Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
edd1fab6 by security tracker role at 2026-10-05T19:13:48+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,23 +1,475 @@
+CVE-2026-97309 (Missing Authorization vulnerability in Webful Creations
RepairBuddy co ...)
+ TODO: check
+CVE-2026-97305 (Authorization Bypass Through User-Controlled Key vulnerability
in Them ...)
+ TODO: check
+CVE-2026-97304 (Missing Authorization vulnerability in Arraytics Timetics
timetics all ...)
+ TODO: check
+CVE-2026-97303 (Missing Authorization vulnerability in Apps Mav Scratch & Win
\u2013 G ...)
+ TODO: check
+CVE-2026-97283 (Deserialization of Untrusted Data vulnerability in Liquid Web
/ Stella ...)
+ TODO: check
+CVE-2026-97275 (Improper Validation of Specified Quantity in Input
vulnerability in Vi ...)
+ TODO: check
+CVE-2026-97071 (Incorrect Calculation vulnerability in VillaTheme CURCY
woo-multi-curr ...)
+ TODO: check
+CVE-2026-97070 (Authorization Bypass Through User-Controlled Key vulnerability
in Cozy ...)
+ TODO: check
+CVE-2026-95166 (In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the
LabelFormat fi ...)
+ TODO: check
+CVE-2026-95165 (Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting
(XSS) in ...)
+ TODO: check
+CVE-2026-94669 (Missing Authorization vulnerability in WP ManageNinja LLC
Fluent Forms ...)
+ TODO: check
+CVE-2026-93323 (The Dockerfile frontend loaded the Dockerfile and
.dockerignore files ...)
+ TODO: check
+CVE-2026-93322 (A malicious frontend can submit an LLB definition that causes
buildkit ...)
+ TODO: check
+CVE-2026-93320 (BuildKit may be tricked into performing file actions with
special file ...)
+ TODO: check
+CVE-2026-93319 (A malicious external BuildKit frontend can send requests using
the int ...)
+ TODO: check
+CVE-2026-93318 (A malicious image can advertise DiffIDs from another image
while conta ...)
+ TODO: check
+CVE-2026-93317 (An unauthenticated attacker controlling a registry or
OCI-layout blob ...)
+ TODO: check
+CVE-2026-93316 (If BuildKit daemon is started with --cdi-disabled it can lead
to daemo ...)
+ TODO: check
+CVE-2026-92931 (CWE-918: Server-Side Request Forgery in the Progress
@progress/sitefin ...)
+ TODO: check
+CVE-2026-89039 (The convert_playwright_script prompt in the k6 MCP server
accepts a fi ...)
+ TODO: check
+CVE-2026-88424 (FineAdmin v1.0 was discovered to contain a SQL injection
vulnerability ...)
+ TODO: check
+CVE-2026-88397 (ApiAdmin v.5.0 and before is vulnerable to SQL Injection in
the user-l ...)
+ TODO: check
+CVE-2026-88396 (ApiAdmin v5.0 and before is vulnerable to Directory Traversal.
The adm ...)
+ TODO: check
+CVE-2026-88395 (GouGuOA v6.0.5 and before is vulnerable to SQL Injection in
/home/mess ...)
+ TODO: check
+CVE-2026-88394 (WookTeam v1.6.6 and before is vulnerable to a Directory
Traversal. The ...)
+ TODO: check
+CVE-2026-88393 (WookTeam v1.6.6 and before is vulnerable to RCE in the project
task ex ...)
+ TODO: check
+CVE-2026-88392 (Unimall v4 is vulnerable to Directory Traversal in
FileUploadControlle ...)
+ TODO: check
+CVE-2026-88391 (Northstar (dromara/northstar, quantitative trading platform)
<= 9.1.1 ...)
+ TODO: check
+CVE-2026-86671 (In Eclipse Che versions 7.29.0 and later, the GET
`/api/scm/resolve` a ...)
+ TODO: check
+CVE-2026-79820 (A remote user validation failure vulnerability exists in HPE
Integrate ...)
+ TODO: check
+CVE-2026-78413 (Velociraptor allows collection of VQL queries packaged into
Artifacts ...)
+ TODO: check
+CVE-2026-78412 (Velociraptor's WatchEvent gRPC API can specify the OrgId of
the org fr ...)
+ TODO: check
+CVE-2026-78411 (Velociraptor's SetClientMetadata used the wrong permission
check to en ...)
+ TODO: check
+CVE-2026-77805 (In Progress\xae Telerik\xae Fiddler\xae Classic for Windows,
versions ...)
+ TODO: check
+CVE-2026-77804 (In Progress\xae Telerik\xae Fiddler\xae Classic for Windows,
versions ...)
+ TODO: check
+CVE-2026-77803 (In Progress\xae Telerik\xae Fiddler\xae Classic for Windows,
versions ...)
+ TODO: check
+CVE-2026-77802 (In Progress\xae Telerik\xae Fiddler\xae Classic for Windows,
versions ...)
+ TODO: check
+CVE-2026-59788 (The email media type OAuth form passes the Authorization
endpoint valu ...)
