Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
c6fbf3ee by security tracker role at 2026-10-03T07:14:18+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,247 @@
+CVE-2026-97660 (The WPC Product Options for WooCommerce plugin for WordPress
is vulner ...)
+ TODO: check
+CVE-2026-97644 (The Groundhogg \u2014 CRM, Newsletters, and Marketing
Automation plugi ...)
+ TODO: check
+CVE-2026-97363 (The WebSocket Application Programming Interface lacks
restrictions on ...)
+ TODO: check
+CVE-2026-97344 (The Wp Social Login and Register Social Counter plugin for
WordPress i ...)
+ TODO: check
+CVE-2026-97343 (The Burst Statistics \u2013 Simple WordPress Analytics (Google
Analyti ...)
+ TODO: check
+CVE-2026-97341 (The Visitor Traffic Real Time Statistics plugin for WordPress
is vulne ...)
+ TODO: check
+CVE-2026-97337 (The Simple Membership plugin for WordPress is vulnerable to
unauthoriz ...)
+ TODO: check
+CVE-2026-97212 (The WebSocket backend uses charging station identifiers to
uniquely as ...)
+ TODO: check
+CVE-2026-96962 (The Pie Register WordPress plugin before 3.8.4.14 does not
restrict a ...)
+ TODO: check
+CVE-2026-96650 (The Strong Testimonials plugin for WordPress is vulnerable to
Stored C ...)
+ TODO: check
+CVE-2026-96575 (The Transliterator \u2013 Multilingual and Multi-script Text
Conversio ...)
+ TODO: check
+CVE-2026-96564 (The SEOPress \u2013 AI SEO Plugin & On-site SEO plugin for
WordPress i ...)
+ TODO: check
+CVE-2026-96270 (The Ultimate Member \u2013 User Profile, Registration, Login,
Member D ...)
+ TODO: check
+CVE-2026-96267 (The WP Visitor Statistics (Real Time Traffic) plugin for
WordPress is ...)
+ TODO: check
+CVE-2026-95865 (The Beaver Builder Page Builder \u2013 Drag and Drop Website
Builder p ...)
+ TODO: check
+CVE-2026-95102 (WebSocket endpoints lack proper authentication mechanisms,
enabling at ...)
+ TODO: check
+CVE-2026-94594 (Armatura One's message broker logs client connection
credentials and t ...)
+ TODO: check
+CVE-2026-94593 (Armatura One's backup and restore routine records the full
database co ...)
+ TODO: check
+CVE-2026-94592 (Armatura One's database initialization routine assigns a
fixed, vendor ...)
+ TODO: check
+CVE-2026-94591 (Armatura One stores database and message-broker credentials in
an inst ...)
+ TODO: check
+CVE-2026-94539 (The SupportCandy \u2013 AI Customer Support Ticket System &
Live Chatb ...)
+ TODO: check
+CVE-2026-94505 (The Nelio Content \u2013 Editorial Calendar & Social Media
Auto-Postin ...)
+ TODO: check
+CVE-2026-94378 (The SupportCandy \u2013 AI Customer Support Ticket System &
Live Chatb ...)
+ TODO: check
+CVE-2026-94239 (The Loco Translate WordPress plugin before 2.8.9 does not
sanitise and ...)
+ TODO: check
+CVE-2026-94238 (The Loco Translate WordPress plugin before 2.8.9 does not
restrict whi ...)
+ TODO: check
+CVE-2026-93896 (The WPFront Notification Bar plugin for WordPress is
vulnerable to Ref ...)
+ TODO: check
+CVE-2026-93889 (The Mail logging \u2013 WP Mail Catcher plugin for WordPress
is vulner ...)
+ TODO: check
+CVE-2026-93474 (Charging station authentication identifiers are publicly
accessible vi ...)
+ TODO: check
+CVE-2026-93430 (The GD Rating System plugin for WordPress is vulnerable to
Stored Cros ...)
+ TODO: check
+CVE-2026-93428 (The Ultimate Member \u2013 User Profile, Registration, Login,
Member D ...)
+ TODO: check
+CVE-2026-92977 (The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin
for Word ...)
+ TODO: check
+CVE-2026-92974 (The Photo Gallery by 10Web \u2013 Mobile-Friendly Image
Gallery plugin ...)
+ TODO: check
+CVE-2026-92923 (The Unlimited Elements for Elementor WordPress plugin before
2.0.21 do ...)
+ TODO: check
+CVE-2026-92826 (The EWWW Image Optimizer plugin for WordPress is vulnerable to
Reflect ...)
