Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
0a1bfd25 by security tracker role at 2026-10-10T19:15:32+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,15 +1,229 @@
-CVE-2026-107794
+CVE-2026-97396 (The Email Marketing for WordPress and WooCommerce \u2013
Retainful plu ...)
+ TODO: check
+CVE-2026-97340 (The Avada | Website Builder For WordPress & WooCommerce theme
for Word ...)
+ TODO: check
+CVE-2026-97264 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-97263 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-96765 (The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION
(WPO365 | LOGI ...)
+ TODO: check
+CVE-2026-96662 (The Appointment Booking Plugin \u2013 LatePoint | Calendar &
Schedulin ...)
+ TODO: check
+CVE-2026-96653 (The WP Directory Kit plugin for WordPress is vulnerable to
time-based ...)
+ TODO: check
+CVE-2026-96563 (The Motors \u2013 Car Dealership & Classified Listings Plugin
plugin f ...)
+ TODO: check
+CVE-2026-96341 (Incorrect Privilege Assignment vulnerability in WPMU DEV
Forminator fo ...)
+ TODO: check
+CVE-2026-96278 (The WP Photo Album Plus plugin for WordPress is vulnerable to
Stored C ...)
+ TODO: check
+CVE-2026-94676 (Deserialization of Untrusted Data vulnerability in Tainacan
Community ...)
+ TODO: check
+CVE-2026-94590 (Improper Verification of Source of a Communication Channel
vulnerabili ...)
+ TODO: check
+CVE-2026-94160 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-93951 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-93950 (Missing Authorization vulnerability in StylemixThemes Motors
motors al ...)
+ TODO: check
+CVE-2026-93949 (Authentication Bypass Using an Alternate Path or Channel
vulnerability ...)
+ TODO: check
+CVE-2026-93945 (Deserialization of Untrusted Data vulnerability in Axiomthemes
Balance ...)
+ TODO: check
+CVE-2026-93944 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Came ...)
+ TODO: check
+CVE-2026-93943 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Conv ...)
+ TODO: check
+CVE-2026-93942 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Dwel ...)
+ TODO: check
+CVE-2026-93941 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Edem ...)
+ TODO: check
+CVE-2026-93940 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Gree ...)
+ TODO: check
+CVE-2026-93938 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Hogw ...)
+ TODO: check
+CVE-2026-93937 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Hygi ...)
+ TODO: check
+CVE-2026-93936 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group IPha ...)
+ TODO: check
+CVE-2026-93935 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Let' ...)
+ TODO: check
+CVE-2026-93934 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Part ...)
+ TODO: check
+CVE-2026-93933 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Rosa ...)
+ TODO: check
+CVE-2026-93932 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Smar ...)
+ TODO: check
+CVE-2026-93931 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Smas ...)
+ TODO: check
+CVE-2026-93930 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Tant ...)
+ TODO: check
+CVE-2026-93929 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Trav ...)
+ TODO: check
+CVE-2026-93927 (Deserialization of Untrusted Data vulnerability in Axiomthemes
Veto ve ...)
+ TODO: check
+CVE-2026-93746 (The WebToffee WooCommerce PDF Invoices, Packing Slips,
Delivery Notes ...)
+ TODO: check
+CVE-2026-91136 (The Divi Plus plugin for WordPress is vulnerable to Arbitrary
File Rea ...)
+ TODO: check
+CVE-2026-66435 (Insertion of Sensitive Information Into Sent Data
vulnerability in Dev ...)
+ TODO: check
+CVE-2026-62046 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Gute ...)
+ TODO: check
+CVE-2026-62045 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Book ...)
+ TODO: check
+CVE-2026-62044 (Deserialization of Untrusted Data vulnerability in bPlugins
Super Vide ...)
+ TODO: check
+CVE-2026-57806 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-4791 (The PeproDev Ultimate Profile Solutions plugin for WordPress is
vulner ...)
+ TODO: check
+CVE-2026-108600 (open-multi-agent (@open-multi-agent/core) 1.5.0 through
1.21.2 contain ...)
+ TODO: check
+CVE-2026-108599 (phi 0.1.1 through 0.28.4 contains an improper link resolution
vulnerab ...)
+ TODO: check
+CVE-2026-108598 (Floci 1.1.0 before 2.2.0 contains a code injection
vulnerability in Vt ...)
+ TODO: check
+CVE-2026-108597 (Cohere Python SDK 5.11.0 through 7.2.0 contains a path
traversal (tar ...)
