Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
c4f5b44d by security tracker role at 2026-10-02T19:15:06+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,603 @@
+CVE-2026-97876 (A local attacker with control over GRUB's configuration can
bypass loc ...)
+ TODO: check
+CVE-2026-97663 (The Customer Reviews for WooCommerce plugin for WordPress is
vulnerabl ...)
+ TODO: check
+CVE-2026-97652 (The WP Statistics \u2013 Simple, privacy-friendly Google
Analytics alt ...)
+ TODO: check
+CVE-2026-97641 (The Relevanssi \u2013 A Better Search plugin for WordPress is
vulnerab ...)
+ TODO: check
+CVE-2026-97637 (The JSON API Auth plugin for WordPress is vulnerable to
Authentication ...)
+ TODO: check
+CVE-2026-97634 (The Event Tickets and Registration plugin for WordPress is
vulnerable ...)
+ TODO: check
+CVE-2026-97342 (The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin
for WordP ...)
+ TODO: check
+CVE-2026-97338 (The Download Manager plugin for WordPress is vulnerable to
Stored Cros ...)
+ TODO: check
+CVE-2026-97336 (The CMB2 plugin for WordPress is vulnerable to Stored
Cross-Site Scrip ...)
+ TODO: check
+CVE-2026-96990 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-96940 (Weak authorization in Microsoft Exchange Server allows an
authenticate ...)
+ TODO: check
+CVE-2026-96871 (The Mang Board plugin for WordPress is vulnerable to Stored
Cross-Site ...)
+ TODO: check
+CVE-2026-96647 (The Listdom: AI-powered Business Directory with Classifieds
Ads Listin ...)
+ TODO: check
+CVE-2026-96613 (The Meari IoT Cloud Platform OpenAPI Service is vulnerable to
an autho ...)
+ TODO: check
+CVE-2026-96578 (The GSpeech TTS \u2013 WordPress Text To Speech Plugin plugin
for Word ...)
+ TODO: check
+CVE-2026-96567 (The MW WP Form plugin for WordPress is vulnerable to Stored
Cross-Site ...)
+ TODO: check
+CVE-2026-96566 (The Newsletter \u2013 Send awesome emails from WordPress
plugin for Wo ...)
+ TODO: check
+CVE-2026-96294 (Uncaught exception, Improper Handling of Exceptional
Conditions vulner ...)
+ TODO: check
+CVE-2026-96292 (Inefficient regular expression complexity, Inefficient
Algorithmic Com ...)
+ TODO: check
+CVE-2026-96289 (Uncontrolled Recursion vulnerability in Apache Thrift PHP
bindings. ...)
+ TODO: check
+CVE-2026-96288 (Uncontrolled Recursion, Allocation of resources without limits
or thro ...)
+ TODO: check
+CVE-2026-96287 (Inefficient Algorithmic Complexity vulnerability in Apache
Thrift Perl ...)
+ TODO: check
+CVE-2026-96286 (Uncaught exception vulnerability in Apache Thrift Perl
bindings. Th ...)
+ TODO: check
+CVE-2026-96277 (Uncaught exception, Improper Handling of Exceptional
Conditions vulner ...)
+ TODO: check
+CVE-2026-95817 (The DoFollow Case by Case plugin for WordPress is vulnerable
to Stored ...)
+ TODO: check
+CVE-2026-95670 (The No External Links plugin for WordPress is vulnerable to
Stored Cro ...)
+ TODO: check
+CVE-2026-95662 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-95512 (A flaw was found in FreeType, specifically within its CID font
loader. ...)
+ TODO: check
+CVE-2026-94658 (Inefficient Algorithmic Complexity vulnerability in Apache
Thrift Lua ...)
+ TODO: check
+CVE-2026-94657 (Allocation of resources without limits or throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-94656 (Allocation of resources without limits or throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-94655 (Allocation of resources without limits or throttling,
Inefficient Algo ...)
+ TODO: check
+CVE-2026-94654 (Loop with unreachable exit condition ('infinite loop')
vulnerability i ...)
+ TODO: check
+CVE-2026-94653 (Inefficient Algorithmic Complexity vulnerability in Apache
Thrift PHP ...)
+ TODO: check
+CVE-2026-94652 (Missing release of memory after effective lifetime
vulnerability in Ap ...)
+ TODO: check
+CVE-2026-94651 (improper handling of exceptional conditions, Missing release
of resour ...)
+ TODO: check
+CVE-2026-94650 (Uncontrolled Recursion vulnerability in Apache Thrift c_glib
bindings. ...)
+ TODO: check
+CVE-2026-94648 (Allocation of resources without limits or throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-94646 (Uncaught exception, Improper validation of specified quantity
in input ...)
+ TODO: check
+CVE-2026-94645 (Improper validation of specified quantity in input, Allocation
of reso ...)
+ TODO: check
+CVE-2026-94644 (Allocation of resources without limits or throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-94642 (Uncaught exception vulnerability in Apache Thrift PHP
bindings. Thi ...)
+ TODO: check
+CVE-2026-94639 (improper handling of exceptional conditions, Allocation of
resources w ...)
+ TODO: check
+CVE-2026-94638 (Allocation of resources without limits or throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-94637 (Improper handling of highly compressed data (data
amplification) vulne ...)
+ TODO: check
+CVE-2026-94636 (Improper handling of highly compressed data (data
amplification), Func ...)
+ TODO: check
+CVE-2026-94635 (Allocation of resources without limits or throttling, Improper
handlin ...)
+ TODO: check
+CVE-2026-94634 (Allocation of resources without limits or throttling,
Initialization o ...)
+ TODO: check
+CVE-2026-94633 (Memory allocation with excessive size value, Improper handling
of leng ...)
+ TODO: check
+CVE-2026-94544 (Next.js is a React framework for building full-stack web
applications. ...)
+ TODO: check
+CVE-2026-94543 (Next.js is a React framework for building full-stack web
applications. ...)
+ TODO: check
+CVE-2026-94541 (The WPMobile.App \u2013 Android and iOS App Builder plugin for
WordPre ...)
+ TODO: check
+CVE-2026-94486 (Next.js is a React framework for building full-stack web
applications. ...)
+ TODO: check
+CVE-2026-94485 (Next.js is a React framework for building full-stack web
applications. ...)
+ TODO: check
+CVE-2026-94484 (Next.js is a React framework for building full-stack web
applications. ...)
+ TODO: check
+CVE-2026-94483 (Next.js is a React framework for building full-stack web
applications. ...)
+ TODO: check
+CVE-2026-94432 (The Appointment Booking Plugin \u2013 LatePoint | Calendar &
Schedulin ...)
+ TODO: check
+CVE-2026-94405 (Authorization Bypass Through User-Controlled Key vulnerability
in Shah ...)
+ TODO: check
+CVE-2026-94180 (Authorization Bypass Through User-Controlled Key vulnerability
in Mone ...)
+ TODO: check
+CVE-2026-93926 (Missing release of memory after effective lifetime, Missing
release of ...)
+ TODO: check
+CVE-2026-93925 (Stack-based buffer overflow, Incorrect bitwise shift of
integer vulner ...)
+ TODO: check
+CVE-2026-93880 (The Greenshift \u2013 animation and page builder blocks plugin
for Wor ...)
+ TODO: check
+CVE-2026-93875 (The JetAppointment plugin for WordPress is vulnerable to
Stored Cross- ...)
+ TODO: check
+CVE-2026-93756 (The Smash Balloon Social Post Feed \u2013 Simple Social Feeds
for Word ...)
+ TODO: check
+CVE-2026-92834 (Use of uninitialized resource, Return of wrong status code
vulnerabili ...)
+ TODO: check
+CVE-2026-91784 (cjbassi/gotop is vulnerable to local argument injection via
process te ...)
+ TODO: check
+CVE-2026-91137 (Improper validation of specified quantity in input, Allocation
of reso ...)