+ TODO: check
+CVE-2026-59787 (The Perl SNMP trap receiver script shipped with Zabbix does
not proper ...)
+ TODO: check
+CVE-2026-59786 (Zabbix Server and Proxy accept the active agent heartbeat
message rega ...)
+ TODO: check
+CVE-2026-59785 (Host search in Frontend allows filtering by fields that are
not displa ...)
+ TODO: check
+CVE-2026-59783 (The Zabbix Server/Proxy has a vulnerability where binary items
can cra ...)
+ TODO: check
+CVE-2026-59782 (The JavaScript preprocessing (Duktape) engine on Zabbix server
has a v ...)
+ TODO: check
+CVE-2026-58880 (In handle_app_val_response of btif_rc.cc, there is a possible
way to a ...)
+ TODO: check
+CVE-2026-58865 (In multiple functions of PduParser.java, there is a possible
persisten ...)
+ TODO: check
+CVE-2026-58859 (In multiple places, there is a possible denial of service due
to an u ...)
+ TODO: check
+CVE-2026-58856 (In returnOutputBufferLocked of
DeprecatedCamera3StreamSplitter.cpp, th ...)
+ TODO: check
+CVE-2026-58854 (In multiple locations, there is a possible memory corruption
due to ty ...)
+ TODO: check
+CVE-2026-58841 (In multiple functions of VirtualAudioControllerTest.java,
there is a p ...)
+ TODO: check
+CVE-2026-58835 (In cfg2prop of btif_storage.cc, there is a possible
out-of-bounds writ ...)
+ TODO: check
+CVE-2026-58834 (In setPermissionGrantState of DevicePolicyManagerService.java,
there i ...)
+ TODO: check
+CVE-2026-58815 (In multiple locations, there is a possible out of bounds write
due to ...)
+ TODO: check
+CVE-2026-55286 (In stpropnci_process of stpropnci.cc, there is a possible out
of bound ...)
+ TODO: check
+CVE-2026-55280 (In multiple locations, there is a possible out-of-bounds write
due to ...)
+ TODO: check
+CVE-2026-55270 (In dialInternal in multiple locations, there is a possible
permission ...)
+ TODO: check
+CVE-2026-55269 (In FilterCapturedPacket of snoop_logger.cc, there is a
possible memory ...)
+ TODO: check
+CVE-2026-55266 (In qsort of libufdt_sysdeps_vendor.c, there is a possible
out-of-bound ...)
+ TODO: check
+CVE-2026-55265 (In multiple functions of PduParser.java, there is a possible
out of bo ...)
+ TODO: check
+CVE-2026-49937 (In multiple functions of MessageQueueBase.h, there is a
possible out o ...)
+ TODO: check
+CVE-2026-49933 (In handle_le_monitor_device_event of msft.cc, there is a
possible cont ...)
+ TODO: check
+CVE-2026-49885 (In rw_t4t_update_file of rw_t4t.cc, there is a possible
out-of-bounds ...)
+ TODO: check
+CVE-2026-49880 (In multiple functions of nfa_nfcee_act.cc, there is a possible
out-of- ...)
+ TODO: check
+CVE-2026-49878 (In wpas_handle_robust_av_scs_recv_action of robust_av.c, there
is a po ...)
+ TODO: check
+CVE-2026-45524 (In isSystem of WifiPermissionsUtil.java, there is a possible
sandbox e ...)
+ TODO: check
+CVE-2026-42700 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-39783 (Missing Authorization vulnerability in WP SYNTEX Polylang
polylang all ...)
+ TODO: check
+CVE-2026-39763 (Missing Authorization vulnerability in Deepak Anand WP Dummy
Content G ...)
+ TODO: check
+CVE-2026-39721 (Missing Authorization vulnerability in Brainstorm Force
Starter Templa ...)
+ TODO: check
+CVE-2026-37719 (An issue in dormakaba evolo Service (all versions) allows a
remote att ...)
+ TODO: check
+CVE-2026-28667 (In multiple functions of rw_t5t.cc, there is a possible
out-of-bounds ...)
+ TODO: check
+CVE-2026-28648 (In Settings, there is a possible permission bypass due to a
confused d ...)
+ TODO: check
+CVE-2026-28647 (In updateState of DeviceAdminAppsPreferenceController.java,
there is a ...)
+ TODO: check
+CVE-2026-28641 (In shouldDisableUninstallButton of
ApplicationActionButtonsPreferenceC ...)
+ TODO: check
+CVE-2026-28640 (In checkCallerIsCertInstallerOrSelfInProfile of
CredentialStorageActiv ...)
+ TODO: check
+CVE-2026-28625 (In multiple locations, there is a possible permission bypass
due to a ...)
+ TODO: check
+CVE-2026-19185 (The system-call verifier for i3c_do_ccc() in
drivers/i3c/i3c_handlers. ...)
+ TODO: check
+CVE-2026-19184 (The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c)
validated the ...)
+ TODO: check
+CVE-2026-12171 (auto-changelog before 2.6.1 merges configuration from inside
the targe ...)
