Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d9149149 by security tracker role at 2026-10-14T19:14:20+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,179 +1,1249 @@
-CVE-2026-98418 [sched/core: Avoid false migration warning for proxy donors]
+CVE-2026-97629 (Description When NGINX Plus or NGINX Open Source is configured
withssl ...)
+ TODO: check
+CVE-2026-97315 (The Responsive Blocks WordPress plugin before 2.3.0 does not
sanitise ...)
+ TODO: check
+CVE-2026-97278 (Deserialization of Untrusted Data vulnerability in WP SYNTEX
Polylang ...)
+ TODO: check
+CVE-2026-97205 (NGINX Plus and NGINX Open Source have a vulnerability in the
ngx_http_ ...)
+ TODO: check
+CVE-2026-96615 (Description NGINX Gateway Fabric has a vulnerability when it
is config ...)
+ TODO: check
+CVE-2026-96596 (Loop with Unreachable Exit Condition ('Infinite Loop')
vulnerability i ...)
+ TODO: check
+CVE-2026-95101 (Description NGINX Plus and NGINX Open Source have a
vulnerability in t ...)
+ TODO: check
+CVE-2026-94348 (Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0,
contains an I ...)
+ TODO: check
+CVE-2026-94200 (Improper Validation of Consistency within Input vulnerability
in Erlan ...)
+ TODO: check
+CVE-2026-94197 (An authentication and authorization bypass vulnerability
exists in F5 ...)
+ TODO: check
+CVE-2026-93683 (A flaw was found in the DPDK vhost library. When handling a
virtio ind ...)
+ TODO: check
+CVE-2026-93637 (An authentication rate-limit bypass in Zimbra Collaboration
Suite 10.1 ...)
+ TODO: check
+CVE-2026-93635 (LDAP filter injection in Zimbra Collaboration Suite 10.1.0
through 10. ...)
+ TODO: check
+CVE-2026-93479 (A vulnerability exists in NGINX Plus and NGINX Open Source
when a map ...)
+ TODO: check
+CVE-2026-92160 (F\xb4 (F Prime) is a framework that enables development and
deployment ...)
+ TODO: check
+CVE-2026-92159 (F\xb4 (F Prime) is a framework that enables development and
deployment ...)
+ TODO: check
+CVE-2026-92158 (F\xb4 (F Prime) is a framework that enables development and
deployment ...)
+ TODO: check
+CVE-2026-92157 (F\xb4 (F Prime) is a framework that enables development and
deployment ...)
+ TODO: check
+CVE-2026-92156 (F\xb4 (F Prime) is a framework that enables development and
deployment ...)
+ TODO: check
+CVE-2026-92155 (F\xb4 (F Prime) is a framework that enables development and
deployment ...)
+ TODO: check
+CVE-2026-92154 (F\xb4 (F Prime) is a framework that enables development and
deployment ...)
+ TODO: check
+CVE-2026-92153 (F\xb4 (F Prime) is a framework that enables development and
deployment ...)
+ TODO: check
+CVE-2026-92152 (F\xb4 (F Prime) is a framework that enables development and
deployment ...)
+ TODO: check
+CVE-2026-92151 (F\xb4 (F Prime) is a framework that enables development and
deployment ...)
+ TODO: check
+CVE-2026-92150 (F\xb4 (F Prime) is a framework that enables development and
deployment ...)
+ TODO: check
+CVE-2026-91883 (Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3,
contain ...)
+ TODO: check
+CVE-2026-91882 (Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3,
contain ...)
+ TODO: check
+CVE-2026-91881 (Dell Terraform Provider for Redfish, versions prior to 1.6.2,
contains ...)
+ TODO: check
+CVE-2026-91184 (Description NGINX Gateway Fabrichas a vulnerability when it
renders t ...)
+ TODO: check
+CVE-2026-91159 (Discourse is an open-source discussion platform. Prior to
2026.9.0, 20 ...)
+ TODO: check
+CVE-2026-91157 (Discourse is an open-source discussion platform. Prior to
2026.9.0, 20 ...)
+ TODO: check
+CVE-2026-91156 (Discourse is an open-source discussion platform. Prior to
2026.9.0, 20 ...)
+ TODO: check
+CVE-2026-90954 (A flaw was found in BusyBox's dpkg-deb archive extraction. The
ar arch ...)
+ TODO: check
+CVE-2026-89077 (Incorrect implementation of authentication algorithm
vulnerability in ...)
+ TODO: check
+CVE-2026-89076 (Improper neutralization of special elements used in an SQL
command ('S ...)
+ TODO: check
+CVE-2026-89075 (Insecure Storage of Sensitive Information vulnerability in
Progress MO ...)
+ TODO: check
+CVE-2026-89074 (Improper handling of unicode encoding vulnerability in
Progress MOVEit ...)
+ TODO: check
+CVE-2026-89073 (Insufficient Session Expiration vulnerability in Progress
MOVEit Trans ...)
+ TODO: check
+CVE-2026-89072 (Incorrect Authorization vulnerability in Progress MOVEit
Transfer (Cli ...)
+ TODO: check
+CVE-2026-89071 (Improper neutralization of special elements used in an LDAP
query ('LD ...)
+ TODO: check
+CVE-2026-89070 (Authentication bypass by capture-replay vulnerability in
Progress MOVE ...)
+ TODO: check
+CVE-2026-89069 (Improper neutralization of input during web page generation
('cross-si ...)
+ TODO: check
+CVE-2026-89068 (Missing critical step in authentication vulnerability in
Progress MOVE ...)
+ TODO: check
+CVE-2026-89067 (Authentication bypass using an alternate path or channel
vulnerability ...)
+ TODO: check
+CVE-2026-88998 (The Tickera WordPress plugin before 3.6.0.4 does not correctly
verify ...)
+ TODO: check
+CVE-2026-88842 (A flaw was found in BusyBox dpkg. The write_status_file()
function doe ...)
+ TODO: check
+CVE-2026-88829 (A flaw was found in BusyBox httpd's reverse proxy feature.
When the pr ...)
+ TODO: check
+CVE-2026-88164 (Missing authorization in Microsoft Office SharePoint allows an
authori ...)
+ TODO: check
+CVE-2026-87093 (Incorrect Permission Assignment for Critical Resource
vulnerability in ...)
+ TODO: check
+CVE-2026-86856 (A flaw was found in the DPDK nfp vDPA driver. Stack and heap
buffers s ...)
+ TODO: check
+CVE-2026-86849 (A flaw was found in DPDK lib/vhost vhost-crypto. Integer
overflow in c ...)
+ TODO: check
+CVE-2026-86848 (A flaw was found in DPDK lib/vhost vhost-crypto. The
indirect-descript ...)
+ TODO: check
+CVE-2026-86847 (A flaw was found in DPDK lib/vhost vhost-crypto. Write-back
chain clea ...)
+ TODO: check
+CVE-2026-86846 (A flaw was found in DPDK lib/vhost vhost-crypto. A guest can
supply an ...)
+ TODO: check
+CVE-2026-86845 (A flaw was found in DPDK lib/vhost vhost-crypto. Session
cleanup can l ...)
+ TODO: check
+CVE-2026-86567 (A flaw was found in DPDK lib/vhost. The VDUSE handler fails to
invalid ...)
+ TODO: check
+CVE-2026-86566 (A flaw was found in DPDK lib/vhost. A guest with runt RX
descriptors c ...)
+ TODO: check
+CVE-2026-86565 (A flaw was found in DPDK lib/vhost. A guest can desynchronize
virtqueu ...)
+ TODO: check
+CVE-2026-86563 (A flaw was found in DPDK lib/vhost. A double-offset bug in
vhost log m ...)
+ TODO: check
+CVE-2026-86562 (A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of
control-q ...)
+ TODO: check
+CVE-2026-86561 (A flaw was found in DPDK lib/vhost. Memory size is not
adequately vali ...)
+ TODO: check
+CVE-2026-86476 (A flaw was found in gst-plugins-base. A heap buffer overflow
can be tr ...)
+ TODO: check
+CVE-2026-86461 (The FV Flowplayer Video Player plugin for WordPress is
vulnerable to L ...)
+ TODO: check
+CVE-2026-86002 (Dokku is a docker-powered platform as a service. In Dokku
versions bef ...)
+ TODO: check
+CVE-2026-85714 (Stirling-PDF is a locally hosted web application that
facilitates vari ...)
+ TODO: check
+CVE-2026-85298 (An Incorrect Authorization vulnerability in the AuthConfig
validation ...)
+ TODO: check
+CVE-2026-82844 (The WPForms Lite WordPress plugin before 2.0.2.2 does not
verify serve ...)
+ TODO: check
+CVE-2026-82402 (Gogs is an open source self-hosted Git service. Prior to
0.15.0+dev, a ...)
+ TODO: check
+CVE-2026-82153 (Dell OS Recovery Tool, versions prior to 2.4.4, contains an
Insecure S ...)
+ TODO: check
+CVE-2026-82026 (Radar before 1.12.2 contains a missing authorization
vulnerability in ...)
+ TODO: check
+CVE-2026-79957 (ServiceNext contains an insecure direct object reference
(IDOR) in the ...)
+ TODO: check
+CVE-2026-78433 (Gitea's web attachment handler skips its cross-repository
ownership ch ...)
+ TODO: check
+CVE-2026-78231 (When OpenID sign-in is enabled, Gitea processes
unauthenticated assert ...)
+ TODO: check
+CVE-2026-77572 (VeraCrypt provides disk encryption with strong security based
on TrueC ...)
+ TODO: check
+CVE-2026-77564 (Talos Linux is a Linux distribution built for Kubernetes
deployments. ...)
+ TODO: check
+CVE-2026-77524 (KEDA is a Kubernetes-based Event Driven Autoscaling component.
In vers ...)
+ TODO: check
+CVE-2026-77371 (Redash is a package for data visualization and sharing. From
26.0.0 un ...)
+ TODO: check
+CVE-2026-76655 (A security vulnerability inHPE NonStop SNMP Trap Multiplexer
may allow ...)
+ TODO: check
+CVE-2026-76519 (A vulnerability in the Advanced Malware Protection (AMP)
feature of Ci ...)
+ TODO: check
+CVE-2026-76113 (Dell Terraform Provider for Redfish, versions 1.1.0 through
1.6.1, con ...)
+ TODO: check
+CVE-2026-76083 (Redash is a package for data visualization and sharing. From
10.0.0 un ...)
+ TODO: check
+CVE-2026-75085 (The STM32WBA IEEE 802.15.4 driver in
drivers/ieee802154/ieee802154_stm ...)
+ TODO: check
+CVE-2026-75084 (The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet
length fr ...)
+ TODO: check
+CVE-2026-75083 (The receive path of the NXP KW41Z IEEE 802.15.4 driver,
kw41z_rx() in ...)
+ TODO: check
+CVE-2026-73814 (Gitea's collaboration access-mode endpoint accepts the Owner
access mo ...)
+ TODO: check
+CVE-2026-73804 (Gitea allows a token with write:user scope to register an
attacker-con ...)
+ TODO: check
+CVE-2026-73802 (Gitea Runner passes workflow-controlled container options into
Docker ...)
+ TODO: check
+CVE-2026-73800 (Gitea resolves local reusable workflow files from a fork's
head commit ...)
+ TODO: check
+CVE-2026-73798 (A security vulnerability inHPE NonStop DNS 9.2.3 Non Secure
Version co ...)
+ TODO: check
+CVE-2026-73797 (A security vulnerability inHPE NonStop TSQLFIL may cause
address space ...)
+ TODO: check
+CVE-2026-73796 (A security vulnerability inHPE NonStop TSQLEXE may cause
application c ...)
+ TODO: check
+CVE-2026-73795 (A security vulnerability in HPE NonStop TMF Auditread2 can
cause Denia ...)
+ TODO: check
+CVE-2026-73794 (HPE NonStop MODULAR NSJ contains a predictable seed
vulnerability in R ...)
+ TODO: check
+CVE-2026-73793 (HPE NonStop Middleware software has secret key handling and
data deser ...)
+ TODO: check
+CVE-2026-73792 (A security vulnerability in HPE NonStop Java JToolkit can
allow comman ...)
+ TODO: check
+CVE-2026-73791 (A security vulnerability inHPE NonStop Hpjmeter can cause
stack and he ...)
+ TODO: check
+CVE-2026-73790 (A vulnerability in HPE NonStop iTP WebServer can cause memory
corrupti ...)
+ TODO: check
+CVE-2026-73539 (Gitea substitutes a URL derived from the markup Context field
into ext ...)
+ TODO: check
+CVE-2026-73535 (Gitea's OpenID connect handler accepts a user's password
without enfor ...)
+ TODO: check
+CVE-2026-73273 (Gitea's Maven upload handler reads checksum uploads entirely
into memo ...)
+ TODO: check
+CVE-2026-73135 (Gitea uses inconsistent repository visibility predicates, and
the cond ...)
+ TODO: check
+CVE-2026-73130 (Gitea does not limit the length of the gitignores field
accepted by re ...)