+ TODO: check
+CVE-2026-91135 (Heap-based buffer overflow vulnerability in Apache Thrift C++
THeaderT ...)
+ TODO: check
+CVE-2026-90970 (GitLab has remediated a vulnerability in the GitLab AI Gateway
compone ...)
+ TODO: check
+CVE-2026-90440 (Uncaught exception, improper handling of exceptional
conditions, impro ...)
+ TODO: check
+CVE-2026-87920 (The W3 Total Cache plugin for WordPress is vulnerable to
Stored Cross- ...)
+ TODO: check
+CVE-2026-87117 (NULL pointer dereference vulnerability in Apache Thrift PHP
bindings. ...)
+ TODO: check
+CVE-2026-86537 (Uncaught exception, Loop with unreachable exit condition
('infinite lo ...)
+ TODO: check
+CVE-2026-86536 (Improperly controlled modification of object prototype
attributes ('pr ...)
+ TODO: check
+CVE-2026-86535 (Loop with unreachable exit condition ('infinite loop'),
Improperly con ...)
+ TODO: check
+CVE-2026-86326 (An improper verification of cryptographic signature
vulnerability exis ...)
+ TODO: check
+CVE-2026-86325 (A stack-based buffer overflow vulnerability exists in protocol
gateway ...)
+ TODO: check
+CVE-2026-85494 (Improper handling of length parameter inconsistency, Uncaught
exceptio ...)
+ TODO: check
+CVE-2026-85493 (Uncontrolled Recursion vulnerability in Apache Thrift Dart and
Java ME ...)
+ TODO: check
+CVE-2026-85492 (The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings
& Traffi ...)
+ TODO: check
+CVE-2026-85483 (Use of uninitialized resource, Return of wrong status code
vulnerabili ...)
+ TODO: check
+CVE-2026-85476 (Loop with unreachable exit condition ('infinite loop')
vulnerability i ...)
+ TODO: check
+CVE-2026-85215 (Improper neutralization of special elements used in an SQL
command ('S ...)
+ TODO: check
+CVE-2026-85209 (Missing Authorization vulnerability in AVEZ Electronics
Communication ...)
+ TODO: check
+CVE-2026-85088 (Improper Validation of Certificate with Host Mismatch in the
C++ and D ...)
+ TODO: check
+CVE-2026-85087 (Improper certificate validation, Return of wrong status code
vulnerabi ...)
+ TODO: check
+CVE-2026-85086 (Improper certificate validation, Initialization of a resource
with an ...)
+ TODO: check
+CVE-2026-83745 (Memory allocation with excessive size value, Improper handling
of leng ...)
+ TODO: check
+CVE-2026-83663 (Uncontrolled Recursion vulnerability in Apache Thrift go
bindings. ...)
+ TODO: check
+CVE-2026-83632 (Allocation of resources without limits or throttling, Integer
overflow ...)
+ TODO: check
+CVE-2026-82459 (Integer underflow (wrap or wraparound), Out-of-bounds write
vulnerabil ...)
+ TODO: check
+CVE-2026-82458 (Memory allocation with excessive size value, Allocation of
resources w ...)
+ TODO: check
+CVE-2026-80464 (Server-Side request forgery (SSRF) vulnerability in HAVELSAN
Inc. Sef ...)
+ TODO: check
+CVE-2026-80443 (Improper certificate validation vulnerability in HAVELSAN Inc.
Sef - A ...)
+ TODO: check
+CVE-2026-80337 (Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI
Chatbot ...)
+ TODO: check
+CVE-2026-80298 (Improper neutralization of special elements used in an SQL
command ('S ...)
+ TODO: check
+CVE-2026-67989 (crmne/ruby_llm at commit
fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 cont ...)
+ TODO: check
+CVE-2026-66859 (NULL Pointer Dereference, Use of Uninitialized Variable
vulnerability ...)
+ TODO: check
+CVE-2026-66858 (The protocol skip routine in several Apache Thrift bindings
did not ap ...)
+ TODO: check
+CVE-2026-66837 (Stack-based Buffer Overflow, Integer Overflow or Wraparound
vulnerabil ...)
+ TODO: check
+CVE-2026-66331 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-66081 (Access of Uninitialized Pointer vulnerability in Apache Thrift
c_glib ...)
+ TODO: check
+CVE-2026-66055 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-66054 (Allocation of Resources Without Limits or Throttling, Improper
Handlin ...)
+ TODO: check
+CVE-2026-64818
+ REJECTED
+CVE-2026-63772 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-63578 (Allocation of resources without limits in password-based
private-key d ...)
+ TODO: check
+CVE-2026-63577 (Improper certificate validation in the directoryName
name-constraint c ...)
+ TODO: check
+CVE-2026-63576 (Improper certificate validation in PkixNameConstraintValidator
(Extrac ...)
+ TODO: check
+CVE-2026-63575 (Loop with unreachable exit condition in the PKCS#12 key
derivation (Pk ...)
+ TODO: check
+CVE-2026-63574 (Memory allocation with excessive size value in the OpenPGP
signature a ...)
+ TODO: check
+CVE-2026-63573 (Observable discrepancy in the CMS RSA PKCS#1 v1.5
key-transport unwrap ...)
+ TODO: check
+CVE-2026-63572 (Allocation of resources without limits in PKCS#12 keystore
loading (Pk ...)
+ TODO: check
+CVE-2026-63571 (Improper verification of cryptographic signature in the
attribute cert ...)
+ TODO: check
+CVE-2026-63570 (Loop with unreachable exit condition in
Pkcs12Store.GetCertificateChai ...)
+ TODO: check
+CVE-2026-61374 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-61373 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-5782 (Improper neutralization of input during web page generation
('cross-si ...)
+ TODO: check
+CVE-2026-59673 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59672 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59671 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59670 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59669 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59668 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59667 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59666 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59665 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59664 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59663 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59662 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59661 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59660 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59659 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
+ TODO: check
+CVE-2026-59265 (A code execution issue in the Java integration in Apache
OpenOffice v4 ...)
+ TODO: check
+CVE-2026-51922 (agentscope v1.0.20 contains code injection in
execute_shell_command (s ...)
+ TODO: check
+CVE-2026-51918 (FinRobot 1.0.0 contains code injection in
CodingUtils.create_file_with ...)
+ TODO: check
+CVE-2026-51917 (FinRobot v1.0.0 is vulnerable to Code Injection in
CodingUtils.modify_ ...)
+ TODO: check
+CVE-2026-51916 (TransformerOptimus SuperAGI v0.0.14 contains an incorrect
access contr ...)
+ TODO: check
+CVE-2026-51915 (TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect
Access ...)
+ TODO: check
+CVE-2026-51914 (TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect
Access ...)
+ TODO: check
+CVE-2026-51911 (vanna v2.0.2 contains a code injection vulnerability in
VannaBase.get_ ...)
+ TODO: check
+CVE-2026-51907 (In TaskingAI v0.3.0 in the QR Code Generator plugin
save_base64_image ...)
+ TODO: check
+CVE-2026-51906 (In TaskingAI v0.3.0 in the DALL-E 3 image generation tool
save_url_ima ...)
+ TODO: check
+CVE-2026-51904 (SuperAGI up to v0.0.14 contains an improper access control
vulnerabili ...)
+ TODO: check
+CVE-2026-51901 (SuperAGI up to 0.0.14 is vulnerable to Incorrect Access
Control. The a ...)
+ TODO: check
+CVE-2026-51899 (In SuperAGI v0.0.14 and prior, controller endpoints
(/api/agents/creat ...)
+ TODO: check
+CVE-2026-51898 (sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in
CodeExe ...)
+ TODO: check
+CVE-2026-39717 (Missing Authorization vulnerability in ThimPress LearnPress
learnpress ...)
+ TODO: check
+CVE-2026-39601 (Concurrent Execution using Shared Resource with Improper
Synchronizati ...)
+ TODO: check
+CVE-2026-39600 (URL Redirection to Untrusted Site ('Open Redirect')
vulnerability in M ...)
