Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b6d86b96 by security tracker role at 2026-10-05T07:13:45+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,175 @@
+CVE-2026-84169 (The UPI QR Code Payment Gateway WordPress plugin through 1.4.3
does no ...)
+ TODO: check
+CVE-2026-78371 (The File Uploads Addon for WooCommerce WordPress plugin before
1.7.6 d ...)
+ TODO: check
+CVE-2026-20589 (In venc, there is a possible out of bounds write due to type
confusion ...)
+ TODO: check
+CVE-2026-20588 (In mtee, there is a possible escalation of privilege due to a
missing ...)
+ TODO: check
+CVE-2026-20587 (In mtee, there is a possible escalation of privilege due to
type confu ...)
+ TODO: check
+CVE-2026-20586 (In vdec, there is a possible out of bounds write due to a
missing boun ...)
+ TODO: check
+CVE-2026-20579 (In vdec, there is a possible out of bounds write due to type
confusion ...)
+ TODO: check
+CVE-2026-20544 (In meta, there is a possible out of bounds write due to a
missing boun ...)
+ TODO: check
+CVE-2026-20543 (In Modem, there is a possible information disclosure due to a
logic er ...)
+ TODO: check
+CVE-2026-20542 (In apusys, there is a possible memory corruption due to use
after free ...)
+ TODO: check
+CVE-2026-20541 (In Modem, there is a possible out of bounds read due to a
missing perm ...)
+ TODO: check
+CVE-2026-20540 (In Modem, there is a possible out of bounds read due to a
missing boun ...)
+ TODO: check
+CVE-2026-20539 (In Modem, there is a possible out of bounds read due to a
missing boun ...)
+ TODO: check
+CVE-2026-20538 (In Modem, there is a possible out of bounds read due to a
missing perm ...)
+ TODO: check
+CVE-2026-20537 (In aidl, there is a possible memory corruption due to use
after free. ...)
+ TODO: check
+CVE-2026-20536 (In aidl, there is a possible memory corruption due to use
after free. ...)
+ TODO: check
+CVE-2026-20535 (In aidl, there is a possible escalation of privilege due to a
missing ...)
+ TODO: check
+CVE-2026-20534 (In Modem, there is a possible out of bounds read due to an
incorrect b ...)
+ TODO: check
+CVE-2026-20533 (In display, there is a possible escalation of privilege due to
an inte ...)
+ TODO: check
+CVE-2026-20532 (In apu, there is a possible application crash due to double
free. This ...)
+ TODO: check
+CVE-2026-20531 (In apu, there is a possible memory corruption due to use after
free. T ...)
+ TODO: check
+CVE-2026-20530 (In display, there is a possible out of bounds write due to a
missing b ...)
+ TODO: check
+CVE-2026-20529 (In battery, there is a possible out of bounds write due to a
missing b ...)
+ TODO: check
+CVE-2026-20528 (In ccci, there is a possible out of bounds write and read due
to a mis ...)
+ TODO: check
+CVE-2026-20527 (In Modem, there is a possible system crash due to a missing
bounds che ...)
+ TODO: check
+CVE-2026-20526 (In Modem, there is a possible out of bounds write due to a
missing bou ...)
+ TODO: check
+CVE-2026-20525 (In Modem, there is a possible system crash due to improper
input valid ...)
+ TODO: check
+CVE-2026-20524 (In apu, there is a possible memory corruption due to improper
input va ...)
+ TODO: check
+CVE-2026-20523 (In neuropilot, there is a possible out of bounds write due to
a missin ...)
+ TODO: check
+CVE-2026-20522 (In neuropilot, there is a possible out of bounds write due to
a missin ...)
+ TODO: check
+CVE-2026-20521 (In Video HAL, there is a possible escalation of privilege due
to a mis ...)
+ TODO: check
+CVE-2026-20520 (In Modem, there is a possible out of bounds write due to a
missing bou ...)
+ TODO: check
+CVE-2026-20519 (In Modem, there is a possible out of bounds write due to a
missing bou ...)
+ TODO: check
+CVE-2026-19954 (Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois
command ...)
+ TODO: check
+CVE-2026-13607 (The File Uploads Addon for WooCommerce WordPress plugin
through 1.7.6 ...)
+ TODO: check
+CVE-2026-105306 (A flaw was found in the Dynamic Client Registration flow of
the Keyclo ...)