+ TODO: check
+CVE-2026-73126 (Gitea's Actions workflow status badge endpoint does not
enforce reposi ...)
+ TODO: check
+CVE-2026-71301 (Gitea's repository markup endpoint resolves same-repository
pull reque ...)
+ TODO: check
+CVE-2026-71184 (Gitea's pull request review notifier does not attach the pull
request ...)
+ TODO: check
+CVE-2026-70407 (Gitea's organization-list API does not enforce the
read:organization t ...)
+ TODO: check
+CVE-2026-70406 (Gitea's shared comparison helper omits the token
repository-access che ...)
+ TODO: check
+CVE-2026-70402 (Gitea creates server-side Git hook directories and scripts
with mode 0 ...)
+ TODO: check
+CVE-2026-70400 (Gitea's repository migration API accepts a public-only token
when the ...)
+ TODO: check
+CVE-2026-70396 (Gitea's organization repository-creation API requires
write:organizati ...)
+ TODO: check
+CVE-2026-68964 (Gitea's user SSH and GPG key-list API endpoints omit the
profile visib ...)
+ TODO: check
+CVE-2026-68957 (Gitea's API and web issue-search paths do not treat restricted
account ...)
+ TODO: check
+CVE-2026-67577 (Gitea's activity-feed and contribution-heatmap API handlers do
not app ...)
+ TODO: check
+CVE-2026-67418 (RabbitMQ is a messaging and streaming broker. From 3.13.0
until 3.13.1 ...)
+ TODO: check
+CVE-2026-67416 (RabbitMQ is a messaging and streaming broker. From 4.0.0 until
4.0.24, ...)
+ TODO: check
+CVE-2026-67414 (RabbitMQ is a messaging and streaming broker. From 4.0.0 until
4.0.24, ...)
+ TODO: check
+CVE-2026-66877 (Gitea enforces first-time fork contributor approval by
blocking jobs, ...)
+ TODO: check
+CVE-2026-66874 (For pull request events, Gitea reads workflow definitions from
the pul ...)
+ TODO: check
+CVE-2026-66853 (Gitea's user organization-list API includes Limited-visibility
organiz ...)
+ TODO: check
+CVE-2026-66849 (Gitea's package registry grants authenticated users read
access to pac ...)
+ TODO: check
+CVE-2026-63792 (Gitea's collaborative-owner authorization path for reading
cross-repos ...)
+ TODO: check
+CVE-2026-63021 (Gitea's Swift package parser limits each manifest to 128 KiB
but does ...)
+ TODO: check
+CVE-2026-62925 (Gitea parses Alpine package uploads before enforcing
package-size quot ...)
+ TODO: check
+CVE-2026-62858 (YOURLS is a self-hosted, customizable URL shortener written in
PHP. Pr ...)
+ TODO: check
+CVE-2026-60021 (Gitea's initial GitLab migration version probe uses an HTTP
client wit ...)
+ TODO: check
+CVE-2026-60018 (Gitea's OneDev migration downloader reads the entire remote
version re ...)
+ TODO: check
+CVE-2026-60010 (Gitea's repository-side team-link API allows a repository
administrato ...)
+ TODO: check
+CVE-2026-60008 (Gitea's Jupyter notebook renderer inserts the notebook's
language_info ...)
+ TODO: check
+CVE-2026-59951 (The MCP Python SDK, called mcp on PyPI, is a Python
implementation of ...)
+ TODO: check
+CVE-2026-59774 (Gitea's Org-mode markup renderer processes INCLUDE directives
supplied ...)
+ TODO: check
+CVE-2026-59766 (Gitea's starred-repository and tracked-time API endpoints do
not re-ch ...)
+ TODO: check
+CVE-2026-55787 (Flyto2 Core is an execution kernel for automation and AI-agent
workflo ...)
+ TODO: check
+CVE-2026-55786 (Flyto2 Core is an execution kernel for automation and AI-agent
workflo ...)
+ TODO: check
+CVE-2026-55573 (e107 is a content management system (CMS). Prior to 2.3.7,
install.php ...)
+ TODO: check
+CVE-2026-55572 (e107 is a content management system (CMS). Prior to 2.3.7, the
bundled ...)
+ TODO: check
+CVE-2026-55167 (LDAP Account Manager (LAM) is a webfrontend for managing
entries (e.g. ...)
+ TODO: check
+CVE-2026-54554 (FOG is a free open-source cloning/imaging/rescue
suite/inventory manag ...)
+ TODO: check
+CVE-2026-54525 (Markdown Preview Enhanced is a Markdown preview extension for
Visual S ...)
+ TODO: check
+CVE-2026-53999 (Radius is a cloud-native, portable application platform that
makes app ...)
+ TODO: check
+CVE-2026-49206 (rapidcsv is a C++ CSV parser library. Prior to 8.99,
RemoveColumn, Ins ...)
+ TODO: check
+CVE-2026-42093 (Redash is a package for data visualization and sharing. From
versions ...)
+ TODO: check
+CVE-2026-35161 (Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0,
contains an O ...)
+ TODO: check
+CVE-2026-33798 (A Stack-based Buffer Overflow vulnerability in the srxpfe of
Juniper N ...)
+ TODO: check
+CVE-2026-33796 (A Stack-based Buffer Overflow vulnerability in the routing
protocol da ...)
+ TODO: check
+CVE-2026-33795 (A Numeric Truncation Error vulnerability in the rpd process of
Juniper ...)
+ TODO: check
+CVE-2026-33792 (A Stack-based Buffer Overflow vulnerability in the srxpfe
process of J ...)
+ TODO: check
+CVE-2026-33789 (A Stack-based Buffer Overflow vulnerability in the routing
protocol da ...)
+ TODO: check
+CVE-2026-25946 (When OpenID sign-in is enabled, Gitea accepts a user-supplied
OpenID U ...)
+ TODO: check
+CVE-2026-19673 (ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates
only th ...)
+ TODO: check
+CVE-2026-16741 (Improper neutralization of special elements used in an OS
command ('OS ...)
+ TODO: check
+CVE-2026-16740 (Missing authentication for critical function vulnerability in
TR7 Cybe ...)
+ TODO: check
+CVE-2026-15176 (A vulnerability exists in NGINX Plus and NGINX Open Source
when a loca ...)
+ TODO: check
+CVE-2026-15102 (ADP Desktop SDK contains a vulnerability where sensitive
information i ...)
+ TODO: check
+CVE-2026-14851 (A vulnerability relating to the exposure of confidential
information i ...)
+ TODO: check
+CVE-2026-110777 (A flaw was found in evolution-data-server. Calendar events
containing ...)
+ TODO: check
+CVE-2026-110775 (Nexent through 2.7.0 contains a missing authorization
vulnerability in ...)
+ TODO: check
+CVE-2026-110774 (Blinko through 1.8.8 contains a broken access control
vulnerability in ...)
+ TODO: check
+CVE-2026-110773 (GrowChief through 0.3.0 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-110772 (Sure 0.7.0 through 0.7.6-alpha.6 contains a missing
authorization vuln ...)
+ TODO: check
+CVE-2026-110771 (Shopizer through 3.2.5 contains an authorization bypass
vulnerability ...)
+ TODO: check
+CVE-2026-110770 (Databasus 3.7.0 through 3.61.0 contains an authentication
bypass vulne ...)
+ TODO: check
+CVE-2026-110769 (holaOS through 2026.822.1 contains a missing authorization
vulnerabili ...)
+ TODO: check
+CVE-2026-110768 (holaOS through 2026.822.1 contains an authorization bypass
vulnerabili ...)
+ TODO: check
+CVE-2026-110767 (Gitingest through 0.3.1 contains a symlink following
vulnerability in ...)
+ TODO: check
+CVE-2026-110766 (Colanode server through 0.4.7 contains a path traversal
vulnerability ...)
+ TODO: check
+CVE-2026-110765 (FlexPrice through 2.1.38 contains an authentication bypass
vulnerabili ...)
+ TODO: check
+CVE-2026-110764 (AstronRPA through 1.1.6 contains an insecure direct object
reference v ...)
+ TODO: check
+CVE-2026-110763 (lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an
insecure dir ...)
+ TODO: check
+CVE-2026-110762 (bbPress before 2.6.19 contains an information disclosure
vulnerability ...)
+ TODO: check
+CVE-2026-110761 (ILIAS before 9.24, 10.12, and 11.5 contains a PHP object
injection vul ...)
+ TODO: check
+CVE-2026-110736 (Godot Engine through 4.7.2 has an out-of-bounds read in the
optimized ...)
+ TODO: check
+CVE-2026-110735 (Godot Engine through 4.7.2 has a heap out-of-bounds write
exists in th ...)
+ TODO: check
+CVE-2026-110734 (Godot Engine through 4.7.2 has a heap out-of-bounds write in
the Radia ...)
+ TODO: check
+CVE-2026-110719 (Portkey AI Gateway 1.14.0 through 1.15.2 contains a
server-side reques ...)
+ TODO: check
+CVE-2026-110718 (TurboDocx html-to-docx through 1.23.1 contains a server-side
request f ...)
+ TODO: check
+CVE-2026-110717 (Janus WebRTC Server through 1.4.3 contains a path traversal
vulnerabil ...)
+ TODO: check
+CVE-2026-110716 (unshield through 1.6.2 contains a heap out-of-bounds read
vulnerabilit ...)
+ TODO: check
+CVE-2026-110715 (MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read
and write v ...)
+ TODO: check
+CVE-2026-110714 (libsmb2 through 6.2 contains an integer underflow
vulnerability in dec ...)
+ TODO: check
+CVE-2026-110713 (libsmb2 through 6.2 contains a heap out-of-bounds read
vulnerability i ...)
+ TODO: check
+CVE-2026-110712 (libsmb2 through 6.2 contains a heap out-of-bounds read
vulnerability i ...)
+ TODO: check
+CVE-2026-110690 (Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1
contains a ...)
+ TODO: check
+CVE-2026-110667 (A security flaw has been discovered in cemtan sar2html 4.0.0.
Affected ...)
+ TODO: check
+CVE-2026-110666 (A vulnerability was identified in cemtan sar2html 4.0.0.
Affected is t ...)
+ TODO: check
+CVE-2026-110661 (CGNS through 4.5.2 contains a stack out-of-bounds read
vulnerability i ...)
+ TODO: check
+CVE-2026-110660 (vgmstream through r2117 contains a stack out-of-bounds read
vulnerabil ...)
+ TODO: check
+CVE-2026-110659 (ELFIO through 3.12 contains a NULL pointer dereference
vulnerability i ...)
+ TODO: check
+CVE-2026-110658 (Sofia-SIP through 1.13.18 contains a heap out-of-bounds read
vulnerabi ...)
+ TODO: check
+CVE-2026-110657 (Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through
1.0.11 c ...)
+ TODO: check
+CVE-2026-110656 (miniupnpc through 2.3.3 contains a one-byte heap
out-of-bounds read vu ...)
+ TODO: check
+CVE-2026-110655 (miniupnpc through 2.3.3 contains a one-byte heap
out-of-bounds read vu ...)
+ TODO: check
+CVE-2026-110654 (libzvbi through 0.2.45 contains an out-of-bounds write
vulnerability i ...)
+ TODO: check
+CVE-2026-110652 (ONLYOFFICE DocumentServer before 10.0.0 contains an
unauthenticated se ...)
+ TODO: check
+CVE-2026-110650 (The thumbnail Python package through 1.5 contains an OS
command inject ...)
+ TODO: check
+CVE-2026-110649 (Stills before 25.24.2 contains an OS command injection
vulnerability t ...)
+ TODO: check
+CVE-2026-110648 (@offactory/compress-fonts before 1.1.1 contains an OS command
injectio ...)
+ TODO: check
+CVE-2026-110647 (Turnpress through 0.4.2 contains an OS command injection
vulnerability ...)
+ TODO: check
+CVE-2026-110646 (Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS
command inje ...)
+ TODO: check
+CVE-2026-110645 (Video-stitch before 2.0.0-beta.1 contains an OS command
injection vuln ...)
+ TODO: check
+CVE-2026-110644 (nodejs-whisper through 0.3.1 contains an OS command injection
vulnerab ...)
+ TODO: check
+CVE-2026-110643 (transcribe2texts through 1.0.6 contains an OS command
injection vulner ...)
+ TODO: check
+CVE-2026-110642 (xhtml2pdf before 0.2.19 contains an OS command injection
vulnerability ...)
+ TODO: check
+CVE-2026-110641 (@runnerty/executor-decompress through 3.1.1 contains an OS
command inj ...)
+ TODO: check
+CVE-2026-110640 (Whisper-node through 1.1.1 contains an OS command injection
vulnerabil ...)
+ TODO: check
+CVE-2026-110639 (@mborne/extract before 0.2.1 contains an OS command injection
vulnerab ...)
+ TODO: check
+CVE-2026-110638 (doc-recog through 1.1.6 contains an OS command injection
vulnerability ...)
+ TODO: check
+CVE-2026-110637 (buildebooks before 0.2.2 contains an OS command injection
vulnerabilit ...)