+ TODO: check
+CVE-2026-108596 (OpenLIT 2.1.0 contains an authorization bypass vulnerability
that allo ...)
+ TODO: check
+CVE-2026-108595 (Phi 0.3.0 through 0.28.4 contains a permission bypass
vulnerability th ...)
+ TODO: check
+CVE-2026-108594 (Mealie 3.26.0 through 3.28.0 contains a server-side request
forgery vu ...)
+ TODO: check
+CVE-2026-108593 (9router 0.4.1 through 0.5.99 contains a configuration
injection vulner ...)
+ TODO: check
+CVE-2026-108592 (mini-swe-agent 1.10.0 through 2.4.6 contains an information
exposure v ...)
+ TODO: check
+CVE-2026-108591 (InnoShop 0.9.2 contains a local file disclosure vulnerability
that all ...)
+ TODO: check
+CVE-2026-108586 (1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an
incorrect a ...)
+ TODO: check
+CVE-2026-108585 (argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path
traversa ...)
+ TODO: check
+CVE-2026-108583 (zotero-mcp 0.10.0 through 0.14.1 contains a server-side
request forger ...)
+ TODO: check
+CVE-2026-108582 (GenOffice through 0.11.505 contains an incorrect permissions
vulnerabi ...)
+ TODO: check
+CVE-2026-108581 (TencentCloud Octop through 1.0.2b6 contains a missing
authorization vu ...)
+ TODO: check
+CVE-2026-108580 (AniWorld Downloader before 5.3.0 contains an improper
restriction of a ...)
+ TODO: check
+CVE-2026-108579 (OpenPanel through 2.3.0 contains a CSV formula injection
vulnerability ...)
+ TODO: check
+CVE-2026-108555 (PairDrop through 1.11.2 contains an IP spoofing vulnerability
in Peer. ...)
+ TODO: check
+CVE-2026-108554 (PDFMathTranslate (pdf2zh) through 1.9.11 contains a
server-side reques ...)
+ TODO: check
+CVE-2026-108553 (OpenRefine through 3.10.1 contains a cross-site request
forgery vulner ...)
+ TODO: check
+CVE-2026-108551 (openapi-typescript-codegen through 0.31.0 contains a code
injection vu ...)
+ TODO: check
+CVE-2026-108550 (SkillHub before 0.2.22 contains an incorrect authorization
vulnerabili ...)
+ TODO: check
+CVE-2026-108549 (cc-connect through 1.5.0 contains a missing authentication
vulnerabili ...)
+ TODO: check
+CVE-2026-108548 (AstronRPA through 1.1.6 contains an authentication bypass
vulnerabilit ...)
+ TODO: check
+CVE-2026-108547 (AstronRPA through 1.1.6 contains a missing tenant
authorization check ...)
+ TODO: check
+CVE-2026-108546 (Spotweb through 1.5.8 contains an OS command injection
vulnerability i ...)
+ TODO: check
+CVE-2026-108545 (SillyTavern 1.12.13 through 1.19.0 contains a denial of
service vulner ...)
+ TODO: check
+CVE-2026-108506 (ZTE Z80 Ultra's system interfaces do not have robust
invocation authen ...)
+ TODO: check
+CVE-2026-108505 (ZTE Z80 Ultra has a local information disclosure
vulnerability. Third- ...)
+ TODO: check
+CVE-2026-108504 (ZTE Z80 Ultra has an unauthorized information disclosure
vulnerability ...)
+ TODO: check
+CVE-2026-108165 (Immich through 3.3.1 contains a missing authorization
vulnerability in ...)
+ TODO: check
+CVE-2026-108164 (Open Source Social Network (OSSN) through 10.1 contains an
insecure di ...)
+ TODO: check
+CVE-2026-108163 (Pingvin Share X before 1.22.0 contains an ineffective rate
limiting vu ...)
+ TODO: check
+CVE-2026-108162 (Pingvin Share X before 1.22.0 contains a rate limit bypass
vulnerabili ...)
+ TODO: check
+CVE-2026-108161 (FusionPBX through 5.6.5 contains an OS command injection
vulnerability ...)
+ TODO: check
+CVE-2026-108115 (Kortix Suna 0.10.7 before 0.13.52 contains a server-side
request forge ...)
+ TODO: check
+CVE-2026-108114 (Strapi 5.47.0 through 5.57.0 contains an improper
authorization vulner ...)
+ TODO: check
+CVE-2026-107657 (The HivePress \u2013 Business Directory, Listings &
Classified Ads Plu ...)