+ TODO: check
+CVE-2026-105712 (gpgtar in GnuPG before 2.5.19 can allow file overwrite via
crafted dat ...)
+ TODO: check
+CVE-2026-105646 (Ghost is a Node.js content management system. From 4.0.0
until 6.67.0, ...)
+ TODO: check
+CVE-2026-105645 (Ghost is a Node.js content management system. From 5.37.0
until 6.67.0 ...)
+ TODO: check
+CVE-2026-105644 (Ghost is a Node.js content management system. From 4.0.0
until 6.67.0, ...)
+ TODO: check
+CVE-2026-105643 (Ghost is a Node.js content management system. From version
6.34.0 unti ...)
+ TODO: check
+CVE-2026-105642 (Ghost is a Node.js content management system. From 6.56.0
until 6.67.0 ...)
+ TODO: check
+CVE-2026-105641 (Plane is an open-source project management tool. Prior to
1.4.0, the d ...)
+ TODO: check
+CVE-2026-105640 (Plane is an open-source project management tool. Prior to
1.4.0, Plane ...)
+ TODO: check
+CVE-2026-105639 (Plane is an open-source project management tool. Prior to
1.4.0, Plane ...)
+ TODO: check
+CVE-2026-105638 (Plane is an open-source project management tool. Prior to
1.4.0, Plane ...)
+ TODO: check
+CVE-2026-105637 (Plane is an open-source project management tool. Prior to
1.4.0, Proje ...)
+ TODO: check
+CVE-2026-105636 (Plane is an open-source project management tool. Prior to
1.4.0, the w ...)
+ TODO: check
+CVE-2026-105635 (Plane is an open-source project management tool. Prior to
1.4.0, Proje ...)
+ TODO: check
+CVE-2026-105634 (Plane is an open-source project management tool. Prior to
1.3.0, the P ...)
+ TODO: check
+CVE-2026-105633 (Plane is an open-source project management tool. Prior to
1.4.0, the V ...)
+ TODO: check
+CVE-2026-105632 (Plane is an open-source project management tool. Prior to
1.4.0, the G ...)
+ TODO: check
+CVE-2026-105631 (Plane is an open-source project management tool. Prior to
1.4.0, Works ...)
+ TODO: check
+CVE-2026-105630 (Plane is an open-source project management tool. Prior to
1.4.0, an au ...)
+ TODO: check
+CVE-2026-105629 (Plane is an open-source project management tool. Prior to
1.4.0, BulkE ...)
+ TODO: check
+CVE-2026-105628 (Plane is an open-source project management tool. Prior to
1.4.0, Plane ...)
+ TODO: check
+CVE-2026-105421 (Missing Authorization vulnerability in Kit Kit (formerly
ConvertKit) f ...)
+ TODO: check
+CVE-2026-105397 (LearnPress plugin for WordPress through 4.4.9.1 contains a
stored cros ...)
+ TODO: check
+CVE-2026-105396 (Heym before v0.0.112 contains a token leakage vulnerability
in build_p ...)
+ TODO: check
+CVE-2026-105387 (A security flaw has been discovered in girishsaraf
Online-Appointment- ...)
+ TODO: check
+CVE-2026-105386 (A vulnerability was identified in onetwothreeneth
HospitalManagementSy ...)
+ TODO: check
+CVE-2026-105385 (A vulnerability was determined in onetwothreeneth
HospitalManagementSy ...)
+ TODO: check
+CVE-2026-105384 (A vulnerability was found in UNION HospitalManagementSystem
up to 9ef9 ...)
+ TODO: check
+CVE-2026-105383 (A vulnerability has been found in onetwothreeneth
HospitalManagementSy ...)
+ TODO: check
+CVE-2026-105382 (A flaw has been found in onetwothreeneth
HospitalManagementSystem up t ...)
+ TODO: check
+CVE-2026-105329 (A vulnerability was determined in TallCMS up to 4.8.0. This
affects an ...)
+ TODO: check
+CVE-2026-105326 (An argument injection flaw was found in CUPS. When email
notification ...)
+ TODO: check
+CVE-2026-105315 (A vulnerability has been found in django-haystack up to
3.3.0. Affecte ...)
+ TODO: check
+CVE-2026-105314 (Papermerge 3.5.3 allows remote code execution by a standard
user via d ...)
+ TODO: check
+CVE-2026-105307 (A vulnerability was detected in Casdoor up to 3.161.1.
Affected is the ...)
+ TODO: check
+CVE-2026-105291 (A vulnerability was identified in feelec-yishu feelcrm-os
1.0.0. This ...)
+ TODO: check
+CVE-2026-105290 (A vulnerability was determined in feelec-yishu feelcrm-os
1.0.0. This ...)
+ TODO: check
+CVE-2026-105289 (A vulnerability was found in feelec-yishu feelcrm-os 1.0.0.
Affected b ...)