+ TODO: check
+CVE-2026-110636 (pypdftk through 0.5 contains an OS command injection
vulnerability in ...)
+ TODO: check
+CVE-2026-110635 (webp-converter before 3.0.0 contains an OS command injection
vulnerabi ...)
+ TODO: check
+CVE-2026-110634 (git-diff before 2.0.7 contains an OS command injection
vulnerability t ...)
+ TODO: check
+CVE-2026-110633 (MyReport Updater through 2.1.1 contains a local privilege
escalation v ...)
+ TODO: check
+CVE-2026-110632 (Report One MyReport Updater through 2.1.1 exposes an
unauthenticated g ...)
+ TODO: check
+CVE-2026-110631 (Komodo through 2.3.3 contains an authentication bypass
vulnerability i ...)
+ TODO: check
+CVE-2026-110630 (VentureDrake Laravel CRM before 2.4.0 contains an incorrect
authorizat ...)
+ TODO: check
+CVE-2026-110629 (VentureDrake Laravel CRM before 2.4.0 contains a missing
authorization ...)
+ TODO: check
+CVE-2026-110628 (Kan 0.5.5 through 0.6.0 contains an unauthenticated
server-side reques ...)
+ TODO: check
+CVE-2026-110627 (ClipBucket v5 through 5.5.3-#206 contains a reflected
cross-site scrip ...)
+ TODO: check
+CVE-2026-110626 (ClipBucket v5 through 5.5.3-#206 contains a reflected
cross-site scrip ...)
+ TODO: check
+CVE-2026-110625 (ClipBucket v5 through 5.5.3-#206 contains a reflected
cross-site scrip ...)
+ TODO: check
+CVE-2026-110624 (Papermerge Core through 3.5.3 contains a missing
authorization vulnera ...)
+ TODO: check
+CVE-2026-110623 (Papermerge Core through 3.5.3 contains a missing
authorization vulnera ...)
+ TODO: check
+CVE-2026-110622 (Papermerge Core through 3.5.3 contains a missing
authorization vulnera ...)
+ TODO: check
+CVE-2026-110621 (Swetrix Cloud before 5.1.0 contains a missing authorization
vulnerabil ...)
+ TODO: check
+CVE-2026-110620 (Formbricks before 4.9.0 contains an authorization bypass
vulnerability ...)
+ TODO: check
+CVE-2026-110619 (frp 0.41.0 through 0.71.1 contains a missing authentication
vulnerabil ...)
+ TODO: check
+CVE-2026-110618 (SmsForwarder through 3.5.0 contains a missing authentication
vulnerabi ...)
+ TODO: check
+CVE-2026-110617 (we-mp-rss through 1.5.3 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-110616 (NullHub through 2026.5.29 contains a missing authentication
vulnerabil ...)
+ TODO: check
+CVE-2026-110615 (jshERP through 3.6 contains a missing authorization
vulnerability in t ...)
+ TODO: check
+CVE-2026-110614 (Yiuman citrus through 0.15.0 contains an ORDER BY sql
injection vulner ...)
+ TODO: check
+CVE-2026-110613 (youlai-mall through commit 9f62de8 contains a missing
authorization vu ...)
+ TODO: check
+CVE-2026-110612 (vlife through 2.0.1 contains an authentication bypass
vulnerability th ...)
+ TODO: check
+CVE-2026-110611 (REBUILD through 4.5.0 contains an authorization bypass
vulnerability i ...)
+ TODO: check
+CVE-2026-110610 (ruoyi-vue-pro through 2026.09 contains a server-side request
forgery v ...)
+ TODO: check
+CVE-2026-110609 (Dromara Skyeye through commit 65d3ddcede70 contains an sql
injection v ...)
+ TODO: check
+CVE-2026-110608 (BizSpring Shop through commit cf22d39daaf1 contains an
insecure direct ...)
+ TODO: check
+CVE-2026-110607 (BizSpring Shop through commit cf22d39daaf1 contains a payment
verifica ...)
+ TODO: check
+CVE-2026-110606 (LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5)
contains ...)
+ TODO: check
+CVE-2026-110605 (libschrift through 0.10.2 contains a divide by zero
vulnerability that ...)
+ TODO: check
+CVE-2026-110604 (Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack
out-of-bound ...)
+ TODO: check
+CVE-2026-110603 (LASzip through 3.5.0 contains an invalid free vulnerability
in laszip_ ...)
+ TODO: check
+CVE-2026-110602 (libmspack through 0.11alpha contains an uninitialized pointer
free vul ...)
+ TODO: check
+CVE-2026-110601 (libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a
heap out- ...)
+ TODO: check
+CVE-2026-110600 (xlsxio through 0.2.37 contains a NULL pointer dereference
vulnerabilit ...)
+ TODO: check
+CVE-2026-110599 (L-SMASH through 2.14.5 contains a double free vulnerability
in hevc_se ...)
+ TODO: check
+CVE-2026-110598 (Libyal libpff through 20260926 contains an integer underflow
in libpff ...)
+ TODO: check
+CVE-2026-110597 (Tinyexr through 3.2.0 contains a heap out-of-bounds read
vulnerability ...)
+ TODO: check
+CVE-2026-110596 (quirc through 1.2 contains an excessive-iteration
vulnerability in fin ...)
+ TODO: check
+CVE-2026-110595 (BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory
allocati ...)
+ TODO: check
+CVE-2026-110594 (BottleCRM 0.43 through 1.14.5 contains a regular expression
denial of ...)
+ TODO: check
+CVE-2026-110593 (BottleCRM through 1.14.5 contains a server-side template
injection vul ...)
+ TODO: check
+CVE-2026-110592 (BottleCRM 0.30 through 1.14.5 contains an HTML injection
vulnerability ...)
+ TODO: check
+CVE-2026-110591 (OW2 ASM 1.4.3 before 9.11 contains an excessive resource
consumption v ...)
+ TODO: check
+CVE-2026-110536 (A vulnerability was determined in D-Link DIR-868L 2.01b05.
This impact ...)
+ TODO: check
+CVE-2026-110284 (The LifterLMS \u2013 WP LMS for eLearning, Online Courses, &
Quizzes p ...)
+ TODO: check
+CVE-2026-110270 (OW2 ASM 3.0 before 9.11 contains an uncontrolled memory
allocation vul ...)
+ TODO: check
+CVE-2026-110263 (OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion
vulnerabili ...)
+ TODO: check
+CVE-2026-110262 (OW2 ASM 3.1 before 9.11 contains an excessive memory
allocation vulner ...)
+ TODO: check
+CVE-2026-110261 (OW2 ASM 3.0 before 9.11 contains a denial of service
vulnerability tha ...)
+ TODO: check
+CVE-2026-110260 (OW2 ASM 3.0 before 9.11 contains a quadratic memory
allocation vulnera ...)
+ TODO: check
+CVE-2026-110259 (OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion
vulnerabili ...)
+ TODO: check
+CVE-2026-110258 (OW2 ASM 3.0 before 9.11 contains an excessive memory
allocation vulner ...)
+ TODO: check
+CVE-2026-110257 (OW2 ASM 5.0 before 9.11 contains an excessive memory
allocation vulner ...)
+ TODO: check
+CVE-2026-110248 (Insertion of sensitive information into log files in the
git_utils[.]p ...)
+ TODO: check
+CVE-2026-110227 (Missing Authorization vulnerability in 10up Restricted Site
Access res ...)
+ TODO: check
+CVE-2026-109971 (A flaw was found in the clevis PKCS#11 pin. The
clevis-decrypt-pkcs11 ...)
+ TODO: check
+CVE-2026-109970 (A flaw was found in the clevis PKCS#11 pin. The
clevis-luks-pkcs11-ask ...)
+ TODO: check
+CVE-2026-109969 (A flaw was found in the clevis PKCS#11 pin. The
clevis-pkcs11-afunix-s ...)
+ TODO: check
+CVE-2026-109968 (A flaw was found in the clevis PKCS#11 pin. The
clevis-pkcs11-afunix-s ...)
+ TODO: check
+CVE-2026-109901 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-109527 (The Model Context Protocol Python SDK is the official Python
SDK for M ...)
+ TODO: check
+CVE-2026-109506 (Multiple TP-Link Wi-Fi range extenders use a custom,
reversible XOR-an ...)
+ TODO: check
+CVE-2026-109439 (Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware
through 8. ...)
+ TODO: check
+CVE-2026-109438 (3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923,
contains an ...)
+ TODO: check
+CVE-2026-108484 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-108483 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-108480 (Missing Authorization vulnerability in Skydropx Skydropx
skydropx allo ...)
+ TODO: check
+CVE-2026-108395 (The Model Context Protocol Java SDK is the official Java SDK
for Model ...)
+ TODO: check
+CVE-2026-108390 (Hestia Control Panel is a lightweight and powerful control
panel for t ...)
+ TODO: check
+CVE-2026-108291 (Deserialization of Untrusted Data vulnerability in itthinx
Affiliates ...)
+ TODO: check
+CVE-2026-108151 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
+ TODO: check
+CVE-2026-108072 (Vulnerability due to incorrect permissions in TSplus Remote
Access sha ...)
+ TODO: check
+CVE-2026-108071 (Incorrect authentication vulnerability in the TSplus Remote
Access mul ...)
+ TODO: check
+CVE-2026-108070 (A vulnerability involving improper access control in the
TSplus Remote ...)
+ TODO: check
+CVE-2026-108065 (SQL Injection (CWE-89) in the SOAP GetUser method of the
/preapproval. ...)
+ TODO: check
+CVE-2026-107913
+ REJECTED
+CVE-2026-107870 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-107867 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-107757 (The Gallery Custom Links plugin for WordPress is vulnerable
to Stored ...)
+ TODO: check
+CVE-2026-107756 (The Meow Lightbox plugin for WordPress is vulnerable to
Stored Cross-S ...)
+ TODO: check
+CVE-2026-107754 (The GeoDirectory \u2013 WP Business Directory Plugin and
Classified Li ...)
+ TODO: check
+CVE-2026-107751 (The Mang Board plugin for WordPress is vulnerable to Stored
Cross-Site ...)
+ TODO: check
+CVE-2026-107650 (The GeoDirectory \u2013 WP Business Directory Plugin and
Classified Li ...)
+ TODO: check
+CVE-2026-107631 (The Record of Consent Extension for Complianz plugin for
WordPress is ...)
+ TODO: check
+CVE-2026-107433 (Missing Authorization vulnerability in miniOrange WP OAuth
Server mini ...)
+ TODO: check
+CVE-2026-107431 (Missing Authorization vulnerability in Crocoblock
JetFormBuilder jetfo ...)
+ TODO: check
+CVE-2026-107428 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-107426 (Missing Authorization vulnerability in VideoWhisper.com Paid
Videochat ...)
+ TODO: check
+CVE-2026-107425 (Missing Authorization vulnerability in Magepeople inc. Bus
Ticket Book ...)
+ TODO: check
+CVE-2026-107424 (Incorrect Privilege Assignment vulnerability in M A Vinoth
Kumar Front ...)
+ TODO: check
+CVE-2026-107422 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-107421 (Session Fixation vulnerability in VideoWhisper.com Broadcast
Live Vide ...)
+ TODO: check
+CVE-2026-107417 (Missing Authorization vulnerability in Muralidharan Ramasamy
Push Noti ...)
+ TODO: check
+CVE-2026-107381 (svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0,
Resolver::pr ...)
+ TODO: check
+CVE-2026-107171 (An Hardcoded Cryptographic Key vulnerability existed in
Trellix Agent ...)
+ TODO: check
+CVE-2026-106599 (Deserialization of Untrusted Data vulnerability in Brainstorm
Force Su ...)
+ TODO: check
+CVE-2026-106465 (The NetX Secure DTLS server sends a HelloVerifyRequest
carrying a fres ...)
+ TODO: check
+CVE-2026-106464 (`_nx_secure_x509_parse_signature_data` computes the
certificate signat ...)
+ TODO: check
+CVE-2026-105874 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-105659 (Uncontrolled Resource Consumption vulnerability in mtrudel
bandit allo ...)
+ TODO: check
+CVE-2026-105236 (Improper Certificate Validation vulnerability in the ssl
application i ...)
+ TODO: check
+CVE-2026-105107 (Koha is vulnerable to SQL injection in the Most-circulated
items repor ...)
+ TODO: check
+CVE-2026-105106 (Koha is vulnerable to OS command injection in the Task
Scheduler delet ...)
+ TODO: check
+CVE-2026-105067 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-105066 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-104939 (Description NGINX Ingress Controller has a vulnerability when
implemen ...)
+ TODO: check
+CVE-2026-104909 (The Mang Board plugin for WordPress is vulnerable to Local
File Inclus ...)
+ TODO: check
+CVE-2026-104795 (The insights-runtime-extractor runs as a privileged DaemonSet
(`hostPI ...)
+ TODO: check
+CVE-2026-104764 (The Post Export Import with Media plugin for WordPress is
vulnerable t ...)
+ TODO: check
+CVE-2026-104761 (The Mang Board plugin for WordPress is vulnerable to Stored
Cross-Site ...)