+ TODO: check
+CVE-2026-39444 (Authorization Bypass Through User-Controlled Key vulnerability
in Publ ...)
+ TODO: check
+CVE-2026-39439 (Missing Authorization vulnerability in Kiera Howe WebSamurai
websamura ...)
+ TODO: check
+CVE-2026-32585 (Missing Authorization vulnerability in airano Airano MCP
Bridge airano ...)
+ TODO: check
+CVE-2026-32584 (Insertion of Sensitive Information Into Sent Data
vulnerability in Chi ...)
+ TODO: check
+CVE-2026-19856 (The All in One SEO WordPress plugin before 5.0.2.1 does not
correctly ...)
+ TODO: check
+CVE-2026-19652 (The Divi Membership plugin for WordPress is vulnerable to
Privilege Es ...)
+ TODO: check
+CVE-2026-18036 (In Bouncy Castle for Java before 1.86, NTRU reduced secret
values with ...)
+ TODO: check
+CVE-2026-17508 (In Bouncy Castle for Java before 1.86, several password-based
key deri ...)
+ TODO: check
+CVE-2026-17507 (In Bouncy Castle for Java before 1.86, the MLS implementation
(org.bou ...)
+ TODO: check
+CVE-2026-12951 (The Dc Woocommerce Multi Vendor plugin for WordPress is
vulnerable to ...)
+ TODO: check
+CVE-2026-11795 (Observable discrepancy vulnerability in Softtr Informatics
Trading Lim ...)
+ TODO: check
+CVE-2026-104914 (MISP contains an improper access control vulnerability in its
attribut ...)
+ TODO: check
+CVE-2026-104912 (MISP contains an authorization flaw in its correlation
handling during ...)
+ TODO: check
+CVE-2026-104910 (MISP contains an authorization bypass in the related events
listing fu ...)
+ TODO: check
+CVE-2026-104908 (MISP contains an improper input validation vulnerability in
the decayi ...)
+ TODO: check
+CVE-2026-104907 (MISP contains a cross-site scripting (XSS) vulnerability in
the remote ...)
+ TODO: check
+CVE-2026-104906 (MISP contains a cross-site scripting (XSS) vulnerability in
the TAXII ...)
+ TODO: check
+CVE-2026-104901 (MISP contains a cross-site scripting (XSS) vulnerability in
the ID Tra ...)
+ TODO: check
+CVE-2026-104900 (MISP contains a stored cross-site scripting (XSS)
vulnerability in the ...)
+ TODO: check
+CVE-2026-104861 (probe-image-size gets image dimensions without downloading
the entire ...)
+ TODO: check
+CVE-2026-104859 (Nx is a monorepo solution for TypeScript and polyglot
codebases. From ...)
+ TODO: check
+CVE-2026-104855 (Wasmtime is a runtime for WebAssembly. From 46.0.0 until
46.0.2 and 47 ...)
+ TODO: check
+CVE-2026-104854 (Nx is a monorepo solution for TypeScript and polyglot
codebases. From ...)
+ TODO: check
+CVE-2026-104853 (Nx is a monorepo solution for TypeScript and polyglot
codebases. From ...)
+ TODO: check
+CVE-2026-104851 (fsspec is a specification and Python implementation framework
for file ...)
+ TODO: check
+CVE-2026-104849 (Tinypool is a minimal Node.js worker thread pool
implementation. Prior ...)
+ TODO: check
+CVE-2026-104848 (Tinypool is a minimal Node.js worker thread pool
implementation. Prior ...)
+ TODO: check
+CVE-2026-104847 (ProseMirror's view component renders and manages the editable
browser ...)
+ TODO: check
+CVE-2026-104846 (Seroval facilitates JS value stringification, including
complex struct ...)
+ TODO: check
+CVE-2026-104845 (Seroval facilitates JS value stringification, including
complex struct ...)
+ TODO: check
+CVE-2026-104844 (PostCSS Selector Parser is a CSS selector parser that
integrates with ...)
+ TODO: check
+CVE-2026-104843 (uv is a Python package and project manager written in Rust.
From 0.12. ...)
+ TODO: check
+CVE-2026-104733 (User Impersonation in ProcessOnes XMMP Server ejabberd <=
26.04 allows ...)
+ TODO: check
+CVE-2026-104721 (Path-traversal vulnerability in QOS.CH Sarl Logback-classic
on Java (l ...)
+ TODO: check
+CVE-2026-104638 (A security vulnerability has been detected in onetwothreeneth
Hospital ...)
+ TODO: check
+CVE-2026-104637 (A weakness has been identified in onetwothreeneth
HospitalManagementSy ...)
+ TODO: check
+CVE-2026-104625 (A security flaw has been discovered in CodeAstro Simple Loan
Managemen ...)
+ TODO: check
+CVE-2026-104614 (A vulnerability was identified in CodeAstro Simple Pharmacy
Management ...)
+ TODO: check
+CVE-2026-104613 (A vulnerability was determined in CodeAstro Simple Pharmacy
Management ...)
+ TODO: check
+CVE-2026-104612 (A vulnerability was found in SourceCodester Student Result
Management ...)
+ TODO: check
+CVE-2026-104611 (A vulnerability was detected in Tenda AC9 15.03.02.13.
Affected is an ...)
+ TODO: check
+CVE-2026-104610 (A security vulnerability has been detected in Tenda HG7, HG9
and HG10 ...)
+ TODO: check
+CVE-2026-104609 (A weakness has been identified in onetwothreeneth
HospitalManagementSy ...)
+ TODO: check
+CVE-2026-104606 (A security flaw has been discovered in itsourcecode Online
Admission S ...)
+ TODO: check
+CVE-2026-104473 (YesWiki before 4.5.3 contains multiple reflected cross-site
scripting ...)
+ TODO: check
+CVE-2026-104472 (YesWiki before 4.6.7 contains a missing authorization
vulnerability in ...)
+ TODO: check
+CVE-2026-104471 (YesWiki before 4.6.7 contains an unrestricted file upload
vulnerabilit ...)
+ TODO: check
+CVE-2026-104470 (YesWiki before 4.6.7 contains a server-side request forgery
vulnerabil ...)
+ TODO: check
+CVE-2026-104469 (YesWiki before 4.6.7 contains a session fixation
vulnerability that al ...)
+ TODO: check
+CVE-2026-104468 (YesWiki before 4.6.7 contains an insufficient session
expiration vulne ...)
+ TODO: check
+CVE-2026-104467 (YesWiki before 4.6.7 contains an authorization bypass
vulnerability in ...)
+ TODO: check
+CVE-2026-104466 (YesWiki before 4.6.7 contains a stored cross-site scripting
vulnerabil ...)
+ TODO: check
+CVE-2026-104465 (YesWiki before 4.6.7 contains a reflected cross-site
scripting vulnera ...)
+ TODO: check
+CVE-2026-104464 (YesWiki before 4.6.7 contains a server-side request forgery
vulnerabil ...)
+ TODO: check
+CVE-2026-104463 (YesWiki before 4.6.7 contains a server-side request forgery
vulnerabil ...)
+ TODO: check
+CVE-2026-104462 (YesWiki before 4.6.7 contains an SQL injection vulnerability
in the Ba ...)
+ TODO: check
+CVE-2026-104461 (YesWiki before 4.6.7 contains a stored cross-site scripting
vulnerabil ...)
+ TODO: check
+CVE-2026-104460 (YesWiki before 4.6.7 contains a blind SQL injection
vulnerability in t ...)
+ TODO: check
+CVE-2026-104459 (YesWiki before 4.6.7 contains a server-side request forgery
vulnerabil ...)
+ TODO: check
+CVE-2026-104458 (YesWiki before 4.6.7 contains a server-side request forgery
vulnerabil ...)
+ TODO: check
+CVE-2026-104457 (YesWiki before 4.6.7 contains an SQL injection vulnerability
in the Ba ...)
