Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
54bf67fe by security tracker role at 2026-10-09T07:13:46+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,16 +1,866 @@
-CVE-2026-97147
+CVE-2026-9209 (mJobTime through build 15.7.3.32 contains an unauthenticated
SQL execu ...)
+ TODO: check
+CVE-2026-97076 (Executable Regular Expression Error vulnerability in WP Media
WP Rocke ...)
+ TODO: check
+CVE-2026-96207 (Improper certificate validation in Microsoft Partner Center
allows an ...)
+ TODO: check
+CVE-2026-95210 (Improper certificate validation in gnutls v3.8.13 causes the
applicati ...)
+ TODO: check
+CVE-2026-95209 (An issue in gnutls v3.8.13 causes legitimate CA certificates
to be rej ...)
+ TODO: check
+CVE-2026-95208 (An issue in the ConfirmNameConstraints() function
(wolfcrypt/src/asn.c ...)
+ TODO: check
+CVE-2026-95184 (Improper certificate validation in gnutls v3.8.13 causes the
applicati ...)
+ TODO: check
+CVE-2026-95125 (libming through 0.4.8 contains a heap buffer overflow in
r_readc() in ...)
+ TODO: check
+CVE-2026-95116 (An issue in libming through 0.4.8 allows a remote attacker to
cause a ...)
+ TODO: check
+CVE-2026-94510 (Authorization bypass through user-controlled key in Microsoft
Bookings ...)
+ TODO: check
+CVE-2026-93699 (Argument injection in WP Toolkit for cPanel allows local users
to exec ...)
+ TODO: check
+CVE-2026-93548 (The FooSales WordPress plugin before 1.43.3 does not verify
that an a ...)
+ TODO: check
+CVE-2026-93509 (The Wallet System for WooCommerce WordPress plugin before
2.8.0 does n ...)
+ TODO: check
+CVE-2026-93034 (SGLang contains an arbitrary code execution vulnerability
caused by th ...)
+ TODO: check
+CVE-2026-93017 (The `insights-operator-gather` ClusterRole grants the
operator's servi ...)
+ TODO: check
+CVE-2026-92990 (The SendPress Newsletters WordPress plugin through 1.26.1.20
protects ...)
+ TODO: check
+CVE-2026-92989 (The SendPress Newsletters WordPress plugin through 1.26.1.20
does not ...)
+ TODO: check
+CVE-2026-92555 (Insertion of sensitive information into sent data
vulnerability in AKI ...)
+ TODO: check
+CVE-2026-91844 (Unrestricted upload of file with dangerous type vulnerability
in \u013 ...)
+ TODO: check
+CVE-2026-89290 (Improper neutralization of Script-Related HTML tags in a web
page (bas ...)
+ TODO: check
+CVE-2026-89191 (Unsanitised input in the "template name" field of SQLView
KRIS's Workf ...)
+ TODO: check
+CVE-2026-89091 (A flaw was found in ansible-core. When installing a collection
with `a ...)
+ TODO: check
+CVE-2026-88931 (The Social Web Suite WordPress plugin through 4.1.12 does not
restric ...)
+ TODO: check
+CVE-2026-88648 (Incomplete X.509 implementation in GnuTLS v3.8.13 allows
attackers con ...)
+ TODO: check
+CVE-2026-88647 (A hostname verification bypass in GnuTLS v3.8.13 allows
attackers to c ...)
+ TODO: check
+CVE-2026-88257 (Improper Input Validation vulnerability in BeamMCP.Schema in
ScriptKit ...)
+ TODO: check
+CVE-2026-88131 (Deserialization of untrusted data in Microsoft Dataverse
allows an una ...)
+ TODO: check
+CVE-2026-87980 (IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow
a local ...)
+ TODO: check
+CVE-2026-87841 (The UnitechPay WordPress plugin through 1.0.6.3 does not
verify the a ...)
+ TODO: check
+CVE-2026-87110 (An unauthenticated user with network access to the Ops Manager
web por ...)
+ TODO: check
+CVE-2026-87109 (An authenticated Ops Manager organization member can retrieve
another ...)
+ TODO: check
+CVE-2026-87108 (An authenticated Ops Manager user with a read-only project
role can re ...)
+ TODO: check
+CVE-2026-86850 (The SKU Error Fixer for WooCommerce WordPress plugin through
1.0 does ...)
+ TODO: check
+CVE-2026-84891 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
+ TODO: check
+CVE-2026-84875 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
+ TODO: check
+CVE-2026-84290 (IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by
an improp ...)
+ TODO: check
+CVE-2026-84278 (IBM Guardium Data Protection 12.2 is affected by a command
injection v ...)
+ TODO: check
+CVE-2026-84276 (IBM Guardium Data Protection 12.2.2 is affected by a
denial-of-service ...)
+ TODO: check
+CVE-2026-84275 (IBM Guardium Data Protection 12.2 is vulnerable to path
traversal in t ...)
+ TODO: check
+CVE-2026-84274 (IBM Guardium Data Protection 12.2.2 is affected by a sensitive
informa ...)
+ TODO: check
+CVE-2026-84272 (IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to
missing ...)
+ TODO: check
+CVE-2026-84271 (IBM Guardium Data Protection 12.2 is vulnerable to a signature
verific ...)
+ TODO: check
+CVE-2026-84250 (IBM Guardium Data Protection 12.2 is vulnerable due to weak
cryptograp ...)
+ TODO: check
+CVE-2026-84249 (IBM Guardium Data Protection 12.2, and 12.2.2 could allow a
remote att ...)
+ TODO: check
+CVE-2026-84247 (IBM Guardium Data Protection 12.2 could allow a remote
authenticated a ...)
+ TODO: check
+CVE-2026-84246 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
+ TODO: check
+CVE-2026-84245 (IBM Guardium Data Protection 12.2 is vulnerable to a local
privilege e ...)
+ TODO: check
+CVE-2026-84244 (IBM Guardium Data Protection 12.2 IBM Security Guardium Data
Protectio ...)
+ TODO: check
+CVE-2026-84230 (IBM Guardium Data Protection 12.2.2 could allow a remote
attacker to c ...)
+ TODO: check
+CVE-2026-84209 (IBM Guardium Data Protection 12.2.2, and 12.1 could allow a
remote att ...)
+ TODO: check
+CVE-2026-84198 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
+ TODO: check
+CVE-2026-84058 (IBM Guardium Data Protection 12.0, 12.1, and 12.2is vulnerable
to a bu ...)
+ TODO: check
+CVE-2026-84057 (IBM Guardium Data Protection 12.2.2, and 12.1 could allow a
remote att ...)
+ TODO: check
+CVE-2026-84035 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
+ TODO: check
+CVE-2026-84032 (IBM Guardium Data Protection 12.2.2 could allow a remote
attacker to c ...)
+ TODO: check
+CVE-2026-83947 (Missing authorization in Azure Event Grid allows an authorized
attacke ...)
+ TODO: check
+CVE-2026-83943 (Exposure of sensitive information to an unauthorized actor in
Azure AP ...)
+ TODO: check
+CVE-2026-82900 (IBM Guardium Data Protection 12.2.2, and 12.1 could allow a
remote att ...)
+ TODO: check
+CVE-2026-82895 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
+ TODO: check
+CVE-2026-82344 (IBM Guardium Data Protection 12.0, 12.1is vulnerable to a
heap-based b ...)
+ TODO: check
+CVE-2026-82335 (IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to
a heap- ...)
+ TODO: check
+CVE-2026-82334 (IBM Guardium Data Protection 12.0, 12.1, 12.2is vulnerable to
a heap-b ...)
+ TODO: check
+CVE-2026-81932 (IBM Guardium Data Protection 12.0, 12.1, and 12.2is vulnerable
to SQL ...)
