108 (An authenticated administrator of Kiteworks Email Protection
Gateway c ...)
+ TODO: check
+CVE-2026-102107 (Kiteworks Core contains a business logic flaw in a Kiteworks
file-requ ...)
+ TODO: check
+CVE-2026-102106 (Improper authentication in a Kiteworks Email Protection
Gateway admini ...)
+ TODO: check
+CVE-2026-102105 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
+ TODO: check
+CVE-2026-102104 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
+ TODO: check
+CVE-2026-102103 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
+ TODO: check
+CVE-2026-102102 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
+ TODO: check
+CVE-2026-102101 (Kiteworks Core before version 9.5.0 is vulnerable to
Deserialization o ...)
+ TODO: check
+CVE-2026-102100 (Kiteworks Core before version 9.5.0 is vulnerable to Stored
Cross-Site ...)
+ TODO: check
+CVE-2026-102099 (Kiteworks Core before version 9.5.0 is vulnerable to
Arbitrary File Wr ...)
+ TODO: check
+CVE-2026-102098 (Kiteworks Core before version 9.5.0 is vulnerable to SQL
Injection. A ...)
+ TODO: check
+CVE-2026-102097 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
+ TODO: check
+CVE-2026-102096 (Kiteworks Core before version 9.5.0 is vulnerable to OS
Command Inject ...)
+ TODO: check
+CVE-2026-102095 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
+ TODO: check
+CVE-2026-102094 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
+ TODO: check
+CVE-2026-102093 (Kiteworks Core before version 9.5.0 is vulnerable to Improper
Privileg ...)
+ TODO: check
+CVE-2026-102092 (Kiteworks Core before version 9.5.0 is vulnerable to Stored
Cross-site ...)
+ TODO: check
+CVE-2026-102091 (Kiteworks Secure Data Forms before version 9.5.0 is
vulnerable to Serv ...)
+ TODO: check
+CVE-2026-102090 (Kiteworks Core before version 9.5.1 is vulnerable to Content
Injection ...)
+ TODO: check
+CVE-2026-102089 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
+ TODO: check
+CVE-2026-101887 (BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero
vulnerabil ...)
+ TODO: check
+CVE-2026-101885 (ZeroClaw versions before 0.8.5 built with plugins-wasm
feature contain ...)
+ TODO: check
+CVE-2026-101884 (OpenClaw Windows Node before 2026.7.1 contains an incomplete
environme ...)
+ TODO: check
+CVE-2026-101883 (OpenClaw Windows Node through 2026.9.4 contains a server-side
request ...)
+ TODO: check
+CVE-2026-101882 (OpenClaw Windows Node before 2026.7.1 contains an incomplete
validatio ...)
+ TODO: check
+CVE-2026-101881 (OpenClaw Windows Node before 2026.7.1 contains an allocation
of resour ...)
+ TODO: check
+CVE-2026-101880 (OpenClaw Windows Node before 2026.7.1 contains an incorrect
authorizat ...)
+ TODO: check
+CVE-2026-101879 (OpenClaw Windows Node before 2026.7.1-3 contains a missing
authorizati ...)
+ TODO: check
+CVE-2026-101148 (The BackupSheep WordPress Backup Plugin WordPress plugin
through 1.8 d ...)
+ TODO: check
+CVE-2026-101147 (The Featured Image from URL (FIFU) WordPress plugin before
6.0.8, Feat ...)
+ TODO: check
+CVE-2025-41753 (The object name of a dynamically created BACnet File Object is
interpr ...)
+ TODO: check
+CVE-2024-58387 (Inspur Haiyue HCM Cloud contains an arbitrary file read
vulnerability ...)
+ TODO: check
+CVE-2023-54403 (Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file
read vul ...)
+ TODO: check
+CVE-2023-54402 (iDocView contains a server-side request forgery vulnerability
in its / ...)
+ TODO: check
CVE-2026-XXXX [GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses
multipart filename rules]
- modsecurity <unfixed>
- modsecurity-apache <unfixed>
@@ -292,13 +640,13 @@ CVE-2026-93514 (Unauthenticated Cross Site Scripting
(XSS) in Notification for T
NOT-FOR-US: WordPress plugin or theme
CVE-2026-93512 (Unauthenticated Cross Site Scripting (XSS) in JW Player for
WordPress ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-93464 (Stored Cross-Site Scripting via custom content descriptions
vulnerabil ...)
+CVE-2026-93464 (A stored cross-site scripting vulnerability via custom content
descrip ...)
NOT-FOR-US: baserCMS
CVE-2026-93463 (Cross-Site Scripting via Script Validation Bypass exists in
baserCMS. ...)
NOT-FOR-US: baserCMS
-CVE-2026-93462 (Missing authentication for critical function vulnerability
exists in b ...)
+CVE-2026-93462 (A missing authentication for critical function vulnerability
exists in ...)