+ TODO: check
+CVE-2026-104456 (YesWiki before 4.6.7 contains a second-order SQL injection
vulnerabili ...)
+ TODO: check
+CVE-2026-104455 (YesWiki before 4.6.7 contains an access control bypass
vulnerability t ...)
+ TODO: check
+CVE-2026-104454 (YesWiki before 4.6.7 contains an algorithmic-complexity
denial of serv ...)
+ TODO: check
+CVE-2026-104453 (YesWiki before 4.6.7 contains a cross-site request forgery
vulnerabili ...)
+ TODO: check
+CVE-2026-104452 (YesWiki before 4.6.7 contains a cross-site request forgery
vulnerabili ...)
+ TODO: check
+CVE-2026-104451 (YesWiki before 4.6.7 contains a cross-site request forgery
vulnerabili ...)
+ TODO: check
+CVE-2026-104450 (YesWiki before 4.6.7 contains a missing authorization flaw in
the poin ...)
+ TODO: check
+CVE-2026-104449 (YesWiki before 4.6.7 contains an access control vulnerability
allowing ...)
+ TODO: check
+CVE-2026-104448 (YesWiki before 4.6.7 contains a cross-site request forgery
vulnerabili ...)
+ TODO: check
+CVE-2026-104447 (YesWiki before 4.6.7 contains a cross-site request forgery
vulnerabili ...)
+ TODO: check
+CVE-2026-104446 (YesWiki before 4.6.7 contains an authentication bypass in the
contact ...)
+ TODO: check
+CVE-2026-104445 (YesWiki before 4.6.7 contains an authentication bypass
vulnerability i ...)
+ TODO: check
+CVE-2026-104444 (YesWiki before 4.6.7 contains an authorization bypass
vulnerability in ...)
+ TODO: check
+CVE-2026-104443 (YesWiki before 4.6.7 contains an empty-filter scope bypass in
the trip ...)
+ TODO: check
+CVE-2026-104442 (YesWiki before 4.6.7 contains an unauthenticated server-side
request f ...)
+ TODO: check
+CVE-2026-104441 (YesWiki before 4.6.7 contains an unauthenticated server-side
request f ...)
+ TODO: check
+CVE-2026-104440 (YesWiki before 4.6.7 contains a blind server-side request
forgery vuln ...)
+ TODO: check
+CVE-2026-104439 (YesWiki before 4.6.7 contains a user enumeration
vulnerability in Lost ...)
+ TODO: check
+CVE-2026-104438 (YesWiki before 4.6.7 contains a missing authorization
vulnerability in ...)
+ TODO: check
+CVE-2026-104437 (Zebra before 4.4.0 contains a consensus divergence
vulnerability in V5 ...)
+ TODO: check
+CVE-2026-104436 (Zebra before 4.5.0 contains an uncontrolled resource
consumption vulne ...)
+ TODO: check
+CVE-2026-104435 (Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a
ZIP-244 co ...)
+ TODO: check
+CVE-2026-104434 (ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad
before 4.5.0 c ...)
+ TODO: check
+CVE-2026-104432 (Zebra before 6.3.0 contains an improper exceptional condition
check in ...)
+ TODO: check
+CVE-2026-104431 (Zebra before 6.0.0 contains a denial of service vulnerability
that all ...)
+ TODO: check
+CVE-2026-104430 (Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem
script sig ...)
+ TODO: check
+CVE-2026-104429 (Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its
per-peer mem ...)
+ TODO: check
+CVE-2026-104428 (The getblock RPC method in zebra-rpc before 11.0.0, used by
the Zcash ...)
+ TODO: check
+CVE-2026-104427 (Zebra before 6.1.0 contains an incomplete cleanup
vulnerability in the ...)
+ TODO: check
+CVE-2026-104426 (Zebra before 6.1.0 contains an inefficient algorithmic
complexity vuln ...)
+ TODO: check
+CVE-2026-104425 (ZcashFoundation Zebra before 6.1.0 contains a resource
exhaustion vuln ...)
+ TODO: check
+CVE-2026-104424 (Zebra before 6.1.0 contains an incorrect calculation
vulnerability in ...)
+ TODO: check
+CVE-2026-104423 (Zebra (zebrad) before 6.2.1 contains an asymmetric resource
consumptio ...)
+ TODO: check
+CVE-2026-104422 (The block sync download path in Zebra (zebrad) before 6.3.0
reads a bl ...)
+ TODO: check
+CVE-2026-104421 (Zebra before 6.2.1 contains an incomplete cleanup
vulnerability that a ...)
+ TODO: check
+CVE-2026-104420 (Zebra before 6.3.0 contains a protection mechanism failure
that allows ...)
+ TODO: check
+CVE-2026-104419 (Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer
supplied the blo ...)
+ TODO: check
+CVE-2026-104418 (Ghost from 6.10.3 before 6.64.0 contains a remote code
execution vulne ...)
+ TODO: check
+CVE-2026-104417 (Ghost from 1.20.0 before 6.64.0 contains a path traversal
vulnerabilit ...)
+ TODO: check
+CVE-2026-104416 (Ghost from 4.39.0 before 6.64.0 contains an information
disclosure vul ...)
+ TODO: check
+CVE-2026-104415 (Ghost from 0.7.2 before 6.64.0 contains an information
disclosure vuln ...)
+ TODO: check
+CVE-2026-104414 (Ghost from 2.5.0 before 6.64.0 contains a stored cross-site
scripting ...)
+ TODO: check
+CVE-2026-104413 (Ghost from 5.94.0 before 6.64.0 contains a stored cross-site
scripting ...)
+ TODO: check
+CVE-2026-104412 (Ghost 0.5.0 before 6.64.0 does not correctly restrict staff
role assig ...)
+ TODO: check
+CVE-2026-104411 (Ghost from 6.22.1 before 6.64.0 contains a stored cross-site
scripting ...)
+ TODO: check
+CVE-2026-104410 (SiYuan before 3.8.5 contains an information disclosure
vulnerability t ...)
+ TODO: check
+CVE-2026-104403 (Authorization Bypass Through User-Controlled Key
vulnerability in Thim ...)
+ TODO: check
+CVE-2026-104026 (In Sapling SCM prior to v0.2.20260929-102736, control
characters were ...)
+ TODO: check
+CVE-2026-103958 (Server-side request forgery in the tool server and remote
agent connec ...)
+ TODO: check
+CVE-2026-103957 (Server-side request forgery in the OAuth2 discovery handling
in Loom f ...)
+ TODO: check
+CVE-2026-103956 (Missing authentication for critical function in the
authentication dep ...)
+ TODO: check
+CVE-2026-103885 (Asymmetric Resource Consumptionvulnerability in Apache
Directory LDAP ...)
+ TODO: check
+CVE-2026-103880 (Asymmetric Resource Consumptionvulnerability in Apache
Directory LDAP ...)
+ TODO: check
+CVE-2026-103878 (Cleartext transmission of sensitive informationvulnerability
in Apache ...)
+ TODO: check
+CVE-2026-103877 (Deserialization of Untrusted Data vulnerability in Apache
Directory LD ...)
+ TODO: check
+CVE-2026-103763 (SiYuan before v3.8.5 contains an information disclosure
vulnerability ...)
+ TODO: check
+CVE-2026-103762 (SiYuan before v3.8.5 contains a missing authorization
vulnerability in ...)
+ TODO: check
+CVE-2026-103648 (Path traversal in image-downloader 4.3.0 allows an attacker
who can co ...)
+ TODO: check
+CVE-2026-103631 (Buffer overflow in WebRTC in Google Chrome prior to
154.0.8037.97 allo ...)
+ TODO: check
+CVE-2026-103630 (Use after free in FedCM in Google Chrome prior to
154.0.8037.97 allowe ...)
+ TODO: check
+CVE-2026-103629 (Integer overflow in Skia in Google Chrome prior to
154.0.8037.97 allow ...)