+ TODO: check
+CVE-2026-81929 (The Ocean Pro Demos and Ocean eComm Treasure Box plugins for
WordPress ...)
+ TODO: check
+CVE-2026-80381 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
+ TODO: check
+CVE-2026-7827 (A stack-based buffer overflow in the _RdbLoadEntity function of
the RD ...)
+ TODO: check
+CVE-2026-7826 (A heap-based out-of-bounds read in the
BufferSerializerIOv2_ReadBuffer ...)
+ TODO: check
+CVE-2026-79842 (An authentication bypass vulnerability exists in HPE
Intelligent Manag ...)
+ TODO: check
+CVE-2026-78407 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-78406 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-78401 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-78399 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-78388 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-77900 (Missing authentication for critical function in Azure App
Service allo ...)
+ TODO: check
+CVE-2026-75875 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
+ TODO: check
+CVE-2026-71896 (An authorization vulnerability in Apache DolphinScheduler
allows authe ...)
+ TODO: check
+CVE-2026-71895 (An authorization vulnerability in Apache DolphinScheduler
allows authe ...)
+ TODO: check
+CVE-2026-71183 (An authorization vulnerability in Apache DolphinScheduler
allows authe ...)
+ TODO: check
+CVE-2026-69435 (Missing authorization in Azure SRE Agent allows an authorized
attacker ...)
+ TODO: check
+CVE-2026-67693 (An issue in gnutls v.3.8.13 allows an attacker to obtain
sensitive inf ...)
+ TODO: check
+CVE-2026-66479 (Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web
/ Stella ...)
+ TODO: check
+CVE-2026-66087 (An authorization bypass vulnerability in Apache
DolphinScheduler allow ...)
+ TODO: check
+CVE-2026-66084 (An authorization bypass vulnerability in Apache
DolphinScheduler allow ...)
+ TODO: check
+CVE-2026-66082 (An authorization bypass vulnerability in Apache
DolphinScheduler allow ...)
+ TODO: check
+CVE-2026-62181
+ REJECTED
+CVE-2026-62171
+ REJECTED
+CVE-2026-62170
+ REJECTED
+CVE-2026-62167
+ REJECTED
+CVE-2026-62166
+ REJECTED
+CVE-2026-62163
+ REJECTED
+CVE-2026-62142 (Cross-Site Request Forgery (CSRF) vulnerability in Melapress
WP 2FA wp ...)
+ TODO: check
+CVE-2026-62128 (Missing Authorization vulnerability in Creator LMS Creator LMS
creator ...)
+ TODO: check
+CVE-2026-62127 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-61801 (The `github.com/moby/sys/user` package provides Go utilities
for parsi ...)
+ TODO: check
+CVE-2026-5759 (A double free and use-after-free vulnerability in the
RdbLoadDeletedNo ...)
+ TODO: check
+CVE-2026-50055 (A policy-enforcement flaw in Zimbra Collaboration Suite allows
an auth ...)
+ TODO: check
+CVE-2026-50054 (An authorization flaw in Zimbra Collaboration Suite\u2019s
GrantRights ...)
+ TODO: check
+CVE-2026-4894 (A vulnerability has been identified regarding insufficient
validation ...)
+ TODO: check
+CVE-2026-44038 (A global out-of-bounds read in the Huffman decoder of the
bundled IJG ...)
+ TODO: check
+CVE-2026-44037 (Uncontrolled mutual recursion between
DcmJSONReader::parseDataSet(), D ...)
+ TODO: check
+CVE-2026-44036 (Uncontrolled mutual recursion between
DcmXMLParseHelper::parseDataSet( ...)
+ TODO: check
+CVE-2026-44035 (Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in
dcmdata/l ...)
+ TODO: check
+CVE-2026-44034 (A heap-based out-of-bounds read in
DcmRLECodecDecoder::decodeFrame() i ...)
+ TODO: check
+CVE-2026-44033 (Uncontrolled recursion in XMLNode::ParseXMLElement() and
XMLNode::empt ...)
+ TODO: check
+CVE-2026-44031 (Uncontrolled recursion in DcmSequenceOfItems::read() and
DcmItem::read ...)
+ TODO: check
+CVE-2026-42698 (Concurrent Execution using Shared Resource with Improper
Synchronizati ...)
+ TODO: check
+CVE-2026-40804 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-27420 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-19878 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-19585 (HashiCorp go-getter versions before 1.8.10 and go-getter/v2
versions b ...)
+ TODO: check
+CVE-2026-19498 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-19494 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-19493 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-19491 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-19482 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-19218 (Weak Password Recovery Mechanism for Forgotten Password
vulnerability ...)
+ TODO: check
+CVE-2026-19083 (Authorization bypass through User-Controlled key vulnerability
in AKIN ...)
+ TODO: check
+CVE-2026-18740 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-17189 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-16916 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-16830 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-16823 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-16340 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16182 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through
10.5.0.22, 10. ...)
+ TODO: check
+CVE-2026-16181 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16179 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16178 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16177 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16176 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16170 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16169 (IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a
remote a ...)
+ TODO: check
+CVE-2026-16167 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16165 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16164 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16163 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16161 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16159 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-16111 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-15824 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-15822 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-15819 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-15784 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-15781 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-15762 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14999 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14992 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14991 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14990 (IBM DataPower Gateway 10.6.0.0 through 10.6.0.10is vulnerable
to cross ...)
+ TODO: check
+CVE-2026-14988 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14905 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14888 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14521 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14509 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14508 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14507 (IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a
remote a ...)
+ TODO: check
+CVE-2026-14502 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14497 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14496 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14273 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-14269 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-13258 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-13257 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
+ TODO: check
+CVE-2026-12859 (Missing Authorization vulnerability in Caz Informatics
Services Trade ...)
+ TODO: check
+CVE-2026-12260 (SQL injection in the NetBoard CRM demo platform; specifically,
the vul ...)
+ TODO: check
+CVE-2026-12109 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-12091 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-11939 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-11936 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-11930 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-11888 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
+ TODO: check
+CVE-2026-11318 (Deskin through 3.3.4.3 contains a privilege escalation
vulnerability i ...)
+ TODO: check
+CVE-2026-10631 (An authorization bypass in the EWS FindItem handler of Zimbra
Collabor ...)
+ TODO: check
+CVE-2026-107914 (Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1
doesn't suffici ...)
+ TODO: check
+CVE-2026-107911 (A type confusion vulnerability in the _read_flags function
(src/comman ...)
+ TODO: check
+CVE-2026-107910 (An improper authentication vulnerability in the
is_authenticated funct ...)
+ TODO: check
+CVE-2026-107909 (A heap-based out-of-bounds write in the ws_read_frame
function (src/bo ...)
+ TODO: check
+CVE-2026-107908 (A heap-based out-of-bounds write in the BoltReadHandler
function (src/ ...)
+ TODO: check
+CVE-2026-107890 (OpenPrinting CUPS before 2.4.20 contains a NULL pointer
dereference ca ...)
+ TODO: check
+CVE-2026-107889 (A flaw was found in the login theme rendering component of
Keycloak. T ...)
+ TODO: check
+CVE-2026-107888 (OpenPrinting CUPS before 2.4.20 contains a NULL pointer
dereference in ...)
+ TODO: check
+CVE-2026-107886 (OpenPrinting CUPS before 2.4.20 contains a double-free in
printer-clas ...)
+ TODO: check
+CVE-2026-107885 (OpenPrinting CUPS through 2.4.20 contains a
resource-exhaustion vulner ...)
+ TODO: check
+CVE-2026-107831 (Jivejdon through 5.0 contains a cross-site request forgery
vulnerabili ...)
