Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
9030b991 by security tracker role at 2026-10-08T07:13:55+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,311 @@
+CVE-2026-97717 (CVE-2026-97717 is a vulnerability in the proxy sub-system of
Secure Ac ...)
+ TODO: check
+CVE-2026-97716 (CVE-2026-97716 is a vulnerability in the connection set up
sub-system ...)
+ TODO: check
+CVE-2026-97715 (CVE-2026-97715is a vulnerability in the client registration
process of ...)
+ TODO: check
+CVE-2026-97714 (CVE-2026-97714 is a is a vulnerability in the authentication
sub-syste ...)
+ TODO: check
+CVE-2026-97664
+ REJECTED
+CVE-2026-94587 (A buffer overflow vulnerability exists in the WebTools
administrative ...)
+ TODO: check
+CVE-2026-94586 (A command injection vulnerability exists in the WebTools
administrativ ...)
+ TODO: check
+CVE-2026-94585 (An authentication bypass vulnerability exists in the web
management in ...)
+ TODO: check
+CVE-2026-94584 (A race condition and thread-safety vulnerability exists in the
web man ...)
+ TODO: check
+CVE-2026-94583 (A race condition vulnerability exists in the request
processing logic ...)
+ TODO: check
+CVE-2026-94582 (A memory buffer overflow vulnerability exists in the internal
diagnost ...)
+ TODO: check
+CVE-2026-94581 (An OS command injection vulnerability exists in the REST API
managemen ...)
+ TODO: check
+CVE-2026-94580 (An arbitrary file and directory deletion vulnerability exists
in the R ...)
+ TODO: check
+CVE-2026-94579 (An OS command injection vulnerability exists in the PAM
(Pluggable Aut ...)
+ TODO: check
+CVE-2026-94578 (Brocade Fabric OS versions before 10.0.1 contain an
authorization logi ...)
+ TODO: check
+CVE-2026-94577 (A privilege escalation vulnerability exists in the internal
Command-Li ...)
+ TODO: check
+CVE-2026-94576 (An authentication logic and privilege escalation vulnerability
exists ...)
+ TODO: check
+CVE-2026-94575 (A logic vulnerability in Brocade Fabric OS versions before
10.0.1 web ...)
+ TODO: check
+CVE-2026-94275 (The Track Orders for WooCommerce WordPress plugin before
1.2.7 does n ...)
+ TODO: check
+CVE-2026-94258 (The SMS Alert WordPress plugin before 4.0.1 does not check
that the a ...)
+ TODO: check
+CVE-2026-94246 (The Wallet System for WooCommerce WordPress plugin before
2.8.0 does ...)
+ TODO: check
+CVE-2026-94245 (The Wallet System for WooCommerce WordPress plugin before
2.8.0 does ...)
+ TODO: check
+CVE-2026-94244 (The Wallet System for WooCommerce WordPress plugin before
2.8.0 does ...)
+ TODO: check
+CVE-2026-94154 (The Aurora Heatmap plugin for WordPress is vulnerable to
Stored Cross- ...)
+ TODO: check
+CVE-2026-92862 (The Android application "Ticket Ryutsu Center" improperly
handles cust ...)
+ TODO: check
+CVE-2026-92861 (The Android application "Ticket Ryutsu Center" contains
hard-coded cre ...)
+ TODO: check
+CVE-2026-89322 (Vault and Vault Enterprise did not consistently evaluate ACL
policies ...)
+ TODO: check
+CVE-2026-87726 (Insufficient API bounds checking in phalFelica in NXP
NXPNfcRdLib RC66 ...)
+ TODO: check
+CVE-2026-87688 (An input validation vulnerability exists in the security
certificate m ...)
+ TODO: check
+CVE-2026-87687 (An authorization and input validation vulnerability exists in
Brocade ...)
+ TODO: check
+CVE-2026-87686 (An authentication and access control bypass vulnerability
exists in th ...)
+ TODO: check
+CVE-2026-87685 (An arbitrary file manipulation vulnerability exists in the
WebTools ma ...)
+ TODO: check
+CVE-2026-87684 (A stack-based buffer overflow vulnerability exists in the SNMP
daemon ...)
+ TODO: check
+CVE-2026-87683 (Multiple stack-based buffer overflow vulnerabilities exist in
the REST ...)
+ TODO: check
+CVE-2026-87682 (Multiple OS Command Injection vulnerabilities exist in the
management ...)
+ TODO: check
+CVE-2026-87681 (An Access Control Bypass vulnerability exists in the
Role-Based Access ...)