+ TODO: check
+CVE-2026-104748 (The SimpleForm \u2013 Form Maker to Chat Apps with Quiz, Poll
and Mult ...)
+ TODO: check
+CVE-2026-104143 (DataEase is an open source data visualization and analysis
tool. Prior ...)
+ TODO: check
+CVE-2026-104142 (DataEase is an open source data visualization and analysis
tool. Prior ...)
+ TODO: check
+CVE-2026-104141 (DataEase is an open source data visualization and analysis
tool. Authe ...)
+ TODO: check
+CVE-2026-104103 (Ludwig is a low-code framework for building custom LLMs,
neural networ ...)
+ TODO: check
+CVE-2026-104086 (7-Zip before 26.03 contains an uninitialized memory
disclosure vulnera ...)
+ TODO: check
+CVE-2026-103994 (A Heap-based Buffer Overflow vulnerability in theVXLAN
Gateway Daemon( ...)
+ TODO: check
+CVE-2026-103993 (An Out-of-bounds Write vulnerability in the routing protocol
daemon (r ...)
+ TODO: check
+CVE-2026-103975 (Appium is a cross-platform automation framework for all kinds
of apps, ...)
+ TODO: check
+CVE-2026-103974 (lichess.org is the forever free, adless and open source chess
server. ...)
+ TODO: check
+CVE-2026-103946 (An SQL injection vulnerability could allow an authenticated
user to re ...)
+ TODO: check
+CVE-2026-103930 (cpp-httplib is a C++ header-only HTTP/HTTPS library. From
0.29.0 until ...)
+ TODO: check
+CVE-2026-103929 (mise manages dev tools like node, python, cmake, and
terraform. Prior ...)
+ TODO: check
+CVE-2026-103907 (The JNews - Jeg Elementor Kit plugin for WordPress is
vulnerable to un ...)
+ TODO: check
+CVE-2026-103905 (The authentication middleware of the JTL-Shop administration
backend p ...)
+ TODO: check
+CVE-2026-103904 (The public consent endpoint of JTL-Shop accepts arbitrary
consent name ...)
+ TODO: check
+CVE-2026-103671 (External control of assumed-Immutable web parameter issue
exists in EC ...)
+ TODO: check
+CVE-2026-103415 (When a TLS 1.3 client processes a HelloRetryRequest, it
copies the ser ...)
+ TODO: check
+CVE-2026-103414 (The GUIX binary resource (theme) loader sizes its arena and
populates ...)
+ TODO: check
+CVE-2026-103380 (The Appointment Booking Plugin \u2013 LatePoint | Calendar &
Schedulin ...)
+ TODO: check
+CVE-2026-103367 (The ShopMagic \u2013 email automation for WordPress plugin
for WordPre ...)
+ TODO: check
+CVE-2026-103366 (The Appointment Booking Plugin \u2013 LatePoint | Calendar &
Schedulin ...)
+ TODO: check
+CVE-2026-103358 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
+ TODO: check
+CVE-2026-103308 (The Visma Pay for WooCommerce WordPress plugin before 1.2.2
does not v ...)
+ TODO: check
+CVE-2026-103081 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
+ TODO: check
+CVE-2026-102944 (cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to
0.51.0, ...)
+ TODO: check
+CVE-2026-102899 (Sentry is an application monitoring and error tracking
platform. From ...)
+ TODO: check
+CVE-2026-102893 (Zulip is an open-source team collaboration tool. In Zulip
Server versi ...)
+ TODO: check
+CVE-2026-102756 (DataEase is an open source data visualization and analysis
tool. Prior ...)
+ TODO: check
+CVE-2026-102755 (DataEase is an open source data visualization and analysis
tool. Prior ...)
+ TODO: check
+CVE-2026-102748 (Dgraph is an open source distributed GraphQL database. Prior
to 25.4.0 ...)
+ TODO: check
+CVE-2026-102695 (OmniFaces is a utility library for Faces. In OmniFaces
versions before ...)
+ TODO: check
+CVE-2026-102682 (Pipecat is an open-source Python framework for building
real-time voic ...)
+ TODO: check
+CVE-2026-102479 (In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or
[5.2.0, ...)
+ TODO: check
+CVE-2026-102476 (In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or
[5.2.0, ...)
+ TODO: check
+CVE-2026-102471 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-102460 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-102354 (BentoPDF is a privacy-focused PDF toolkit that runs in the
browser. In ...)
+ TODO: check
+CVE-2026-102185 (A Loop with Unreachable Exit Condition ('Infinite Loop')
vulnerability ...)
+ TODO: check
+CVE-2026-102184 (AnImproper Validation of Specified Quantity in Input
vulnerability in ...)
+ TODO: check
+CVE-2026-102183 (AnImproper Validation of Specified Quantity in Input
vulnerability in ...)
+ TODO: check
+CVE-2026-102182 (A Stack-based Buffer Overflow vulnerability in the kmd
component of Ju ...)
+ TODO: check
+CVE-2026-102180 (A Stack-based Buffer Overflow vulnerability in the routing
protocol da ...)
+ TODO: check
+CVE-2026-102179 (An Out-of-bounds Write vulnerability in the routing protocol
daemon (r ...)
+ TODO: check
+CVE-2026-102178 (A Stack-based Buffer Overflow vulnerability in the BGP
routing daemon ...)
+ TODO: check
+CVE-2026-102177 (An Out-of-bounds Write vulnerability in the routing protocol
daemon (r ...)
+ TODO: check
+CVE-2026-102176 (A Buffer Copy without Checking Size of Input ('Classic Buffer
Overflow ...)
+ TODO: check
+CVE-2026-102175 (A Heap-based Buffer Overflow vulnerability in the sdxd
service-deploym ...)
+ TODO: check
+CVE-2026-102174 (A Stack-based Buffer Overflow vulnerability in the iked IKE
key-manage ...)
+ TODO: check
+CVE-2026-102087 (An Incomplete List of Disallowed Inputs vulnerability in the
routing p ...)
+ TODO: check
+CVE-2026-102086 (A NULL Pointer Dereference vulnerability in the DNS plugin of
Juniper ...)
+ TODO: check
+CVE-2026-102085 (An Improper Restriction of Communication Channel to Intended
Endpoints ...)
+ TODO: check
+CVE-2026-102084 (An Improper Validation of Syntactic Correctness of Input
vulnerability ...)
+ TODO: check
+CVE-2026-102083 (An Improper Resource Locking vulnerability in the UTM
processing of Ju ...)
+ TODO: check
+CVE-2026-102082 (An Improper Handling of Missing Special Element vulnerability
in the S ...)
+ TODO: check
+CVE-2026-102081 (A Missing Release of Memory after Effective Lifetime
vulnerability in ...)
+ TODO: check
+CVE-2026-102080 (An Improper Resource Locking vulnerability in the clock
synchronizatio ...)
+ TODO: check
+CVE-2026-102079 (An OS command injection vulnerability in the CLI of Juniper
Networks J ...)
+ TODO: check
+CVE-2026-102078 (A Use After Free vulnerability in the packet forwarding
engine (pfe) o ...)
+ TODO: check
+CVE-2026-102077 (An Improper Check for Unusual or Exceptional Conditions
vulnerability ...)
+ TODO: check
+CVE-2026-102072 (An Improper Handling of Highly Compressed Data vulnerability
in the gR ...)
+ TODO: check
+CVE-2026-102071 (A Reachable Assertion vulnerability in the routing protocol
daemon (rp ...)
+ TODO: check
+CVE-2026-102070 (A Reachable Assertion vulnerability in the Two-Way Active
Measurement ...)
+ TODO: check
+CVE-2026-102069 (A Stack-based Buffer Overflow vulnerability in the dot1x
daemon of Jun ...)
+ TODO: check
+CVE-2026-102068 (A Stack-based Buffer Overflow vulnerability in the kernel of
Juniper N ...)
+ TODO: check
+CVE-2026-102067 (An Improper Validation of Specified Quantity in Input
vulnerability in ...)
+ TODO: check
+CVE-2026-102066 (A Improper Validation of Specified Quantity in Input
vulnerability in ...)
+ TODO: check
+CVE-2026-102065 (An Improper Validation of Specified Quantity in Input
vulnerability in ...)
+ TODO: check
+CVE-2026-102064 (A Reachable Assertion vulnerability in the routing protocol
daemon (rp ...)
+ TODO: check
+CVE-2026-102063 (A Reachable Assertion vulnerability in the routing protocol
daemon (rp ...)
+ TODO: check
+CVE-2026-102062 (An Use of Externally-Controlled Format String vulnerability
in the ipf ...)
+ TODO: check
+CVE-2026-102061 (A Stack-based Buffer Overflow vulnerability in the phone-home
daemon ( ...)
+ TODO: check
+CVE-2026-102060 (A NULL Pointer Dereference vulnerability in the rpd process
of Juniper ...)
+ TODO: check
+CVE-2026-102059 (An Improper Neutralization of Special Elements used in an OS
Command ( ...)
+ TODO: check
+CVE-2026-102058 (A Reachable Assertion vulnerability in the bfdd daemon of
Juniper Netw ...)
+ TODO: check
+CVE-2026-102057 (A Stack-based Buffer Overflow vulnerability in the jdhcpd
process of J ...)
+ TODO: check
+CVE-2026-102056 (An Out-of-bounds Read vulnerability in the cfmd process of
Juniper Net ...)
+ TODO: check
+CVE-2026-102055 (A Stack-based Buffer Overflow vulnerability in the cfmd
process of Jun ...)
+ TODO: check
+CVE-2026-102054 (An Improper Handling of Length Parameter Inconsistency
vulnerability i ...)
+ TODO: check
+CVE-2026-102053 (An Improper Release of Memory Before Removing Last Reference
vulnerabi ...)
+ TODO: check
+CVE-2026-102052 (A Stack-based Buffer Overflow vulnerability in the jdhcpd
process of J ...)
+ TODO: check
+CVE-2026-102051 (An Improper Release of Memory Before Removing Last Reference
vulnerabi ...)
+ TODO: check
+CVE-2026-102050 (A Stack-based Buffer Overflow vulnerability in the l2cpd
daemon of Jun ...)
+ TODO: check
+CVE-2026-102049 (A Stack-based Buffer Overflow vulnerability in the l2cpd
process of Ju ...)
+ TODO: check
+CVE-2026-102048 (An Allocation of Resources Without Limits or Throttling
vulnerability ...)
+ TODO: check
+CVE-2026-102047 (An Improper Validation of Consistency within Input
vulnerability in th ...)
+ TODO: check
+CVE-2026-102046 (A Loop with Unreachable Exit Condition ('Infinite Loop')
vulnerability ...)
+ TODO: check
+CVE-2026-102045 (An Out-of-bounds Write Out-of-bounds Write vulnerability in
lacpd of J ...)
+ TODO: check
+CVE-2026-102044 (A Reachable Assertion vulnerability in the rpd process of
Juniper Netw ...)
+ TODO: check
+CVE-2026-102043 (A Numeric Truncation Error vulnerability in the rpd process
of Juniper ...)
+ TODO: check
+CVE-2026-102042 (A Reachable Assertion vulnerability in the rpd process of
Juniper Netw ...)
+ TODO: check
+CVE-2026-102041 (A Reachable Assertion vulnerability in the rpd routing daemon
of Junip ...)
+ TODO: check
+CVE-2026-102040 (A NULL Pointer Dereference vulnerability in the rpd routing
daemon of ...)
+ TODO: check
+CVE-2026-102039 (A NULL Pointer Dereference vulnerability in the rpd process
of Juniper ...)
+ TODO: check
+CVE-2026-102037 (An XML Injection vulnerability in the Unified Threat
Management daemon ...)
+ TODO: check
+CVE-2026-102036 (An Integer Overflow or Wraparound vulnerability in the l2ald
process o ...)
+ TODO: check
+CVE-2026-102035 (A Reachable Assertion vulnerability in the l2ald process of
Juniper Ne ...)
+ TODO: check
+CVE-2026-102034 (A Reachable Assertion vulnerability in the l2ald daemon of
Juniper Net ...)
+ TODO: check
+CVE-2026-102033 (AnImproper Validation of Specified Quantity in Input
vulnerability in ...)
+ TODO: check
+CVE-2026-102032 (A Missing Release of Memory after Effective Lifetime
vulnerability in ...)
+ TODO: check
+CVE-2026-102031 (An OS Command Injection vulnerability in TACACS of Juniper
Networks Ju ...)
+ TODO: check
+CVE-2026-102030 (An Incomplete Cleanup vulnerability in the rpd process of
Juniper Netw ...)
+ TODO: check
+CVE-2026-102029 (A NULL Pointer Dereference vulnerability in the routing
protocol daemo ...)
+ TODO: check
+CVE-2026-102028 (A NULL Pointer Dereference vulnerability in the routing
protocol daemo ...)
+ TODO: check
+CVE-2026-102027 (An Incorrect Calculation of Buffer Size vulnerability in the
routing p ...)
+ TODO: check
+CVE-2026-102026 (An Improper Control of a Resource Through its Lifetime
vulnerability i ...)