+ TODO: check
+CVE-2026-107830 (Jivejdon from commit e0306088 through commit ee67a65e lacks
rate limit ...)
+ TODO: check
+CVE-2026-107829 (Jivejdon through 5.0 contains a weak password storage
vulnerability th ...)
+ TODO: check
+CVE-2026-107828 (Jivejdon through 5.0 contains an authentication bypass
vulnerability t ...)
+ TODO: check
+CVE-2026-107802 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and
earlier, ...)
+ TODO: check
+CVE-2026-107801 (Jivejdon through 5.0 contains a stored cross-site scripting
vulnerabil ...)
+ TODO: check
+CVE-2026-107800 (Jivejdon through 5.0 contains a stored cross-site scripting
vulnerabil ...)
+ TODO: check
+CVE-2026-107799 (Jivejdon through 5.0 contains a stored cross-site scripting
vulnerabil ...)
+ TODO: check
+CVE-2026-107798 (jivejdon from commit 595d8d22 through commit ee67a65e
contains a store ...)
+ TODO: check
+CVE-2026-107797 (Jivejdon through 5.0 contains a reflected cross-site
scripting vulnera ...)
+ TODO: check
+CVE-2026-107796 (Jivejdon from commit 5489372d through commit ee67a65e
contains a refle ...)
+ TODO: check
+CVE-2026-107793 (Jivejdon through 5.0 contains an authorization bypass
vulnerability in ...)
+ TODO: check
+CVE-2026-107792 (Jivejdon from commit d58a36b0 through commit ee67a65e
contains a missi ...)
+ TODO: check
+CVE-2026-107782 (System Informer before 4.0.26241.138 contains an incorrect
authorizati ...)
+ TODO: check
+CVE-2026-107781 (Dromara Skyeye through commit
003549ae5615bd114ba5bb8ddf6a8e8ead97c321 ...)
+ TODO: check
+CVE-2026-107780 (Dromara Skyeye through commit
003549ae5615bd114ba5bb8ddf6a8e8ead97c321 ...)
+ TODO: check
+CVE-2026-107779 (Dromara Skyeye through commit
003549ae5615bd114ba5bb8ddf6a8e8ead97c321 ...)
+ TODO: check
+CVE-2026-107778 (MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer
dereferen ...)
+ TODO: check
+CVE-2026-107738 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and
earlier, ...)
+ TODO: check
+CVE-2026-107737 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and
earlier, ...)
+ TODO: check
+CVE-2026-107736 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and
earlier, ...)
+ TODO: check
+CVE-2026-107735 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and
earlier, ...)
+ TODO: check
+CVE-2026-107734 (SumatraPDF is a multi-format reader for Windows. In 3.5.2 and
earlier, ...)
+ TODO: check
+CVE-2026-107733 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and
earlier, ...)
+ TODO: check
+CVE-2026-107732 (SumatraPDF is a multi-format reader for Windows. In 3.6.1 and
earlier, ...)
+ TODO: check
+CVE-2026-107731 (SumatraPDF is a multi-format reader for Windows. In
3.7.0.22298, four ...)
+ TODO: check
+CVE-2026-107730 (SumatraPDF is a multi-format reader for Windows. In
3.7.0.22298, LitPa ...)
+ TODO: check
+CVE-2026-107729 (SumatraPDF is a multi-format reader for Windows. In
3.7.0.22298, src/M ...)
+ TODO: check
+CVE-2026-107728 (Strawberry GraphQL is a library for creating GraphQL APIs.
From 0.217. ...)
+ TODO: check
+CVE-2026-107727 (Strawberry GraphQL is a library for creating GraphQL APIs.
From 0.312. ...)
+ TODO: check
+CVE-2026-107726 (Hazelcast is a unified real-time data platform combining
stream proces ...)
+ TODO: check
+CVE-2026-107725 (Hazelcast is a unified real-time data platform combining
stream proces ...)
+ TODO: check
+CVE-2026-107724 (fast-jwt provides fast JSON Web Token (JWT) implementation.
In 6.2.4, ...)
+ TODO: check
+CVE-2026-107723 (fast-jwt provides fast JSON Web Token (JWT) implementation.
Prior to 6 ...)
+ TODO: check
+CVE-2026-107722 (fast-jwt provides fast JSON Web Token (JWT) implementation.
From 6.2.0 ...)
+ TODO: check
+CVE-2026-107721 (fast-jwt provides fast JSON Web Token (JWT) implementation.
Prior to 6 ...)
+ TODO: check
+CVE-2026-107720 (fast-jwt provides fast JSON Web Token (JWT) implementation.
Prior to 6 ...)
+ TODO: check
+CVE-2026-107719 (fast-jwt provides fast JSON Web Token (JWT) implementation.
Prior to 6 ...)
+ TODO: check
+CVE-2026-107718 (AdonisJS HTTP Server is a package for handling HTTP requests
in the Ad ...)
+ TODO: check
+CVE-2026-107717 (Banks generates meaningful LLM prompts using a simple
template languag ...)
+ TODO: check
+CVE-2026-107716 (Banks generates meaningful LLM prompts using a simple
template languag ...)
+ TODO: check
+CVE-2026-107715 (The Mechanize library is used for automating interaction with
websites ...)
+ TODO: check
+CVE-2026-107714 (The Mechanize library is used for automating interaction with
websites ...)
+ TODO: check
+CVE-2026-107709 (A path traversal vulnerability exists in Bower decompress-zip
through ...)
+ TODO: check
+CVE-2026-107708 (MIT krb5 through 1.22.2 contains a NULL pointer dereference
vulnerabil ...)
+ TODO: check
+CVE-2026-107707 (Intego Antivirus for Windows through 3.0.0.1 contains a link
following ...)
+ TODO: check
+CVE-2026-107706 (Dolibarr ERP CRM before 24.0.2 contains an incorrect
authorization vul ...)
+ TODO: check
+CVE-2026-107705 (Poppler 0.42.0 through 26.10.0 contains a stack-based buffer
overflow ...)
+ TODO: check
+CVE-2026-107704 (The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an
OS comman ...)
+ TODO: check
+CVE-2026-107703 (@enmaso/node-convert through 1.0.0 contains an OS command
injection vu ...)
+ TODO: check
+CVE-2026-107702 (QloApps through 1.7.0 contains an authorization bypass
vulnerability i ...)
+ TODO: check
+CVE-2026-107701 (dot-access through 1.0.0 contains a prototype pollution
vulnerability ...)
+ TODO: check
+CVE-2026-107700 (dot-access 0.0.3 through 1.0.0 contains a code injection
vulnerability ...)
+ TODO: check
+CVE-2026-107699 (ppt2png through 0.0.6 contains an OS command injection
vulnerability t ...)
+ TODO: check
+CVE-2026-107698 (FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a
server-side requ ...)
+ TODO: check
+CVE-2026-107697 (FFmpeg before 8.1.3 contains a protection mechanism failure
in the HLS ...)
+ TODO: check
+CVE-2026-107696 (FFmpeg through 9.0.2 contains an infinite loop vulnerability
in ff_rts ...)
+ TODO: check
+CVE-2026-107695 (FFmpeg before 8.1.3 contains an infinite loop vulnerability
in the HLS ...)
+ TODO: check
+CVE-2026-107678 (FFmpeg through 9.0.2 contains a stack exhaustion
vulnerability in av_e ...)
+ TODO: check
+CVE-2026-107677 (FFmpeg through 9.0.2 contains a denial of service
vulnerability in the ...)
+ TODO: check
+CVE-2026-107676 (FFmpeg through 9.0.2 contains an uninitialized memory
disclosure vulne ...)
+ TODO: check
+CVE-2026-107675 (FFmpeg through 9.0.2 contains a missing host key verification
vulnerab ...)