+ TODO: check
+CVE-2026-103628 (Out of bounds write in WebGL in Google Chrome prior to
154.0.8037.97 a ...)
+ TODO: check
+CVE-2026-103627 (Information leak in SVG in Google Chrome prior to
154.0.8037.97 allowe ...)
+ TODO: check
+CVE-2026-103626 (Incorrect authorization in FileSystem in Google Chrome on on
Windows p ...)
+ TODO: check
+CVE-2026-103625 (Type confusion in V8 in Google Chrome prior to 154.0.8037.97
allowed a ...)
+ TODO: check
+CVE-2026-103624 (Use after free in Contextual Tasks in Google Chrome on on
Windows prio ...)
+ TODO: check
+CVE-2026-103623 (Use after free in MediaStream in Google Chrome prior to
154.0.8037.97 ...)
+ TODO: check
+CVE-2026-103622 (Use after free in SVG in Google Chrome prior to 154.0.8037.97
allowed ...)
+ TODO: check
+CVE-2026-103621 (Integer overflow in Compositing in Google Chrome prior to
154.0.8037.9 ...)
+ TODO: check
+CVE-2026-103604 (Inefficient algorithmic complexity in X.509 distinguished
name string ...)
+ TODO: check
+CVE-2026-103603 (Memory allocation with excessive size value in the HSS/LMS
signature c ...)
+ TODO: check
+CVE-2026-103602 (Improper certificate validation in
PkixNameConstraintValidator in Legi ...)
+ TODO: check
+CVE-2026-103601 (Release of unverified plaintext in the CCM (CcmBlockCipher)
and DSTU 7 ...)
+ TODO: check
+CVE-2026-103600 (Uncontrolled recursion in the ASN.1 parser (Asn1InputStream,
Asn1Strea ...)
+ TODO: check
+CVE-2026-103552 (Stack Overflow vulnerability in Apache Directory LDAP API.
Before b ...)
+ TODO: check
+CVE-2026-103426 (The Relevanssi Premium plugin for WordPress is vulnerable to
Stored Cr ...)
+ TODO: check
+CVE-2026-102798 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-102797 (Server-Side Request Forgery (SSRF) vulnerability in ThemeREX
Group The ...)
+ TODO: check
+CVE-2026-102795 (Improper Access Control vulnerability in Apache Traffic
Server. Thi ...)
+ TODO: check
+CVE-2026-102772 (The CMB2 plugin for WordPress is vulnerable to Stored
Cross-Site Scrip ...)
+ TODO: check
+CVE-2026-102731 (Memory allocation with excessive size value vulnerability in
Apache Di ...)
+ TODO: check
+CVE-2026-102626 (An authenticated LimeSurvey Community Edition 7.4.0user with
the globa ...)
+ TODO: check
+CVE-2026-102002 (The Otter Blocks \u2013 Gutenberg Blocks, Page Builder for
Gutenberg E ...)
+ TODO: check
+CVE-2026-101104 (The Meari IoT Cloud Platform OpenAPI Service is vulnerable to
an autho ...)
+ TODO: check
+CVE-2026-100182 (The Download Monitor plugin for WordPress is vulnerable to
Stored Cros ...)
+ TODO: check
+CVE-2026-100107 (The Kubio AI Page Builder plugin for WordPress is vulnerable
to Stored ...)
+ TODO: check
+CVE-2023-54405 (H3C CVM, the Cloud Virtualization Management component of the
H3C CAS ...)
+ TODO: check
+CVE-2020-37278 (Weaver e-Bridge contains an unauthenticated arbitrary file
read vulner ...)
+ TODO: check
+CVE-2014-125130 (CodeArt Google MP3 Audio Player plugin
(google-mp3-audio-player) for W ...)
+ TODO: check
CVE-2026-102966
- mediawiki 1:1.43.10+dfsg-1
NOTE:
https://lists.wikimedia.org/hyperkitty/list/[email protected]/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
@@ -1407,7 +2007,7 @@ CVE-2026-97288 (Contributor Cross Site Scripting (XSS) in
OAuth Server <= 4.5.1
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97287 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-97286 (Contributor Cross Site Scripting (XSS) in Strong Testimonials
<= 3.3.1 ...)
+CVE-2026-97286 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97285 (Contributor Broken Access Control in The Events Calendar <=
6.17.5 ver ...)
NOT-FOR-US: WordPress plugin or theme
@@ -4769,7 +5369,7 @@ CVE-2022-51019 (Akaunting before 2.1.31 contains an OS
command injection vulnera
CVE-2015-20122 (Seeyon A6 collaborative office automation platform contains an
unauthe ...)
NOT-FOR-US: Seeyon
CVE-2026-100756 (Incorrect boundary conditions in the Audio/Video: Playback
component. ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4777,7 +5377,7 @@ CVE-2026-100756 (Incorrect boundary conditions in the
Audio/Video: Playback comp
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100756
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100756
CVE-2026-100757 (Use-after-free in the Widget component. This vulnerability
was fixed i ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4785,7 +5385,7 @@ CVE-2026-100757 (Use-after-free in the Widget component.
This vulnerability was
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100757
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100757
CVE-2026-100758 (Sandbox escape in the DOM: Navigation component. This
vulnerability wa ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4793,7 +5393,7 @@ CVE-2026-100758 (Sandbox escape in the DOM: Navigation
component. This vulnerabi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100758
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100758
CVE-2026-100759 (Uninitialized memory in the Storage: Quota Manager component.
This vul ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4801,7 +5401,7 @@ CVE-2026-100759 (Uninitialized memory in the Storage:
Quota Manager component. T
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100759
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100759
CVE-2026-100760 (Sandbox escape in the Security: Process Sandboxing component.
This vul ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4814,7 +5414,7 @@ CVE-2026-100761 (Privilege escalation due to
use-after-free in the Graphics: Web
- firefox 157.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100761
CVE-2026-100762 (Sandbox escape due to use-after-free in the DOM: Content
Processes com ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4828,7 +5428,7 @@ CVE-2026-100764 (Privilege escalation due to incorrect
boundary conditions in th
- firefox 157.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100764
CVE-2026-100765 (Use-after-free in the JavaScript: WebAssembly component. This
vulnerab ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4838,7 +5438,7 @@ CVE-2026-100765 (Use-after-free in the JavaScript:
WebAssembly component. This v
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100765
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100765
CVE-2026-100766 (Information disclosure in the Networking: JAR component. This
vulnerab ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4846,7 +5446,7 @@ CVE-2026-100766 (Information disclosure in the
Networking: JAR component. This v
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100766
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100766
CVE-2026-100767 (Use-after-free in the Networking: Cache component. This
vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4857,7 +5457,7 @@ CVE-2026-100768 (Use-after-free in the Graphics: WebGPU
component. This vulnerab
- firefox 157.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100768
CVE-2026-100769 (Use-after-free in the JavaScript: WebAssembly component. This
vulnerab ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4865,7 +5465,7 @@ CVE-2026-100769 (Use-after-free in the JavaScript:
WebAssembly component. This v
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100769
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100769
CVE-2026-100770 (Sandbox escape due to use-after-free in the DOM: Content
Processes com ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4873,7 +5473,7 @@ CVE-2026-100770 (Sandbox escape due to use-after-free in
the DOM: Content Proces
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100770
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100770
CVE-2026-100771 (Undefined behavior in the DOM: Streams component. This
vulnerability w ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4881,7 +5481,7 @@ CVE-2026-100771 (Undefined behavior in the DOM: Streams
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100771
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100771
CVE-2026-100772 (Use-after-free in the DOM: Core & HTML component. This
vulnerability w ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4889,7 +5489,7 @@ CVE-2026-100772 (Use-after-free in the DOM: Core & HTML
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100772
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100772
CVE-2026-100773 (Use-after-free in the Storage: IndexedDB component. This
vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4897,7 +5497,7 @@ CVE-2026-100773 (Use-after-free in the Storage: IndexedDB
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100773
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100773
CVE-2026-100774 (Use-after-free in the DOM: Core & HTML component. This
vulnerability w ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4905,7 +5505,7 @@ CVE-2026-100774 (Use-after-free in the DOM: Core & HTML
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100774
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100774
CVE-2026-100775 (Sandbox escape in the Graphics component. This vulnerability
was fixed ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4913,7 +5513,7 @@ CVE-2026-100775 (Sandbox escape in the Graphics
component. This vulnerability wa
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100775
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100775
CVE-2026-100776 (Use-after-free in the JavaScript: WebAssembly component. This
vulnerab ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4921,7 +5521,7 @@ CVE-2026-100776 (Use-after-free in the JavaScript:
WebAssembly component. This v
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100776
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100776
CVE-2026-100777 (Use-after-free in the Graphics: Canvas2D component. This
vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4929,7 +5529,7 @@ CVE-2026-100777 (Use-after-free in the Graphics: Canvas2D
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100777
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100777
CVE-2026-100778 (Sandbox escape due to use-after-free in the DOM: Core & HTML
component ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4937,7 +5537,7 @@ CVE-2026-100778 (Sandbox escape due to use-after-free in
the DOM: Core & HTML co
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100778
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100778
CVE-2026-100779 (Use-after-free in the XSLT component. This vulnerability was
fixed in ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4945,7 +5545,7 @@ CVE-2026-100779 (Use-after-free in the XSLT component.