+ TODO: check
+CVE-2026-102025 (A Mismatched Memory Management Routines vulnerability in the
routing p ...)
+ TODO: check
+CVE-2026-102024 (An Integer Overflow or Wraparound vulnerability in the
routing daemon ...)
+ TODO: check
+CVE-2026-102023 (A Reachable Assertion vulnerability in fwstatsd of Juniper
Networks Ju ...)
+ TODO: check
+CVE-2026-102022 (A Reachable Assertion vulnerability in the routing protocol
daemon (rp ...)
+ TODO: check
+CVE-2026-102021 (A NULL Pointer Dereference vulnerability in the routing
protocol daemo ...)
+ TODO: check
+CVE-2026-102020 (A Reachable Assertion vulnerability in the rpd process of
Juniper Netw ...)
+ TODO: check
+CVE-2026-102019 (AnImproper Validation of Specified Quantity in Input
vulnerability in ...)
+ TODO: check
+CVE-2026-102018 (A NULL Pointer Dereference vulnerability in the rpd process
of Juniper ...)
+ TODO: check
+CVE-2026-102017 (An Out-of-bounds Write vulnerability in the rpd process of
Juniper Net ...)
+ TODO: check
+CVE-2026-102016 (AnImproper Validation of Specified Quantity in Input
vulnerability in ...)
+ TODO: check
+CVE-2026-102015 (A Heap-based Buffer Overflow vulnerability in the
secure-dot1xd proces ...)
+ TODO: check
+CVE-2026-102014 (A Stack-based Buffer Overflow vulnerability in the authd
process of Ju ...)
+ TODO: check
+CVE-2026-102013 (A NULL Pointer Dereference vulnerability in the na-grpcd
process of Ju ...)
+ TODO: check
+CVE-2026-102012 (A Reachable Assertion vulnerability in the na-grpcd process
of Juniper ...)
+ TODO: check
+CVE-2026-102011 (A Reachable Assertion vulnerability in the rpd process of
Juniper Netw ...)
+ TODO: check
+CVE-2026-102000 (A Reachable Assertion vulnerability in the rpd process of
Juniper Netw ...)
+ TODO: check
+CVE-2026-101999 (A Reachable Assertion vulnerability in the rpd process of
Juniper Netw ...)
+ TODO: check
+CVE-2026-101997 (An Improper Neutralization of Special Elements used in an SQL
Command ...)
+ TODO: check
+CVE-2026-101996 (A Reachable Assertion vulnerability in the l2ald daemon
of Juniper ...)
+ TODO: check
+CVE-2026-101995 (AnImproper Validation of Specified Quantity in Input
vulnerability in ...)
+ TODO: check
+CVE-2026-101994 (An Improper Handling of Length Parameter Inconsistency
vulnerability i ...)
+ TODO: check
+CVE-2026-101993 (A Reachable Assertion vulnerability in the routing protocol
daemon (rp ...)
+ TODO: check
+CVE-2026-101992 (An Improper Input Validation vulnerability in the routing
protocol dae ...)
+ TODO: check
+CVE-2026-101991 (An Improper Handling of Length Parameter Inconsistency
vulnerability i ...)
+ TODO: check
+CVE-2026-101990 (A Stack-based Buffer Overflow vulnerability in the routing
protocol da ...)
+ TODO: check
+CVE-2026-101989 (A Reachable Assertion vulnerability in the routing protocol
daemon (rp ...)
+ TODO: check
+CVE-2026-101988 (A NULL Pointer Dereference vulnerability in the routing
protocol daemo ...)
+ TODO: check
+CVE-2026-101987 (AnImproper Validation of Specified Quantity in Input
vulnerability in ...)
+ TODO: check
+CVE-2026-101986 (An Improper Authentication vulnerability in J-Web of Juniper
Networks ...)
+ TODO: check
+CVE-2026-101985 (A Improper Validation of Specified Quantity in Input
vulnerability in ...)
+ TODO: check
+CVE-2026-101984 (A Reachable Assertion vulnerability in the routing protocol
daemon (rp ...)
+ TODO: check
+CVE-2026-101983 (A Stack-based Buffer Overflow vulnerability in the httpd
process of Ju ...)
+ TODO: check
+CVE-2026-101982 (A Stack-based Buffer Overflow vulnerability in the routing
protocol da ...)
+ TODO: check
+CVE-2026-101981 (A Stack-based Buffer Overflow vulnerability in the routing
protocol da ...)
+ TODO: check
+CVE-2026-101980 (An Integer Underflow vulnerability in the kernel of Juniper
Networks J ...)
+ TODO: check
+CVE-2026-101979 (A Stack-based Buffer Overflow vulnerability in the authd
Juniper Netwo ...)
+ TODO: check
+CVE-2026-101978 (An OS Command Injection vulnerability in the bootzd
zero-touch provisi ...)
+ TODO: check
+CVE-2026-101977 (A NULL Pointer Dereference vulnerability in the routing
protocol daemo ...)
+ TODO: check
+CVE-2026-101976 (An Out-of-bounds Write vulnerability in the routing protocol
daemon (r ...)
+ TODO: check
+CVE-2026-101975 (A Reachable Assertion vulnerability in the routing protocol
daemon (rp ...)
+ TODO: check
+CVE-2026-101974 (An Improper Validation of Specified Quantity in Input
vulnerability in ...)
+ TODO: check
+CVE-2026-101973 (A NULL Pointer Dereference vulnerability in the pkid
component of Juni ...)
+ TODO: check
+CVE-2026-101972 (An Integer Overflow or Wraparound vulnerability in the
routing protoco ...)
+ TODO: check
+CVE-2026-101971 (An Allocation of Resources Without Limits or Throttling
vulnerability ...)
+ TODO: check
+CVE-2026-101970 (A Use After Free vulnerability in the rpd PIM Join/Prune
processing of ...)
+ TODO: check
+CVE-2026-101969 (An Improper Input Validation vulnerability in the rpd process
of Junip ...)
+ TODO: check
+CVE-2026-101968 (An Integer Underflow (Wrap or Wraparound) vulnerability in
the rpd pro ...)
+ TODO: check
+CVE-2026-101967 (An OS Command Injection vulnerability in the bootzd
zero-touch provisi ...)
+ TODO: check
+CVE-2026-101966 (A Use of Externally-Controlled Format String vulnerability in
the jti- ...)
+ TODO: check
+CVE-2026-101965 (An Use of Externally-Controlled Format String vulnerability
in the gRP ...)
+ TODO: check
+CVE-2026-101964 (A Reachable Assertion vulnerability in the routing protocol
daemon (rp ...)
+ TODO: check
+CVE-2026-101963 (An Incorrect Calculation vulnerability in the routing
protocol daemon ...)
+ TODO: check
+CVE-2026-101962 (An Improper Handling of Length Parameter Inconsistency
vulnerability i ...)
+ TODO: check
+CVE-2026-101961 (A NULL Pointer Dereference vulnerability in the
routing-policy nexthop ...)
+ TODO: check
+CVE-2026-101960 (An Out-of-bounds Write vulnerability in the routing protocol
daemon (r ...)
+ TODO: check
+CVE-2026-101959 (A Function Call With Incorrect Variable or Reference as
Argument vulne ...)
+ TODO: check
+CVE-2026-101957 (An Improper Initialization vulnerability in the routing
protocol daemo ...)
+ TODO: check
+CVE-2026-101956 (An Improper Authentication vulnerability in the J-Web web
management c ...)
+ TODO: check
+CVE-2026-101955 (A Stack-based Buffer Overflow vulnerability in the UTM
Anti-Spam SBL o ...)
+ TODO: check
+CVE-2026-101954 (An Improper Authentication vulnerability in the J-Web
management inter ...)
+ TODO: check
+CVE-2026-101952 (An Improper Validation of Consistency within Input
vulnerability in th ...)
+ TODO: check
+CVE-2026-101951 (An Improper Validation of Consistency within Input
vulnerability in th ...)
+ TODO: check
+CVE-2026-101950 (A Heap-based Buffer Overflow vulnerability in the SVR
component of Jun ...)
+ TODO: check
+CVE-2026-101949 (A NULL Pointer Dereference vulnerability in the routing
protocol daemo ...)
+ TODO: check
+CVE-2026-101948 (A NULL Pointer Dereference vulnerability in the routing
protocol daemo ...)
+ TODO: check
+CVE-2026-101946 (An Out-of-bounds Read vulnerability in the rpd process of
Juniper Netw ...)
+ TODO: check
+CVE-2026-101945 (An Integer Overflow or Wraparound vulnerability in the rpd
process of ...)
+ TODO: check
+CVE-2026-101944 (An Integer Overflow or Wraparound vulnerability in the
routing protoco ...)
+ TODO: check
+CVE-2026-101943 (An Improper Input Validation vulnerability in the routing
protocol dae ...)
+ TODO: check
+CVE-2026-101942 (An Improper Handling of Length Parameter Inconsistency
vulnerability i ...)
+ TODO: check
+CVE-2026-101941 (A NULL Pointer Dereference vulnerability in the routing
protocol daemo ...)
+ TODO: check
+CVE-2026-101940 (A NULL Pointer Dereference vulnerability in the rpd routing
daemon of ...)
+ TODO: check
+CVE-2026-101939 (A NULL Pointer Dereference vulnerability in the routing
protocol daemo ...)
+ TODO: check
+CVE-2026-101938 (An Integer Underflow (Wrap or Wraparound) vulnerability in
the srxpfe ...)
+ TODO: check
+CVE-2026-101937 (A Signed to Unsigned Conversion Error vulnerability in the
srxpfe of J ...)
+ TODO: check
+CVE-2026-101936 (A Reachable Assertion vulnerability in the srxpfe process of
Juniper N ...)
+ TODO: check
+CVE-2026-101934 (An Out-of-bounds Write vulnerability in eventd of Juniper
Networks Jun ...)
+ TODO: check
+CVE-2026-101927 (A Heap-based Buffer Overflow vulnerability in eventd of
Juniper Networ ...)
+ TODO: check
+CVE-2026-101897 (Angular is a development platform for building mobile and
desktop web ...)
+ TODO: check
+CVE-2026-101896 (Angular is a development platform for building mobile and
desktop web ...)
+ TODO: check
+CVE-2026-101895 (Angular is a development platform for building mobile and
desktop web ...)
+ TODO: check
+CVE-2026-101341 (Tokens of text in RDATA (of for example TXT records) under 32
bytes ar ...)
+ TODO: check
+CVE-2026-101339 (A HIP resource record that fills the RDATA near or at is
limit, and ha ...)
+ TODO: check
+CVE-2026-101338 (When a SVCB or HTTPS RR has filled the wire format RDATA up
to the bri ...)
+ TODO: check
+CVE-2026-101337 (When base64 data is split up in pieces, of 3 character or
less, tokens ...)
+ TODO: check
+CVE-2026-101301 (The WPCode WordPress plugin before 2.4.0 does not correctly
verify tha ...)
+ TODO: check
+CVE-2026-101217 (Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x,
contain(s) an Im ...)
+ TODO: check
+CVE-2026-101216 (Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x,
contain(s) an Im ...)
+ TODO: check
+CVE-2026-101215 (Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x,
contain(s) an Im ...)
+ TODO: check
+CVE-2026-101025 (Description NGINX JavaScript (njs) has a vulnerability
where the bui ...)
+ TODO: check
+CVE-2026-101019 (Description NGINX JavaScript (njs) has a vulnerability where
the njs X ...)
+ TODO: check
+CVE-2026-100413 (SeaweedFS is a distributed storage system for files and
blobs. From 4. ...)
+ TODO: check
+CVE-2026-100406 (dbt enables data analysts and engineers to transform their
data using ...)
+ TODO: check
+CVE-2026-100404 (Zulip is an open-source team collaboration tool. In Zulip
Server versi ...)
+ TODO: check
+CVE-2026-100394 (Nezha Monitoring is a self-hostable, lightweight, servers and
websites ...)
+ TODO: check
+CVE-2026-100236 (A flaw was found in the DPDK GSO library. When software GSO
copies pac ...)
+ TODO: check
+CVE-2026-100231 (A flaw was found in the GStreamer multimedia framework's ASF
muxer plu ...)
+ TODO: check
+CVE-2026-100229 (A flaw was found in GStreamer's H.266 codec parser library
(libgstcode ...)
+ TODO: check
+CVE-2026-100169 (Improper Authentication in the social account linking path of
the Prow ...)
+ TODO: check
+CVE-2026-100163 (The Appointment Booking Plugin \u2013 LatePoint | Calendar &
Schedulin ...)
+ TODO: check
+CVE-2026-0322 (A remote code execution (RCE) vulnerability in the management
interfac ...)
+ TODO: check
+CVE-2025-9373 (The PeproDev Branches Map plugin for WordPress is vulnerable to
Stored ...)
+ TODO: check
+CVE-2025-71433 (Kaneo before 2.1.6 contains a missing authorization
vulnerability that ...)
+ TODO: check
+CVE-2024-58392 (PhysicsFS through 3.2.0 contains an out-of-bounds read
vulnerability i ...)