+ TODO: check
+CVE-2026-106610 (Incorrect Privilege Assignment vulnerability in miniOrange
miniorange ...)
+ TODO: check
+CVE-2026-106609 (Missing Authorization vulnerability in Web Impian Bayarcash
WooCommerc ...)
+ TODO: check
+CVE-2026-106608 (Incorrect Privilege Assignment vulnerability in Automattic
WooCommerce ...)
+ TODO: check
+CVE-2026-106606 (Deserialization of Untrusted Data vulnerability in YITH YITH
WooCommer ...)
+ TODO: check
+CVE-2026-106139 (In Progress\xae Kendo UI for Vue (@progress/kendo-vue-charts)
starting ...)
+ TODO: check
+CVE-2026-106138 (In Progress\xae KendoReact (@progress/kendo-react-charts)
starting wit ...)
+ TODO: check
+CVE-2026-105892 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
+ TODO: check
+CVE-2026-105889 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-105885 (Deserialization of Untrusted Data vulnerability in 10Web
Slider by 10W ...)
+ TODO: check
+CVE-2026-104803 (The WPCOM Member plugin for WordPress is vulnerable to
Authentication ...)
+ TODO: check
+CVE-2026-104759 (The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION
(WPO365 | LOGI ...)
+ TODO: check
+CVE-2026-104728 (The AutomatorWP \u2013 No-Code Workflow Automation,
Integration & Webh ...)
+ TODO: check
+CVE-2026-104722 (The Listdom: AI-powered Business Directory with Classifieds
Ads Listin ...)
+ TODO: check
+CVE-2026-104398 (Deserialization of Untrusted Data vulnerability in VillaTheme
AFFI \u2 ...)
+ TODO: check
+CVE-2026-103636 (Out-of-bounds read in the VarOpt union deserialization of
Apache DataS ...)
+ TODO: check
+CVE-2026-103635 (Out-of-bounds read in the compact Theta sketch
deserialization of Apac ...)
+ TODO: check
+CVE-2026-103513 (Out-of-bounds read and write in the CPC sketch
deserialization of Apac ...)
+ TODO: check
+CVE-2026-103501 (Heap buffer overflow in the HLL sketch deserialization of
Apache DataS ...)
+ TODO: check
+CVE-2026-103478 (The Premium Packages \u2013 Sell Digital Products Securely
plugin for ...)
+ TODO: check
+CVE-2026-103357 (Missing Authorization vulnerability in VillaTheme GIFT4U
gift4u-gift-c ...)
+ TODO: check
+CVE-2026-103071 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
+ TODO: check
+CVE-2026-102774 (The SureDash \u2013 Community, Courses & Member Dashboard
plugin for W ...)
+ TODO: check
+CVE-2026-102388 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-102291 (The Kirki \u2013 Freeform Page Builder, Website Builder &
Customizer p ...)
+ TODO: check
+CVE-2026-101921 (The WPForms \u2013 AI Form Builder for WordPress \u2013
Contact Forms, ...)
+ TODO: check
+CVE-2026-101920 (The Molongui Authorship \u2013 Author Boxes, Guest Authors &
Co-Author ...)
+ TODO: check
+CVE-2026-100178 (The WPAdverts \u2013 Classifieds Plugin plugin for WordPress
is vulner ...)
+ TODO: check
+CVE-2026-100147 (The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout
plugin fo ...)
+ TODO: check
+CVE-2026-107794 (ExtUtils::Typemaps::STL::List versions before 1.07 for Perl
allocate a ...)
- libextutils-typemaps-default-perl 1.07-1 (bug #1150541)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44246012/
NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=91213
NOTE: Fixed by:
https://github.com/tsee/extutils-typemap-default/commit/10f45bf0d00d3140499755c2ad49f8bf435851ac
(ExtUtils-Typemaps-Default-1.07)
NOTE: Fixed by:
https://github.com/tsee/extutils-typemap-default/commit/3e6602d8a9db424e5842e001554bf268797e4de1
(ExtUtils-Typemaps-Default-1.07)
-CVE-2013-10076
+CVE-2013-10076 (ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl
allocate ...)
- libextutils-typemaps-default-perl 1.05-1
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44246011/
NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=91213
NOTE: Fixed by:
https://github.com/tsee/extutils-typemap-default/commit/0eb696b75afcfedbf87a72e11d44d98110863934
(ExtUtils-Typemaps-Default-1.05)
-CVE-2026-107373
+CVE-2026-107373 (ExtUtils::Typemaps::STL::String versions before 1.06 for Perl
T_STD_ST ...)