+ TODO: check
+CVE-2026-107660 (FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper
certific ...)
+ TODO: check
+CVE-2026-107651 (A flaw was found in Eye of GNOME (eog). A heap-based buffer
overflow e ...)
+ TODO: check
+CVE-2026-107640 (Integrics Enswitch 3.13 through 4.4 contains an
authentication bypass ...)
+ TODO: check
+CVE-2026-107639 (ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5
contains an ...)
+ TODO: check
+CVE-2026-107638 (pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an
improper ...)
+ TODO: check
+CVE-2026-107637 (pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an
improper ...)
+ TODO: check
+CVE-2026-107636 (pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a
payment va ...)
+ TODO: check
+CVE-2026-107635 (Dislocker through 0.7.3 contains an integer underflow
vulnerability in ...)
+ TODO: check
+CVE-2026-107634 (Dislocker through 0.7.3 contains a heap out-of-bounds read
vulnerabili ...)
+ TODO: check
+CVE-2026-107623 (A flaw was found in the OIDC Dynamic Client Registration
(DCR) compone ...)
+ TODO: check
+CVE-2026-107615 (An uncontrolled search path element vulnerability in GlavSoft
TightVNC ...)
+ TODO: check
+CVE-2026-107614 (An integer underflow in
WinCursorShapeUtils::trimTransparent() in Glav ...)
+ TODO: check
+CVE-2026-107613 (A NULL pointer dereference vulnerability in the
Win8ScreenDriver compo ...)
+ TODO: check
+CVE-2026-107612 (Incorrect permission assignment in GlavSoft TightVNC Server
for Window ...)
+ TODO: check
+CVE-2026-107611 (An out-of-bounds read vulnerability in the ZRLE decoder of
GlavSoft Ti ...)
+ TODO: check
+CVE-2026-107608 (Improper link resolution before file access in the asset
bundling outp ...)
+ TODO: check
+CVE-2026-107604 (A flaw was found in the installation provider and client
registration ...)
+ TODO: check
+CVE-2026-107589 (Insufficient job validation for service accounts in Jacamar
CI prior t ...)
+ TODO: check
+CVE-2026-107587 (Improper certificate validation in the webmail of Progressive
Robot hM ...)
+ TODO: check
+CVE-2026-107586 (Uncontrolled eviction in the browser session table of the
REST API in ...)
+ TODO: check
+CVE-2026-107585 (Uncontrolled eviction in the pending sign-in tables of the
REST API in ...)
+ TODO: check
+CVE-2026-107584 (Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open
when appl ...)
+ TODO: check
+CVE-2026-107583 (Inefficient algorithmic complexity in the webmail's message
view of th ...)
+ TODO: check
+CVE-2026-107582 (Inefficient algorithmic complexity in the REST API (6.3.3
through 6.3. ...)
+ TODO: check
+CVE-2026-107581 (Progressive Robot hMailServer 6.0.0 through 6.3.5 processes
several IM ...)
+ TODO: check
+CVE-2026-107580 (Inefficient algorithmic complexity in the decoding of message
header f ...)
+ TODO: check
+CVE-2026-107579 (Inefficient algorithmic complexity in the bounce and
complaint process ...)
+ TODO: check
+CVE-2026-107578 (Improper link resolution and external control of file paths
in the adm ...)
+ TODO: check
+CVE-2026-107577 (Inefficient algorithmic complexity and a non-terminating loop
in the M ...)
+ TODO: check
+CVE-2026-107576 (Inefficient algorithmic complexity in the inbound DKIM and
ARC signatu ...)
+ TODO: check
+CVE-2026-107575 (Inefficient algorithmic complexity in the SPF macro expansion
of Progr ...)
+ TODO: check
+CVE-2026-107574 (Inefficient algorithmic complexity in the JSON reader of
Progressive R ...)
+ TODO: check
+CVE-2026-107573 (Incorrect default permissions in the Windows installer of
Progressive ...)
+ TODO: check
+CVE-2026-107572 (Inefficient complexity in the Sieve filter evaluation of
Progressive R ...)
+ TODO: check
+CVE-2026-107570 (heap OOB write in convert_file_from_to() via a crafted
Content-Type he ...)
+ TODO: check
+CVE-2026-107565 (A flaw was found in luksmeta. A local attacker with
administrative pri ...)
+ TODO: check
+CVE-2026-107510 (An authenticated high privilege user can inject arguments in
troublesh ...)
+ TODO: check
+CVE-2026-107503 (Unvalidated environments URL allows OAuth authorization code
+ PKCE ve ...)
+ TODO: check
+CVE-2026-107466 (A flaw was found in flatpak-builder. This vulnerability
allows an atta ...)
+ TODO: check
+CVE-2026-107406 (Memory overflow vulnerability leading to Remote Code
Execution or Deni ...)
+ TODO: check
+CVE-2026-107399 (The Mechanize library is used for automating interaction with
websites ...)
+ TODO: check
+CVE-2026-107397 (Indico is an event management system that uses
Flask-Multipass, a mult ...)
+ TODO: check
+CVE-2026-107396 (Indico is an event management system that uses
Flask-Multipass, a mult ...)
+ TODO: check
+CVE-2026-107395 (Indico is an event management system that uses
Flask-Multipass, a mult ...)
+ TODO: check
+CVE-2026-107394 (Indico is an event management system that uses
Flask-Multipass, a mult ...)
+ TODO: check
+CVE-2026-107393 (FreeScout is a self-hosted help desk and shared mailbox.
Prior to 1.8. ...)
+ TODO: check
+CVE-2026-107392 (music-metadata is a metadata parser for audio and video media
files. P ...)
+ TODO: check
+CVE-2026-107391 (music-metadata is a metadata parser for audio and video media
files. I ...)
+ TODO: check
+CVE-2026-107390 (music-metadata is a metadata parser for audio and video media
files. P ...)
+ TODO: check
+CVE-2026-107389 (music-metadata is a metadata parser for audio and video media
files. P ...)
+ TODO: check
+CVE-2026-107388 (music-metadata is a metadata parser for audio and video media
files. P ...)
+ TODO: check
+CVE-2026-107387 (music-metadata is a metadata parser for audio and video media
files. P ...)
+ TODO: check
+CVE-2026-107386 (amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until
1.14.0, the fr ...)
+ TODO: check
+CVE-2026-107385 (MariaDB Connector/Node.js is used to connect applications
developed on ...)
+ TODO: check
+CVE-2026-107384 (MariaDB Connector/Node.js is used to connect applications
developed on ...)
+ TODO: check
+CVE-2026-107383 (MariaDB Connector/Node.js is used to connect applications
developed on ...)
+ TODO: check
+CVE-2026-107382 (MariaDB Connector/Node.js is used to connect applications
developed on ...)
+ TODO: check
+CVE-2026-107380 (savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0,
svg-sanitiz ...)
+ TODO: check
+CVE-2026-107379 (savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0,
svg-sanitiz ...)
+ TODO: check
+CVE-2026-107378 (CairoSVG is an SVG converter based on Cairo, a 2D graphics
library. Pr ...)
+ TODO: check
+CVE-2026-107377 (datamodel-code-generator generates Python data models from
schema defi ...)
+ TODO: check
+CVE-2026-107376 (webonyx graphql-php is a PHP implementation of the GraphQL
specificati ...)
+ TODO: check
+CVE-2026-107375 (JHipster is a development platform to quickly generate,
develop, and d ...)
+ TODO: check
+CVE-2026-107362 (Malcolm file-upload component ships the upstream FilePond PHP
server ( ...)
+ TODO: check
+CVE-2026-107361 (The Arkime live capture service (arkime-live) in Malcolm runs
with net ...)
+ TODO: check
+CVE-2026-107337 (The Malcolm kiosk Flask application exposes a POST
/script_call/<scrip ...)
