Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f14af091 by security tracker role at 2026-10-07T07:13:40+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,509 @@
+CVE-2026-97680 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-97679 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-97678 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-97676 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-97674 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-97673 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-97671 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-97655 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
attacker to ...)
+ TODO: check
+CVE-2026-97626 (Requesting a user or organization profile page (`GET
/{username}`) wit ...)
+ TODO: check
+CVE-2026-97354 (The PowerPress Podcasting plugin by Blubrry WordPress plugin
before 11 ...)
+ TODO: check
+CVE-2026-97331 (The User Private Files WordPress plugin before 2.1.9 does not
validat ...)
+ TODO: check
+CVE-2026-97208 (The Gitea API endpoint for creating push mirrors (`POST
/api/v1/repos/ ...)
+ TODO: check
+CVE-2026-97188 (The String locator WordPress plugin before 2.6.8 does not
restrict the ...)
+ TODO: check
+CVE-2026-96594 (The Gitea API endpoint `GET
/api/v1/repos/{owner}/{repo}/media/{filepa ...)
+ TODO: check
+CVE-2026-96589 (When a private repository is transferred to a user who lacks
access, G ...)
+ TODO: check
+CVE-2026-96580 (Gitea expanded a workflow's static `strategy.matrix` into its
full Car ...)
+ TODO: check
+CVE-2026-96530 (The Optimole WordPress plugin before 4.2.15 does not perform
a capabi ...)
+ TODO: check
+CVE-2026-96404 (When Gitea's web installer is reachable against a database
that alread ...)
+ TODO: check
+CVE-2026-96400 (With `[migrations] ALLOWED_DOMAINS` set to a matching entry
such as `* ...)
+ TODO: check
+CVE-2026-96399 (A repository's external issue tracker regular expression
containing al ...)
+ TODO: check
+CVE-2026-95112 (When processing issue and comment bodies, Gitea scanned the
entire pre ...)
+ TODO: check
+CVE-2026-95106 (Gitea accepted pushed Git trees containing two entries with
the same n ...)
+ TODO: check
+CVE-2026-94205 (Gitea Actions decided whether a fork pull request run needed
approval ...)
+ TODO: check
+CVE-2026-94114 (Symbolic name not mapping to correct object vulnerability in
Apache Co ...)
+ TODO: check
+CVE-2026-93679 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-93678 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-93677 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-93675 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
attacker to ...)
+ TODO: check
+CVE-2026-93674 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
attacker to ...)
+ TODO: check
+CVE-2026-93449 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-93448 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-93447 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker
with acc ...)
+ TODO: check
+CVE-2026-93445 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-93443 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-89430 (Gitea validated a push mirror's remote address against the
`[migration ...)
+ TODO: check
+CVE-2026-89182 (With `[repository] FORCE_PRIVATE = true`, Gitea creates new
repositori ...)
+ TODO: check
+CVE-2026-88962 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-87971 (The If-So Dynamic Content WordPress plugin before 1.10.2 does
not val ...)
+ TODO: check
+CVE-2026-87782 (The Koinonia Link WordPress plugin before 1.1.5 does not check
that a ...)
+ TODO: check
+CVE-2026-86833 (The MetForm WordPress plugin before 4.3.1 does not sanitize or
escape ...)
+ TODO: check
+CVE-2026-86816 (The WPCafe WordPress plugin before 3.0.21 does not restrict
access to ...)
+ TODO: check
+CVE-2026-86684 (The Gitea push mirror API checked whether the repository
owner, instea ...)
+ TODO: check
+CVE-2026-84897 (src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the
server-to-c ...)
+ TODO: check
+CVE-2026-83742 (Unsigned integer underflow in wstrncat() in src/port.c in
wolfSSL wolf ...)
+ TODO: check
+CVE-2026-83540 (When password or public key authentication is used with the
Windows po ...)
+ TODO: check
+CVE-2026-82212 (The Nexi XPay Build WordPress plugin through 7.6.2 does not
correctly ...)
+ TODO: check
+CVE-2026-82211 (The Nexi XPay Build WordPress plugin through 7.6.2 does not
verify the ...)
+ TODO: check
+CVE-2026-81535 (In wolfSSH through 1.5.0 built
with--enable-fwd,DoChannelOpen()insrc/i ...)
+ TODO: check
+CVE-2026-80048 (A flaw was found in `sssd-kcm`. A local user or process able
to connec ...)
+ TODO: check
+CVE-2026-79960 (When a push was authenticated with a deploy key, Gitea
recorded the re ...)
+ TODO: check
+CVE-2026-79818 (A vulnerability in an API interface of ClearPass Policy
Manager could ...)
+ TODO: check
+CVE-2026-79817 (A sensitive information disclosure vulnerability exists in the
client ...)