- libextutils-typemaps-default-perl 1.07-1 (bug #1150541)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44245994/
NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=94110
@@ -3553,6 +3767,7 @@ CVE-2026-101331 (IBM Langflow OSS 1.0.0 through 1.12.2
could allow a remote auth
CVE-2026-101329 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
NOT-FOR-US: IBM
CVE-2026-101258 (A flaw was found in Ghostscript. When Ghostscript renders a
crafted Po ...)
+ {DSA-6550-1}
- ghostscript 10.08.0~dfsg-1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2542396
NOTE: https://github.com/v12-security/pocs/tree/main/ghostscript
@@ -11662,6 +11877,7 @@ CVE-2026-103229 (A vulnerability was found in
AdithyaYelloju Restaurant-Manageme
CVE-2026-103227 (A weakness has been identified in GPAC up to 26.07.0.
Affected by this ...)
- gpac <removed>
CVE-2026-103226 (A vulnerability was identified in Artifex Ghostscript up to
10.09.0. A ...)
+ {DSA-6550-1}
- ghostscript 10.08.0~dfsg-1
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=709672
NOTE: Fixed by:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=cbdc86cc7a95c792baae3a15c7acf59b95fbcd5c
(ghostpdl-10.08.0)
@@ -15524,10 +15740,10 @@ CVE-2026-100312 (A security flaw has been discovered
in mathurvishal CloudClassr
NOT-FOR-US: mathurvishal CloudClassroom-PHP-Project
CVE-2026-100311 (A vulnerability was identified in mathurvishal
CloudClassroom-PHP-Proj ...)
NOT-FOR-US: mathurvishal CloudClassroom-PHP-Project
-CVE-2026-105830 [GHSA-3q6v-r5mr-hxv8: Fix quadratic-time table start detection
on long paragraphs]
+CVE-2026-105830 (league/commonmark from 2.0.0 before 2.10.2 contains a
quadratic-time d ...)
- php-league-commonmark 2.10.3-1
NOTE:
https://github.com/thephpleague/commonmark/security/advisories/GHSA-3q6v-r5mr-hxv8
-CVE-2026-105829 [GHSA-97jj-33gv-5xf9: Escape disallowed raw HTML tags that end
the rendered output]
+CVE-2026-105829 (League CommonMark from 1.3.0 before 2.10.2 contains a
cross-site scrip ...)
- php-league-commonmark 2.10.3-1
NOTE:
https://github.com/thephpleague/commonmark/security/advisories/GHSA-97jj-33gv-5xf9
CVE-2026-98163 (In the Linux kernel, the following vulnerability has been
resolved: c ...)
@@ -274688,9 +274904,9 @@ CVE-2025-8789 (A vulnerability was found in
Portabilis i-Educar up to 2.9.0. It
NOT-FOR-US: Portabilis
CVE-2025-8788 (A vulnerability was found in Portabilis i-Diario up to 1.5.0
and class ...)
NOT-FOR-US: Portabilis
-CVE-2025-8787 (A vulnerability has been found in Portabilis i-Diario up to
1.5.0 and ...)
+CVE-2025-8787 (A security flaw has been discovered in Portabilis i-Diario up
to 1.5.0 ...)
NOT-FOR-US: Portabilis
-CVE-2025-8786 (A vulnerability, which was classified as problematic, was found
in Por ...)
+CVE-2025-8786 (A vulnerability was identified in Portabilis i-Diario up to
1.5.0. Imp ...)
NOT-FOR-US: Portabilis
CVE-2025-8785 (A vulnerability, which was classified as problematic, has been
found i ...)
NOT-FOR-US: Portabilis
@@ -276221,7 +276437,7 @@ CVE-2025-8513 (A vulnerability, which was classified
as problematic, was found i
NOT-FOR-US: Caixin News App
CVE-2025-8512 (A vulnerability, which was classified as problematic, has been
found i ...)
NOT-FOR-US: TVB Big Big Shop App
-CVE-2025-8511 (A vulnerability classified as problematic was found in
Portabilis i-Di ...)
+CVE-2025-8511 (A vulnerability was found in Portabilis i-Diario 1.5.0.
Impacted is an ...)
NOT-FOR-US: Portabilis
CVE-2025-8510 (A vulnerability classified as problematic has been found in
Portabilis ...)
NOT-FOR-US: Portabilis
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0a1bfd2556bc09b05bef5de39db9333e048d3ac0
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0a1bfd2556bc09b05bef5de39db9333e048d3ac0
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