+ TODO: check
+CVE-2026-105302 (A flaw was found in the User Session Note mapper of the
Keycloak ident ...)
+ TODO: check
+CVE-2026-105301 (A flaw was found in the X.509 client-certificate
authenticator of Keyc ...)
+ TODO: check
+CVE-2026-105295 (GitAhead 2.5.0 through 2.7.1 contains an insecure update
mechanism tha ...)
+ TODO: check
+CVE-2026-105294 (Legcord 1.1.0 through 1.3.0 contains a configuration
injection vulnera ...)
+ TODO: check
+CVE-2026-105293 (Legcord 1.1.0 through 1.3.0 contains a path traversal
vulnerability in ...)
+ TODO: check
+CVE-2026-105292 (Chaterm before 0.12.1 contains a login cross-site request
forgery vuln ...)
+ TODO: check
+CVE-2026-105246 (A vulnerability was found in SourceCodester Online Reviewer
Management ...)
+ TODO: check
+CVE-2026-105245 (A vulnerability has been found in sgl-project sglang up to
0.5.21. Thi ...)
+ TODO: check
+CVE-2026-105238 (A flaw has been found in ChatGPTNextWeb NextChat up to
2.16.1. This vu ...)
+ TODO: check
+CVE-2026-105237 (A vulnerability was detected in linlinjava litemall up to
1.8.0. This ...)
+ TODO: check
+CVE-2026-105233 (A vulnerability has been found in kishor-23
food-waste-management-syst ...)
+ TODO: check
+CVE-2026-105232 (A flaw has been found in kishor-23
food-waste-management-system 411989 ...)
+ TODO: check
+CVE-2026-105231 (A vulnerability was detected in kishor-23
food-waste-management-system ...)
+ TODO: check
+CVE-2026-105230 (A security vulnerability has been detected in kishor-23
food-waste-man ...)
+ TODO: check
+CVE-2026-105229 (A weakness has been identified in kishor-23
food-waste-management-syst ...)
+ TODO: check
+CVE-2026-105226 (A security flaw has been discovered in osCommerce osCommerce2
up to 2. ...)
+ TODO: check
+CVE-2026-105225 (A vulnerability was identified in osCommerce osCommerce2 up
to 2.3.4.1 ...)
+ TODO: check
+CVE-2026-105223 (maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS
certificate ...)
+ TODO: check
+CVE-2026-105222 (The alexpechkarev/google-maps Laravel package through 12.16
disables T ...)
+ TODO: check
+CVE-2026-105221 (The gist RubyGem before 6.1.0 contains an improper
certificate validat ...)
+ TODO: check
+CVE-2026-105220 (Twine 2 desktop through 2.12.0 contains a cross-site
scripting vulnera ...)
+ TODO: check
+CVE-2026-105188 (A vulnerability was found in code-projects Human Resource
Management S ...)
+ TODO: check
+CVE-2026-105187 (A vulnerability has been found in itsourcecode Online
Admission System ...)
+ TODO: check
+CVE-2026-105186 (A flaw has been found in itsourcecode Online Admission System
1.0. Thi ...)
+ TODO: check
+CVE-2026-105185 (A vulnerability was detected in itsourcecode Online Admission
System 1 ...)
+ TODO: check
+CVE-2026-105184 (A security vulnerability has been detected in itsourcecode
Online Admi ...)
+ TODO: check
+CVE-2026-105183 (A weakness has been identified in itsourcecode Online
Admission System ...)
+ TODO: check
+CVE-2026-105182 (A security flaw has been discovered in SourceCodester Online
Reviewer ...)
+ TODO: check
+CVE-2026-105181 (A vulnerability was identified in itsourcecode Online
Admission System ...)
+ TODO: check
+CVE-2026-105180 (A vulnerability was determined in Jeebase 0.0.1. This
vulnerability af ...)
+ TODO: check
+CVE-2026-105179 (A weakness has been identified in SourceCodester Drug
Recommendation S ...)
+ TODO: check
+CVE-2026-105178 (A security flaw has been discovered in SourceCodester Drug
Recommendat ...)
+ TODO: check
+CVE-2026-105177 (A vulnerability was identified in SourceCodester Drug
Recommendation S ...)
+ TODO: check
+CVE-2026-105176 (A vulnerability was determined in SourceCodester Drug
Recommendation S ...)