+ TODO: check
+CVE-2026-79816 (A vulnerability in a client interface of HPE Networking
ClearPass Poli ...)
+ TODO: check
+CVE-2026-79815 (A command injection vulnerability in the OnGuard agent of
ClearPass Po ...)
+ TODO: check
+CVE-2026-79814 (An arbitrary file write vulnerability in the ClearPass Policy
Manager ...)
+ TODO: check
+CVE-2026-79813 (A local privilege escalation vulnerability exists in the
ClearPass cli ...)
+ TODO: check
+CVE-2026-79812 (A denial of service vulnerability exists in the OnGuard agent
of HPE N ...)
+ TODO: check
+CVE-2026-79811 (A SQL injection vulnerability in the API of ClearPass Policy
Manager c ...)
+ TODO: check
+CVE-2026-79810 (Remote code execution vulnerabilities exist in the affected
interface ...)
+ TODO: check
+CVE-2026-79809 (An unauthenticated path traversal vulnerability exists in an
API endpo ...)
+ TODO: check
+CVE-2026-79808 (A buffer overflow vulnerability exists in the OnGuard agent of
ClearPa ...)
+ TODO: check
+CVE-2026-79807 (A missing integrity verification vulnerability in the Windows
client s ...)
+ TODO: check
+CVE-2026-79806 (A privilege escalation vulnerability in the ClearPass Policy
Manager O ...)
+ TODO: check
+CVE-2026-79805 (An authenticated path traversal vulnerability exists in
ClearPass Poli ...)
+ TODO: check
+CVE-2026-79803 (A command injection vulnerability exists in the API of
ClearPass Polic ...)
+ TODO: check
+CVE-2026-79802 (A command injection vulnerability exists in the client
software of Cle ...)
+ TODO: check
+CVE-2026-79801 (A missing integrity verification vulnerability in the client
agent sof ...)
+ TODO: check
+CVE-2026-79800 (An authenticated path traversal vulnerability exists in the
command li ...)
+ TODO: check
+CVE-2026-79799 (A vulnerability in the web-based management interface of
ClearPass Pol ...)
+ TODO: check
+CVE-2026-79798 (SQL injection vulnerabilities in the web-based management
interface of ...)
+ TODO: check
+CVE-2026-79797 (An improper access control vulnerability exists in the Android
client ...)
+ TODO: check
+CVE-2026-79796 (Vulnerabilities have been identified in the affected interface
of Clea ...)
+ TODO: check
+CVE-2026-79794 (A SQL injection vulnerability in the web-based management
interface of ...)
+ TODO: check
+CVE-2026-76754 (A vulnerability in an affected interface of ClearPass Policy
Manager c ...)
+ TODO: check
+CVE-2026-76753 (A format string vulnerability in an affected service interface
of HPE ...)
+ TODO: check
+CVE-2026-76752 (Authentication bypass vulnerabilities exist in the web-based
managemen ...)
+ TODO: check
+CVE-2026-76751 (A missing integrity verification vulnerability exists in the
OnGuard a ...)
+ TODO: check
+CVE-2026-76750 (Deserialization of untrusted data vulnerabilities exist in the
web int ...)
+ TODO: check
+CVE-2026-76749 (A sensitive information disclosure vulnerability exists in
AOS-S. Succ ...)
+ TODO: check
+CVE-2026-76748 (A privilege escalation vulnerability exists in the API of
AOS-S. Succe ...)
+ TODO: check
+CVE-2026-76747 (Buffer overflow vulnerabilities exist in the affected
interface of AOS ...)
+ TODO: check
+CVE-2026-76746 (An unauthenticated buffer overflow vulnerability exists in
AOS-S. Succ ...)
+ TODO: check
+CVE-2026-76745 (Memory corruption vulnerabilities exist in AOS-S that are
reachable by ...)
+ TODO: check
+CVE-2026-76744 (Buffer overflow vulnerabilities exist in the affected
interface of AOS ...)
+ TODO: check
+CVE-2026-76743 (A vulnerability have been identified in the management
interface of AO ...)
+ TODO: check
+CVE-2026-76742 (Authentication bypass vulnerabilities exist in the web
management inte ...)
+ TODO: check
+CVE-2026-76741 (Buffer overflow vulnerabilities exist in the affected
interface of AOS ...)
+ TODO: check
+CVE-2026-76061 (A flaw was found in CRI-O's `bind_mount_prefix` handling. When
configu ...)
+ TODO: check
+CVE-2026-73278 (Gitea's OAuth2 and OpenID Connect sign-in paths do not require
a WebAu ...)
+ TODO: check
+CVE-2026-70357 (Gitea validates a repository migration hostname against its
network al ...)
+ TODO: check
+CVE-2026-65142 (NVIDIA Model-Optimizer contains a vulnerability where an
attacker may ...)