NOT-FOR-US: baserCMS
-CVE-2026-93460 (Stored Cross-site scripting via appended strings in email form
fields ...)
+CVE-2026-93460 (A stored cross-site scripting vulnerability via appended
strings in em ...)
NOT-FOR-US: baserCMS
CVE-2026-92899 (Apache WSS4J remembers the Nonce of each UsernameToken it
accepts, so ...)
- wss4j <unfixed>
@@ -1349,11 +1697,11 @@ CVE-2026-102620 (A vulnerability was determined in
Freedesktop Poppler 26.06.0/2
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1762
NOTE:
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2326
NOTE:
https://gitlab.freedesktop.org/poppler/poppler/-/commit/245d3c6823377755f2c1d5fdddd010279c6ed94d
-CVE-2026-101283
+CVE-2026-101283 (iperf3 3.20\u20133.21 (esnet/iperf) has a pre-auth heap
buffer overflo ...)
- iperf3 <unfixed>
NOTE: https://github.com/esnet/iperf/releases/tag/3.22
NOTE:
https://github.com/esnet/iperf/commit/e29f6504dcfac7d2961fed4fd66364115e36fe5a
(3.22)
-CVE-2026-101276
+CVE-2026-101276 (iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated
heap use- ...)
- iperf3 <unfixed>
NOTE: https://github.com/esnet/iperf/releases/tag/3.22
NOTE:
https://github.com/esnet/iperf/commit/9bea2d9a49d54870e2405c209fa60bf134a8a1a1
(3.22)
@@ -3475,7 +3823,8 @@ CVE-2026-97029 (Flatpak's process ID namespace separation
does not prevent a san
{DSA-6524-1}
- flatpak 1.18.4-1
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2
-CVE-2026-103111 [GHSA-r9hj-j2rw-4q3m: PCRE2: out-of-bounds write in JIT
matching with large stack allocations]
+CVE-2026-103111 (PCRE2 before 10.49, when there is an attacker-controlled
regular expre ...)
+ {DSA-6530-1}
- pcre2 10.48-3.1 (bug #1149217)
NOTE:
https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m
NOTE: Fixed by:
https://github.com/PCRE2Project/pcre2/commit/2b4038298072684b0fae29b15bedfb1a75bda46d
(pcre2-10.49)
@@ -12416,6 +12765,7 @@ CVE-2026-93992 (Gopeed through 2.0.0-beta.3 contains a
path traversal vulnerabil
CVE-2026-93991 (Argo Workflows versions 4.1.0 through 4.1.3 contain an
authorization b ...)
NOT-FOR-US: Argo Workflows
CVE-2026-93990 (Expat before 2.8.5 fails to validate that a high surrogate in
UTF-16 i ...)
+ {DLA-4807-1}
- expat 2.8.4-2 (bug #1148665)
NOTE: https://github.com/libexpat/libexpat/pull/1282
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/0cfd15bdf4b2c22d6b0df73610709dfb60921091
(R_2_8_5)
@@ -56618,6 +56968,7 @@ CVE-2026-66621 (Improper Neutralization of Input During
Web Page Generation ('Cr
CVE-2026-66620 (Editor PHP Object Injection in OptionTree <= 2.7.3 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-66046 (Expat through 2.8.3 contains a denial of service vulnerability
caused ...)
+ {DLA-4807-1}
- expat 2.8.4-1 (bug #1144925)
[trixie] - expat <no-dsa> (Minor issue)
NOTE: https://github.com/libexpat/libexpat/pull/1321
@@ -144576,7 +144927,7 @@ CVE-2026-8195 (A vulnerability was detected in
JeecgBoot up to 3.9.1. The affect
CVE-2026-8194 (A security vulnerability has been detected in osTicket up to
1.18.3. I ...)
- osticket <itp> (bug #998157)
CVE-2026-45186 (In libexpat before 2.8.1, the computational complexity of
attribute na ...)
- {DSA-6404-1}
+ {DSA-6404-1 DLA-4807-1}
- expat 2.8.0-2 (bug #1136164)
NOTE: https://github.com/libexpat/libexpat/pull/1216
NOTE: https://blog.hartwork.org/posts/expat-2-8-1-released/
@@ -178080,14 +178431,14 @@ CVE-2026-4172 (A vulnerability was detected in
TRENDnet TEW-632BRP 1.010B32. Thi
CVE-2026-4171 (A security vulnerability has been detected in CodeGenieApp
serverless- ...)
NOT-FOR-US: CodeGenieApp serverless-express
CVE-2026-32778 (libexpat before 2.7.5 allows a NULL pointer dereference in the
functio ...)
