Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
6f8217a0 by Moritz Muehlenhoff at 2026-10-08T20:10:12+02:00
bugnums
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -241,71 +241,71 @@ CVE-2026-107355
CVE-2026-107354
REJECTED
CVE-2026-107353 (traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through
0.4.6, 0.5. ...)
- - node-traverse <unfixed>
+ - node-traverse <unfixed> (bug #1150332)
NOTE:
https://github.com/ljharb/js-traverse/security/advisories/GHSA-rj28-8w7x-jmqc
NOTE:
https://github.com/ljharb/js-traverse/commit/81ccab43e379cf42eb2a5f689630f7f79b3d71b8
(v0.6.12)
NOTE:
https://github.com/ljharb/js-traverse/commit/37a9ebd103d2a259c824c29cdcc3f0dfe1acffce
(v0.6.12)
CVE-2026-107352 (Missing authorization checks in Amazon Athena engine version
3 request ...)
NOT-FOR-US: Amazon
CVE-2026-107315 (pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through
42.7.13 pa ...)
- - libpgjava <unfixed>
+ - libpgjava <unfixed> (bug #1150330)
NOTE:
https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-f64h-wr5q-3qf3
NOTE:
https://github.com/pgjdbc/pgjdbc/commit/c8998c8e9632a7cdecb128dd7cd122d330b3598a
(REL42.7.14)
CVE-2026-107314 (pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through
42.7.13 e ...)
- - libpgjava <unfixed>
+ - libpgjava <unfixed> (bug #1150330)
[trixie] - libpgjava <not-affected> (Vulnerable code not present,
introduced in 42.7.11)
[bookworm] - libpgjava <not-affected> (Vulnerable code not present,
introduced in 42.7.11)
NOTE:
https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h
NOTE:
https://github.com/pgjdbc/pgjdbc/commit/a65ef98fe37bf0ecbd1a6331205cdb924985ed75
(REL42.7.14)
CVE-2026-107285 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - async-http-client <unfixed> (bug #1150331)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-3wp9-xfwm-rjjf
NOTE:
https://github.com/AsyncHttpClient/async-http-client/commit/c4feab0f7f86d61505a48e40d383c8a375a22e18
(async-http-client-project-2.16.1)
CVE-2026-107284 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - sync-http-client <unfixed> (bug #1150331)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-rwhr-j9rv-85f8
NOTE:
https://github.com/AsyncHttpClient/async-http-client/commit/75a278550aa9a980009d022fb4e635f9c8738c03
(async-http-client-project-2.16.1)
CVE-2026-107283 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - sync-http-client <unfixed> (bug #1150331)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mfj3-87qq-382v
NOTE:
https://github.com/AsyncHttpClient/async-http-client/commit/e1f5fc88fe211d3f64032c33b91093ba3d5e793d
(async-http-client-project-2.16.1)
CVE-2026-107282 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - sync-http-client <unfixed> (bug #1150331)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-jmqq-x5g9-9p2w
NOTE:
https://github.com/AsyncHttpClient/async-http-client/commit/bbc31aed3b044f9f7a126cf689a8c8d7ad2ae1cb
(async-http-client-project-2.16.1)
CVE-2026-107281 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - sync-http-client <unfixed> (bug #1150331)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-vvp4-63h8-v5pm
NOTE:
https://github.com/AsyncHttpClient/async-http-client/commit/73813babf51231ee79f7da4f07b777f19f48d34d
(async-http-client-project-2.16.1)
CVE-2026-107280 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - sync-http-client <unfixed> (bug #1150331)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-f9m8-cv68-674w
NOTE:
https://github.com/AsyncHttpClient/async-http-client/commit/d1f0ccec417092098d40242fee7dfac84bb3c21f
(async-http-client-project-2.16.1)
CVE-2026-107279 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- async-http-client <not-affected> (Only affects 3.x)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-qhv6-3pmh-95q4
CVE-2026-107232 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - sync-http-client <unfixed> (bug #1150331)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-v9f2-7rw2-gr2x
NOTE:
https://github.com/AsyncHttpClient/async-http-client/commit/3a625cb892233c0a6653ac68823a25ffbc80f393
(async-http-client-project-2.16.1)
CVE-2026-107231 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - sync-http-client <unfixed> (bug #1150331)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-rqf5-2wxv-rjf4
NOTE:
https://github.com/AsyncHttpClient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6
(async-http-client-project-2.16.1)
CVE-2026-107230 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - sync-http-client <unfixed> (bug #1150331)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-v2j5-22fr-j62r
NOTE:
https://github.com/AsyncHttpClient/async-http-client/commit/d3bb4d68b41acf5d3ab7541afa9fdfe7ec3ba054
(async-http-client-project-3.0.14)
CVE-2026-107229 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - sync-http-client <unfixed> (bug #1150331)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-qjr7-w8pj-pmv9
NOTE:
https://github.com/AsyncHttpClient/async-http-client/commit/7dc5bbc2d0a48aa2a9caf089a626dcfd333168e9
(async-http-client-project-3.0.14)
CVE-2026-107228 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - sync-http-client <unfixed> (bug #1150331)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-2jwh-9rmr-j4xf
NOTE:
https://github.com/AsyncHttpClient/async-http-client/commit/fd9763620725126c1c8bb0af1ceb9a7523099a5f
(async-http-client-project-3.0.14)
CVE-2026-107227 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - sync-http-client <unfixed> (bug #1150331)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x8v2-478q-2hvg
NOTE:
https://github.com/AsyncHttpClient/async-http-client/commit/b61637f30327f314b7693418f12ce141ac6b2b30
(async-http-client-project-3.0.14)
CVE-2026-107176 (A flaw was found in the cluster-samples-operator. The RBAC
Role coreos ...)
@@ -615,7 +615,7 @@ CVE-2026-107183 (llama.cpp before b11393 contains a
use-after-free and double fr
NOTE: https://github.com/ggml-org/llama.cpp/pull/29942
NOTE: Fixed by:
https://github.com/ggml-org/llama.cpp/commit/dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f
(b11393, v0.6.0)
CVE-2026-107181 (Telegram Desktop before 7.2.9 contains an IPC
record-separator injecti ...)
- - telegram-desktop <unfixed>
+ - telegram-desktop <unfixed> (bug #1150328)
NOTE:
https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
NOTE:
https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a
(v7.2.9)
CVE-2026-107180 (On MISP instances configured to require TOTP enrolment
(Security.otp_r ...)
@@ -20748,7 +20748,7 @@ CVE-2026-94490 (A security flaw has been discovered in
OctoPrint 1.0.0. Affected
CVE-2026-94489 (A vulnerability was identified in OctoPrint 1.0.0. Affected by
this vu ...)
- octoprint <itp> (bug #718591)
CVE-2026-94488 (Telegram Desktop before 6.9.4 allows XSS in the HTML exporter.
(The fi ...)
- - telegram-desktop <unfixed>
+ - telegram-desktop <unfixed> (bug #1150329)
NOTE: https://expatch.com/writeups/telegram-html-export-xss.html
NOTE:
https://github.com/telegramdesktop/tdesktop/commit/8457d13aa795fadf99c955d2a04f00ebc3c59df9
(v6.9.4)
CVE-2026-94426 (A vulnerability was determined in xuxueli xxl-job up to 3.5.0.
The imp ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6f8217a0aabb3686a5f2420aa9c27caeaa91c78f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6f8217a0aabb3686a5f2420aa9c27caeaa91c78f
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