+ TODO: check
+CVE-2026-65122 (NVIDIA TensorRT contains a vulnerability where an attacker can
cause a ...)
+ TODO: check
+CVE-2026-59347 (VMware Workstation and Fusion contain a stack-based
buffer-overflow vu ...)
+ TODO: check
+CVE-2026-59346 (VMware Workstation and Fusion contain an integer-overflow
vulnerabilit ...)
+ TODO: check
+CVE-2026-43598 (Improper input validation in the AMD ROCm Communication
Collectives Li ...)
+ TODO: check
+CVE-2026-19572 (A security vulnerability has been identified in FlexNet
Publisher lmad ...)
+ TODO: check
+CVE-2026-19396 (A predictable seed in the pseudo-random number generator
(PRNG) in the ...)
+ TODO: check
+CVE-2026-19386 (A stack-based buffer overflow in the ASUS router modules
allows an aut ...)
+ TODO: check
+CVE-2026-19029 (A heap-based buffer over-read in H5Z__filter_scaleoffset() in
src/H5Zs ...)
+ TODO: check
+CVE-2026-16528 (Insertion of Sensitive Information into Log File in certain
ASUS route ...)
+ TODO: check
+CVE-2026-16516 (wolfSSH does not validate that the ECDSA curve identifier in a
KEXDH_R ...)
+ TODO: check
+CVE-2026-14911 (Improper Neutralization of Input During Web Page Generation
(\u201cCro ...)
+ TODO: check
+CVE-2026-106589 (In sshd in OpenSSH through 10.6, in certain environments such
as QNX 6 ...)
+ TODO: check
+CVE-2026-106588 (In sshd in OpenSSH through 10.6, use of the macOS 27 (or
later) SDK ha ...)
+ TODO: check
+CVE-2026-106587 (In sshd in OpenSSH before 10.6, the value "none" for a
configuration o ...)
+ TODO: check
+CVE-2026-106586 (In sshd in OpenSSH before 10.6, the restrict keyword (in
authorized_ke ...)
+ TODO: check
+CVE-2026-106585 (In sshd and ssh in OpenSSH before 10.6, there is no check for
whether ...)
+ TODO: check
+CVE-2026-106584 (In ssh-keygen in OpenSSH before 10.6, certificates could have
incorrec ...)
+ TODO: check
+CVE-2026-106583 (In ssh in OpenSSH before 10.6, a $ or \ character can occur
in a comma ...)
+ TODO: check
+CVE-2026-106582 (In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary
coder can b ...)
+ TODO: check
+CVE-2026-106555 (In sshd in OpenSSH before 10.6, GSSAPIAuthentication
authentication st ...)
+ TODO: check
+CVE-2026-106553 (In sshd in OpenSSH before 10.6, credentials can incorrectly
persist af ...)
+ TODO: check
+CVE-2026-106552 (In sftp in OpenSSH before 10.6, a server can trigger
directory travers ...)
+ TODO: check
+CVE-2026-106550 (Mozilla's Node-convict (version 6.2.2 and later) is
vulnerable to a De ...)
+ TODO: check
+CVE-2026-106547 (A heap-based buffer overflow in H5VM_array_fill() in
src/H5VM.c in HDF ...)
+ TODO: check
+CVE-2026-106509 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106508 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106507 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106506 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106505 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106504 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106503 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106502 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106501 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106500 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106499 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106498 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106497 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106496 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106494 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106493 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106492 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106491 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106490 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106489 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106488 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106487 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106486 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106471 (A flaw was found in Candlepin. The central authorization
filter incorr ...)
+ TODO: check
+CVE-2026-106463 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106462 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106461 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-106460 (Backstage is an open framework for building developer
portals. From 0. ...)
+ TODO: check
+CVE-2026-106459 (Backstage is an open framework for building developer
portals. From 0. ...)
+ TODO: check
+CVE-2026-106458 (Backstage is an open framework for building developer
portals. From 0. ...)
+ TODO: check
+CVE-2026-106457 (Backstage is an open framework for building developer
portals. From 0. ...)
+ TODO: check
+CVE-2026-106456 (Backstage is an open framework for building developer
portals. From 0. ...)
+ TODO: check
+CVE-2026-106455 (Backstage is an open framework for building developer
portals. From 0. ...)
+ TODO: check
+CVE-2026-106454 (Twisted is an event-based framework for internet
applications, support ...)
+ TODO: check
+CVE-2026-106453 (yawkat LZ4 Java provides LZ4 compression for Java. Prior to
1.11.2, LZ ...)
+ TODO: check
+CVE-2026-106452 (yawkat LZ4 Java provides LZ4 compression for Java. Prior to
1.11.2, ne ...)
+ TODO: check
+CVE-2026-106451 (yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0
until 1. ...)