+ TODO: check
+CVE-2026-105288 (A vulnerability has been found in feelec-yishu feelcrm-os
1.0.0. Affec ...)
+ TODO: check
+CVE-2026-105287 (A flaw has been found in feelec-yishu feelcrm-os 1.0.0.
Affected is an ...)
+ TODO: check
+CVE-2026-105286 (A vulnerability was detected in Totolink A3002MU
1.0.0-B20230403.1455. ...)
+ TODO: check
+CVE-2026-105285 (A security vulnerability has been detected in Totolink
A3002MU 1.0.0-B ...)
+ TODO: check
+CVE-2026-105284 (A weakness has been identified in Totolink A3002MU
1.0.0-B20230403.145 ...)
+ TODO: check
+CVE-2026-105263 (A security flaw has been discovered in Shaarli up to 0.16.3.
The affec ...)
+ TODO: check
+CVE-2026-105254 (A vulnerability was identified in itsourcecode Online
Admission System ...)
+ TODO: check
+CVE-2026-105253 (A vulnerability was determined in itsourcecode Online
Admission System ...)
+ TODO: check
+CVE-2026-105251 (A vulnerability was detected in vgmstream up to r2117.
Affected by thi ...)
+ TODO: check
+CVE-2026-105250 (A security vulnerability has been detected in vgmstream up to
r2117. A ...)
+ TODO: check
+CVE-2026-105249 (A weakness has been identified in vgmstream up to r2117. This
impacts ...)
+ TODO: check
+CVE-2026-105248 (A security flaw has been discovered in vgmstream up to r2117.
This aff ...)
+ TODO: check
+CVE-2026-105247 (A vulnerability was determined in SourceCodester Online
Reviewer Manag ...)
+ TODO: check
+CVE-2026-105073 (Exposure of Sensitive System Information to an Unauthorized
Control Sp ...)
+ TODO: check
+CVE-2026-105069 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-105068 (Insertion of Sensitive Information Into Sent Data
vulnerability in Pix ...)
+ TODO: check
+CVE-2026-105064 (Use of Externally-Controlled Input to Select Classes or Code
('Unsafe ...)
+ TODO: check
+CVE-2026-105062 (Missing Authorization vulnerability in Brandtoss WP Admin
Audit wp-adm ...)
+ TODO: check
+CVE-2026-105060 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-105056 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-105055 (Missing Authorization vulnerability in WP Mailster WP
Mailster wp-mail ...)
+ TODO: check
+CVE-2026-104979 (Plane is an open-source project management tool. Prior to
1.4.0, Intak ...)
+ TODO: check
+CVE-2026-104978 (Plane is an open-source project management tool. Prior to
1.4.0, Plane ...)
+ TODO: check
+CVE-2026-104977 (Plane is an open-source project management tool. Prior to
1.4.0, the f ...)
+ TODO: check
+CVE-2026-104976 (Plane is an open-source project management tool. Prior to
1.4.0, Plane ...)
+ TODO: check
+CVE-2026-104975 (Plane is an open-source project management tool. Prior to
1.4.0, Plane ...)
+ TODO: check
+CVE-2026-104974 (Plane is an open-source project management tool. Prior to
1.4.0, a use ...)
+ TODO: check
+CVE-2026-104973 (Plane is an open-source project management tool. Prior to
1.4.0, the f ...)
+ TODO: check
+CVE-2026-104971 (Plane is an open-source project management tool. Prior to
1.4.0, Dupli ...)
+ TODO: check
+CVE-2026-104970 (Plane is an open-source project management tool. From 0.13
until 1.4.0 ...)
+ TODO: check
+CVE-2026-104969 (Plane is an open-source project management tool. Prior to
1.4.0, the c ...)
+ TODO: check
+CVE-2026-104968 (Plane is an open-source project management tool. Prior to
1.4.0, GET / ...)
+ TODO: check
+CVE-2026-104967 (Plane is an open-source project management tool. Prior to
1.4.0, BulkD ...)
+ TODO: check
+CVE-2026-104966 (Plane is an open-source project management tool. Prior to
1.4.0, two e ...)
+ TODO: check
+CVE-2026-104965 (Plane is an open-source project management tool. Prior to
1.4.0, the i ...)
+ TODO: check
+CVE-2026-104964 (Plane is an open-source project management tool. Prior to
1.4.0, Plane ...)
+ TODO: check
+CVE-2026-104963 (Plane is an open-source project management tool. Prior to
1.4.0, GET / ...)
+ TODO: check
+CVE-2026-104962 (Plane is an open-source project management tool. Prior to
1.4.0, GET / ...)
+ TODO: check
+CVE-2026-104961 (Plane is an open-source project management tool. Prior to
1.4.0, Works ...)
+ TODO: check
+CVE-2026-104960 (Plane is an open-source project management tool. Prior to
1.4.0, Plane ...)
+ TODO: check
+CVE-2026-104956 (Plane is an open-source project management tool. Prior to
1.4.0, the u ...)
+ TODO: check
+CVE-2026-104955 (Plane is an open-source project management tool. Prior to
1.4.0, a Pro ...)
+ TODO: check
+CVE-2026-104905 (FacturaScripts before version 2026.7 contains a PHP object
injection v ...)