+ TODO: check
+CVE-2026-87680 (A command injection vulnerability in the REST API management
interface ...)
+ TODO: check
+CVE-2026-87679 (When Brocade Fabric OS versions before 10.0.1 processes trunk
configur ...)
+ TODO: check
+CVE-2026-87678 (An input validation and output encoding vulnerability exists
in the we ...)
+ TODO: check
+CVE-2026-87677 (An OS command injection vulnerability exists in the account
management ...)
+ TODO: check
+CVE-2026-87676 (A stack-based buffer overflow vulnerability exists in the
security lib ...)
+ TODO: check
+CVE-2026-87675 (An OS command injection vulnerability exists in the
configuration mana ...)
+ TODO: check
+CVE-2026-87674 (A local privilege escalation vulnerability exists in the
system loggin ...)
+ TODO: check
+CVE-2026-87673 (An OS command injection vulnerability exists in maintenance
command-li ...)
+ TODO: check
+CVE-2026-87672 (An information disclosure vulnerability exists in the
SupportLink diag ...)
+ TODO: check
+CVE-2026-87671 (An out-of-bounds memory read vulnerability exists in the web
managemen ...)
+ TODO: check
+CVE-2026-87670 (An authorization logic vulnerability exists in the Brocade
Fabric OS v ...)
+ TODO: check
+CVE-2026-87669 (A missing authorization check in Brocade Fabric OS versions
before 10. ...)
+ TODO: check
+CVE-2026-87668 (A stack-based buffer overflow vulnerability exists in the
diagnostic e ...)
+ TODO: check
+CVE-2026-87667 (An argument injection vulnerability exists in the
configuration manage ...)
+ TODO: check
+CVE-2026-87666 (An OS command injection vulnerability exists in the time and
zone mana ...)
+ TODO: check
+CVE-2026-87665 (A stack-based buffer overflow vulnerability exists in the
Internet Key ...)
+ TODO: check
+CVE-2026-87664 (A session context forgery vulnerability exists in the web
management d ...)
+ TODO: check
+CVE-2026-87663 (An authentication bypass and command injection vulnerability
exists in ...)
+ TODO: check
+CVE-2026-87662 (Brocade Fabric versions before 9.2.2d and 10.0.0 through
10.0.0a1 hand ...)
+ TODO: check
+CVE-2026-87661 (Brocade Fabric OS versions before 9.2.2d and 10.0.0 through
10.0.0a1 d ...)
+ TODO: check
+CVE-2026-87660 (An improper file permission and missing authorization
vulnerability ex ...)
+ TODO: check
+CVE-2026-87659 (A critical authorization bypass vulnerability exists in the
Management ...)
+ TODO: check
+CVE-2026-87428 (In Brocade ASCG before 3.5.0, a local unauthorized user on the
ASCG VM ...)
+ TODO: check
+CVE-2026-87426 (An unauthenticated network-based attacker can query specific
internal ...)
+ TODO: check
+CVE-2026-87425 (An unauthenticated remote attacker can modify the TLS client
trust sto ...)
+ TODO: check
+CVE-2026-87424 (A vulnerability in the SupportLink API authentication
component of Bro ...)
+ TODO: check
+CVE-2026-86828 (The BackWPup WordPress plugin before 5.7.7 does not properly
restrict ...)
+ TODO: check
+CVE-2026-86827 (The BackWPup WordPress plugin before 5.7.7 does not verify
that a req ...)
+ TODO: check
+CVE-2026-86826 (The BackWPup WordPress plugin before 5.7.7 does not properly
restrict ...)
+ TODO: check
+CVE-2026-85490 (When Brocade ASCG before 3.5.0 processes support bundle
archives inges ...)
+ TODO: check
+CVE-2026-85489 (An authentication flaw exists in the Brocade ASCG
administrative manag ...)
+ TODO: check
+CVE-2026-85488 (Brocade ASCG before 3.5.0 has a well-known Brocade default
password em ...)
+ TODO: check
+CVE-2026-85487 (A path traversal vulnerability exists in the HTTP service
component of ...)
+ TODO: check
+CVE-2026-85486 (Brocade ASCG before 3.5.0 improperly processes user input by
evaluatin ...)
+ TODO: check
+CVE-2026-85423 (A vulnerability has been identified in the data collection
service of ...)
+ TODO: check
+CVE-2026-85422 (A vulnerability in Brocade ASCG version before 3.5.0 could
allow an at ...)