+ TODO: check
+CVE-2020-37282 (office-converter through 1.0.2 contains an OS command
injection vulner ...)
+ TODO: check
+CVE-2020-37281 (Gravitee API Management through 4.12.22 contains an
authentication byp ...)
+ TODO: check
+CVE-2017-20286 (DevIL through 1.8.0 contains a heap-based buffer overflow in
iGetPalet ...)
+ TODO: check
+CVE-2016-20099 (L-SMASH through 2.14.5 contains an infinite loop vulnerability
in vc1_ ...)
+ TODO: check
+CVE-2016-15060 (A vulnerability was found in PCMan FTP Server up to 2.0.7.
This affect ...)
+ TODO: check
+CVE-2026-98418 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux 7.2.8-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/fe3c73d7bc769e7afc252f867a3421fe168b898d (7.3-rc4)
-CVE-2026-98415 [soc: samsung: exynos-pmu: fix use-after-free of interrupt
generator node]
+CVE-2026-98415 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux 7.2.8-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/4dd1999783d7d12434006289338373e49492dc96 (7.3-rc4)
-CVE-2026-98414 [memcg: avoid charging the root memcg from
obj_cgroup_charge_pages()]
+CVE-2026-98414 (In the Linux kernel, the following vulnerability has been
resolved: m ...)
- linux 7.2.8-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/6e673d0879ef78c395cfe0d3ba316690a60055d8 (7.3-rc4)
-CVE-2026-98405 [smb: client: fix missing iov bounds check in
parse_posix_sids()]
+CVE-2026-98405 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/
-CVE-2026-98431 [RDMA/uverbs: Fix mmap_lock/disassociation_lock circular
dependency]
+CVE-2026-98431 (In the Linux kernel, the following vulnerability has been
resolved: R ...)
- linux 7.2.8-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236 (7.3-rc4)
-CVE-2026-98430 [RDMA/efa: Keep admin queues alive while IRQ is registered]
+CVE-2026-98430 (In the Linux kernel, the following vulnerability has been
resolved: R ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/e08aca85c02ff290f785f07acae758f0daf5f49e (7.3-rc4)
-CVE-2026-98429 [RDMA/efa: Keep EQ resources alive while IRQ is registered]
+CVE-2026-98429 (In the Linux kernel, the following vulnerability has been
resolved: R ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/e22a3627b7151754f07f90ea3d1ab6e85f5d93f4 (7.3-rc4)
-CVE-2026-98428 [ALSA: usb: 6fire: Avoid embedded URBs]
+CVE-2026-98428 (In the Linux kernel, the following vulnerability has been
resolved: A ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/9fe49dbc023e82dfaee7b245997d820d01742a9a (7.3-rc3)
-CVE-2026-98427 [net/sched: codel: bound the dropping loop per dequeue call]
+CVE-2026-98427 (In the Linux kernel, the following vulnerability has been
resolved: n ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/7f4a5ec6258fd7c92633ec4b0493fc51166d9398 (7.3-rc4)
-CVE-2026-98426 [wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error
path]
+CVE-2026-98426 (In the Linux kernel, the following vulnerability has been
resolved: w ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/a3d722190cdef18da4878b5efc27c3c386dda248 (7.3-rc4)
-CVE-2026-98425 [wifi: mac80211: don't warn when an IBSS has no channel to scan]
+CVE-2026-98425 (In the Linux kernel, the following vulnerability has been
resolved: w ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/a7491b7efbd9136b120a12ed72af9c12121dd134 (7.3-rc4)
-CVE-2026-98424 [wifi: cfg80211: undo netns switch if renaming the wiphy fails]
+CVE-2026-98424 (In the Linux kernel, the following vulnerability has been
resolved: w ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/a41bd1938a9bfe226d444172a7e20e4bd5097960 (7.3-rc4)
-CVE-2026-98423 [wifi: mac80211_hwsim: don't hand frames to mac80211 while
stopping]
+CVE-2026-98423 (In the Linux kernel, the following vulnerability has been
resolved: w ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/87840d4a3a21b1c19b867a80e16ba69dff284de2 (7.3-rc4)
-CVE-2026-98422 [wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown]
+CVE-2026-98422 (In the Linux kernel, the following vulnerability has been
resolved: w ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/4504f3960dc4501c73be9f99eabda2e26e9db41e (7.3-rc4)
-CVE-2026-98421 [wifi: mac80211: require a peer station for TDLS setup confirm]
+CVE-2026-98421 (In the Linux kernel, the following vulnerability has been
resolved: w ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/038e1d126304fd25d507fd4e671232df57bd1799 (7.3-rc4)
-CVE-2026-98420 [ksmbd: follow SMB2 session expiration semantics]
+CVE-2026-98420 (In the Linux kernel, the following vulnerability has been
resolved: k ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/d7fd1f98607f2cd358e583f9548bdf0173090a86 (7.3-rc4)
-CVE-2026-98419 [drop_monitor: fix out-of-bounds write in reset_per_cpu_data()]
+CVE-2026-98419 (In the Linux kernel, the following vulnerability has been
resolved: d ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/439f392084f8f7f59ab9d47a9579185accefe1d8 (7.3-rc4)
-CVE-2026-98417 [net: xfrm: reject unrepresentable espintcp transport headers]
+CVE-2026-98417 (In the Linux kernel, the following vulnerability has been
resolved: n ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/96f01b53c2d05e003b040892256de54a586e8529 (7.3-rc4)
-CVE-2026-98416 [dmaengine: ti: k3-udma-glue: fix NULL dereference in
k3_udma_glue_release_rx_chn()]
+CVE-2026-98416 (In the Linux kernel, the following vulnerability has been
resolved: d ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/0294b6dd515256c03ea2dbf508ddd3826d788579 (7.3-rc4)
-CVE-2026-98413 [selinux: always fill AVC decision in avc_has_perm_noaudit()]
+CVE-2026-98413 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/8861db305103107199b1426f25fde1fb6d465583 (7.3-rc4)
-CVE-2026-98412 [power: sequencing: fix NULL-pointer dereference in
pwrseq_unit_new()]
+CVE-2026-98412 (In the Linux kernel, the following vulnerability has been
resolved: p ...)
- linux 7.2.8-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/115b303e8e093d964089ec6f3c40d984d77b33d0 (7.3-rc4)
-CVE-2026-98411 [power: sequencing: fix NULL-pointer dereference in
pwrseq_device_register()]
+CVE-2026-98411 (In the Linux kernel, the following vulnerability has been
resolved: p ...)
- linux 7.2.8-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/242da4318d97380741516b595af3920207b2f0f1 (7.3-rc4)
-CVE-2026-98410 [watchdog: da9063: fix suspend/resume handling of HW_RUNNING
watchdog]
+CVE-2026-98410 (In the Linux kernel, the following vulnerability has been
resolved: w ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/7cb575b71ab98194d2e040bded3a7281e089c5ed (7.3-rc4)
-CVE-2026-98409 [watchdog: rtd119x: Avoid division by zero]
+CVE-2026-98409 (In the Linux kernel, the following vulnerability has been
resolved: w ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/5af7d2cbd20f893def03c8310a460ade66a5d822 (7.3-rc4)
-CVE-2026-98408 [watchdog: rzv2h: Avoid division by zero]
+CVE-2026-98408 (In the Linux kernel, the following vulnerability has been
resolved: w ...)
- linux 7.2.8-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/6274281c41efa8dd1aa5234c59ad904ff89d7af4 (7.3-rc4)
-CVE-2026-98407 [wifi: rsi: fix heap OOB write on key removal]
+CVE-2026-98407 (In the Linux kernel, the following vulnerability has been
resolved: w ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/e6c5ed7a98d7bc8b0f7918246f1c90ddb3f79dfa (7.3-rc4)
-CVE-2026-98406 [wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not
in driver]
+CVE-2026-98406 (In the Linux kernel, the following vulnerability has been
resolved: w ...)
- linux 7.2.8-1
NOTE:
https://git.kernel.org/linus/da2ca406f45a6e21760243152ed8d2e8e72915c2 (7.3-rc4)
-CVE-2026-98397 [platform/x86: x86-android-tablets: hold device reference for
secondary fwnode teardown]
+CVE-2026-98397 (In the Linux kernel, the following vulnerability has been
resolved: p ...)
- linux 7.2.7-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/144113b0a70fa18033a747ee5db6803308f7688c (7.3-rc3)
-CVE-2026-98396 [powerpc: Do not restore KUAP in
arch_exit_to_user_mode_prepare()]
+CVE-2026-98396 (In the Linux kernel, the following vulnerability has been
resolved: p ...)
- linux 7.2.7-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/c2549d749539487239475fbc8c614a1f9244d655 (7.3-rc3)
-CVE-2026-98395 [powerpc/entry: Fix irq_soft_mask corruption on replayed
interrupt exit]
+CVE-2026-98395 (In the Linux kernel, the following vulnerability has been
resolved: p ...)
- linux 7.2.7-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/63a7531ca31f9f097d9cc1cc3fe86ae683cdabdd (7.3-rc3)
-CVE-2026-98392 [Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one]
+CVE-2026-98392 (In the Linux kernel, the following vulnerability has been
resolved: B ...)
- linux 7.2.7-1
[trixie] - linux 6.12.111-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/3dd1b41f96aad08444be1b7626c89de2b9f2abd4 (7.3-rc3)
-CVE-2026-98391 [drm/xe: Guard page-fault worker with runtime PM check]
+CVE-2026-98391 (In the Linux kernel, the following vulnerability has been
resolved: d ...)
- linux 7.2.7-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/20fce5b34b21a995839743b4917a1edd2fd503ba (7.3-rc3)
-CVE-2026-98390 [x86/amd_node: Avoid divide by zero on virtualized systems]
+CVE-2026-98390 (In the Linux kernel, the following vulnerability has been
resolved: x ...)
- linux 7.2.7-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/72bd92bd8190d7869ecb462649ca40f297822a33 (7.3-rc3)
-CVE-2026-98404 [drm/virtio: Fix a NULL vs ERR_PTR() bug in
virtio_gpu_user_framebuffer_create()]
+CVE-2026-98404 (In the Linux kernel, the following vulnerability has been
resolved: d ...)
- linux 7.2.7-1
[trixie] - linux 6.12.111-1
NOTE:
https://git.kernel.org/linus/94579f24e2b526a04eb41050af0ba018c6f528e7 (7.3-rc2)
-CVE-2026-98403 [s390/boot: Avoid IPL parameter append past command line]
+CVE-2026-98403 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux 7.2.7-1
NOTE:
https://git.kernel.org/linus/d76181dfabdaa720703167393704efacba343442 (7.3-rc2)
-CVE-2026-98402 [net: icmp: avoid invalid transport header access in icmp_send
tracepoint]
+CVE-2026-98402 (In the Linux kernel, the following vulnerability has been
resolved: n ...)
- linux 7.2.7-1
[trixie] - linux 6.12.111-1
NOTE:
https://git.kernel.org/linus/7fcc2fe39fed1cb98a7374a113ff3800e8f9af80 (7.3-rc2)
-CVE-2026-98401 [net: iptunnel: fix stale transport header during tunnel
decapsulation]
+CVE-2026-98401 (In the Linux kernel, the following vulnerability has been
resolved: n ...)
- linux 7.2.7-1
[trixie] - linux 6.12.111-1
NOTE:
https://git.kernel.org/linus/28a57fb2c5df4deb42a06e52fd36c14b37aa0034 (7.3-rc2)
-CVE-2026-98400 [s390/ipl: Fix NULL deref in kdump without re-IPL parm block]
+CVE-2026-98400 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux 7.2.7-1
[trixie] - linux 6.12.111-1
NOTE:
https://git.kernel.org/linus/7f918871112e8e7c581e99eb8e545af4e59c8367 (7.3-rc2)
-CVE-2026-98399 [s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm
block]
+CVE-2026-98399 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux 7.2.7-1
[trixie] - linux 6.12.111-1
NOTE:
https://git.kernel.org/linus/37f61b71cbc0caefc01022a19ee56fc2510e2e6e (7.3-rc2)
-CVE-2026-98398 [locking/lockdep: Invalidate stale class_cache entries for
zapped classes]
+CVE-2026-98398 (In the Linux kernel, the following vulnerability has been
resolved: l ...)
- linux 7.2.7-1
[trixie] - linux 6.12.111-1
NOTE:
https://git.kernel.org/linus/02c6be7d675b21d81f0ba3a524346850a8c0e3bf (7.3-rc2)
-CVE-2026-98394 [af_unix: Return immediately when manage_oob() returns NULL for
0-length buffer.]
+CVE-2026-98394 (In the Linux kernel, the following vulnerability has been
resolved: a ...)
- linux 7.2.7-1
[trixie] - linux 6.12.111-1
NOTE:
https://git.kernel.org/linus/6e5ee08eb5858d175da6768d75d163817b6a9d4a (7.3-rc3)
-CVE-2026-98393 [net: ipv4: Fix UDP length overflow with PMTU discover and big
MTU]
+CVE-2026-98393 (In the Linux kernel, the following vulnerability has been
resolved: n ...)