+ TODO: check
+CVE-2026-105175 (A vulnerability was found in SourceCodester Drug
Recommendation System ...)
+ TODO: check
+CVE-2026-105174 (A vulnerability has been found in Gerapy up to 0.9.13. This
vulnerabil ...)
+ TODO: check
+CVE-2026-105173 (A flaw has been found in code-projects Human Resource
Management 1.0. ...)
+ TODO: check
+CVE-2026-105172 (A vulnerability was detected in itsourcecode Online Admission
System 1 ...)
+ TODO: check
+CVE-2026-105171 (A security vulnerability has been detected in kishor-23
food-waste-man ...)
+ TODO: check
+CVE-2026-105170 (A weakness has been identified in kishor-23
food-waste-management-syst ...)
+ TODO: check
+CVE-2026-105169 (A security flaw has been discovered in kishor-23
food-waste-management ...)
+ TODO: check
+CVE-2026-105168 (A vulnerability was identified in kishor-23
food-waste-management-syst ...)
+ TODO: check
+CVE-2026-105167 (A vulnerability was determined in kishor-23
food-waste-management-syst ...)
+ TODO: check
+CVE-2026-105166 (A vulnerability was found in kishor-23
food-waste-management-system 41 ...)
+ TODO: check
+CVE-2026-105165 (A vulnerability has been found in devopspolis
secrets-replicator up to ...)
+ TODO: check
+CVE-2026-105164 (A flaw has been found in NASA cFS up to 7.0.1. This issue
affects the ...)
+ TODO: check
+CVE-2026-105163 (A vulnerability was detected in crossplane crossplane-runtime
up to 2. ...)
+ TODO: check
+CVE-2026-100727 (An improper access control vulnerability exists in GROWI,
which allow ...)
+ TODO: check
+CVE-2019-25777 (YAML versions before 1.27_001 for Perl allow a loaded
perl/glob docume ...)
+ TODO: check
+CVE-2017-20285 (YAML versions before 1.30 for Perl allow a loaded document to
trigger ...)
+ TODO: check
CVE-2026-97307 (Insertion of Sensitive Information Into Sent Data
vulnerability in Sty ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97276 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -107999,61 +108171,61 @@ CVE-2026-17545 (On Windows, PHP's filesystem and
stream APIs do not reject reser
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-91766 (When the http:// stream wrapper follows a redirect it forwards
the use ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-92842 (The convert.base64-encode, convert.quoted-printable-encode and
convert ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-93682 (When the HTTP stream wrapper follows a redirect and the
response carri ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2025-14181 (The SOAP HTTP client guards its response buffer growth with a
check th ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-91765 (cleanup_xml_node() in the SOAP XML parser recurses once per
XML nestin ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-6103 (phar_tar_number() parses the octal size field of a TAR header
into a u ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-91767 (php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c
underflows ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-91769 (PHP's OpenSSL stream peer verification checks the
certificate's subjec ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2025-1218 (The mysqlnd wire protocol parser reads fields out of server
packets be ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7
NOTE: https://github.com/php/php-src/blob/php-8.4.26/NEWS
CVE-2026-91768 (The IPv6 branch of the FastCGI client access check compares
only the f ...)