+ TODO: check
+CVE-2026-106450 (yawkat LZ4 Java provides LZ4 compression for Java. Prior to
1.11.4, ne ...)
+ TODO: check
+CVE-2026-106449 (yawkat LZ4 Java provides LZ4 compression for Java. Prior to
1.11.4, ne ...)
+ TODO: check
+CVE-2026-106448 (StableLib is a stable library of useful TypeScript and
JavaScript code ...)
+ TODO: check
+CVE-2026-106447 (StableLib is a stable library of useful TypeScript and
JavaScript code ...)
+ TODO: check
+CVE-2026-106446 (Handlebars provides the power necessary to let users build
semantic te ...)
+ TODO: check
+CVE-2026-106445 (Handlebars provides the power necessary to let users build
semantic te ...)
+ TODO: check
+CVE-2026-106444 (Handlebars provides the power necessary to let users build
semantic te ...)
+ TODO: check
+CVE-2026-106063 (A heap-based buffer overflow was found in GIMP\u2019s DICOM
export plu ...)
+ TODO: check
+CVE-2026-106062 (A heap-based buffer overflow was found in GIMP\u2019s
DirectDraw Surfa ...)
+ TODO: check
+CVE-2026-106061 (A flaw was found in GIMP\u2019s X cursor (XMC) thumbnail
loader. When ...)
+ TODO: check
+CVE-2026-106032 (Server-side request forgery in the OpenAPI schema processing
of the ag ...)
+ TODO: check
+CVE-2026-105812 (Improper control of code generation in the agent import
functionality ...)
+ TODO: check
+CVE-2026-105811 (Authorization bypass through a user-controlled key in the
optional Ama ...)
+ TODO: check
+CVE-2026-105324 (An HTTP header injection vulnerability in
start-page-loader.cgi of ADM ...)
+ TODO: check
+CVE-2026-105322 (The Magee Shortcodes WordPress plugin through 2.1.1 does not
restrict ...)
+ TODO: check
+CVE-2026-105316 (The Magee Shortcodes WordPress plugin through 2.1.1 does not
sanitise ...)
+ TODO: check
+CVE-2026-105268 (The Gitea API routes for issue attachments
(`/api/v1/repos/{owner}/{re ...)
+ TODO: check
+CVE-2026-105267 (The Gitea web route for deleting tags (`POST
/{owner}/{repo}/tags/dele ...)
+ TODO: check
+CVE-2026-105244 (Improper Encoding or Escaping of Output vulnerability in the
RemoteSys ...)
+ TODO: check
+CVE-2026-105243 (Insufficient Logging vulnerability in the EventLogAppender of
Apache l ...)
+ TODO: check
+CVE-2026-105242 (Improper Handling of Exceptional Conditions vulnerability in
the aspne ...)
+ TODO: check
+CVE-2026-105241 (Improper Handling of Unicode Encoding vulnerability in the
SmtpPickupD ...)
+ TODO: check
+CVE-2026-105240 (Improper Neutralization of Null Byte or NUL Character
vulnerability in ...)
+ TODO: check
+CVE-2026-105239 (Improper Neutralization of Null Byte or NUL Character
vulnerability in ...)
+ TODO: check
+CVE-2026-105111 (Improper neutralization of input during web page generation
('cross-si ...)
+ TODO: check
+CVE-2026-104953 (The MPG WordPress plugin before 4.2.3 does not properly
validate the ...)
+ TODO: check
+CVE-2026-104678 (The CP Media Player WordPress plugin before 1.3.4 does not
perform a ...)
+ TODO: check
+CVE-2026-104677 (The WP Coder WordPress plugin before 4.5.2 does not restrict
access t ...)
+ TODO: check
+CVE-2026-104667 (The Animated Number Counters WordPress plugin before 3.1 does
not sani ...)
+ TODO: check
+CVE-2026-104653 (The Envira Gallery WordPress plugin before 1.16.1 does not
sanitise o ...)
+ TODO: check
+CVE-2026-104652 (The Envira Gallery WordPress plugin before 1.16.1 does not
sanitise a ...)
+ TODO: check
+CVE-2026-104651 (The Yaad Sarig Payment Gateway For WC WordPress plugin before
2.2.13 d ...)
+ TODO: check
+CVE-2026-104636 (Gitea validated the initial remote URL for push mirrors, wiki
remote c ...)
+ TODO: check
+CVE-2026-104633 (When migrating a repository from another Gitea instance,
Gitea used th ...)
+ TODO: check
+CVE-2026-104632 (Gitea Actions blocks the jobs of workflow runs from
first-time fork pu ...)
+ TODO: check
+CVE-2026-104626 (A user who can open a fork pull request can place workflow
content wit ...)
+ TODO: check
+CVE-2026-104335 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-104334 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
attacker to ...)