+ TODO: check
+CVE-2026-104894 (Plane is an open-source project management tool. Prior to
1.4.0, the m ...)
+ TODO: check
+CVE-2026-104893 (Plane is an open-source project management tool. Prior to
1.4.0, GET / ...)
+ TODO: check
+CVE-2026-104892 (Plane is an open-source project management tool. Prior to
1.4.0, aPITo ...)
+ TODO: check
+CVE-2026-104891 (mppx-condition-gate provides conditional free-access wrappers
for mppx ...)
+ TODO: check
+CVE-2026-104890 (Kunstmaan CMS is an open source content management system
based on the ...)
+ TODO: check
+CVE-2026-104811 (DigitalCanion SA has discovered a vulnerability that allows
remote att ...)
+ TODO: check
+CVE-2026-104810 (This vulnerability allows remote attackers to delete
sensitive files o ...)
+ TODO: check
+CVE-2026-104809 (DigitalCanion has discovered a vulnerability that allows an
attacker t ...)
+ TODO: check
+CVE-2026-104808 (DigitalCanion has discovered a stored Cross-Site Scripting
(XSS) vulne ...)
+ TODO: check
+CVE-2026-104807 (DigitalCanion has discovered a stored Cross-Site Scripting
(XSS) vulne ...)
+ TODO: check
+CVE-2026-104806 (DigitalCanion has discovered a path traversal vulnerability
that allow ...)
+ TODO: check
+CVE-2026-104805 (DigitalCanion has discovered a vulnerability in the backup
restoration ...)
+ TODO: check
+CVE-2026-104714 (Concurrent execution using shared resource with improper
synchronizati ...)
+ TODO: check
+CVE-2026-104713 (Allocation of resources without limits or throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-104712 (Asymmetric resource consumption (amplification) vulnerability
in Apach ...)
+ TODO: check
+CVE-2026-104711 (Improper neutralization of special elements used in an
expression lang ...)
+ TODO: check
+CVE-2026-104706 (DigitalCanion has discovered a path traversal vulnerability
that allow ...)
+ TODO: check
+CVE-2026-104675 (Missing Authorization vulnerability in Liquid Web / StellarWP
Event Ti ...)
+ TODO: check
+CVE-2026-104673 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-104409 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-104408 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-104407 (Cross-Site Request Forgery (CSRF) vulnerability in Blubrry
Podcasting ...)
+ TODO: check
+CVE-2026-104404 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-104401 (Exposure of Sensitive System Information to an Unauthorized
Control Sp ...)
+ TODO: check
+CVE-2026-104400 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-104397 (Missing Authorization vulnerability in Jeroen Peters Name
Directory na ...)
+ TODO: check
+CVE-2026-104396 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-104389 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-104388 (Missing Authorization vulnerability in Blubrry Podcasting
PowerPress P ...)
+ TODO: check
+CVE-2026-104386 (Missing Authorization vulnerability in WPFunnels Team WP VR
wpvr allow ...)
+ TODO: check
+CVE-2026-103684 (Missing Authorization vulnerability in Arraytics WP Event
Solution wp- ...)
+ TODO: check
+CVE-2026-103512 (Perforce P4 Search prior to 2026.4.2 trusts a client-supplied
address ...)
+ TODO: check
+CVE-2026-103511 (Perforce P4 Search prior to 2026.4.2 does notvalidatefile
names suppli ...)
+ TODO: check
+CVE-2026-103510 (P4 Search prior to 2026.4.2 does not fail securely when its
service au ...)
+ TODO: check
+CVE-2026-103507 (Perforce P4 Search prior to 2026.4.2 does not restrict file
paths writ ...)
+ TODO: check
+CVE-2026-103352 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-103351 (Improper Validation of Specified Quantity in Input
vulnerability in Ma ...)
+ TODO: check
+CVE-2026-103349 (Deserialization of Untrusted Data vulnerability in Rymera Web
Co Produ ...)
+ TODO: check
+CVE-2026-103335 (Insertion of Sensitive Information Into Sent Data
vulnerability in Dee ...)
+ TODO: check
+CVE-2026-103334 (Insertion of Sensitive Information Into Sent Data
vulnerability in Eto ...)
+ TODO: check
+CVE-2026-103086 (Missing Authorization vulnerability in Stiofan UsersWP
userswp allows ...)
+ TODO: check
+CVE-2026-103085 (Improper Access Control vulnerability in WP User Manager WP
User Manag ...)
+ TODO: check
+CVE-2026-103084 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-103079 (Authorization Bypass Through User-Controlled Key
vulnerability in Ahma ...)
+ TODO: check
+CVE-2026-103078 (Authorization Bypass Through User-Controlled Key
vulnerability in Ahma ...)
+ TODO: check
+CVE-2026-102914 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-102780 (Joomla Extension - joomlafry.com - Unauthenticated
cross-record public ...)
+ TODO: check
+CVE-2026-102779 (Joomla Extension - joomlafry.com - Unauthenticated forced
execution of ...)