+ TODO: check
+CVE-2026-92727 (The EmbedPress \u2013 PDF Embedder, 3D PDF FlipBook, Google
Reviews, Y ...)
+ TODO: check
+CVE-2026-92551 (The Paid Membership Plugin, Ecommerce, User Registration Form,
Login F ...)
+ TODO: check
+CVE-2026-92538 (The LearnPress \u2013 WordPress LMS Plugin for Create and Sell
Online ...)
+ TODO: check
+CVE-2026-92536 (The Paid Membership Plugin, Ecommerce, User Registration Form,
Login F ...)
+ TODO: check
+CVE-2026-92437 (The Mailchimp for WooCommerce WordPress plugin before 6.3 does
not req ...)
+ TODO: check
+CVE-2026-92243 (The Ivory Search \u2013 WordPress Search Plugin plugin for
WordPress i ...)
+ TODO: check
+CVE-2026-91108 (The Alt Text AI \u2013 Automatically generate image alt text
for SEO a ...)
+ TODO: check
+CVE-2026-91078 (The TillKit WordPress plugin before 1.0.5 does not require the
hard-co ...)
+ TODO: check
+CVE-2026-89236 (The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does
not sanit ...)
+ TODO: check
+CVE-2026-88783 (The Kubio AI Page Builder WordPress plugin before 2.9.3 does
not limit ...)
+ TODO: check
+CVE-2026-88782 (The Kubio AI Page Builder WordPress plugin before 2.9.3 does
not valid ...)
+ TODO: check
+CVE-2026-87115 (The VikAppointments Services Booking Calendar plugin for
WordPress is ...)
+ TODO: check
+CVE-2026-87091 (The Welcart e-Commerce plugin for WordPress is vulnerable to
Stored Cr ...)
+ TODO: check
+CVE-2026-86834 (The MetForm WordPress plugin before 4.3.1 does not properly
restrict ...)
+ TODO: check
+CVE-2026-86832 (The MetForm WordPress plugin before 4.3.1 does not properly
restrict ...)
+ TODO: check
+CVE-2026-85568 (The Unlimited Elements for Elementor WordPress plugin before
2.0.21 do ...)
+ TODO: check
+CVE-2026-85015 (The Unlimited Elements for Elementor WordPress plugin before
2.0.21 do ...)
+ TODO: check
+CVE-2026-84411 (The web management service in affected RouterOS versions
contains an i ...)
+ TODO: check
+CVE-2026-82045 (UTMStack before 11.2.16 contains a JPQL injection
vulnerability that a ...)
+ TODO: check
+CVE-2026-82044 (UTMStack before 11.2.16 contains a server-side request forgery
vulnera ...)
+ TODO: check
+CVE-2026-82043 (UTMStack before 11.2.16 contains an account enumeration
vulnerability ...)
+ TODO: check
+CVE-2026-82042 (UTMStack before 11.2.16 contains an authentication bypass
vulnerabilit ...)
+ TODO: check
+CVE-2026-82041 (UTMStack before 11.2.16 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-82040 (UTMStack before 11.2.16 contains a server-side request forgery
vulnera ...)
+ TODO: check
+CVE-2026-82039 (UTMStack before 11.2.16 contains a SQL injection vulnerability
in UtmA ...)
+ TODO: check
+CVE-2026-80518 (The WP Ultimate CSV Importer WordPress plugin before 9.2 does
not use ...)
+ TODO: check
+CVE-2026-80517 (The WP Ultimate CSV Importer WordPress plugin before 9.2 does
not pro ...)
+ TODO: check
+CVE-2026-79113 (OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer
overflow ...)
+ TODO: check
+CVE-2026-75937 (A specially crafted HTTP POST request to the web
administration interf ...)
+ TODO: check
+CVE-2026-75028 (The WPCafe \u2013 Restaurant Menu, Online Food Ordering &
Table Bookin ...)
+ TODO: check
+CVE-2026-39718 (Cross-Site Request Forgery (CSRF) vulnerability in Webriti
Wallstreet ...)
+ TODO: check
+CVE-2026-18443 (The Smart Manager \u2013 Advanced WooCommerce Bulk Edit &
Inventory Ma ...)
+ TODO: check
+CVE-2026-15795 (The Responsive Plus \u2013 Elementor Templates & Starter Sites
plugin ...)
+ TODO: check
+CVE-2026-12392 (An information exposure vulnerability in Canonical MAAS prior
to versi ...)
+ TODO: check
+CVE-2026-11601 (The WPCafe \u2013 Restaurant Menu, Online Food Ordering &
Table Bookin ...)
+ TODO: check
+CVE-2026-11399 (The Helpdesk Support Ticket System for WooCommerce plugin for
WordPres ...)