+ TODO: check
+CVE-2026-104050 (The Academy LMS WordPress plugin before 4.0.0 does not
verify that a ...)
+ TODO: check
+CVE-2026-104049 (The Academy LMS WordPress plugin before 4.0.0 does not
verify course ...)
+ TODO: check
+CVE-2026-104048 (A flaw was found in SSSD. In trust-enabled identity
management environ ...)
+ TODO: check
+CVE-2026-104047 (A flaw was found in SSSD. When configured to use Microsoft
Entra ID, s ...)
+ TODO: check
+CVE-2026-104046 (A flaw was found in SSSD (System Security Services Daemon).
When Ident ...)
+ TODO: check
+CVE-2026-104045 (A flaw was found in SSSD. A local user can trigger a Denial
of Service ...)
+ TODO: check
+CVE-2026-103870 (A flaw was found in pulp-rpm when it publishes a distribution
tree. Ad ...)
+ TODO: check
+CVE-2026-103869 (A flaw was found in pulp-ansible's bearer-token refresh for
collection ...)
+ TODO: check
+CVE-2026-103868 (A flaw was found in pulp-container when it authenticates to
an upstrea ...)
+ TODO: check
+CVE-2026-103681 (The Frontend Dashboard WordPress plugin before 3.0.0 does not
perform ...)
+ TODO: check
+CVE-2026-103670 (When a Gitea Actions run was inserted, older runs in the same
workflow ...)
+ TODO: check
+CVE-2026-103667 (Gitea's container registry served blob downloads with a
`Content-Type` ...)
+ TODO: check
+CVE-2026-103504 (Changing an organization team's permission through the API
with only t ...)
+ TODO: check
+CVE-2026-103378 (The Geliver Ak\u0131ll\u0131 Kargo Pazaryeri WordPress plugin
before 3 ...)
+ TODO: check
+CVE-2026-103360 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-103323 (The Integration for Epos Now and WooCommerce WordPress plugin
before 4 ...)
+ TODO: check
+CVE-2026-103059 (When Gitea's built-in SSH server is enabled
(`START_SSH_SERVER = true` ...)
+ TODO: check
+CVE-2026-103009 (Authorization Bypass Through User-Controlled Key (CWE-639) in
Elastics ...)
+ TODO: check
+CVE-2026-103008 (Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to
Denial o ...)
+ TODO: check
+CVE-2026-103007 (Incorrect Authorization (CWE-863) in Elasticsearch can lead
to Privile ...)
+ TODO: check
+CVE-2026-103006 (Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to
Denial o ...)
+ TODO: check
+CVE-2026-103005 (Memory Allocation with Excessive Size Value (CWE-789) in
Elasticsearch ...)
+ TODO: check
+CVE-2026-102478 (In affected versions of Octopus Server, an authenticated user
with per ...)
+ TODO: check
+CVE-2026-102413 (Uncaught Exception (CWE-248) in Elastic Endpoint can lead to
denial of ...)
+ TODO: check
+CVE-2026-102412 (Incorrect Authorization (CWE-863) in Kibana can lead to
sensitive info ...)
+ TODO: check
+CVE-2026-102411 (Allocation of Resources Without Limits or Throttling
(CWE-770) in Elas ...)
+ TODO: check
+CVE-2026-102410 (Missing Authorization (CWE-862) in Kibana can lead to
information disc ...)
+ TODO: check
+CVE-2026-102409 (Uncontrolled Recursion (CWE-674) in Elasticsearch can allow
an authent ...)
+ TODO: check
+CVE-2026-102408 (Inefficient Regular Expression Complexity (CWE-1333) in
Elasticsearch ...)
+ TODO: check
+CVE-2026-102407 (Incorrect Authorization (CWE-863) in Elasticsearch can lead
to unautho ...)
+ TODO: check
+CVE-2026-102406 (Authorization Bypass Through User-Controlled Key (CWE-639) in
Kibana c ...)
+ TODO: check
+CVE-2026-102404 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch
can lead ...)
+ TODO: check
+CVE-2026-102173 (The Kirki \u2013 Freeform Page Builder, Website Builder &
Customizer p ...)
+ TODO: check
+CVE-2026-102169 (On affected Arista Wi-Fi access points with Captive Portal
enabled, an ...)
+ TODO: check
+CVE-2026-102168 (On affected Arista Wi-Fi access points with Captive Portal
enabled, an ...)
+ TODO: check
+CVE-2026-102167 (On affected Arista Wi-Fi access points, a memory corruption
vulnerabil ...)
+ TODO: check
+CVE-2026-102165 (On affected Arista Wi-Fi access points, an unauthenticated
attacker wi ...)
+ TODO: check
+CVE-2026-102164 (On affected Arista access points configured with VXLAN
tunnelling and ...)