- {DSA-6514-1}
+ {DSA-6514-1 DLA-4819-1}
- php8.4 8.4.26-1
- php8.2 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637
@@ -127542,82 +127714,82 @@ CVE-2026-45447 (Issue summary: A specially crafted
PKCS#7 or S/MIME signed messa
NOTE: Fixed by:
https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54
(openssl-3.0.21)
NOTE: Fixed by:
https://github.com/openssl/openssl/commit/18de9aba8294b5fb0915866cf3a1bb45f9599b8d
(openssl-3.0.21)
CVE-2026-62434 (A guest started with Populated on Demand enabled (PoD) can
attempt to ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-507.html
CVE-2026-62433 (Parts of the DM_OP handling code assumes the caller has
provided the r ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-506.html
CVE-2026-62432 (The EVTCHNOP_expand_array hypercall checks for whether FIFO
event chan ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-505.html
CVE-2026-62431 (The logic to handle periodic Viridian STIMERs performs a
division with ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-504.html
CVE-2026-62430 (Accesses to the CMOS memory contents are done using an
indirect IO por ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-503.html
CVE-2026-62429 (Accessing the vNUMA configuration data of a guest is still
possible wh ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-502.html
CVE-2026-62435 ([This CNA information record relates to multiple CVEs; the
text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-501.html
CVE-2026-62436 ([This CNA information record relates to multiple CVEs; the
text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-501.html
CVE-2026-62428 (When grant-copy operations are processed, the respective grant
may or ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-500.html
CVE-2026-62426 ([This CNA information record relates to multiple CVEs; the
text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-499.html
CVE-2026-62427 ([This CNA information record relates to multiple CVEs; the
text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-499.html
CVE-2026-42494 ([This CNA information record relates to multiple CVEs; the
text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-497.html
CVE-2026-42495 ([This CNA information record relates to multiple CVEs; the
text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-497.html
CVE-2026-62423 ([This CNA information record relates to multiple CVEs; the
text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-497.html
CVE-2026-62424 ([This CNA information record relates to multiple CVEs; the
text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-497.html
CVE-2026-62425 ([This CNA information record relates to multiple CVEs; the
text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-497.html
@@ -127625,17 +127797,17 @@ CVE-2026-42492 (Xenstore, to have an up-to-date
picture of the entire system, wa
- xen <not-affected> (Vulnerable code introduced later)
NOTE: https://xenbits.xen.org/xsa/advisory-496.html
CVE-2026-42493 (Addressing certain issues, in particular related to operations
which m ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-495.html
CVE-2026-42488 (Some shadow paging errors paths will switch the page-tables
without up ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-494.html
CVE-2025-10263 (Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2,
Neoverse V1 ...)
- {DSA-6424-1 DLA-4671-1 DLA-4665-1 DLA-4664-1}
+ {DSA-6424-1 DLA-4818-1 DLA-4671-1 DLA-4665-1 DLA-4664-1}
- linux 7.0.13-1
[trixie] - linux 6.12.94-1
- xen 4.20.3+127-gc42374a105-1
@@ -127643,17 +127815,17 @@ CVE-2025-10263 (Arm C1-Ultra, C1-Premium, Neoverse
V3 & V3AE, Neoverse V2, Neove
NOTE: https://xenbits.xen.org/xsa/advisory-493.html
NOTE: Mitigations in src:linux:
https://lore.kernel.org/all/[email protected]/
CVE-2026-42490 ([This CNA information record relates to multiple CVEs; the
text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-492.html
CVE-2026-42489 ([This CNA information record relates to multiple CVEs; the
text explai ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-492.html
CVE-2026-42487 (HVM guest I/O port accesses are subject to either emulation or
at leas ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (out of LTS support)
NOTE: https://xenbits.xen.org/xsa/advisory-491.html
@@ -148002,7 +148174,7 @@ CVE-2025-12659 (Siemens Simcenter Femapcontains a
memory corruption vulnerabilit
CVE-2024-54017 (A vulnerability has been identified in SIPROTEC 5 6MD84
(CP300) (All v ...)
NOT-FOR-US: Siemens
CVE-2025-54518 (Improper isolation of shared resources within the CPU
operation cache ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
NOTE: https://xenbits.xen.org/xsa/advisory-490.html
@@ -158065,12 +158237,12 @@ CVE-2026-6691 (The MongoDB C Driver's Cyrus SASL
integration performs unsafe str
NOTE:
https://github.com/mongodb/mongo-c-driver/commit/b4984965877d559862e225beba09cb4e9d4a56a6
(2.2.0)
NOTE:
https://github.com/mongodb/mongo-c-driver/commit/d9c26f49e75d3de746a690db9c81ff5b4f6e21b0
(2.2.0)
CVE-2026-23556 (When oxenstored is tearing a domain down, the node data is
cleaned up ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
NOTE: https://xenbits.xen.org/xsa/advisory-483.html
CVE-2026-23557 (Any guest can cause xenstored to crash by issuing a
XS_RESET_WATCHES c ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1 (unimportant)
NOTE: https://xenbits.xen.org/xsa/advisory-484.html
NOTE: Debian uses the ocaml-based xenstored
@@ -158079,7 +158251,7 @@ CVE-2026-31786 (In the Linux kernel, the following
vulnerability has been resolv
- linux 7.0.3-1
NOTE: https://xenbits.xen.org/xsa/advisory-485.html
CVE-2026-23558 (The adjustments made for XSA-379 as well as those subsequently
becomin ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
NOTE: https://xenbits.xen.org/xsa/advisory-486.html
@@ -163795,7 +163967,7 @@ CVE-2026-1838 (The Hostel plugin for WordPress is
vulnerable to Reflected Cross-
CVE-2026-1559 (The Youzify plugin for WordPress is vulnerable to Stored
Cross-Site Sc ...)