+ TODO: check
+CVE-2026-85421 (A critical security vulnerability has been identified in
Brocade ASCG ...)
+ TODO: check
+CVE-2026-85097 (The Bricksforge plugin for WordPress is vulnerable to
unauthenticated ...)
+ TODO: check
+CVE-2026-82627 (The Uncanny Automator \u2013 AI + Automation for WordPress |
AI Agent, ...)
+ TODO: check
+CVE-2026-76286 (In Splunk MCP Server versions below 1.2.1, Splunk MCP Server
could sen ...)
+ TODO: check
+CVE-2026-76285 (Improper Adherence to Coding Standards. Splunk addressed
multiple inte ...)
+ TODO: check
+CVE-2026-76284 (Improper Neutralization. Splunk addressed multiple internally
identifi ...)
+ TODO: check
+CVE-2026-76283 (Protection Mechanism Failure. Splunk addressed multiple
internally ide ...)
+ TODO: check
+CVE-2026-76282 (Improper Control of a Resource Through its Lifetime. Splunk
addressed ...)
+ TODO: check
+CVE-2026-76281 (Improper Access Control. Splunk addressed multiple internally
identifi ...)
+ TODO: check
+CVE-2026-76280 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,
and 9.4.1 ...)
+ TODO: check
+CVE-2026-76279 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,
and 9.4.1 ...)
+ TODO: check
+CVE-2026-76278 (In Splunk Enterprise versions below 10.4.3, 10.2.7, and
10.0.10, a use ...)
+ TODO: check
+CVE-2026-76277 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,
and 9.4.1 ...)
+ TODO: check
+CVE-2026-76276 (In Splunk Enterprise versions below 10.4.3, 10.2.7, and
10.0.10, a low ...)
+ TODO: check
+CVE-2026-76275 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,
and 9.4.1 ...)
+ TODO: check
+CVE-2026-76274 (In Splunk Enterprise versions below 10.4.3, 10.2.7, and
10.0.10, a use ...)
+ TODO: check
+CVE-2026-76273 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,
and 9.4.1 ...)
+ TODO: check
+CVE-2026-76272 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,
and 9.4.1 ...)
+ TODO: check
+CVE-2026-76271 (In Splunk Enterprise versions below 10.4.3, 10.2.7, and
10.0.10, a low ...)
+ TODO: check
+CVE-2026-76270 (In Splunk Enterprise versions below 10.4.3, a user that holds
a role w ...)
+ TODO: check
+CVE-2026-76269 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,
and 9.4.1 ...)
+ TODO: check
+CVE-2026-76268 (In Splunk Enterprise versions below 10.4.3 and 10.2.7, an
unauthentica ...)
+ TODO: check
+CVE-2026-76267 (In Splunk Enterprise versions below 10.4.3, 10.2.7, and
10.0.10, a use ...)
+ TODO: check
+CVE-2026-76266 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,
and 9.4.1 ...)
+ TODO: check
+CVE-2026-76265 (In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10,
and 9.4.1 ...)
+ TODO: check
+CVE-2026-76264 (In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10,
and 9.4.1 ...)
+ TODO: check
+CVE-2026-5769 (A vulnerability in Brocade SANnav before 3.0.1 can have the
Brocade Fa ...)
+ TODO: check
+CVE-2026-5049 (A path traversal vulnerability affects the The Zone Alias
Import flow ...)
+ TODO: check
+CVE-2026-5048 (In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability
in var ...)
+ TODO: check
+CVE-2026-5047 (A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0
prints encod ...)
+ TODO: check
+CVE-2026-34499 (Use of hard-coded cryptographic key vulnerability in Johnson
Controls ...)
+ TODO: check
+CVE-2026-17609 (The Super Forms \u2013 Drag & Drop Form Builder plugin for
WordPress i ...)
+ TODO: check
+CVE-2026-17538 (The LatePoint - Appointment Booking & Reservation plugin for
WordPress ...)
+ TODO: check
+CVE-2026-17196 (The Super Forms \u2013 Drag & Drop Form Builder plugin for
WordPress i ...)
+ TODO: check
+CVE-2026-107459 (The SecuShare Pro developed by Openfind has an OS Command
Injection vu ...)
+ TODO: check
+CVE-2026-107450 (In Stump through 0.1.10, the updateSmartList and
deleteSmartList Graph ...)
+ TODO: check
+CVE-2026-107449 (linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher
SSRF pro ...)
+ TODO: check
+CVE-2026-107448 (Magic: The Gathering Arena (Windows/Steam client;
2026.59.30.12801.127 ...)