+ TODO: check
+CVE-2026-102163 (On affected Arista access points with Wireless Intrusion
Prevention Sy ...)
+ TODO: check
+CVE-2026-102162 (On affected Arista Wi-Fi access points with captive portal,
or applica ...)
+ TODO: check
+CVE-2026-102161 (An unauthenticated attacker located on an adjacent private
network (or ...)
+ TODO: check
+CVE-2026-102160 (An operating system (OS) command injection vulnerability in
CloudVisio ...)
+ TODO: check
+CVE-2026-102159 (An access-control flaw in the CV-CUE backend may allow an
unauthentica ...)
+ TODO: check
+CVE-2026-102158 (Improper validation of selected CloudVision CUE application
programmin ...)
+ TODO: check
+CVE-2026-102157 (An insecure direct object reference (IDOR) vulnerability in a
CloudVis ...)
+ TODO: check
+CVE-2026-102156 (Improper neutralization of Lightweight Directory Access
Protocol (LDAP ...)
+ TODO: check
+CVE-2026-102155 (An XML External Entity (XXE) injection vulnerability in the
WiFi-serve ...)
+ TODO: check
+CVE-2026-101331 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-101329 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
+ TODO: check
+CVE-2026-101258 (A flaw was found in Ghostscript. When Ghostscript renders a
crafted Po ...)
+ TODO: check
+CVE-2026-101158 (A missing input validation vulnerability in the Fileserver
upload API ...)
+ TODO: check
+CVE-2026-101157 (A stored cross-site scripting (XSS) vulnerability may allow
an unauthe ...)
+ TODO: check
+CVE-2026-101156 (A stored cross-site scripting (XSS) vulnerability may allow
an authent ...)
+ TODO: check
+CVE-2026-101155 (An authenticated remote attacker with specific permissions
can read or ...)
+ TODO: check
+CVE-2026-101154 (An authenticated remote attacker with specific permissions
can read or ...)
+ TODO: check
+CVE-2026-101153 (On affected versions of CloudVision Portal (on-premises) or
CloudVisio ...)
+ TODO: check
+CVE-2026-101152 (Insufficient validation in the Single Sign-On (SSO) login
flow could a ...)
+ TODO: check
+CVE-2026-101151 (Insufficient validation of request in login flow could allow
a remote, ...)
+ TODO: check
+CVE-2026-101150 (Insufficient validation of OIDC bearer token configuration
could allow ...)
+ TODO: check
+CVE-2026-101149 (Insufficient validation of OIDC SSO provider configuration
could allow ...)
+ TODO: check
+CVE-2026-101029 (Gitea's repository migration and pull mirror egress checks
could be by ...)
+ TODO: check
+CVE-2026-101027 (When `[migrations] ALLOWED_DOMAINS` was configured, a
hostname matchin ...)
+ TODO: check
+CVE-2026-101023 (Gitea's OAuth2 token endpoint verified the signature and
grant of a to ...)
+ TODO: check
CVE-2026-88812 [XKB SetGeometry TextDoodad Double Free]
- xorg-server <unfixed>
- xwayland <unfixed>
@@ -391,7 +897,7 @@ CVE-2026-25433 (Subscriber Broken Access Control in
WP2LEADS <= 3.5.7 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-12380 (Improper neutralization of input during web page generation
('cross-si ...)
NOT-FOR-US: E-Commerce Pack
-CVE-2026-106513 (MISP (Malware Information Sharing Platform) exposes critical
infrastru ...)
+CVE-2026-106513 (MISP exposes critical infrastructure
settings\u2014specifically the Re ...)
- misp <itp> (bug #1144317)
CVE-2026-106512 (The CakeResponse::download() method in
lib/Cake/Network/CakeResponse.p ...)
- misp <itp> (bug #1144317)
@@ -8147,7 +8653,7 @@ CVE-2026-102377 (Contributor PHP Object Injection in
Photo Gallery by 10Web <= 1
NOT-FOR-US: WordPress plugin or theme
CVE-2026-102376 (Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32
versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-102375 (Subscriber Broken Access Control in Optimole <= 4.2.14
versions.)
+CVE-2026-102375 (Missing Authorization vulnerability in Optimole Optimole
optimole-wp a ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-101295 (Path traversal / arbitrary file write in oc-mirror's operator
catalog ...)
NOT-FOR-US: openshift/oc-mirror
@@ -8159,7 +8665,7 @@ CVE-2026-100510 (Unauthenticated Cross Site Scripting
(XSS) in Post and Page Bui
NOT-FOR-US: WordPress plugin or theme
CVE-2026-100508 (Unauthenticated Denial of Service Attack in Two Factor <=
0.16.0 versi ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-100507 (Unauthenticated Cross Site Scripting (XSS) in If-So Dynamic
Content Pe ...)