NOT-FOR-US: WordPress plugin
CVE-2025-54505 (A transient execution vulnerability within AMD CPUs may allow
a local ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <end-of-life> (not supported under bullseye)
NOTE: AMD CPU HW issue:
@@ -173313,7 +173485,7 @@ CVE-2026-4819 (In Search Guard FLX versions from
1.0.0 up to 4.0.1, the audit lo
CVE-2026-4818 (In Search Guard FLX versions from 3.0.0 up to 4.0.1, there
exists an i ...)
NOT-FOR-US: Search Guard FLX
CVE-2026-4800 (Impact: The fix for CVE-2021-23337
(https://github.com/advisories/GHS ...)
- {DLA-4663-1}
+ {DLA-4820-1 DLA-4663-1}
- node-lodash 4.18.1+dfsg-1 (bug #1132500)
[trixie] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
NOTE: Fixed by:
https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6
(4.18.0)
@@ -173720,7 +173892,7 @@ CVE-2026-30277 (An arbitrary file overwrite
vulnerability in PDF Reader App : TA
CVE-2026-30276 (An arbitrary file overwrite vulnerability in DeftPDF Document
Translat ...)
NOT-FOR-US: DeftPDF
CVE-2026-2950 (Impact: Lodash versions 4.17.23 and earlier are vulnerable to
prototy ...)
- {DLA-4663-1}
+ {DLA-4820-1 DLA-4663-1}
- node-lodash 4.18.1+dfsg-1
[trixie] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
NOTE:
https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
@@ -205732,7 +205904,7 @@ CVE-2025-13878 (Malformed BRID/HHIT records can cause
`named` to terminate unexp
NOTE: Fixed by:
https://gitlab.isc.org/isc-projects/bind9/-/commit/d4c0d617015625330f08a3f86a10a533cec0f6ec
(v9.20.18)
NOTE: Fixed by:
https://gitlab.isc.org/isc-projects/bind9/-/commit/7bf83f69a80bdc6094c2adee3595e28b1b3e19ea
(v9.21.17)
CVE-2025-13465 (Lodash versions 4.0.0 through 4.17.22 are vulnerable to
prototype poll ...)
- {DLA-4663-1}
+ {DLA-4820-1 DLA-4663-1}
- node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-10 (bug #1126265)
[trixie] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
NOTE:
https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
@@ -278357,11 +278529,12 @@ CVE-2026-23555 (Any guest issuing a Xenstore
command accessing a node using the
NOTE: https://xenbits.xen.org/xsa/advisory-481.html
NOTE: Debian uses the ocaml-based xenstored
CVE-2026-23554 (The Intel EPT paging code uses an optimization to defer
flushing of an ...)
- {DSA-6424-1}
+ {DSA-6424-1 DLA-4818-1}
- xen 4.20.3+127-gc42374a105-1
[bullseye] - xen <not-affected> (Vulnerable code not present)
NOTE: https://xenbits.xen.org/xsa/advisory-480.html
CVE-2026-23553 (In the context switch logic Xen attempts to skip an IBPB in
the case o ...)
+ {DLA-4818-1}
- xen 4.20.2+37-g61ff35323e-1
[trixie] - xen 4.20.2+37-g61ff35323e-0+deb13u1
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
@@ -278370,6 +278543,7 @@ CVE-2025-58151 (varstored is a component of the Xapi
toolstack handling UEFI Var
- xen-api <removed>
NOTE: https://xenbits.xen.org/xsa/advisory-478.html
CVE-2025-58150 (Shadow mode tracing code uses a set of per-CPU variables to
avoid cumb ...)
+ {DLA-4818-1}
- xen 4.20.2+37-g61ff35323e-1
[trixie] - xen 4.20.2+37-g61ff35323e-0+deb13u1
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6d86b96583f9421659c423dc7475367500adaa4
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6d86b96583f9421659c423dc7475367500adaa4
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