This vulnerability was fi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100779
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100779
CVE-2026-100780 (Use-after-free in the DOM: Core & HTML component. This
vulnerability w ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4953,7 +5553,7 @@ CVE-2026-100780 (Use-after-free in the DOM: Core & HTML
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100780
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100780
CVE-2026-100781 (Sandbox escape due to incorrect boundary conditions in the
Graphics: W ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4961,7 +5561,7 @@ CVE-2026-100781 (Sandbox escape due to incorrect boundary
conditions in the Grap
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100781
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100781
CVE-2026-100782 (Privilege escalation due to incorrect boundary conditions in
the Graph ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4969,7 +5569,7 @@ CVE-2026-100782 (Privilege escalation due to incorrect
boundary conditions in th
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100782
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100782
CVE-2026-100783 (Uninitialized memory in the Audio/Video component. This
vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4977,7 +5577,7 @@ CVE-2026-100783 (Uninitialized memory in the Audio/Video
component. This vulnera
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100783
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100783
CVE-2026-100784 (Use-after-free in the Layout: Text and Fonts component. This
vulnerabi ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4985,7 +5585,7 @@ CVE-2026-100784 (Use-after-free in the Layout: Text and
Fonts component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100784
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100784
CVE-2026-100785 (Use-after-free in the DOM: Core & HTML component. This
vulnerability w ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -4993,7 +5593,7 @@ CVE-2026-100785 (Use-after-free in the DOM: Core & HTML
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100785
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100785
CVE-2026-100786 (Sandbox escape due to use-after-free in the Graphics
component. This v ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5001,7 +5601,7 @@ CVE-2026-100786 (Sandbox escape due to use-after-free in
the Graphics component.
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100786
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100786
CVE-2026-100787 (Sandbox escape in the XUL component. This vulnerability was
fixed in F ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5011,7 +5611,7 @@ CVE-2026-100787 (Sandbox escape in the XUL component.
This vulnerability was fix
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100787
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100787
CVE-2026-100788 (Invalid pointer in the JavaScript: WebAssembly component.
This vulnera ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5019,7 +5619,7 @@ CVE-2026-100788 (Invalid pointer in the JavaScript:
WebAssembly component. This
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100788
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100788
CVE-2026-100789 (Use-after-free in the Graphics: Canvas2D component. This
vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5027,7 +5627,7 @@ CVE-2026-100789 (Use-after-free in the Graphics: Canvas2D
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100789
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100789
CVE-2026-100790 (Use-after-free in the XSLT component. This vulnerability was
fixed in ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5035,7 +5635,7 @@ CVE-2026-100790 (Use-after-free in the XSLT component.
This vulnerability was fi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100790
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100790
CVE-2026-100791 (Use-after-free in the DOM: Core & HTML component. This
vulnerability w ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5043,7 +5643,7 @@ CVE-2026-100791 (Use-after-free in the DOM: Core & HTML
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100791
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100791
CVE-2026-100792 (JIT miscompilation in the JavaScript: WebAssembly component.
This vuln ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5054,7 +5654,7 @@ CVE-2026-100793 (JIT miscompilation in the JavaScript
Engine component. This vul
- firefox 157.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100793
CVE-2026-100794 (Sandbox escape due to incorrect boundary conditions in the
Internation ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5062,7 +5662,7 @@ CVE-2026-100794 (Sandbox escape due to incorrect boundary
conditions in the Inte
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100794
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100794
CVE-2026-96869 (Information disclosure in the Networking component. This
vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5076,7 +5676,7 @@ CVE-2026-100796 (Use-after-free in the JavaScript:
WebAssembly component. This v
- firefox 157.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100796
CVE-2026-100797 (Privilege escalation due to use-after-free in the Graphics:
WebRender ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5084,7 +5684,7 @@ CVE-2026-100797 (Privilege escalation due to
use-after-free in the Graphics: Web
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100797
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100797
CVE-2026-100798 (Cryptography misuse in Storage: Quota Manager component. This
vulnerab ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5097,7 +5697,7 @@ CVE-2026-100799 (Uninitialized memory in the Graphics:
WebGPU component. This vu
- firefox 157.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100799
CVE-2026-100800 (Sandbox escape due to use-after-free in the Disability Access
APIs com ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5107,7 +5707,7 @@ CVE-2026-100800 (Sandbox escape due to use-after-free in
the Disability Access A
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100800
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100800
CVE-2026-100801 (Privilege escalation in the DLL Services component. This
vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5118,7 +5718,7 @@ CVE-2026-100802 (Uninitialized memory in the Graphics:
WebGPU component. This vu
- firefox 157.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100802
CVE-2026-100803 (Same-origin policy bypass in the WebExtensions component.
This vulnera ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5132,7 +5732,7 @@ CVE-2026-100805 (Race condition, use-after-free in the
Audio/Video component. Th
- firefox 157.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100805
CVE-2026-100806 (Uninitialized memory in the Graphics: WebGPU component. This
vulnerabi ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5142,7 +5742,7 @@ CVE-2026-100806 (Uninitialized memory in the Graphics:
WebGPU component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100806
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100806
CVE-2026-100807 (Privilege escalation in the DOM: Service Workers component.
This vulne ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5150,7 +5750,7 @@ CVE-2026-100807 (Privilege escalation in the DOM: Service
Workers component. Thi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100807
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100807
CVE-2026-100808 (Mitigation bypass in the DOM: Service Workers component. This
vulnerab ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5160,7 +5760,7 @@ CVE-2026-100808 (Mitigation bypass in the DOM: Service
Workers component. This v
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100808
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100808
CVE-2026-100809 (Same-origin policy bypass in the DevTools component. This
vulnerabilit ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5173,7 +5773,7 @@ CVE-2026-100810 (Other issue in the DevTools component.
This vulnerability was f
- firefox 157.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100810
CVE-2026-100811 (Sandbox escape due to use-after-free in the DOM: Core & HTML
component ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5181,7 +5781,7 @@ CVE-2026-100811 (Sandbox escape due to use-after-free in
the DOM: Core & HTML co
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100811
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100811
CVE-2026-100812 (Denial-of-service in the Graphics component. This
vulnerability was fi ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5194,7 +5794,7 @@ CVE-2026-100813 (Invalid pointer in the JavaScript
Engine: JIT component. This v
- firefox 157.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100813
CVE-2026-100814 (Incorrect boundary conditions in the JavaScript Engine: JIT
component. ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5204,7 +5804,7 @@ CVE-2026-100814 (Incorrect boundary conditions in the
JavaScript Engine: JIT com
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100814
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100814
CVE-2026-100815 (Use-after-free in the CSS Parsing and Computation component.