+CVE-2026-100507 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-100280 (In JetBrains YouTrack before 2026.2.19197 creating a project
from an u ...)
NOT-FOR-US: JetBrains
@@ -10087,6 +10593,7 @@ CVE-2026-18413 (The ADC API requires each driver to
reject a sampling sequence w
CVE-2026-16513 (The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles()
in subsys ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-102422 (shell-quote's `quote()` function emits a `{ comment }` token
as `#` fo ...)
+ {DSA-6548-1}
- node-shell-quote 1.12.0-1 (bug #1149713)
NOTE:
https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv
NOTE: Fixed by:
https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc
(v1.11.0)
@@ -81747,7 +82254,7 @@ CVE-2026-34966 (Gitea prior to 1.27.0 contains a
server-side request forgery vul
- gitea <removed>
CVE-2026-21766 (The default login portlet in HCL Digital Experience and
Digital Experi ...)
NOT-FOR-US: HCL
-CVE-2026-19028 (H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through
2.3.0 comput ...)
+CVE-2026-19028 (H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior
to2.3.0 comput ...)
- hdf5 <unfixed> (unimportant)
NOTE: https://github.com/HDFGroup/hdf5/pull/6497
NOTE: https://github.com/HDFGroup/hdf5/issues/6488
@@ -81759,7 +82266,7 @@ CVE-2026-19027 (The H5Z__nbit_decompress_one_byte,
H5Z__nbit_decompress_one_noop
NOTE: https://github.com/HDFGroup/hdf5/issues/6489
NOTE: https://github.com/HDFGroup/hdf5/issues/6492
NOTE: HDF not covered by security support, see
https://bugs.debian.org/1117722
-CVE-2026-19026 (H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0
dereferences cd_va ...)
+CVE-2026-19026 (H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0
dereferences cd_v ...)
- hdf5 <unfixed> (unimportant)
NOTE: https://github.com/HDFGroup/hdf5/pull/6497
NOTE: https://github.com/HDFGroup/hdf5/issues/6489
@@ -85905,6 +86412,7 @@ CVE-2026-56846 (A flaw in Node.js HTTP/2 handling can
cause HTTP/2 retained head
NOTE:
https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http2-retained-headers-can-bypass-maxsessionmemory-limits-cve-2026-56846---high
NOTE: Fixed by:
https://github.com/nodejs/node/commit/f14d78b9e0201bfe0291f2b0dc4b5d88c70cc28e
(v22.23.2)
CVE-2026-66066 (Action Pack is a framework for handling and responding to web
requests ...)
+ {DSA-6546-1}
- rails 2:7.2.3.2+dfsg-1 (bug #1143080)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
NOTE: Fixed by:
https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a
(v7.2.3.2)
@@ -104935,7 +105443,7 @@ CVE-2026-45646 (Allocation of resources without
limits or throttling in ASP.NET
CVE-2026-45496 (Improper limitation of a pathname to a restricted directory
('path tra ...)
NOT-FOR-US: Microsoft
CVE-2026-45363 (ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON
Web Token ...)
- {DLA-4787-1}
+ {DSA-6547-1 DLA-4787-1}
- ruby-jwt 3.2.0-1
NOTE:
https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x
NOTE: Fixed by:
https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f
(v3.2.0)
@@ -119636,6 +120144,7 @@ CVE-2026-1840 (The Aclara Metrum Cellular Web
Interface is vulnerable to unautho
CVE-2026-1606 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-13311 (shell-quote prior to 1.8.5 finalizes parsed tokens in parse()
using Ar ...)
+ {DSA-6548-1}
- node-shell-quote 1.9.0+~1.7.5-1 (bug #1140921)
[bookworm] - node-shell-quote <postponed> (Minor issue;
quadratic-complexity DoS in parse(), reachable only where a service parses
attacker-supplied strings)
NOTE:
https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv
@@ -178288,6 +178797,7 @@ CVE-2026-33664 (Kestra is an open-source,
event-driven orchestration platform Ve
CVE-2026-33661 (Pay is an open-source payment SDK extension package for
various Chines ...)
NOT-FOR-US: Pay
CVE-2026-33658 (Active Storage allows users to attach cloud and local files in
Rails a ...)
+ {DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, DoS)
@@ -181918,6 +182428,7 @@ CVE-2026-33241 (Salvo is a Rust web framework. Prior
to version 0.89.3, Salvo's
CVE-2026-33211 (Tekton Pipelines project provides k8s-style resources for
declaring CI ...)
NOT-FOR-US: Tekton Pipelines project
CVE-2026-33202 (Active Storage allows users to attach cloud and local files in
Rails a ...)