- linux 7.2.7-1
NOTE:
https://git.kernel.org/linus/b83641e0ab8b20eefcc4cdc5a059f897375291a2 (7.3-rc3)
-CVE-2026-98389 [drm/amdgpu: skip gfx switch_power_profile during GPU reset]
+CVE-2026-98389 (In the Linux kernel, the following vulnerability has been
resolved: d ...)
- linux 7.2.7-1
NOTE:
https://git.kernel.org/linus/1f1d43418d61c8511779e0f63a954a78b9433b43 (7.3-rc3)
-CVE-2026-98388 [exec: do_close_on_exec() before taking exec_update_lock]
+CVE-2026-98388 (In the Linux kernel, the following vulnerability has been
resolved: e ...)
- linux 7.2.7-1
[trixie] - linux 6.12.111-1
NOTE:
https://git.kernel.org/linus/e780259b54e618ceb4763fbc21314acf3565e813 (7.3-rc3)
-CVE-2026-98387 [s390/crypto: Fix skcipher_walk return code handling in
aes_s390]
+CVE-2026-98387 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux 7.2.7-1
[trixie] - linux 6.12.111-1
NOTE:
https://git.kernel.org/linus/15fa028589c3a2545f0bff355eff06d5844196bf (7.3-rc3)
-CVE-2026-98386 [scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring
slot]
+CVE-2026-98386 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux 7.2.7-1
NOTE:
https://git.kernel.org/linus/626e44f3d8a924a97a3848a9fd45833947e081e9 (7.3-rc1)
-CVE-2026-107350
+CVE-2026-107350 (Improper authentication in PgBouncer 1.17.0 through 1.26.0
allows a re ...)
- pgbouncer 1.26.1-1
NOTE: Fixed by:
https://github.com/pgbouncer/pgbouncer/commit/55233b2124264c0617dc68686473db7124de1620
(pgbouncer_1_26_1)
-CVE-2026-107349
+CVE-2026-107349 (An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an
unauthen ...)
- pgbouncer 1.26.1-1
NOTE: Fixed by:
https://github.com/pgbouncer/pgbouncer/commit/5cf3aa700d4a871e79540c545d8fe8990cb39b08
(pgbouncer_1_26_1)
-CVE-2026-107348
+CVE-2026-107348 (Integer overflow in the message buffer growth logic
(mbuf_make_room) i ...)
- pgbouncer 1.26.1-1
NOTE: Fixed by:
https://github.com/pgbouncer/pgbouncer/commit/8c26514ff883774a0d364d71a1c28b389d94fc4a
(pgbouncer_1_26_1)
CVE-2026-97844 (Out-of-bounds read in DNS Server allows an authorized attacker
to disc ...)
@@ -3754,7 +4824,7 @@ CVE-2026-92391
NOTE: https://curl.se/docs/CVE-2026-92391.html
NOTE: Introduced with:
https://github.com/curl/curl/commit/ce0881edee3c78609eae49665fb70264d8786d29
(curl-7_56_0)
NOTE: Fixed by:
https://github.com/curl/curl/commit/d7546809d5bd548b69ec49fca26565c8f6f0d344
(rc-8_23_0-1)
-CVE-2026-92392
+CVE-2026-92392 (During an upload, curl mishandles HTTP/2 `RST_STREAM` received
from th ...)
{DSA-6558-1}
- curl 8.23.0-1
[bookworm] - curl <not-affected> (Vulnerable code not present)
@@ -4119,7 +5189,7 @@ CVE-2026-74030 (Wazuh from 3.9.0 before 4.14.8 contains
an uncontrolled YAML ali
NOT-FOR-US: Wazuh
CVE-2026-72895 (A vulnerability has been identified in SIMATIC IPC BX-21A (All
version ...)
NOT-FOR-US: Siemens
-CVE-2026-69227 (A flaw in Portal for ArcGIS allows unauthenticated access to
certain / ...)
+CVE-2026-69227 (A flaw in Portal for ArcGIS allows unauthenticated access to
certain ...)
NOT-FOR-US: Esri
CVE-2026-69226 (A flaw in Portal for ArcGIS allows unauthenticated users to
create new ...)
NOT-FOR-US: Esri
@@ -4920,9 +5990,11 @@ CVE-2024-34320 (ProPhoenix Law RMS v2022.2403.3.101 was
discovered to contain an
CVE-2024-34319 (A Server-Side Request Forgery (SSRF) in the serviceURL
parameter of Pr ...)
TODO: check
CVE-2026-109783 (Mitigation bypass in the File Handling component. This
vulnerability w ...)
+ {DSA-6560-1}
- firefox-esr 153.5.0esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109783
CVE-2026-109782 (Mitigation bypass in the File Handling component. This
vulnerability w ...)
+ {DSA-6560-1}
- firefox-esr 153.5.0esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109782
CVE-2026-109704 (Privilege escalation in the Application Update component.
This vulnera ...)
@@ -4933,6 +6005,7 @@ CVE-2026-109704 (Privilege escalation in the Application
Update component. This
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109704
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109704
CVE-2026-109705 (Sandbox escape, site isolation issue due to incorrect
boundary conditi ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -4940,6 +6013,7 @@ CVE-2026-109705 (Sandbox escape, site isolation issue due
to incorrect boundary
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109705
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109705
CVE-2026-109706 (Use-after-free in the Storage: IndexedDB component. This
vulnerability ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -4947,6 +6021,7 @@ CVE-2026-109706 (Use-after-free in the Storage: IndexedDB
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109706
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109706
CVE-2026-109707 (Sandbox escape due to use-after-free in the Networking
component. This ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -4954,6 +6029,7 @@ CVE-2026-109707 (Sandbox escape due to use-after-free in
the Networking componen
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109707
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109707
CVE-2026-109708 (Sandbox escape due to incorrect boundary conditions in the
Networking ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -4961,6 +6037,7 @@ CVE-2026-109708 (Sandbox escape due to incorrect boundary
conditions in the Netw
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109708
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109708
CVE-2026-109709 (Information disclosure, privilege escalation in the Security:
Process ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -4968,6 +6045,7 @@ CVE-2026-109709 (Information disclosure, privilege
escalation in the Security: P
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109709
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109709
CVE-2026-109710 (Use-after-free in the Graphics: Text component. This
vulnerability was ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -4975,6 +6053,7 @@ CVE-2026-109710 (Use-after-free in the Graphics: Text
component. This vulnerabil
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109710
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109710
CVE-2026-109711 (Use-after-free in the Graphics: Canvas2D component. This
vulnerability ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -4982,6 +6061,7 @@ CVE-2026-109711 (Use-after-free in the Graphics: Canvas2D
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109711
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109711
CVE-2026-109712 (Sandbox escape due to uninitialized memory in the Graphics
component. ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -4989,6 +6069,7 @@ CVE-2026-109712 (Sandbox escape due to uninitialized
memory in the Graphics comp
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109712
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109712
CVE-2026-109713 (Use-after-free in the Crash Reporting component. This
vulnerability wa ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -4999,6 +6080,7 @@ CVE-2026-109714 (Incorrect boundary conditions in the
Layout component. This vul
- firefox <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109714
CVE-2026-109715 (Incorrect boundary conditions in the JavaScript Engine
component. This ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5006,6 +6088,7 @@ CVE-2026-109715 (Incorrect boundary conditions in the
JavaScript Engine componen
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109715
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109715
CVE-2026-109716 (Incorrect boundary conditions in the JavaScript Engine
component. This ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5013,6 +6096,7 @@ CVE-2026-109716 (Incorrect boundary conditions in the
JavaScript Engine componen
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109716
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109716
CVE-2026-109717 (Use-after-free in the DOM: Bindings (WebIDL) component. This
vulnerabi ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5020,6 +6104,7 @@ CVE-2026-109717 (Use-after-free in the DOM: Bindings
(WebIDL) component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109717
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109717
CVE-2026-109718 (Use-after-free in the XML component. This vulnerability was
fixed in F ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5027,6 +6112,7 @@ CVE-2026-109718 (Use-after-free in the XML component.
This vulnerability was fix
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109718
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109718
CVE-2026-109719 (Race condition, use-after-free in the Graphics: CanvasWebGL
component. ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5034,6 +6120,7 @@ CVE-2026-109719 (Race condition, use-after-free in the
Graphics: CanvasWebGL com
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109719
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109719
CVE-2026-109720 (JIT miscompilation in the JavaScript: WebAssembly component.
This vuln ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5041,6 +6128,7 @@ CVE-2026-109720 (JIT miscompilation in the JavaScript:
WebAssembly component. Th
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109720
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109720
CVE-2026-109721 (Incorrect boundary conditions in the JavaScript Engine: JIT
component. ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5048,6 +6136,7 @@ CVE-2026-109721 (Incorrect boundary conditions in the
JavaScript Engine: JIT com
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109721
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109721
CVE-2026-109722 (JIT miscompilation in the JavaScript Engine: JIT component.
This vulne ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5055,6 +6144,7 @@ CVE-2026-109722 (JIT miscompilation in the JavaScript
Engine: JIT component. Thi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109722
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109722
CVE-2026-109723 (Integer overflow in the Layout: Text and Fonts component.
This vulnera ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5062,6 +6152,7 @@ CVE-2026-109723 (Integer overflow in the Layout: Text and
Fonts component. This
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109723
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109723
CVE-2026-109724 (Use-after-free in the DOM: Core & HTML component. This
vulnerability w ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5069,12 +6160,14 @@ CVE-2026-109724 (Use-after-free in the DOM: Core & HTML
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109724
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109724
CVE-2026-109725 (Use-after-free in the DOM: Core & HTML component. This
vulnerability w ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109725
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109725
CVE-2026-109726 (Use-after-free in the SVG component. This vulnerability was
fixed in F ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5082,6 +6175,7 @@ CVE-2026-109726 (Use-after-free in the SVG component.
This vulnerability was fix
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109726
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109726
CVE-2026-109727 (Use-after-free in the Audio/Video component. This
vulnerability was fi ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5089,6 +6183,7 @@ CVE-2026-109727 (Use-after-free in the Audio/Video
component. This vulnerability
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109727
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109727
CVE-2026-109728 (Use-after-free in the DOM: Animation component. This
vulnerability was ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5096,6 +6191,7 @@ CVE-2026-109728 (Use-after-free in the DOM: Animation
component. This vulnerabil
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109728
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109728
CVE-2026-109729 (Use-after-free in the JavaScript Engine: JIT component. This
vulnerabi ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5103,6 +6199,7 @@ CVE-2026-109729 (Use-after-free in the JavaScript Engine:
JIT component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109729
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109729
CVE-2026-109730 (Integer overflow in the Graphics component. This
vulnerability was fix ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5110,6 +6207,7 @@ CVE-2026-109730 (Integer overflow in the Graphics
component. This vulnerability
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109730
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109730
CVE-2026-109731 (Incorrect boundary conditions in the Graphics: Canvas2D
component. Thi ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5117,6 +6215,7 @@ CVE-2026-109731 (Incorrect boundary conditions in the
Graphics: Canvas2D compone
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109731
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109731
CVE-2026-109732 (Use-after-free in the DOM: Streams component. This
vulnerability was f ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5124,6 +6223,7 @@ CVE-2026-109732 (Use-after-free in the DOM: Streams
component. This vulnerabilit
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109732
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109732
CVE-2026-109733 (JIT miscompilation in the JavaScript Engine: JIT component.
This vulne ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5131,6 +6231,7 @@ CVE-2026-109733 (JIT miscompilation in the JavaScript
Engine: JIT component. Thi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109733
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109733
CVE-2026-109734 (Mitigation bypass in the DOM: Security component. This
vulnerability w ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5141,6 +6242,7 @@ CVE-2026-109735 (Use-after-free in the DOM: Animation
component. This vulnerabil
- firefox <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109735
CVE-2026-109736 (Frame poisoning in the Layout component. This vulnerability
was fixed ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5148,6 +6250,7 @@ CVE-2026-109736 (Frame poisoning in the Layout component.
This vulnerability was
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109736
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109736
CVE-2026-109737 (Mitigation bypass in the Enterprise Policies component. This
vulnerabi ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5155,6 +6258,7 @@ CVE-2026-109737 (Mitigation bypass in the Enterprise
Policies component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109737
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109737
CVE-2026-109738 (Use-after-free in the Audio/Video: Playback component. This
vulnerabil ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5172,6 +6276,7 @@ CVE-2026-109740 (Sandbox escape due to incorrect boundary
conditions in the Widg
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109740
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109740
CVE-2026-109741 (Use-after-free in the Storage: Bucket File System component.
This vuln ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5179,6 +6284,7 @@ CVE-2026-109741 (Use-after-free in the Storage: Bucket
File System component. Th
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109741
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109741
CVE-2026-109742 (Information disclosure in the PDF Viewer component. This
vulnerability ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5186,6 +6292,7 @@ CVE-2026-109742 (Information disclosure in the PDF Viewer
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109742
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109742
CVE-2026-109743 (Privilege escalation in the Panning and Zooming component.