+ TODO: check
+CVE-2026-102778 (Joomla Extension - svenbluege.de - Cross-site scripting and
open redir ...)
+ TODO: check
+CVE-2026-102777 (Joomla Extension - svenbluege.de - Server-side request
forgery in the ...)
+ TODO: check
+CVE-2026-102776 (Joomla Extension - svenbluege.de - Cross-site request forgery
of list ...)
+ TODO: check
+CVE-2026-102775 (Joomla Extension - phoca.cz - Authorisation bypass through
user-contro ...)
+ TODO: check
+CVE-2026-102576 (A flaw was found in Quay. A remote attacker could trick a
user into lo ...)
+ TODO: check
+CVE-2026-102428 (Joomla Extension - ordasoft.com - Unauthenticated SQL
injection in Ord ...)
+ TODO: check
+CVE-2026-102426 (Joomla Extension - joomshaper.com - Reflected XSS in the
Dynamic Conte ...)
+ TODO: check
+CVE-2026-102393 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-102383 (Missing Authorization vulnerability in VillaTheme Lookzy
woo-lookbook ...)
+ TODO: check
+CVE-2026-102295 (A flaw was found in Quay. A cross-site scripting (XSS)
vulnerability i ...)
+ TODO: check
+CVE-2026-102282 (adm-zip is a JavaScript library for creating and extracting
ZIP archiv ...)
+ TODO: check
+CVE-2026-101919 (A flaw was found in the HyperShift operator. The operator
copies user- ...)
+ TODO: check
+CVE-2026-100515 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-100509 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-100103 (Perforce P4 Search container images prior to 2026.4.2 reset
the servic ...)
+ TODO: check
+CVE-2026-100102 (Perforce P4 Search container images prior to 2026.4.2enablean
unauthen ...)
+ TODO: check
+CVE-2025-15643 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
CVE-2026-XXXX [OSSN-0112]
- gnocchi 4.7.0-7 (bug #1150009)
NOTE:
https://github.com/gnocchixyz/gnocchi/security/advisories/GHSA-cjq3-6hm7-q33w
NOTE: https://wiki.openstack.org/wiki/OSSN/OSSN-0112
-CVE-2026-63266 [Arbitrary file write via calcext:data-mappings, sql provider
and Firebird backup functionality]
+CVE-2026-63266 (LibreOffice Calc can link a cell range to an external data
source, and ...)
+ {DSA-6543-1}
- libreoffice 4:26.2.5.2-1
NOTE: https://www.libreoffice.org/security/#cve-2026-63266
-CVE-2026-63267 [LFI and GET SSRF via calcext:data-mappings and csv provider]
+CVE-2026-63267 (LibreOffice Calc can link a cell range to an external csv data
source, ...)
+ {DSA-6543-1}
- libreoffice 4:26.2.5.2-1
NOTE: https://www.libreoffice.org/security/#cve-2026-63267
-CVE-2026-63268 [LFI via calcext:data-mappings, sql provider and
sdbc:flat:file:// db href]
+CVE-2026-63268 (LibreOffice Calc can link a cell range to an external data
source, and ...)
+ {DSA-6543-1}
- libreoffice 4:26.2.5.2-1
NOTE: https://www.libreoffice.org/security/#cve-2026-63268
-CVE-2026-63269 [LFI and GET SSRF via GStreamer and HLS playlists]
+CVE-2026-63269 (LibreOffice can link to audio and video files from a document,
and on ...)
+ {DSA-6543-1}
- libreoffice 4:26.2.5.2-1
NOTE: https://www.libreoffice.org/security/#cve-2026-63269
-CVE-2026-63270 [Environment/ini-file leaks]
+CVE-2026-63270 (URLs could be constructed which expanded environment variable
or INI f ...)
+ {DSA-6543-1}
- libreoffice 4:26.2.5.2-1
NOTE: https://www.libreoffice.org/security/#cve-2026-63270
-CVE-2026-63277 [RCE via calcext:data-mappings, sql provider and jdbc connector]
+CVE-2026-63277 (LibreOffice Calc can link a cell range to an external data
source, and ...)
+ {DSA-6543-1}
- libreoffice 4:26.2.5.2-1
NOTE: https://www.libreoffice.org/security/#cve-2026-63277
CVE-2026-84169 (The UPI QR Code Payment Gateway WordPress plugin through 1.4.3
does no ...)
@@ -3019,7 +3471,7 @@ CVE-2026-94177 (Unauthenticated SQL Injection in
GamiPress <= 8.0.2 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-94173 (Contributor Insecure Direct Object References (IDOR) in
Business Direc ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-94171 (Unauthenticated Cross Site Scripting (XSS) in CURCY <= 2.2.16
versions ...)
+CVE-2026-94171 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-94123 (Unauthenticated Arbitrary File Download in NextGEN Gallery <=
4.5.0 ve ...)