+ TODO: check
+CVE-2026-107336 (Malcolm's front nginx reverse proxy defines a "Dashboards
\u2192 Arkim ...)
+ TODO: check
+CVE-2026-107335 (Malcolm's upload-processing pipeline
(scripts/safe-extract.py) enforce ...)
+ TODO: check
+CVE-2026-107334 (Malcolm's nginx Lua role-based access control (RBAC) layer
decides whe ...)
+ TODO: check
+CVE-2026-107333 (Malcolm's nginx based reverse proxy contains a URL path
normalization ...)
+ TODO: check
+CVE-2026-107332 (Insecure file permissions in the CodeCatalyst connection
handler in AW ...)
+ TODO: check
+CVE-2026-107325 (Improper validation of a BSON array length in the MongoDB Go
Driver ca ...)
+ TODO: check
+CVE-2026-107324 (An integer overflow in BSON value-length handling in the
MongoDB Go Dr ...)
+ TODO: check
+CVE-2026-107322 (An incomplete list of disallowed inputs in Amazon Agent
Plugins for AW ...)
+ TODO: check
+CVE-2026-107318 (@fastify/reply-from is a Fastify plugin that forwards
requests to an u ...)
+ TODO: check
+CVE-2026-107303 (JHipster is a development platform to quickly generate,
develop, and d ...)
+ TODO: check
+CVE-2026-107302 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
+ TODO: check
+CVE-2026-107301 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
+ TODO: check
+CVE-2026-107300 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
+ TODO: check
+CVE-2026-107299 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
+ TODO: check
+CVE-2026-107298 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
+ TODO: check
+CVE-2026-107297 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
+ TODO: check
+CVE-2026-107296 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
+ TODO: check
+CVE-2026-107295 (Pydantic AI is a Python agent framework for building
applications and ...)
+ TODO: check
+CVE-2026-107294 (Pydantic AI is a Python agent framework for building
applications and ...)
+ TODO: check
+CVE-2026-107293 (Pydantic AI is a Python agent framework for building
applications and ...)
+ TODO: check
+CVE-2026-107292 (Pydantic AI is a Python agent framework for building
applications and ...)
+ TODO: check
+CVE-2026-107291 (Pydantic AI is a Python agent framework for building
applications and ...)
+ TODO: check
+CVE-2026-107290 (Pydantic AI is a Python agent framework for building
applications and ...)
+ TODO: check
+CVE-2026-107289 (Pydantic AI is a Python agent framework for building
applications and ...)
+ TODO: check
+CVE-2026-107288 (Pydantic AI is a Python agent framework for building
applications and ...)
+ TODO: check
+CVE-2026-107287 (Pydantic AI is a Python agent framework for building
applications and ...)
+ TODO: check
+CVE-2026-107286 (Pydantic AI is a Python agent framework for building
applications and ...)
+ TODO: check
+CVE-2026-107275 (@fastify/jwt is a JSON Web Token plugin for the Fastify web
framework. ...)
+ TODO: check
+CVE-2026-106611 (Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV
Forminator ...)
+ TODO: check
+CVE-2026-106603 (Authorization Bypass Through User-Controlled Key
vulnerability in Grou ...)
+ TODO: check
+CVE-2026-106600 (Missing Authorization vulnerability in Liquid Web / StellarWP
GiveWP g ...)
+ TODO: check
+CVE-2026-106596 (Missing Authorization vulnerability in Visual Composer Visual
Composer ...)
+ TODO: check
+CVE-2026-106438 (An incorrect calculation in Decimal128 string parsing in the
MongoDB C ...)
+ TODO: check
+CVE-2026-106437 (The BSON buffer-reservation API in the MongoDB C Driver can
record a l ...)
+ TODO: check
+CVE-2026-106436 (The BSON encoder in the MongoDB PHP Driver does not check
some return ...)
+ TODO: check
+CVE-2026-106435 (The MongoDB Python Driver's binary accelerator can read
outside a buff ...)
+ TODO: check
+CVE-2026-106434 (The explicit decryption component of MongoDB libmongocrypt
can return ...)
+ TODO: check
+CVE-2026-106433 (Improper state management in MongoDB libmongocrypt can cause
provider- ...)
+ TODO: check
+CVE-2026-106432 (The BSON encoder in the MongoDB PHP Driver converts a string
length to ...)
+ TODO: check
+CVE-2026-106431 (An off-by-one error in the BSON bulk document writer in the
MongoDB C ...)
+ TODO: check
+CVE-2026-106430 (The MongoDB C++ Driver discards content after an embedded NUL
byte in ...)
+ TODO: check
+CVE-2026-106429 (An integer underflow in the KMS endpoint-parsing logic of
MongoDB libm ...)
+ TODO: check
+CVE-2026-106428 (An out-of-bounds read in SCRAM authentication response
parsing in the ...)
+ TODO: check
+CVE-2026-106177 (A kernel buffer overflow vulnerability in HP Sure Click
versions prior ...)
+ TODO: check
+CVE-2026-106126 (A command injection vulnerability in the Active Directory
Events Liste ...)
+ TODO: check
+CVE-2026-106097 (The Code Snippets WordPress plugin before 3.10.0 does not
sanitise and ...)
+ TODO: check
+CVE-2026-106095 (The Code Snippets WordPress plugin before 3.10.0 does not
perform a ca ...)
+ TODO: check
+CVE-2026-105893 (Authorization Bypass Through User-Controlled Key
vulnerability in Liqu ...)
+ TODO: check
+CVE-2026-105891 (Missing Authorization vulnerability in Liquid Web / StellarWP
Event Ti ...)
+ TODO: check
+CVE-2026-105890 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-105888 (Missing Authorization vulnerability in Liquid Web / StellarWP
Event Ti ...)
+ TODO: check
+CVE-2026-105887 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-105886 (Missing Authorization vulnerability in BdThemes Ultimate Post
Kit ulti ...)
+ TODO: check
+CVE-2026-105878 (Missing Authorization vulnerability in YITH YITH WooCommerce
Product B ...)
+ TODO: check
+CVE-2026-105833 (EspoCRM before 10.0.5 contains an insecure direct object
reference vul ...)
+ TODO: check
+CVE-2026-105832 (EspoCRM before 10.0.6 contains an authentication bypass
vulnerability ...)
+ TODO: check
+CVE-2026-105831 (EspoCRM before 10.0.6 contains a stored HTML injection
vulnerability t ...)
+ TODO: check
+CVE-2026-105830 (league/commonmark from 2.0.0 before 2.10.2 contains a
quadratic-time d ...)
+ TODO: check
+CVE-2026-105829 (League CommonMark from 1.3.0 before 2.10.2 contains a
cross-site scrip ...)
+ TODO: check
+CVE-2026-105828 (Parse Server 8.2.2 before 8.6.92 and 9.0.0 before
9.10.1-alpha.12 cont ...)
+ TODO: check
+CVE-2026-105827 (ImageMagick before 7.1.2-30 and 6.9.13-55 contains an
uncontrolled rec ...)
+ TODO: check
+CVE-2026-105826 (ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains
a securi ...)
+ TODO: check
+CVE-2026-105825 (ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains
a denial ...)
+ TODO: check
+CVE-2026-105824 (ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains
a use-af ...)
+ TODO: check
+CVE-2026-105823 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a
security ...)
+ TODO: check
+CVE-2026-105674 (TP-Link Tapo C325WB V2 generates the pre-shared key used by
its local ...)
+ TODO: check
+CVE-2026-105673 (An unauthenticated denial-of-service vulnerability exists in
Tapo C325 ...)
+ TODO: check
+CVE-2026-105672 (TP-Link Tapo C325WB V2 contains an unauthenticated
authorization bypas ...)