+ TODO: check
+CVE-2026-107446 (containerd overlaybd through 1.0.18 has a do_load_index (LSMT
index lo ...)
+ TODO: check
+CVE-2026-107445 (A flaw was found in Katello where the Flatpak Remote
Repositories API ...)
+ TODO: check
+CVE-2026-107444 (A flaw was found in Katello where the Docker Tags
repositories API doe ...)
+ TODO: check
+CVE-2026-107355
+ REJECTED
+CVE-2026-107354
+ REJECTED
+CVE-2026-107353 (traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through
0.4.6, 0.5. ...)
+ TODO: check
+CVE-2026-107352 (Missing authorization checks in Amazon Athena engine version
3 request ...)
+ TODO: check
+CVE-2026-107315 (pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through
42.7.13 pa ...)
+ TODO: check
+CVE-2026-107314 (pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through
42.7.13 e ...)
+ TODO: check
+CVE-2026-107285 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107284 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107283 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107282 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107281 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107280 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107279 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107232 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107231 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107230 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107229 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107228 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107227 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
+ TODO: check
+CVE-2026-107176 (A flaw was found in the cluster-samples-operator. The RBAC
Role coreos ...)
+ TODO: check
+CVE-2026-107161 (A heap-based buffer overflow flaw was found in Cyrus SASL.
The add_to_ ...)
+ TODO: check
+CVE-2026-105820 (Vault's ACL policy cache allowed namespace traversal when
policy names ...)
+ TODO: check
+CVE-2026-105818 (Vault's PKI secrets engine ACME server did not restrict
certificate id ...)
+ TODO: check
+CVE-2026-105816 (Vault and Vault Enterprise did not consistently verify that
stored plu ...)
+ TODO: check
+CVE-2026-105260 (The Database Addon For WPForms ( wpforms entries ) WordPress
plugin b ...)
+ TODO: check
+CVE-2026-105198 (The Appointment Booking Plugin WordPress plugin before 5.7.3
does not ...)
+ TODO: check
+CVE-2026-105197 (The Appointment Booking Plugin WordPress plugin before 5.6.5
does not ...)
+ TODO: check
+CVE-2026-105196 (The Appointment Booking Plugin WordPress plugin before 5.6.9
does not ...)
+ TODO: check
+CVE-2026-105195 (The Booking Calendar WordPress plugin before 11.8.3 does not
adequatel ...)
+ TODO: check
+CVE-2026-105194 (The Easy Digital Downloads WordPress plugin before 3.7.1
does not res ...)
+ TODO: check
+CVE-2026-105193 (The Booking Calendar WordPress plugin before 11.8 does not
generate it ...)
+ TODO: check
+CVE-2026-104646 (The Image Photo Gallery Final Tiles Grid WordPress plugin
before 3.6.1 ...)
+ TODO: check
+CVE-2026-104645 (The Image Photo Gallery Final Tiles Grid WordPress plugin
before 3.6.1 ...)
+ TODO: check
+CVE-2026-103692 (The Frontend Dashboard WordPress plugin before 3.0.5 does not
perform ...)
+ TODO: check
+CVE-2026-103646 (The Ultimate Multisite WordPress plugin before 2.17.0 does
not requir ...)
+ TODO: check
+CVE-2026-103309 (The GPTranslate WordPress plugin before 2.34.14 does not
properly res ...)
+ TODO: check
+CVE-2026-102488 (In affected versions, Octopus Server incorrectly evaluates
multiple sc ...)
+ TODO: check
+CVE-2024-8122 (The WSO2 Identity Server fails to enforce a default expiry time
for SM ...)
+ TODO: check
+CVE-2023-5649 (An Improper Input Validation vulnerability for the registered
case cre ...)
+ TODO: check
+CVE-2023-5648 (In Brocade ASCG before Brocade ASCG v3.0, several
security-related HTT ...)
+ TODO: check
+CVE-2017-20283 (NXP MQX Classic before 5.0 contains an out-of-bounds write
vulnerabili ...)
+ TODO: check
CVE-2026-84790
- openvpn 2.7.8-1
NOTE: Fixed by:
https://github.com/OpenVPN/openvpn/commit/cf4384eef4676a01bd3ee98fa602f7b2af8079ea
(v2.7.8)
@@ -558,7 +866,7 @@ CVE-2026-95106 (Gitea accepted pushed Git trees containing
two entries with the
NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-94205 (Gitea Actions decided whether a fork pull request run needed
approval ...)
NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
-CVE-2026-94114 (Symbolic name not mapping to correct object vulnerability in
Apache Co ...)
+CVE-2026-94114 (Symbolic name not mapping to correct class. BCEL caches
attacker-co ...)
- bcel <unfixed> (bug #1150215)
[trixie] - bcel <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/07/12
@@ -3160,7 +3468,7 @@ CVE-2026-39723 (Unauthenticated Broken Access Control in
Morning for WooCommerce
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39599 (Contributor Broken Access Control in WDS MCP Content Manager
<= 3.10.4 ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-32582 (Contributor Broken Access Control in IATO MCP <= 1.11.0
versions.)
+CVE-2026-32582 (Missing Authorization vulnerability in iatoai IATO MCP
iato-mcp allows ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-32576 (Authorization Bypass Through User-Controlled Key vulnerability
in ZWEI ...)
NOT-FOR-US: WordPress plugin or theme
@@ -9061,6 +9369,7 @@ CVE-2026-27371 (Unauthenticated Cross Site Scripting
(XSS) in WPFunnels <= 3.13.
CVE-2026-27085 (Shop manager Content Injection in Astra WordPress Theme <=
4.13.12 ver ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-19553 (ssl.SSLContext.wrap_bio() didn't require the server_hostname
argument ...)
+ {DLA-4827-1}
- python3.15 3.15.0~rc3-1
- python3.14 3.14.8-1
- python3.13 <unfixed>
@@ -9374,6 +9683,7 @@ CVE-2026-100253 (In JetBrains TeamCity before 2026.2,
2026.1.4, 2025.11.8 sand
CVE-2025-14564 (The Viable URL Media Uploader plugin for WordPress is
vulnerable to St ...)
NOT-FOR-US: WordPress plugin
CVE-2026-19445 (A remote, unauthenticated TLS client can make a server crash
or call t ...)
+ {DLA-4827-1}
- python3.15 3.15.0~rc3-1
- python3.14 3.14.8-1
- python3.13 <unfixed>
@@ -16302,7 +16612,7 @@ CVE-2026-12227 (The Visual Composer Website Builder
plugin for WordPress is vuln
NOT-FOR-US: WordPress plugin
CVE-2025-32000 (HCL Sametime is vulnerable to insufficient input sanitization.
The app ...)
NOT-FOR-US: HCL
-CVE-2026-107363 [OSSA-2026-043]
+CVE-2026-107363 (In OpenStack Zaqar before 23.0.1, the WebSocket transport
fails to bin ...)
- zaqar 23.0.0-2 (bug #1150261)
NOTE: https://security.openstack.org/ossa/OSSA-2026-043.html
NOTE: https://bugs.launchpad.net/ossa/+bug/2161402
@@ -57211,6 +57521,7 @@ CVE-2026-16233 (There is a memory corruption
vulnerability recently discovered i
CVE-2026-16231 (hbs is an Express view engine that wraps Handlebars. Its
registerAsync ...)
NOT-FOR-US: express-hbs
CVE-2026-15310 (When decompressing crafted zip files using the
bzip/LZMA/Zstandard c ...)
+ {DLA-4827-1}
- python3.15 3.15.0~rc2-1
- python3.14 3.14.7-3
- python3.13 <unfixed>
@@ -65956,6 +66267,7 @@ CVE-2026-17106 (The tar extraction routines in
moby/go-archive (Unpack, UnpackLa
- golang-github-moby-go-archive 0.3.3-1 (bug #1145200)
NOTE:
https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
CVE-2026-17084 (The "stringprep" module didn't process characters from RFC
3454 tables ...)
+ {DLA-4827-1}
- python3.15 3.15.0~rc2-1
- python3.14 3.14.7-3
- python3.13 <unfixed>
@@ -65976,6 +66288,7 @@ CVE-2026-17084 (The "stringprep" module didn't process
characters from RFC 3454
CVE-2026-16309 (Authorization bypass through User-Controlled key vulnerability
in Neti ...)
NOT-FOR-US: EdoWEB
CVE-2026-15806 (The HTTPPasswordMgr class in the urllib.request module, along
with its ...)
+ {DLA-4827-1}
- python3.15 3.15.0~rc2-1
- python3.14 3.14.7-3
- python3.13 <unfixed>
@@ -78515,6 +78828,7 @@ CVE-2026-19404 (A flaw was found in 389 Directory
Server. The CleanAllRUV and Ab
CVE-2026-19278 (A flaw was found in StackRox/RHACS Central's Auth
Machine-to-Machine ( ...)