NOT-FOR-US: WordPress plugin or theme
@@ -6000,7 +6452,7 @@ CVE-2026-95520 (A heap-based buffer overflow flaw was
found in rpm. Parsing a sy
[trixie] - rpm <no-dsa> (Minor issue)
[bookworm] - rpm <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2537809
-CVE-2026-19395
+CVE-2026-19395 (In Qt for MCUs, a Text element that displays styled text halts
the dev ...)
NOT-FOR-US: Qt for MCUs
CVE-2026-95509 (Strings optimized for Latin-1 displaying Latin-1 characters
cause inco ...)
NOT-FOR-US: Qt for MCUs
@@ -18244,7 +18696,6 @@ CVE-2026-85495
[bookworm] - ppp <postponed> (Minor issue)
NOTE:
https://github.com/ppp-project/ppp/security/advisories/GHSA-frhv-j822-2pvx
CVE-2026-75883 (The code in pppd that formats a response to a PEAP Request
packet in p ...)
- {DLA-4808-1}
- ppp <unfixed> (bug #1148816)
[bookworm] - ppp <not-affected> (PEAP support introduced in 2.5.0)
NOTE:
https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35
@@ -69647,6 +70098,7 @@ CVE-2026-19694 (TTX Logger file parser crash in 4.6.0
to 4.6.7 allows denial of
NOTE: https://www.wireshark.org/security/wnpa-sec-2026-68.html
NOTE: https://gitlab.com/wireshark/wireshark/-/work_items/21389
CVE-2026-19487 (Perl versions from 5.9.4 before 5.41.9 produce incorrect
regular expre ...)
+ {DLA-4821-1}
- perl 5.42.2-3 (bug #1144668)
[trixie] - perl 5.40.1-6+deb13u1
NOTE: https://lists.security.metacpan.org/cve-announce/msg/42658992/
@@ -86020,6 +86472,7 @@ CVE-2026-54605 (OAuth is a Ruby wrapper for the OAuth
1.0 and 1.0a protocols, pr
NOTE: Introduced with:
https://github.com/ruby-oauth/oauth/commit/d74b767f464ee045cec75504974ff897b3dc0076
(v0.5.5)
NOTE: Fixed by:
https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f
(v1.1.6)
CVE-2026-54603 (OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1
authorization frame ...)
+ {DLA-4822-1}
- ruby-oauth2 2.0.25-1 (bug #1143054)
[trixie] - ruby-oauth2 <no-dsa> (Minor issue)
NOTE:
https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9
@@ -102957,12 +103410,14 @@ CVE-2026-57691 (Improper Neutralization of Input
During Web Page Generation ('Cr
CVE-2026-57668 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-57433 (Storable versions before 3.41 for Perl have a signed integer
overflow ...)
+ {DLA-4821-1}
- perl 5.40.1-8 (bug #1138906; bug #1142035)
[trixie] - perl 5.40.1-6+deb13u1
- libstorable-perl <removed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41780100/
NOTE: Fixed by:
https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7
(v5.43.11)
CVE-2026-57432 (Perl versions before 5.40.5-RC1, from 5.41.0 before
5.42.3-RC1, from 5 ...)
+ {DLA-4821-1}
- perl 5.40.1-8 (bug #1138905; bug #1142036)
[trixie] - perl 5.40.1-6+deb13u1
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41780102/
@@ -103184,6 +103639,7 @@ CVE-2026-14453 (This vulnerability is a critical
Server-Side Template Injection
CVE-2026-14165 (An Authorization Bypass Through User-Controlled Key
vulnerability affe ...)
NOT-FOR-US: Dassault Systemes
CVE-2026-13221 (Perl versions before 5.40.5-RC1, from 5.41.0 before
5.42.3-RC1, from 5 ...)
+ {DLA-4821-1}
[experimental] - perl 5.44.0-1
- perl 5.42.3-1 (bug #1142037)
[trixie] - perl 5.40.1-6+deb13u1
@@ -106670,6 +107126,7 @@ CVE-2011-10043 (Module::Load versions before 0.22 for
Perl allow arbitrary modul
- perl 5.18.1-2
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41608305/
CVE-2026-7017 (HTTP::Tiny versions before 0.095 for Perl forward credential
headers t ...)
+ {DLA-4821-1}
- libhttp-tiny-perl 0.096-1 (bug #1141638)
[trixie] - libhttp-tiny-perl 0.090-1+deb13u1
[bookworm] - libhttp-tiny-perl <postponed> (Minor issue; leak requires
caller-supplied credential headers and an attacker-influenced redirect)
@@ -124226,6 +124683,7 @@ CVE-2026-53705 (A flaw was found in GStreamer's
WavPack audio decoder in gst-plu
NOTE: Fixed by:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/9326c636a22a678952a6cae6518465d35d441a87
(1.28.4)
NOTE: Fixed by:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f7cb3e0288627cce919e656584b852ac8605c922
(1.28.4)
CVE-2026-12087 (Socket versions before 2.041 for Perl have an out-of-bounds
heap read. ...)