+ TODO: check
+CVE-2026-105570 (Docker Sandboxes compared OAuth token-endpoint hostnames
case-sensitiv ...)
+ TODO: check
+CVE-2026-105452 (Docker Sandboxes could forward a client-supplied credential
alongside ...)
+ TODO: check
+CVE-2026-105436 (Deserialization of Untrusted Data vulnerability in MainWP
MainWP Child ...)
+ TODO: check
+CVE-2026-105405 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains
an inval ...)
+ TODO: check
+CVE-2026-105404 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains
a code i ...)
+ TODO: check
+CVE-2026-105403 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 allows a
security ...)
+ TODO: check
+CVE-2026-105402 (ImageMagick before 7.1.2-31 contains a denial of service
vulnerability ...)
+ TODO: check
+CVE-2026-105401 (ImageMagick before 7.1.2-31 contains a heap buffer overflow
vulnerabil ...)
+ TODO: check
+CVE-2026-105400 (ImageMagick before 7.1.2-31 contains a resource leak
vulnerability tha ...)
+ TODO: check
+CVE-2026-105399 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains
a denial ...)
+ TODO: check
+CVE-2026-105398 (ImageMagick before 7.1.2-31 contains a heap buffer overflow
vulnerabil ...)
+ TODO: check
+CVE-2026-105331 (Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10
allows a u ...)
+ TODO: check
+CVE-2026-105275 (Satel Netco Design versions prior to v2.1.7 contains a
relative path t ...)
+ TODO: check
+CVE-2026-105269 (Satel Netco Design versions prior to v2.1.7 contains a stored
cross si ...)
+ TODO: check
+CVE-2026-105190 (The Easy Digital Downloads WordPress plugin before 3.7.1 does
not cons ...)
+ TODO: check
+CVE-2026-105110 (OS Command Injection in the login.xgi CGI endpoint in
Iskratel Innbox ...)
+ TODO: check
+CVE-2026-105079 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-105078 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-105076 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-104704 (Progressive Robot hMailServer 6.0.0 through 6.3.5 does not
enforce TLS ...)
+ TODO: check
+CVE-2026-104671 (The TutorStarter WordPress theme before 4.0.4 does not
respect the sit ...)
+ TODO: check
+CVE-2026-104660 (Missing authorization on COM objects in Progressive Robot
hMailServer ...)
+ TODO: check
+CVE-2026-104659 (Missing Host header validation and missing throttling of
failed admini ...)
+ TODO: check
+CVE-2026-104658 (The Linux live-update apply helper (hmailserver-update) of
Progressive ...)
+ TODO: check
+CVE-2026-104634 (Incorrect Type Conversion or Cast vulnerability in
BeamMCP.Server in S ...)
+ TODO: check
+CVE-2026-104628 (Satel Netco Design versions prior to v2.1.7 contains an
inefficient re ...)
+ TODO: check
+CVE-2026-104078 (Obsidian Desktop before 1.14.0 contains a filter bypass
vulnerability ...)
+ TODO: check
+CVE-2026-104077 (Obsidian Desktop before 1.14.0 contains a remote code
execution vulner ...)
+ TODO: check
+CVE-2026-104076 (TVU Networks Receiver/Transceiver devices running firmware
before vers ...)
+ TODO: check
+CVE-2026-104075 (TVU Networks Receiver/Transceiver devices running firmware
before vers ...)
+ TODO: check
+CVE-2026-103663 (Ollama is vulnerable to path traversal in the `/api/pull`
endpoint due ...)
+ TODO: check
+CVE-2026-103649 (Missing network timeouts in the Linux builds of Progressive
Robot hMai ...)
+ TODO: check
+CVE-2026-103647 (Cross-site scripting in the webmail of Progressive Robot
hMailServer 6 ...)
+ TODO: check
+CVE-2026-103517 (The Airwallex Online Payments Gateway WordPress plugin before
1.36.0 d ...)
+ TODO: check
+CVE-2026-103072 (Missing Authorization vulnerability in VillaTheme VillaTheme
Core vill ...)
+ TODO: check
+CVE-2026-103070 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-103011 (Heap-based buffer overflow in the legacy Blowfish encryption
routine ( ...)
+ TODO: check
+CVE-2026-103010 (Heap-based buffer overflow in the legacy Blowfish decryption
routine ( ...)
+ TODO: check
+CVE-2026-102784 (Joomla Extension - balbooa.com - CSRF in language
installation feature ...)
+ TODO: check
+CVE-2026-102783 (Joomla Extension - balbooa.com - Path Traversal in image
preview Gridb ...)
+ TODO: check
+CVE-2026-102368 (Affected Tapo device firmware stores device-specific
cryptographic mat ...)
+ TODO: check
+CVE-2026-101998 (Docker Sandboxes could fail open while masking credentials in
protecte ...)
+ TODO: check
+CVE-2026-101028 (Incorrect Authorization vulnerability in ash-project ash
allows an act ...)
+ TODO: check
+CVE-2026-101024 (Satel Netco Design versions prior to v2.1.7 contains a
relative path t ...)
+ TODO: check
+CVE-2026-100197
+ REJECTED
+CVE-2025-71428 (Jivejdon through 5.0 contains a sql injection vulnerability in
Account ...)
+ TODO: check
+CVE-2025-15700 (The AWP Classifieds WordPress plugin before 4.4.9 does not
validate th ...)
+ TODO: check
+CVE-2026-97147 (In OpenStack Mistral through 23.0.0, several of the v2 API
write paths ...)
- mistral <unfixed> (bug #1150346)
NOTE: https://launchpad.net/bugs/2160267
NOTE: https://security.openstack.org/ossa/OSSA-2026-044.html
-CVE-2026-93861
+CVE-2026-93861 (In OpenStack Mistral through 23.0.0, the workflow membership
API lets ...)
- mistral <unfixed> (bug #1150346)
NOTE: https://launchpad.net/bugs/2161277
NOTE: https://security.openstack.org/ossa/OSSA-2026-044.html
-CVE-2026-93858
+CVE-2026-93858 (In OpenStack Mistral through 23.0.0, the std.ssh_proxied
action passes ...)
- mistral <unfixed> (bug #1150346)
NOTE: https://launchpad.net/bugs/2162100
NOTE: https://security.openstack.org/ossa/OSSA-2026-044.html
-CVE-2026-93860
+CVE-2026-93860 (In OpenStack Mistral through 23.0.0, the /v2/maintenance API
controlle ...)