- {DSA-6404-1}
+ {DSA-6404-1 DLA-4807-1}
- expat 2.7.5-1 (bug #1131119)
[bullseye] - expat <postponed> (Minor issue)
NOTE: https://github.com/libexpat/libexpat/pull/1163
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/576b61e42feeea704253cb7c7bedb2eeb3754387
NOTE: Test:
https://github.com/libexpat/libexpat/commit/d5fa769b7a7290a7e2c4a0b2287106dec9b3c030
CVE-2026-32777 (libexpat before 2.7.5 allows an infinite loop while parsing
DTD conten ...)
- {DSA-6404-1}
+ {DSA-6404-1 DLA-4807-1}
- expat 2.7.5-1 (bug #1131118)
[bullseye] - expat <postponed> (Minor issue)
NOTE: https://github.com/libexpat/libexpat/issues/1161
@@ -178095,7 +178446,7 @@ CVE-2026-32777 (libexpat before 2.7.5 allows an
infinite loop while parsing DTD
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/55cda8c7125986e17d7e1825cba413bd94a35d02
NOTE: Test:
https://github.com/libexpat/libexpat/commit/a7805c1a8a48d2ce83ef289cf55bdc8b45de76a8
CVE-2026-32776 (libexpat before 2.7.5 allows a NULL pointer dereference with
empty ext ...)
- {DSA-6404-1}
+ {DSA-6404-1 DLA-4807-1}
- expat 2.7.5-1 (bug #1131117)
[bullseye] - expat <postponed> (Minor issue)
NOTE: https://github.com/libexpat/libexpat/pull/1158
@@ -196676,7 +197027,7 @@ CVE-2026-1117 (A vulnerability in the
`lollms_generation_events.py` component of
NOT-FOR-US: parisneo/lollms
CVE-2026-0921
REJECTED
-CVE-2026-0631 (An OS Command Injection vulnerability in OpenVPN modules in
TP-Link Ar ...)
+CVE-2026-0631 (An OS Command Injection vulnerability exists in the Surfshark
VPN logi ...)
NOT-FOR-US: TP-Link
CVE-2026-0630 (An OS Command Injection vulnerability in TP-Link Archer BE230
v1.2(web ...)
NOT-FOR-US: TP-Link
@@ -197381,7 +197732,7 @@ CVE-2025-15288 (Tanium addressed an improper access
controls vulnerability in In
CVE-2025-12899 (A flaw in Zephyr\u2019s network stack allows an IPv4 packet
containing ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-25210 (In libexpat before 2.7.4, the doContent function does not
properly det ...)
- {DSA-6404-1}
+ {DSA-6404-1 DLA-4807-1}
- expat 2.7.4-1 (bug #1126697)
[bullseye] - expat <postponed> (Minor issue)
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/7ddea353ad3795f7222441274d4d9a155b523cba
(R_2_7_4)
@@ -199778,7 +200129,7 @@ CVE-2025-71146 (In the Linux kernel, the following
vulnerability has been resolv
CVE-2025-71145 (In the Linux kernel, the following vulnerability has been
resolved: u ...)
- linux <not-affected> (Vulnerable code not present)
CVE-2026-24515 (In libexpat before 2.7.4, XML_ExternalEntityParserCreate does
not copy ...)
- {DSA-6404-1}
+ {DSA-6404-1 DLA-4807-1}
- expat 2.7.3-2 (bug #1126277)
[bullseye] - expat <postponed> (Minor issue, DoS)
NOTE: https://github.com/libexpat/libexpat/pull/1131
@@ -251492,7 +251843,7 @@ CVE-2025-59378 (In guix-daemon in GNU Guix before
1618ca7, a content-addressed-m
NOTE: Fixed by:
https://codeberg.org/guix/guix/commit/f607aaaaaafe19257ef09ca519d325df6ae97e05
NOTE: Fixed by:
https://codeberg.org/guix/guix/commit/9202921e812708b23788b2209cdb576d456f56db
CVE-2025-59375 (libexpat in Expat before 2.7.2 allows attackers to trigger
large dynam ...)
- {DSA-6404-1 DSA-6179-1 DSA-6178-1 DLA-4511-1 DLA-4510-1}
+ {DSA-6404-1 DSA-6179-1 DSA-6178-1 DLA-4807-1 DLA-4511-1 DLA-4510-1}
- firefox 149.0-1
- firefox-esr 140.9.0esr-1
- thunderbird 1:140.9.0esr-1
@@ -420511,6 +420862,7 @@ CVE-2024-2351 (A vulnerability classified as critical
was found in CodeAstro Eco
CVE-2024-27698
REJECTED
CVE-2024-28757 (libexpat through 2.6.1 allows an XML Entity Expansion attack
when ther ...)
+ {DLA-4807-1}
- expat 2.6.1-2 (bug #1065868; unimportant)
- libxmltok <removed>
[bookworm] - libxmltok <ignored> (Minor issue, no runtime dependencies
left)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a84a2ba7a33dd6cb82713db17784b4b6bea4528b
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a84a2ba7a33dd6cb82713db17784b4b6bea4528b
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