+ TODO: check
+CVE-2026-105090 (Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS.
The surv ...)
+ TODO: check
+CVE-2026-105083 (ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy
bypass vul ...)
+ TODO: check
+CVE-2026-105080 (In ConvertX before 0.19.0, converters/calibre.ts does not
block recipe ...)
+ TODO: check
+CVE-2026-105051 (Denuvo Anti-Tamper through 2026-03-04 allows bypass of a
hypervisor pr ...)
+ TODO: check
+CVE-2026-105050 (PeaZip before 11.3.0, in a non-default configuration, is
vulnerable to ...)
+ TODO: check
+CVE-2026-105049 (Zilliz Attu before 3.0.0 has a Playground feature that does
not requir ...)
+ TODO: check
+CVE-2026-105048 (The Playground feature of Zilliz Attu before 3.0.0 allows
SSRF (proxyi ...)
+ TODO: check
+CVE-2026-105046 (Kentico Xperience 13 before 13.0.216 lacks object-level
authorization ...)
+ TODO: check
+CVE-2026-105043 (MathWorks Simulink before R2026b, when showing a crafted .slx
file, ca ...)
+ TODO: check
+CVE-2026-105030 (Kener 4.0.0 before 4.1.6 contains an information disclosure
vulnerabil ...)
+ TODO: check
+CVE-2026-105029 (UVdesk support-center-bundle before 1.1.3.3 contains an
insecure direc ...)
+ TODO: check
+CVE-2026-104994 (Trivy before 0.71.0 allows directory traversal in Terraform
filesystem ...)
+ TODO: check
+CVE-2026-104991 (Phproject before 1.8.7 contains a missing object-level
authorization v ...)
+ TODO: check
+CVE-2026-104988 (A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST
authentic ...)
+ TODO: check
+CVE-2026-104887
+ REJECTED
+CVE-2026-104886
+ REJECTED
+CVE-2026-104874 (Multidict is an implementation of a multidict data structure.
From 6.7 ...)
+ TODO: check
+CVE-2026-104873 (LangGraph Python SDK is used to connect to running LangGraph
API serve ...)
+ TODO: check
+CVE-2026-104872 (OpenTelemetry JavaScript Contrib provides instrumentation
libraries fo ...)
+ TODO: check
+CVE-2026-104871 (The Angular SSR is a server-rise rendering tool for Angular
applicatio ...)
+ TODO: check
+CVE-2026-104479 (Shopclass before 6.2.0 contains a stored cross-site scripting
vulnerab ...)
+ TODO: check
+CVE-2026-104478 (Formwork before 2.3.13 contains a path traversal
vulnerability in Back ...)
+ TODO: check
+CVE-2026-104477 (Showdown through 2.1.0 contains a cross-site scripting
vulnerability i ...)
+ TODO: check
+CVE-2026-104476 (Backdrop CMS before 1.35.1 contains an information disclosure
vulnerab ...)
+ TODO: check
+CVE-2026-104475 (IDURAR ERP CRM through 4.1.1 contains a stored cross-site
scripting vu ...)
+ TODO: check
+CVE-2026-104474 (OpenLiteSpeed before 1.9.3 contains a local privilege
escalation vulne ...)
+ TODO: check
+CVE-2026-104433 (Mooncake transfer engine before 0.3.12 contains an
out-of-bounds read ...)
+ TODO: check
+CVE-2026-104313 (The WPC Estimated Delivery Date for WooCommerce plugin for
WordPress i ...)
+ TODO: check
+CVE-2026-104055 (The postgresql-operator charm runs a Prometheus
postgres_exporter to c ...)
+ TODO: check
+CVE-2026-104019 (OS command injection in the Studio Space startup validation
script in ...)
+ TODO: check
+CVE-2026-103918 (oRPC is a tool that helps build APIs that are end-to-end
type-safe and ...)
+ TODO: check
+CVE-2026-103913 (The GeoDirectory plugin for WordPress is vulnerable to SQL
Injection v ...)
+ TODO: check
+CVE-2026-103909 (The Calculated Fields Form \u2013 AI Form Builder for
WordPress \u2013 ...)
+ TODO: check
+CVE-2026-103888 (The WPC Smart Quick View for WooCommerce plugin for WordPress
is vulne ...)
+ TODO: check
+CVE-2026-103519 (The The WP Ultimate Review plugin for WordPress is vulnerable
to arbit ...)
+ TODO: check
+CVE-2026-103514 (The WP 2FA WordPress plugin before 4.1.0 does not invalidate
a time-b ...)