- mistral <unfixed> (bug #1150346)
NOTE: https://launchpad.net/bugs/2162789
NOTE: https://security.openstack.org/ossa/OSSA-2026-044.html
@@ -22,7 +872,7 @@ CVE-2026-105516
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2545962
CVE-2026-103871
NOT-FOR-US: Pulp (Red Hat)
-CVE-2026-97032
+CVE-2026-97032 (HTTP/2 servers could end up crashing due to inadvertently
modifying it ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -34,7 +884,7 @@ CVE-2026-97032
NOTE: Fixed by:
https://github.com/golang/go/commit/12acaf3086437e140e2dd3b7d2c30fdd633c5fe0
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/go/commit/6e049521882c944afc1e519a83971ec421dc2974
(go1.26.9)
NOTE: Fixed by:
https://github.com/golang/net/commit/18ece0ce30bc35fa81fe72028bf309bb3ff3f4a5
(v0.60.0)
-CVE-2026-78659
+CVE-2026-78659 (When "Trailer" headers are sent by a client, the HTTP server
internall ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -46,7 +896,7 @@ CVE-2026-78659
NOTE: Fixed by:
https://github.com/golang/go/commit/cbb0fb8b51cba866018b8a0fb4b5458f16c5c80b
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/go/commit/6e049521882c944afc1e519a83971ec421dc2974
(go1.26.9)
NOTE: Fixed by:
https://github.com/golang/net/commit/57f4235f83712a299328015548240512213a3852
(v0.60.0)
-CVE-2026-97031
+CVE-2026-97031 (Multiple ECH outer extension references are not permitted
under RFC 98 ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -56,7 +906,7 @@ CVE-2026-97031
NOTE: https://github.com/golang/go/issues/81855
NOTE: Fixed by:
https://github.com/golang/go/commit/f022e61963529d5e691f0e42a87fd5b520f01636
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/go/commit/eb1bf6e0c4f68b23409483b156e1455696508c6e
(go1.26.9)
-CVE-2026-94444
+CVE-2026-94444 (Previously, a user operating inside of a malicious Go project
that def ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -66,7 +916,7 @@ CVE-2026-94444
NOTE: https://github.com/golang/go/issues/81833
NOTE: Fixed by:
https://github.com/golang/go/commit/1e4f1fec6fb468a23979823b8c3cbec5c8fca1af
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/go/commit/5fa9de469645f7c45afe3bca767b929f5226bb1c
(go1.26.9)
-CVE-2026-94447
+CVE-2026-94447 (Previously, a user operating inside of a malicious Go project
that def ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -76,7 +926,7 @@ CVE-2026-94447
NOTE: https://github.com/golang/go/issues/81834
NOTE: Fixed by:
https://github.com/golang/go/commit/68fa7699a27d745f90bf8630202e1a415d1b0769
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/go/commit/7325b729f07c7ff255b9b5e3f427234ebd21ac47
(go1.26.9)
-CVE-2026-94448
+CVE-2026-94448 (When a JavaScript template literal contains consecutive
expressions, t ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -86,7 +936,7 @@ CVE-2026-94448
NOTE: https://github.com/golang/go/issues/81821
NOTE: Fixed by:
https://github.com/golang/go/commit/b26d150e6985f804826f4fcb1aa33aa81e700b52
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/go/commit/e59c03e695f2eaa26e308f756c83773afb034e47
(go1.26.9)
-CVE-2026-97030
+CVE-2026-97030 (A trusted template author may have previously written a valid
template ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -96,7 +946,7 @@ CVE-2026-97030
NOTE: https://github.com/golang/go/issues/81823
NOTE: Fixed by:
https://github.com/golang/go/commit/6e2cfab0a1c1683c52f9e09270627b0c4e6446e3
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/go/commit/5d84f6f08caf63b5f1300930368756bd34955f4a
(go1.26.9)
-CVE-2026-94440
+CVE-2026-94440 (Parsing a multipart form can bypass memory limits and read an
arbitrar ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -106,7 +956,7 @@ CVE-2026-94440
NOTE: https://github.com/golang/go/issues/81741
NOTE: Fixed by:
https://github.com/golang/go/commit/7c79b50a74b6d1aa4269b1827dda7d81f3717f9d
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/go/commit/d7a7aa8e6781ddf8dce12adf60a813d957d4763e
(go1.26.9)
-CVE-2026-56866
+CVE-2026-56866 (When http.Transport sends an HTTP/1 CONNECT request with a
non-empty R ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -116,7 +966,7 @@ CVE-2026-56866
NOTE: https://github.com/golang/go/issues/81740
NOTE: Fixed by:
https://github.com/golang/go/commit/76875df0f3425f69e4dc2c439040a248b6107854
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/go/commit/3fe1aac0ce941cb16b0ec5d489827cf1c58197c4
(go1.26.9)
-CVE-2026-94439
+CVE-2026-94439 (When an HTTP server handler sends a 2xx response to an HTTP/1
CONNECT ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -126,7 +976,7 @@ CVE-2026-94439
NOTE: https://github.com/golang/go/issues/81744
NOTE: Fixed by:
https://github.com/golang/go/commit/e92229e24a387cc006a750af176b07a459ba71a1
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/go/commit/087de1ff08ea620ac2f6ae26c939454cb793883a
(go1.26.9)
-CVE-2026-78669
+CVE-2026-78669 (A malicious HTTP/2 peer can cause excessive CPU consumption in
the cli ...)
- golang-1.27 1.27.2-1
- golang-1.26 <unfixed>
- golang-1.25 <removed>
@@ -138,7 +988,7 @@ CVE-2026-78669
NOTE: Fixed by:
https://github.com/golang/go/commit/1d58cdaa1069e259b60c324ec77472f09f23d92e
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/go/commit/6e049521882c944afc1e519a83971ec421dc2974
(go1.26.9)
NOTE: Fixed by:
https://github.com/golang/net/commit/cc7d34fd2dd5864bcafe3e5e0a84919240be98c0
(v0.60.0)
-CVE-2026-78660
+CVE-2026-78660 (Historically, we have been rather lax about malformed
framing-related ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -149,7 +999,7 @@ CVE-2026-78660
NOTE: https://github.com/golang/go/issues/81115
NOTE: Fixed by:
https://github.com/golang/go/commit/072779d81582543bf2872c259e0c6cceea728de4
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/net/commit/28247830e9fb37184c6be718f483a0c7d0949022
(v0.60.0)
-CVE-2026-56857
+CVE-2026-56857 (On Windows, when the target of Root.Mkdir or Root.MkdirAll is
a juncti ...)
- golang-1.27 <not-affected> (Only affects Go on Windows)
- golang-1.26 <not-affected> (Only affects Go on Windows)
- golang-1.25 <not-affected> (Only affects Go on Windows)
@@ -157,7 +1007,7 @@ CVE-2026-56857
- golang-1.19 <not-affected> (Only affects Go on Windows)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81739
-CVE-2026-78667
+CVE-2026-78667 (When parsing a Range header containing a large number of small
ranges, ...)
- golang-1.27 1.27.2-1
- golang-1.26 1.26.9-1
- golang-1.25 <removed>
@@ -167,7 +1017,7 @@ CVE-2026-78667
NOTE: https://github.com/golang/go/issues/81858
NOTE: Fixed by:
https://github.com/golang/go/commit/ababc3cd873d8acce1777268aa7a817e6b672028
(go1.27.2)
NOTE: Fixed by:
https://github.com/golang/go/commit/eb25b4e532c5a01f99ef860ec66743a8783f992b
(go1.26.9)
-CVE-2026-78663
+CVE-2026-78663 (The HTTP/2 server can refund connection-level flow control
twice for t ...)
- golang-1.27 1.27.2-1
- golang-1.26 <unfixed>
- golang-1.25 <removed>
@@ -1945,7 +2795,7 @@ CVE-2026-39792 (Unauthenticated Arbitrary File Deletion
in Simple File List <= 6
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39791 (Unauthenticated Sensitive Data Exposure in Mailjet Email
Marketing <= ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-39790 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <=
1.4.6 vers ...)
+CVE-2026-39790 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39788 (Subscriber Cross Site Scripting (XSS) in Front End PM <=
11.4.6 versio ...)
NOT-FOR-US: WordPress plugin or theme
@@ -3711,7 +4561,7 @@ CVE-2026-39789 (Unauthenticated Broken Access Control in
Fluent Affiliate Pro <=
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39760 (Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook
<= 5.5 ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-39723 (Unauthenticated Broken Access Control in Morning for
WooCommerce <= 2. ...)
+CVE-2026-39723 (Missing Authorization vulnerability in Green Invoice Morning
for WooCo ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39599 (Contributor Broken Access Control in WDS MCP Content Manager
<= 3.10.4 ...)