NOT-FOR-US: Red Hat Advanced Cluster Security
CVE-2026-18503 (Attacker-controlled CSV samples can trigger super-linear
regular-expr ...)
+ {DLA-4827-1}
- python3.15 3.15.0~rc1-1
- python3.14 3.14.7-1
- python3.13 3.13.15-1
@@ -108929,6 +109243,7 @@ CVE-2026-1989 (Authorization bypass through
User-Controlled key vulnerability in
CVE-2026-1365 (Insertion of sensitive information into sent data vulnerability
in Say ...)
NOT-FOR-US: OSOS
CVE-2026-15308 (The incremental HTML parser (html.parser.HTMLParser) allows
for CPU de ...)
+ {DLA-4827-1}
- python3.14 3.14.7-1
- python3.13 3.13.15-1
[trixie] - python3.13 <no-dsa> (Minor issue)
@@ -132633,6 +132948,7 @@ CVE-2026-11701 (Inappropriate implementation in Guest
View in Google Chrome prio
- chromium 149.0.7827.102-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9669 (bz2.BZ2Decompressor objects could be reused after a
decompression erro ...)
+ {DLA-4827-1}
- python3.14 3.14.6-1
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u3
@@ -136645,6 +136961,7 @@ CVE-2022-49036 (An inclusion of functionality from
untrusted control sphere vuln
CVE-2019-25720 (Dr\xe4ger SC Monitoring devices (SC 6002XL, SC 6802XL, SC
7000, SC 800 ...)
NOT-FOR-US: Draeger
CVE-2026-3276 (unicodedata.normalize() can take excessive CPU time when
processing sp ...)
+ {DLA-4827-1}
- python3.14 3.14.6-1
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u3
@@ -150171,6 +150488,7 @@ CVE-2026-8367 (aria2c accepts a server certificate
with incorrect Extended Key U
[bullseye] - aria2 <postponed> (Minor issue, revisit when fixed
upstream)
NOTE: https://github.com/aria2/aria2/issues/2355
CVE-2026-8328 (The ftpcp() function in Lib/ftplib.py was not updated when
CVE-2021-4 ...)
+ {DLA-4827-1}
- python3.14 3.14.6-1
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u3
@@ -164715,6 +165033,7 @@ CVE-2026-6878 (A vulnerability was identified in
ByteDance verl up to 0.7.0. Aff
CVE-2026-6874 (A vulnerability was determined in ericc-ch copilot-api up to
0.7.0. Th ...)
NOT-FOR-US: ericc-ch copilot-api
CVE-2026-6019 (http.cookies.Morsel.js_output() returns an inline <script>
snippet and ...)
+ {DLA-4827-1}
- python3.14 3.14.5~rc1-1
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u2
@@ -171430,6 +171749,7 @@ CVE-2026-22750 (When configuring SSL bundles in
Spring Cloud Gateway by using th
CVE-2026-22560 (An open redirect vulnerability in Rocket.Chat versions prior
to 8.4.0 ...)
NOT-FOR-US: Rocket.Chat
CVE-2026-1502 (CR/LF bytes were not rejected by HTTP client proxy tunnel
headers or h ...)
+ {DLA-4827-1}
- python3.14 3.14.5-1
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u3
@@ -172363,7 +172683,7 @@ CVE-2025-14551 (In Ubuntu, Subiquity version 24.04.4
could leak sensitive user c
NOT-FOR-US: Subiquity
CVE-2024-1490 (An authenticated remote attacker with high privileges can
exploit the ...)
NOT-FOR-US: WAGO
-CVE-2026-1403
+CVE-2026-1403 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- gitlab <removed>
CVE-2026-93602 (rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5
contain fau ...)
- rust-rustls-webpki 0.103.10+ds-1 (bug #1133085)
@@ -191885,6 +192205,7 @@ CVE-2025-70230 (Stack buffer overflow vulnerability
in D-Link DIR-513 v1.10 via
CVE-2025-70229 (Stack buffer overflow vulnerability in D-Link DIR-513 v1.10
via the cu ...)
NOT-FOR-US: D-Link
CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where
malformed HT ...)
+ {DLA-4827-1}
- python3.14 <not-affected> (Fixed before initial upload to Debian
unstable)
- python3.13 3.13.4-1
- python3.11 <removed>
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9030b99138e1331ffa697423fbef5c3b6509dd90
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9030b99138e1331ffa697423fbef5c3b6509dd90
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