+ {DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, path traversal in unlikely
scenario)
@@ -181926,6 +182437,7 @@ CVE-2026-33202 (Active Storage allows users to attach
cloud and local files in R
NOTE: Fixed by:
https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82
(v7.2.3.1)
CVE-2026-33195 (Active Storage allows users to attach cloud and local files in
Rails a ...)
+ {DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, path traversal in unlikely
scenario)
@@ -181934,6 +182446,7 @@ CVE-2026-33195 (Active Storage allows users to attach
cloud and local files in R
NOTE: Fixed by:
https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c
(v7.2.3.1)
CVE-2026-33176 (Active Support is a toolkit of support libraries and Ruby core
extensi ...)
+ {DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, DoS)
@@ -181942,6 +182455,7 @@ CVE-2026-33176 (Active Support is a toolkit of
support libraries and Ruby core e
NOTE: Fixed by:
https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a
(v7.2.3.1)
CVE-2026-33174 (Active Storage allows users to attach cloud and local files in
Rails a ...)
+ {DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, DoS)
@@ -181950,6 +182464,7 @@ CVE-2026-33174 (Active Storage allows users to attach
cloud and local files in R
NOTE: Fixed by:
https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b
(v7.2.3.1)
CVE-2026-33173 (Active Storage allows users to attach cloud and local files in
Rails a ...)
+ {DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, automatic content type
bypass)
@@ -181958,6 +182473,7 @@ CVE-2026-33173 (Active Storage allows users to attach
cloud and local files in R
NOTE: Fixed by:
https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
(v7.2.3.1)
CVE-2026-33170 (Active Support is a toolkit of support libraries and Ruby core
extensi ...)
+ {DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, XSS)
@@ -181966,6 +182482,7 @@ CVE-2026-33170 (Active Support is a toolkit of
support libraries and Ruby core e
NOTE: Fixed by:
https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb
(v7.2.3.1)
CVE-2026-33169 (Active Support is a toolkit of support libraries and Ruby core
extensi ...)
+ {DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, DoS)
@@ -181974,6 +182491,7 @@ CVE-2026-33169 (Active Support is a toolkit of
support libraries and Ruby core e
NOTE: Fixed by:
https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974
(v7.2.3.1)
CVE-2026-33168 (Action View provides conventions and helpers for building web
pages wi ...)
+ {DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, XSS)
@@ -268780,7 +269298,7 @@ CVE-2025-9019 (A vulnerability has been found in
tcpreplay 4.5.1. This vulnerabi
NOTE: https://github.com/appneta/tcpreplay/issues/959
CVE-2025-9017 (A vulnerability has been found in PHPGurukul Zoo Management
System 2.1 ...)
NOT-FOR-US: PHPGurukul
-CVE-2025-9016 (A vulnerability was identified in Mechrevo Control Center GX V2
5.56.5 ...)
+CVE-2025-9016 (A vulnerability has been found in Mechrevo Control Center GX V2
5.56.5 ...)
NOT-FOR-US: Mechrevo Control Center GX V2
CVE-2025-9013 (A vulnerability has been found in PHPGurukul Online Shopping
Portal Pr ...)
NOT-FOR-US: PHPGurukul
@@ -268808,7 +269326,7 @@ CVE-2025-9002 (A vulnerability was identified in
Surbowl dormitory-management-ph
NOT-FOR-US: Surbowl dormitory-management-php
CVE-2025-9001 (A vulnerability was determined in LemonOS up to
nightly-2024-07-12 on ...)
NOT-FOR-US: LemonOS
-CVE-2025-9000 (A vulnerability was found in Mechrevo Control Center GX V2
5.56.51.48. ...)
+CVE-2025-9000 (A vulnerability was detected in Mechrevo Control Center GX V2
5.56.51. ...)
NOT-FOR-US: Mechrevo Control Center GX V2
CVE-2025-8993 (A vulnerability was found in itsourcecode Online Tour and
Travel Manag ...)
NOT-FOR-US: itsourcecode System
@@ -293297,7 +293815,7 @@ CVE-2025-35003 (Improper Restriction of Operations
within the Bounds of a Memory
NOT-FOR-US: Apache NuttX RTOS
CVE-2025-5155 (A vulnerability has been found in qianfox FoxCMS 1.2.5 and
classified ...)
NOT-FOR-US: FoxCMS
-CVE-2025-5154 (A vulnerability, which was classified as problematic, was found
in Pho ...)
+CVE-2025-5154 (A vulnerability was identified in PhonePe App 25.03.21.0 on
Android. T ...)
NOT-FOR-US: PhonePe app
CVE-2025-5153 (A vulnerability, which was classified as problematic, has been
found i ...)
NOT-FOR-US: CMS Made Simple
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f14af091be4d82fc601e103cdc2f2f91635e5948
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f14af091be4d82fc601e103cdc2f2f91635e5948
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