This vuln ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5214,7 +5814,7 @@ CVE-2026-100815 (Use-after-free in the CSS Parsing and
Computation component. Th
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100815
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100815
CVE-2026-100816 (Site isolation issue in the DOM: Networking component. This
vulnerabil ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5227,7 +5827,7 @@ CVE-2026-100817 (Other issue in the JavaScript:
WebAssembly component. This vuln
- firefox 157.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100817
CVE-2026-100818 (Sandbox escape due to use-after-free in the Widget: Gtk
component. Thi ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5235,7 +5835,7 @@ CVE-2026-100818 (Sandbox escape due to use-after-free in
the Widget: Gtk compone
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100818
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100818
CVE-2026-100819 (Sandbox escape due to incorrect boundary conditions in the
XPCOM compo ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5243,7 +5843,7 @@ CVE-2026-100819 (Sandbox escape due to incorrect boundary
conditions in the XPCO
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100819
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100819
CVE-2026-100820 (Privilege escalation in the Address Bar component. This
vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5251,7 +5851,7 @@ CVE-2026-100820 (Privilege escalation in the Address Bar
component. This vulnera
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100820
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100820
CVE-2026-100821 (Site isolation issue in the Panning and Zooming component.
This vulner ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5259,7 +5859,7 @@ CVE-2026-100821 (Site isolation issue in the Panning and
Zooming component. This
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100821
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100821
CVE-2026-100822 (Spoofing issue in the Networking: HTTP component. This
vulnerability w ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5272,7 +5872,7 @@ CVE-2026-100823 (Spoofing issue in the Downloads
component in Firefox for Androi
- firefox <not-affected> (Only affects Firefox on Android)
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100823
CVE-2026-100824 (Privilege escalation in the Places component. This
vulnerability was f ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5282,7 +5882,7 @@ CVE-2026-100824 (Privilege escalation in the Places
component. This vulnerabilit
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100824
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100824
CVE-2026-100825 (Use-after-free in the JavaScript Engine: JIT component. This
vulnerabi ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5292,7 +5892,7 @@ CVE-2026-100825 (Use-after-free in the JavaScript Engine:
JIT component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100825
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100825
CVE-2026-100826 (Denial-of-service in the Storage: StorageManager component.
This vulne ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5302,7 +5902,7 @@ CVE-2026-100826 (Denial-of-service in the Storage:
StorageManager component. Thi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100826
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100826
CVE-2026-100828 (Mitigation bypass in the Bookmarks & History component. This
vulnerabi ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5312,7 +5912,7 @@ CVE-2026-100828 (Mitigation bypass in the Bookmarks &
History component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100828
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100828
CVE-2026-100829 (Mitigation bypass in the DOM: Security component. This
vulnerability w ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5322,7 +5922,7 @@ CVE-2026-100829 (Mitigation bypass in the DOM: Security
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100829
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100829
CVE-2026-100830 (Mitigation bypass in the DOM: Navigation component. This
vulnerability ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5332,7 +5932,7 @@ CVE-2026-100830 (Mitigation bypass in the DOM: Navigation
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100830
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100830
CVE-2026-100831 (Use-after-free in the DOM: UI Events & Focus Handling
component. This ...)
- {DSA-6533-1}
+ {DSA-6533-1 DLA-4814-1}
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
@@ -5340,7 +5940,7 @@ CVE-2026-100831 (Use-after-free in the DOM: UI Events &
Focus Handling component
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100831
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100831
CVE-2026-100832 (Use-after-free in the Graphics: Canvas2D component. This
vulnerability ...)
- {DSA-6536-1 DSA-6533-1 DLA-4810-1}
+ {DSA-6536-1 DSA-6533-1 DLA-4814-1 DLA-4810-1}
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100832
@@ -7558,6 +8158,7 @@ CVE-2026-100310 (GNU libextractor before 1.16 loads
plugins from an untrusted se
CVE-2026-100208 (Integer overflow or wraparound in Microsoft Office Outlook
allows an u ...)
NOT-FOR-US: Microsoft
CVE-2026-104201 [GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key
re-encryption]
+ {DSA-6540-1}
- radsecproxy 1.11.4-1
NOTE:
https://github.com/radsecproxy/radsecproxy/security/advisories/GHSA-wj29-mxmc-q98c
NOTE:
https://github.com/radsecproxy/radsecproxy/commit/9256b4a78ad6b14d97f80a0e749c66d97e46d5e1
(1.11.4)
@@ -9930,7 +10531,7 @@ CVE-2026-97181 (GPM LIGHT developed by ezGlobal has a
Sensitive Data Exposure vu
NOT-FOR-US: ezGlobal
CVE-2026-97179 (A security vulnerability has been detected in O2OA up to
9.5.3/10.0.2. ...)
NOT-FOR-US: O2OA
-CVE-2026-97062 (Aureus ERP through 1.6.0 stores uploaded SVG files on its
public disk ...)
+CVE-2026-97062 (Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores
uploaded SVG ...)
NOT-FOR-US: Aureus ERP
CVE-2026-97061 (Black Candy through 3.2.1 fails to scope playlist search
queries to th ...)
NOT-FOR-US: Black Candy
@@ -9968,6 +10569,7 @@ CVE-2026-96746 (An out-of-bounds write in the
connection-monitoring logic of the
NOTE:
https://github.com/mongodb/mongo-c-driver/commit/52352bfdea96506fafe0f53e222a1f61eebe54f2
(2.5.5)
NOTE:
https://github.com/mongodb/mongo-c-driver/commit/59bcc756ad8f04af74b84b88ab747adfd2647b5b
(1.30.12)
CVE-2026-96745 (Deserialization of untrusted data in the command monitoring
support of ...)
+ {DSA-6539-1}
- php-mongodb 2.5.3-1 (bug #1148966)
NOTE:
https://github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c
NOTE: https://jira.mongodb.org/browse/PHPC-2743
@@ -11914,7 +12516,7 @@ CVE-2026-91789 (Foxit PDF Editor/Reader\u2019s U3D/GIF
texture decoding path con
NOT-FOR-US: Foxit
CVE-2026-91788 (When implementing the JavaScript interface, Foxit PDF
Editor/Reader di ...)
NOT-FOR-US: Foxit
-CVE-2026-91775 (LimeSurvey fails to safely encode attacker-controlled content
from a c ...)
+CVE-2026-91775 (LimeSurvey Community Edition 7.0.14fails to safely encode
attacker-con ...)
- limesurvey <itp> (bug #472802)
CVE-2026-90950 (The Paid Membership Subscriptions WordPress plugin before
3.1.0 does n ...)
NOT-FOR-US: WordPress plugin
@@ -12634,7 +13236,7 @@ CVE-2026-86243 (Buffer over-read vulnerability in
Apache Tomcat Native during th
NOTE: Fixed by:
https://github.com/apache/tomcat-native/commit/9a7c804afc05fdc630520eb4012ce1c4ff787862
(2.0.16)
NOTE: Fixed by:
https://github.com/apache/tomcat-native/commit/ce019af0db385dfd5bc7c7a759f71602559a0499
(1.3.9)
NOTE: https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557
-CVE-2026-94422
+CVE-2026-94422 (An incorrect implementation of message filtering in
xdg-dbus-proxy ver ...)
{DSA-6510-1}
- xdg-dbus-proxy 0.1.9-1 (bug #1148782)
NOTE:
https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq
@@ -15324,13 +15926,13 @@ CVE-2026-93986 (rclone before 1.75.1 fails to confine
names from server and thir
- rclone <unfixed> (bug #1148669)
[trixie] - rclone <no-dsa> (Minor issue)
NOTE:
https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q
-CVE-2026-93985 (OpenPanel js-runtime through commit bad75bdd contains a
sandbox escape ...)
+CVE-2026-93985 (OpenPanel js-runtime through 2.3.0 contains a sandbox escape
vulnerabi ...)