+ TODO: check
+CVE-2026-103421 (The WPMobile.App \u2013 Android and iOS App Builder plugin
for WordPre ...)
+ TODO: check
+CVE-2026-103293 (The MPG WordPress plugin before 4.2.3 does not validate that
the data ...)
+ TODO: check
+CVE-2026-103036 (oRPC is a tool that helps build APIs that are end-to-end
type-safe and ...)
+ TODO: check
+CVE-2026-101928 (The Magic Tooltips For Contact Form 7 plugin for WordPress is
vulnerab ...)
+ TODO: check
+CVE-2026-101923 (The Photo Reviews for WooCommerce plugin for WordPress is
vulnerable t ...)
+ TODO: check
+CVE-2026-101357 (The SEOPress \u2013 AI SEO Plugin & On-site SEO plugin for
WordPress i ...)
+ TODO: check
+CVE-2026-101162 (The WP Ultimate Review WordPress plugin before 2.4.4 does not
escape s ...)
+ TODO: check
+CVE-2026-101161 (The WP Ultimate Review WordPress plugin before 2.4.4 does not
prevent ...)
+ TODO: check
+CVE-2026-101160 (The WP Ultimate Review WordPress plugin before 2.4.4 does not
validate ...)
+ TODO: check
+CVE-2026-101159 (The WP Ultimate Review WordPress plugin before 2.4.4 does not
properly ...)
+ TODO: check
+CVE-2026-100180 (The Jeg Kit for Elementor \u2013 Powerful Addons for
Elementor, Widget ...)
+ TODO: check
+CVE-2026-100157 (The The WP Ultimate Review plugin for WordPress is vulnerable
to arbit ...)
+ TODO: check
+CVE-2026-100152 (The The All in One SEO \u2013 AI SEO Plugin to Boost SEO
Rankings & Tr ...)
+ TODO: check
+CVE-2026-100149 (The WPZOOM Connect: AI Chat, Click to Chat, Social Icons &
Share Butto ...)
+ TODO: check
+CVE-2026-100148 (The Rich Showcase for Google Reviews plugin for WordPress is
vulnerabl ...)
+ TODO: check
+CVE-2025-12828 (The Ultra Addons Lite for Elementor plugin for WordPress is
vulnerable ...)
+ TODO: check
CVE-2026-97663 (The Customer Reviews for WooCommerce plugin for WordPress is
vulnerabl ...)
NOT-FOR-US: WordPress plugin
CVE-2026-97652 (The WP Statistics \u2013 Simple, privacy-friendly Google
Analytics alt ...)
@@ -12272,7 +12516,7 @@ CVE-2026-93205 (In the Linux kernel, the following
vulnerability has been resolv
{DSA-6528-1}
- linux 7.2.6-1
NOTE:
https://git.kernel.org/linus/2bd22a0d40503a65d243b011de146603c8ce1cbc (7.3-rc1)
-CVE-2026-97876 [grub serial-mmio secure boot bypass]
+CVE-2026-97876 (A local attacker with control over GRUB's configuration can
bypass loc ...)
- grub2 2.14-4 (bug #1148741)
NOTE: https://www.openwall.com/lists/oss-security/2026/09/13/5
NOTE: Fixed by:
https://gitlab.freedesktop.org/gnu-grub/grub/-/commit/26beaa3b2720fefdc4d04c1ae209b776fe6848d6
(grub-2.16)
@@ -43724,6 +43968,7 @@ CVE-2026-83744 (A security vulnerability has been
detected in invoiceninja Invoi
CVE-2026-83743 (A weakness has been identified in invoiceninja Invoice Ninja
up to 5.1 ...)
NOT-FOR-US: invoiceninja Invoice Ninja
CVE-2026-83596 (A flaw was found in WebKitGTK. Processing malicious web
content can ca ...)
+ {DSA-6534-1}
- webkit2gtk 2.54.0-1
[trixie] - webkit2gtk <postponed> (Fix along with future DSA)
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
@@ -52532,6 +52777,7 @@ CVE-2026-78380 (RansomLook fails to enforce the privacy
status of ransomware gro
CVE-2026-78378 (Ransomlook contains a Redis glob pattern injection
vulnerability cause ...)
NOT-FOR-US: RansomLook
CVE-2026-78376 (A flaw was found in WebKitGTK. Processing malicious web
content can ca ...)
+ {DSA-6534-1}
- webkit2gtk 2.54.0-1
[trixie] - webkit2gtk <postponed> (Fix along with future DSA)
[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c6fbf3eed7c4863e4e714ad107851d4ceebbe7f7
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c6fbf3eed7c4863e4e714ad107851d4ceebbe7f7
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