+ {DLA-4821-1}
- libsocket-perl 2.041-1 (bug #1146063)
[trixie] - libsocket-perl 2.038-1+deb13u1
[bookworm] - libsocket-perl <postponed> (Minor issue; up-to-3-byte heap
over-read, only reachable when a script passes attacker-controlled source to
pack_ip_mreq_source())
@@ -133336,7 +133794,7 @@ CVE-2025-53440 (Improper Control of Filename for
Include/Require Statement in PH
NOT-FOR-US: WordPress plugin or theme
CVE-2025-53346 (Missing Authorization vulnerability in ThimPress Thim Core
allows Expl ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2025-53345 (Missing Authorization vulnerability leading to code execution
after in ...)
+CVE-2025-53345 (Missing Authorization vulnerability in ThimPress Thim Core
thim-core.T ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-53302 (Missing Authorization vulnerability in Anton Shevchuk
Constructor allo ...)
NOT-FOR-US: WordPress plugin or theme
@@ -140417,7 +140875,7 @@ CVE-2026-46644 (Symfony Polyfill backports PHP
features and provides compatibili
NOTE:
https://symfony.com/blog/cve-2026-46644-insecure-equivalence-in-symfony-polyfill-intl-idn-for-ascii-only-xn-labels
NOTE:
https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq
CVE-2026-48962 (IO::Compress versions before 2.220 for Perl can execute
arbitrary code ...)
- {DLA-4812-1}
+ {DLA-4821-1 DLA-4812-1}
- libio-compress-perl 2.220-1 (bug #1138055)
[trixie] - libio-compress-perl 2.213-1+deb13u1
- perl 5.40.1-8 (bug #1138854)
@@ -140436,7 +140894,7 @@ CVE-2026-48961 (IO::Compress versions from 2.207
before 2.220 for Perl ship a zi
NOTE: Introduced with:
https://github.com/pmqs/IO-Compress/commit/ddfe67584a228877e5d28840da75ff32e435a5e3
(v2.207)
NOTE: Fixed by:
https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7
(v2.220)
CVE-2026-48959 (IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU
exhaust ...)
- {DLA-4812-1}
+ {DLA-4821-1 DLA-4812-1}
- libio-compress-perl 2.220-1 (bug #1138051)
[trixie] - libio-compress-perl 2.213-1+deb13u1
- perl 5.40.1-8 (bug #1138856)
@@ -140444,7 +140902,7 @@ CVE-2026-48959 (IO::Uncompress::Unzip versions before
2.220 for Perl allow CPU e
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40434381/
NOTE: Fixed by:
https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2
(v2.220)
CVE-2025-15649 (IO::Uncompress::Unzip versions before 2.215 for Perl propagate
uncaugh ...)
- {DLA-4812-1}
+ {DLA-4821-1 DLA-4812-1}
- libio-compress-perl 2.217-1 (bug #1146065)
[trixie] - libio-compress-perl 2.213-1+deb13u1
- perl 5.40.1-8 (bug #1138863)
@@ -141109,12 +141567,14 @@ CVE-2026-9538 (Archive::Tar versions before 3.10
for Perl allow memory exhaustio
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40396448/
NOTE:
https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7
(3.10)
CVE-2026-42497 (Archive::Tar versions before 3.08 for Perl extract hardlinks
to attack ...)
+ {DLA-4821-1}
[experimental] - perl 5.44.0-1
- perl 5.42.3-1 (bug #1138859)
[trixie] - perl 5.40.1-6+deb13u1
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40396457/
NOTE:
https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158
(3.08)
CVE-2026-42496 (Archive::Tar versions before 3.08 for Perl extract symlinks
with attac ...)
+ {DLA-4821-1}
[experimental] - perl 5.44.0-1
- perl 5.42.3-1 (bug #1138860)
[trixie] - perl 5.40.1-6+deb13u1
@@ -142257,6 +142717,7 @@ CVE-2026-5091 (Catalyst::Plugin::Authentication
versions through 0.10024 for Per
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40281889/
NOTE:
https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/b0515f492257438cf07082acf1e10d06e8088a5e
(v0.10_025)
CVE-2026-8376 (Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1,
from 5 ...)
+ {DLA-4821-1}
- perl 5.40.1-8 (bug #1137345)
[trixie] - perl 5.40.1-6+deb13u1
[bullseye] - perl <postponed> (Minor issue; can be fixed in point
release)
@@ -148777,6 +149238,7 @@ CVE-2026-0541 (ACAP applications can gain elevated
privileges due to improper in
CVE-2026-0502 (Due to insufficient CSRF protection in SAP BusinessObjects
Business In ...)
NOT-FOR-US: SAP
CVE-2026-7010 (HTTP::Tiny versions before 0.093 for Perl do not validate CRLF
in HTTP ...)
+ {DLA-4821-1}
- libhttp-tiny-perl 0.092-2 (bug #1146064)
[trixie] - libhttp-tiny-perl 0.090-1+deb13u1
[bookworm] - libhttp-tiny-perl <no-dsa> (Minor issue)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/edd1fab6c5b5adbf7a5450faa8afbc01a40dddc8
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/edd1fab6c5b5adbf7a5450faa8afbc01a40dddc8
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