NOT-FOR-US: WordPress plugin or theme
@@ -5237,7 +6087,7 @@ CVE-2026-96990 (Allocation of Resources Without Limits or
Throttling vulnerabili
- thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/hrgcqlms4ksrz4qkqdjwoxxggdty7dgh
NOTE: Erlang bindings not built in Debian
-CVE-2026-96940 (Weak authorization in Microsoft Exchange Server allows an
authenticate ...)
+CVE-2026-96940 (An elevation of privilege vulnerability exists when Microsoft
Exchange ...)
NOT-FOR-US: Microsoft
CVE-2026-96871 (The Mang Board plugin for WordPress is vulnerable to Stored
Cross-Site ...)
NOT-FOR-US: WordPress plugin
@@ -9817,7 +10667,7 @@ CVE-2026-102509 (Memory Allocation with Excessive Size
Value, Allocation of Reso
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-102508 (Improper Verification of Cryptographic Signature and Improper
Certific ...)
NOT-FOR-US: Apache software not packaged in Debian
-CVE-2026-102490 (All versions of Zammad including the latest alpha enable the
local zam ...)
+CVE-2026-102490 (Zammad packages built with packager.io (DEB and RPM) could
have allowe ...)
- zammad <itp> (bug #841355)
CVE-2026-102489 (Zammad versions 6.3.0 to 6.5.4 are vulnerable a session
hijack vulnera ...)
- zammad <itp> (bug #841355)
@@ -46645,6 +47495,7 @@ CVE-2026-85155 (WWBN AVideo contains a SQL injection
vulnerability in the sort c
CVE-2026-85154 (WWBN AVideo contains an authentication failure vulnerability
where the ...)
NOT-FOR-US: WWBN AVideo
CVE-2026-85150 (A NULL pointer dereference flaw was found in GStreamer's RTSP
support ...)
+ {DLA-4828-1}
- gst-plugins-base1.0 1.28.7-1
[trixie] - gst-plugins-base1.0 <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2527936
@@ -61432,7 +62283,7 @@ CVE-2026-18298 (GStreamer PNG File Parsing Heap-based
Buffer Overflow Remote Cod
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/b399811826a352da6d90a1fd6c230cfdbc1e7b56
(1.28.5)
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/96173accdbd4970c7b6aeb7d5c3890104c4bd263
(1.28.5)
CVE-2026-18297 (GStreamer OGG File Parsing Stack-based Buffer Overflow Remote
Code Exe ...)
- {DSA-6489-1}
+ {DSA-6489-1 DLA-4828-1}
- gst-plugins-base1.0 1.28.5-1
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0053.html
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12044
@@ -85002,7 +85853,7 @@ CVE-2026-15920 (An issue was discovered in Django 5.2
before 5.2.17 and 6.0 befo
- python-django 3:5.2.17-1 (bug #1143611)
NOTE:
https://www.djangoproject.com/weblog/2026/aug/04/security-releases/
NOTE: Fixed by:
https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349
(5.2.17)
-CVE-2026-15830 (An issue was discovered in Django 5.2 before 5.2.17 and 6.0
before 6.0 ...)
+CVE-2026-15830 (An issue was discovered in Django 6.0 before 6.0.9 and 5.2
before 5.2. ...)
- python-django 3:5.2.17-1 (bug #1143611)
[bookworm] - python-django <ignored> (Invasive fix; too difficult to
backport; affects only GeoSpatial component)
[bullseye] - python-django <ignored> (Invasive fix; too difficult to
backport; affects only GeoSpatial component)
@@ -87652,7 +88503,7 @@ CVE-2026-56846 (A flaw in Node.js HTTP/2 handling can
cause HTTP/2 retained head
NOTE:
https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http2-retained-headers-can-bypass-maxsessionmemory-limits-cve-2026-56846---high
NOTE: Fixed by:
https://github.com/nodejs/node/commit/f14d78b9e0201bfe0291f2b0dc4b5d88c70cc28e
(v22.23.2)
CVE-2026-66066 (Action Pack is a framework for handling and responding to web
requests ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.2+dfsg-1 (bug #1143080)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
NOTE: Fixed by:
https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a
(v7.2.3.2)
@@ -173509,7 +174360,7 @@ CVE-2026-39680 (Missing Authorization vulnerability
in MWP Development Diet Calo
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39679 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-39678 (Missing Authorization vulnerability in DOTonPAPER Pinpoint
Booking Sys ...)
+CVE-2026-39678 (Missing Authorization vulnerability in Pinpoint Booking System
Pinpoin ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39677 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
NOT-FOR-US: WordPress plugin or theme
@@ -183671,7 +184522,7 @@ CVE-2026-33241 (Salvo is a Rust web framework. Prior
to version 0.89.3, Salvo's
CVE-2026-33211 (Tekton Pipelines project provides k8s-style resources for
declaring CI ...)
NOT-FOR-US: Tekton Pipelines project
CVE-2026-33202 (Active Storage allows users to attach cloud and local files in
Rails a ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, path traversal in unlikely
scenario)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
@@ -183679,7 +184530,7 @@ CVE-2026-33202 (Active Storage allows users to attach
cloud and local files in R
NOTE: Fixed by:
https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82
(v7.2.3.1)
CVE-2026-33195 (Active Storage allows users to attach cloud and local files in
Rails a ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, path traversal in unlikely
scenario)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87
@@ -183687,7 +184538,7 @@ CVE-2026-33195 (Active Storage allows users to attach
cloud and local files in R
NOTE: Fixed by:
https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c
(v7.2.3.1)
CVE-2026-33176 (Active Support is a toolkit of support libraries and Ruby core
extensi ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, DoS)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
@@ -183704,7 +184555,7 @@ CVE-2026-33174 (Active Storage allows users to attach
cloud and local files in R
NOTE: Fixed by:
https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b
(v7.2.3.1)
CVE-2026-33173 (Active Storage allows users to attach cloud and local files in
Rails a ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, automatic content type
bypass)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
@@ -183712,7 +184563,7 @@ CVE-2026-33173 (Active Storage allows users to attach
cloud and local files in R
NOTE: Fixed by:
https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
(v7.2.3.1)
CVE-2026-33170 (Active Support is a toolkit of support libraries and Ruby core
extensi ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, XSS)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v
@@ -183720,7 +184571,7 @@ CVE-2026-33170 (Active Support is a toolkit of
support libraries and Ruby core e
NOTE: Fixed by:
https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb
(v7.2.3.1)
CVE-2026-33169 (Active Support is a toolkit of support libraries and Ruby core
extensi ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, DoS)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
@@ -183728,7 +184579,7 @@ CVE-2026-33169 (Active Support is a toolkit of
support libraries and Ruby core e
NOTE: Fixed by:
https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11
(v8.0.4.1)
NOTE: Fixed by:
https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974
(v7.2.3.1)
CVE-2026-33168 (Action View provides conventions and helpers for building web
pages wi ...)
- {DSA-6546-1}
+ {DSA-6546-1 DLA-4829-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
[bullseye] - rails <postponed> (Minor issue, XSS)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq
@@ -298497,7 +299348,7 @@ CVE-2025-2527 (Mattermost versions 10.5.x <= 10.5.2,
9.11.x <= 9.11.11 failed to
CVE-2025-26481 (Dell PowerScale OneFS, versions 9.4.0.0 through 9.9.0.0,
contains an u ...)
NOT-FOR-US: Dell / EMC
CVE-2025-1647 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
- {DLA-4204-1}
+ {DLA-4830-1 DLA-4204-1}
- twitter-bootstrap4 <not-affected> (Only affects 3.x)
- twitter-bootstrap3 3.4.1+dfsg-5 (bug #1105899)
NOTE: https://www.herodevs.com/vulnerability-directory/cve-2025-1647
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/54bf67fe60b8ab252307d3d1fb99aae2213cb528
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/54bf67fe60b8ab252307d3d1fb99aae2213cb528
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