NOT-FOR-US: OpenPanel
-CVE-2026-93984 (OpenPanel tracking API through commit
bad75bddc74d12d36cfb843f4531d3b8 ...)
+CVE-2026-93984 (OpenPanel tracking API through 2.3.0 fails to verify client
secret cry ...)
NOT-FOR-US: OpenPanel
-CVE-2026-93983 (OpenPanel through commit bad75bdd fails to escape property
keys in Cli ...)
+CVE-2026-93983 (OpenPanel through 2.3.0 fails to escape property keys in
ClickHouse SQ ...)
NOT-FOR-US: OpenPanel
-CVE-2026-93982 (OpenPanel through commit bad75bdd writes Model Context
Protocol authen ...)
+CVE-2026-93982 (OpenPanel through 2.3.0 writes Model Context Protocol
authentication t ...)
NOT-FOR-US: OpenPanel
CVE-2026-93981 (hono before 4.13.7 fails to HTML-escape plain strings rendered
by hono ...)
NOT-FOR-US: Hono
@@ -31201,13 +31803,13 @@ CVE-2026-88895 (CyberPanel before 3.0.5 fails to
enforce two-factor authenticati
NOT-FOR-US: CyberPanel
CVE-2026-88894 (Snipe-IT's predefined kit checkout path does not enforce Full
Multiple ...)
- snipe-it <itp> (bug #1005172)
-CVE-2026-88893 (OpenPanel share lookup procedures fail to validate access
controls and ...)
+CVE-2026-88893 (OpenPanel through 2.3.0 share lookup procedures fail to
validate acces ...)
NOT-FOR-US: OpenPanel
-CVE-2026-88892 (OpenPanel is an analytics platform. In all versions (no
patched releas ...)
+CVE-2026-88892 (In OpenPanel through 2.3.0, the data importer fetches a
caller-supplie ...)
NOT-FOR-US: OpenPanel
-CVE-2026-88891 (OpenPanel fails to enforce read-only project access level on
26 of 29 ...)
+CVE-2026-88891 (OpenPanel through 2.3.0 fails to enforce read-only project
access leve ...)
NOT-FOR-US: OpenPanel
-CVE-2026-88890 (OpenPanel through commit cd24bb8 contains an SQL injection
vulnerabili ...)
+CVE-2026-88890 (OpenPanel through 2.3.0 contains an SQL injection
vulnerability in the ...)
NOT-FOR-US: OpenPanel
CVE-2026-88889 (Renovate before 44.14.7 contains a command injection
vulnerability in ...)
NOT-FOR-US: Renovate
@@ -31591,7 +32193,7 @@ CVE-2026-81795 (Unauthenticated Cross Site Scripting
(XSS) in Page Visits Counte
NOT-FOR-US: WordPress plugin or theme
CVE-2026-81794 (Unauthenticated Broken Access Control in Shirt Product
Designer for Wo ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-81793 (Unauthenticated Broken Access Control in Salon booking system
<= 10.31 ...)
+CVE-2026-81793 (Missing Authorization vulnerability in Dimitri Grassi Salon
booking sy ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-81791 (Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7
versions.)
NOT-FOR-US: WordPress plugin or theme
@@ -40240,6 +40842,7 @@ CVE-2026-84969 (A memory-handling error in the
BSON-to-JSON conversion helpers o
NOTE: Fixed by:
https://github.com/mongodb/mongo-c-driver/commit/08d0cfaaf08a54d7e87a5e5fa8d38251bf0eeca6
(1.30.9)
NOTE: Introduced by:
https://github.com/mongodb/mongo-c-driver/commit/f2c1bb7989177fa2ddba1a915e8423e46ee1defe
(1.30.0)
CVE-2026-84968 (An out-of-bounds read in the BSON decoding component of the
MongoDB PH ...)
+ {DSA-6539-1}
- php-mongodb 2.5.3-1 (bug #1149050)
[bookworm] - php-mongodb <postponed> (Minor issue, infoleak)
NOTE: https://jira.mongodb.org/browse/PHPC-2744
@@ -46207,7 +46810,7 @@ CVE-2026-82072 (Out of bounds read in V8 in Google
Chrome prior to 151.0.7922.72
- chromium 151.0.7922.71-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-81934 (Redis contains a use-after-free vulnerability in the
'tlsProcessPendin ...)
- {DLA-4794-1}
+ {DSA-6538-1 DLA-4794-1}
- redis 5:8.0.6-3 (bug #1147423)
NOTE:
https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834
(8.8.2)
NOTE: The same flaw in valkey is tracked in CVE-2026-56684
@@ -142998,6 +143601,7 @@ CVE-2026-8596 (Cleartext storage of sensitive
information in the ModelBuilder/Se
CVE-2026-7373 (Rapid7 Metasploit Pro is vulnerable to a local privilege
escalation at ...)
NOT-FOR-US: Rapid7 Metasploit Pro
CVE-2026-6811 (Stack exhaustion vulnerability in the MongoDB PHP driver can
cause app ...)
+ {DSA-6539-1}
- php-mongodb 2.5.3-1 (bug #1136802)
[bookworm] - php-mongodb <no-dsa> (Minor issue)
[bullseye] - php-mongodb <postponed> (Minor issue, DoS in unusual
circumstances)
@@ -152449,7 +153053,7 @@ CVE-2026-25589 (RedisBloom is a probabilistic data
structures module for Redis.
CVE-2026-25588 (RedisTimeSeries is a time-series module for Redis. In all
versions bef ...)
NOT-FOR-US: RedisTimeSeries Redis module
CVE-2026-25243 (Redis is an in-memory data structure store. In versions of
redis-serve ...)
- {DLA-4682-1}
+ {DSA-6538-1 DLA-4682-1}
- redict <unfixed>
[experimental] - redis 5:8.6.3-1
- redis 5:8.0.6-3 (bug #1147421)
@@ -152465,7 +153069,7 @@ CVE-2026-25243 (Redis is an in-memory data structure
store. In versions of redis
NOTE: https://github.com/valkey-io/valkey/pull/3619
NOTE: valkey fixed by:
https://github.com/valkey-io/valkey/commit/fea0b4064cf612d1c365b032326832bff0946bd9
(8.1.7)
CVE-2026-23631 (Redis is an in-memory data structure store. In all versions of
redis-s ...)
- {DLA-4682-1}
+ {DSA-6538-1 DLA-4682-1}
- redict <unfixed>
[experimental] - redis 5:8.6.3-1
- redis 5:8.0.6-3 (bug #1147421)
@@ -152480,6 +153084,7 @@ CVE-2026-23631 (Redis is an in-memory data structure
store. In all versions of r
NOTE: valkey fixed by:
https://github.com/valkey-io/valkey/commit/c7c92db43b63be0599a076590f012ed35d279a47
(8.1.7)
NOTE: redict has the yielding-long-command mechanism but
readSyncBulkPayload() lacks the guard
CVE-2026-23479 (Redis is an in-memory data structure store. In redis-server
from 7.2.0 ...)
+ {DSA-6538-1}
- redict <unfixed>
[experimental] - redis 5:8.6.3-1
- redis 5:8.0.6-3 (bug #1147421)
@@ -249886,7 +250491,7 @@ CVE-2025-58224 (Cross-Site Request Forgery (CSRF)
vulnerability in Printeers Pri
NOT-FOR-US: WordPress plugin or theme
CVE-2025-58223 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2025-58222 (Missing Authorization vulnerability in Maidul Team Manager
wp-team-man ...)
+CVE-2025-58222 (Missing Authorization vulnerability in Dynamic Web Lab Team
Manager wp ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-58221 (Missing Authorization vulnerability in ONTRAPORT PilotPress
pilotpress ...)
NOT-FOR-US: WordPress plugin or theme
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c4f5b44d6ba8403b14820366e42471b40aba63de
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c4f5b44d6ba8403b14820366e42471b40aba63de
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