This vulner ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5193,6 +6300,7 @@ CVE-2026-109743 (Privilege escalation in the Panning and
Zooming component. This
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109743
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109743
CVE-2026-109744 (Other issue in the DOM: File component. This vulnerability
was fixed i ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5200,6 +6308,7 @@ CVE-2026-109744 (Other issue in the DOM: File component.
This vulnerability was
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109744
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109744
CVE-2026-109745 (Sandbox escape due to uninitialized memory in the DOM: Web
Serial comp ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5222,6 +6331,7 @@ CVE-2026-109750 (Site isolation issue in the DOM: Web
Authentication component.
- firefox <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109750
CVE-2026-109751 (Information disclosure in the Networking component. This
vulnerability ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5229,6 +6339,7 @@ CVE-2026-109751 (Information disclosure in the Networking
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109751
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109751
CVE-2026-109752 (Use-after-free in the DOM: Workers component. This
vulnerability was f ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5236,6 +6347,7 @@ CVE-2026-109752 (Use-after-free in the DOM: Workers
component. This vulnerabilit
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109752
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109752
CVE-2026-109753 (Incorrect boundary conditions in the Layout component. This
vulnerabil ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5243,6 +6355,7 @@ CVE-2026-109753 (Incorrect boundary conditions in the
Layout component. This vul
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109753
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109753
CVE-2026-109754 (Incorrect boundary conditions in the DOM: Editor component.
This vulne ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5253,6 +6366,7 @@ CVE-2026-109755 (Sandbox escape in the DOM: Content
Processes component. This vu
- firefox <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109755
CVE-2026-109756 (Privilege escalation in the DOM: Navigation component. This
vulnerabil ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5260,6 +6374,7 @@ CVE-2026-109756 (Privilege escalation in the DOM:
Navigation component. This vul
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109756
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109756
CVE-2026-109757 (Sandbox escape due to race condition in the Networking
component. This ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5267,6 +6382,7 @@ CVE-2026-109757 (Sandbox escape due to race condition in
the Networking componen
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109757
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109757
CVE-2026-109759 (Site isolation issue in the Networking component. This
vulnerability w ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5274,6 +6390,7 @@ CVE-2026-109759 (Site isolation issue in the Networking
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109759
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109759
CVE-2026-109760 (Mitigation bypass in the Networking: HTTP component. This
vulnerabilit ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5284,6 +6401,7 @@ CVE-2026-109761 (Use-after-free in the JavaScript:
WebAssembly component. This v
- firefox <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109761
CVE-2026-109762 (Incorrect boundary conditions in the SVG component. This
vulnerability ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5291,6 +6409,7 @@ CVE-2026-109762 (Incorrect boundary conditions in the SVG
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109762
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109762
CVE-2026-109763 (Mitigation bypass in the File Handling component. This
vulnerability w ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5298,6 +6417,7 @@ CVE-2026-109763 (Mitigation bypass in the File Handling
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109763
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109763
CVE-2026-109764 (Mitigation bypass in the Enterprise Policies component. This
vulnerabi ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5305,6 +6425,7 @@ CVE-2026-109764 (Mitigation bypass in the Enterprise
Policies component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109764
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109764
CVE-2026-109765 (Race condition, use-after-free in the Graphics: Text
component. This v ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5312,6 +6433,7 @@ CVE-2026-109765 (Race condition, use-after-free in the
Graphics: Text component.
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109765
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109765
CVE-2026-109766 (Mitigation bypass in the Enterprise Policies component. This
vulnerabi ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5319,6 +6441,7 @@ CVE-2026-109766 (Mitigation bypass in the Enterprise
Policies component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109766
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109766
CVE-2026-109767 (Information disclosure in the Networking component. This
vulnerability ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5332,6 +6455,7 @@ CVE-2026-109769 (Information disclosure in the
Networking: Cache component. This
- firefox <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109769
CVE-2026-109770 (Spoofing issue in the DOM: Web Serial component. This
vulnerability wa ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5351,6 +6475,7 @@ CVE-2026-109774 (Invalid pointer, undefined behavior in
the DOM: Notifications c
- firefox <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109774
CVE-2026-109775 (Denial-of-service in the WebRTC component. This vulnerability
was fixe ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5358,6 +6483,7 @@ CVE-2026-109775 (Denial-of-service in the WebRTC
component. This vulnerability w
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109775
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109775
CVE-2026-109776 (Race condition in the XPCOM component. This vulnerability was
fixed in ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5365,6 +6491,7 @@ CVE-2026-109776 (Race condition in the XPCOM component.
This vulnerability was f
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109776
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109776
CVE-2026-109777 (Information disclosure in the Storage: IndexedDB component.
This vulne ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5372,6 +6499,7 @@ CVE-2026-109777 (Information disclosure in the Storage:
IndexedDB component. Thi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109777
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109777
CVE-2026-109778 (Privilege escalation in the WebExtensions component. This
vulnerabilit ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5385,6 +6513,7 @@ CVE-2026-109780 (Mitigation bypass in the DOM: Core &
HTML component. This vulne
- firefox <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109780
CVE-2026-109781 (Denial-of-service in the Printing: Output component. This
vulnerabilit ...)
+ {DSA-6560-1}
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -5633,7 +6762,7 @@ CVE-2026-41504 (OWASP Coraza WAF is a golang modsecurity
compatible web applicat
NOT-FOR-US: OWASP Coraza WAF
CVE-2026-41210 (Moonlight Qt is a GameStream client for Windows, macOS, Linux,
and Ste ...)
- moonlight-qt <itp> (bug #1106208)
-CVE-2026-35001 (OpenS100 through commit daa35b contains an integer overflow
vulnerabil ...)
+CVE-2026-35001 (OpenS100 through commit 2b1dafc contains an integer overflow
vulnerabi ...)
NOT-FOR-US: OpenS100
CVE-2026-19938 (The Bluetooth host's ATT transmit path releases a buffer it
does not o ...)
NOT-FOR-US: Zephyr, different from src:zephyr
@@ -30179,6 +31308,7 @@ CVE-2026-83555 (The Email Subscribers & Newsletters
WordPress plugin before 5.9
CVE-2026-82843 (The WP OAuth Server ( Login with WordPress ) WordPress plugin
before 6 ...)
NOT-FOR-US: WordPress plugin
CVE-2026-82331 (Improper link resolution before file access ('link following')
vulnera ...)
+ {DSA-6559-1}
- buildstream 2.8.1-1
NOTE: https://lists.apache.org/thread/9b342631x7bvtyg0pq7zgywtl2cmy34v
NOTE: https://github.com/apache/buildstream/pull/2192
@@ -31602,9 +32732,9 @@ CVE-2026-94372 (MISP contains a stored cross-site
scripting (XSS) vulnerability
- misp <itp> (bug #1144317)
CVE-2026-94277 (MISP's galaxy matrix statistics view
(app/View/Users/statistics_galaxy ...)
- misp <itp> (bug #1144317)
-CVE-2026-94216 (A vulnerability was determined in ST Engineering iDirect
Evolution and ...)
+CVE-2026-94216 (A vulnerability was determined in ST Engineering iDirect iDX
and Evo i ...)
NOT-FOR-US: ST Engineering iDirect Evolution and Velocity WebServer
Evolution
-CVE-2026-94214 (A vulnerability was found in ST Engineering iDirect Evolution
and Velo ...)
+CVE-2026-94214 (A vulnerability was found in ST Engineering iDirect iDX and
Evo iDX. T ...)
NOT-FOR-US: ST Engineering iDirect Evolution and Velocity WebServer
Evolution
CVE-2026-94211 (A vulnerability has been found in Hyve5 Leantime up to 3.9.8.
Affected ...)
NOT-FOR-US: Hyve5 Leantime
@@ -33834,6 +34964,7 @@ CVE-2026-93455 (django-page-cms through 2.0.13 fails to
properly validate page p
CVE-2026-93454 (Aureus ERP through 1.6.0 stores the Payment Term note field
unsanitize ...)
NOT-FOR-US: Aureus ERP
CVE-2026-93453 (SOGo before 5.12.11 constructs password-reset links using the
client-s ...)
+ {DSA-6561-1}
- sogo 5.12.11-1 (bug #1148454)
NOTE: https://www.sogo.nu/news/2026/sogo-v51211-released.html
NOTE: Fixed by:
https://github.com/Alinto/sogo/commit/382118a93b6925de2ce7f774abc1865ebea2dbba
(SOGo-5.12.11)
@@ -57104,7 +58235,7 @@ CVE-2026-84732 (Retransmissions of ACK packet ID in
OpenVPN through 2.6.22 and 2
NOTE:
https://community.openvpn.net/Security%20Announcements/CVE-2026-84732
NOTE: Fixed by:
https://github.com/OpenVPN/openvpn/commit/a9b75ba3fa53986c60a815ec096a332be82c3118
(v2.7.7)
NOTE: Fixed by:
https://github.com/OpenVPN/openvpn/commit/b439b30374385bb8d1c50bdbef0b7778873b13ef
(v2.7.7)
-CVE-2026-84471
+CVE-2026-84471 (The fix for CVE-2026-12996 was incomplete. A use-after-free in
OpenVPN ...)
- openvpn 2.7.7-1
NOTE: Fixed by:
https://github.com/OpenVPN/openvpn/commit/c52f940196444668284eb06ec0cf08a8bc3cd36b
(v2.7.7)
CVE-2026-84256 (An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22
and 2.7_a ...)
@@ -69398,7 +70529,7 @@ CVE-2026-28190 (Subscriber Broken Access Control in
ProLancer Element <= 1.4.8 v
NOT-FOR-US: WordPress plugin or theme
CVE-2026-28171 (Unauthenticated Arbitrary File Deletion in WooCommerce File
Approval < ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-28167 (Unauthenticated Arbitrary File Download in Super Forms <=
6.3.315 vers ...)
+CVE-2026-28167 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-28166 (Unauthenticated Cross Site Scripting (XSS) in Tourmaster <=
5.4.9 vers ...)
NOT-FOR-US: WordPress plugin or theme
@@ -76648,7 +77779,7 @@ CVE-2026-73337 (Joomla! Core - [20260807] - MFA
Authentication Bypass in Joomla
NOT-FOR-US: Joomla
CVE-2026-73336 (Joomla! Core - [20260806] - XSS through schema.org outputs in
Joomla 5 ...)
NOT-FOR-US: Joomla
-CVE-2026-73190 (Unauthenticated Cross Site Scripting (XSS) in WPDM \u2013
Premium Pack ...)
+CVE-2026-73190 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-73189
REJECTED
@@ -84156,13 +85287,13 @@ CVE-2026-10571 (IBM WebSphere Application Server -
Liberty 17.0.0.3 through 26.0
NOT-FOR-US: IBM
CVE-2025-10308 (The Astro Booking Engine plugin for WordPress is vulnerable to
Cross-S ...)
NOT-FOR-US: WordPress plugin
-CVE-2026-73261 [Built-in TCP/IP malformed TCP option handling]
+CVE-2026-73261 (Mongoose is an embedded web server and network library. Prior
to 7.23, ...)
- mongoose 7.23+ds-1
-CVE-2026-73260 [Built-in TLS X.509 DER parsing bounds check]
+CVE-2026-73260 (Mongoose is an embedded web server and network library. Prior
to 7.23, ...)
- mongoose 7.23+ds-1
-CVE-2026-63626 [Built-in TCP/IP PPP IPV6CP option parsing bounds check]
+CVE-2026-63626 (Mongoose is an embedded web server and network library. Prior
to 7.23, ...)
- mongoose 7.23+ds-1
-CVE-2026-73252 [Built-in TLS short-record handling]
+CVE-2026-73252 (Mongoose is an embedded web server and network library. Prior
to 7.23, ...)
- mongoose 7.23+ds-1
CVE-2026-73251 (Mongoose is an embedded web server and network library. Prior
to 7.23, ...)
- mongoose 7.23+ds-1
@@ -107392,6 +108523,7 @@ CVE-2026-61083 (Vulnerability in the Oracle
Performance Management product of Or
CVE-2026-61082 (Vulnerability in the MySQL Connectors product of Oracle MySQL
(compone ...)
- mysql-connector-java <removed>
CVE-2026-61081 (Vulnerability in the MySQL Server, MySQL Cluster product of
Oracle MyS ...)
+ {DLA-4835-1}
- mariadb 1:11.8.9+ds-1
[trixie] - mariadb <no-dsa> (Minor issue)
- mysql-9.7 9.7.2-1 (bug #1142644)
@@ -107820,6 +108952,7 @@ CVE-2026-60750 (Vulnerability in the Oracle Payroll
product of Oracle E-Business
CVE-2026-60749 (Vulnerability in the Oracle Assets product of Oracle
E-Business Suite ...)
NOT-FOR-US: Oracle
CVE-2026-60747 (Vulnerability in the MySQL Server, MySQL Cluster product of
Oracle MyS ...)
+ {DLA-4835-1}
- mariadb 1:11.8.9+ds-1
[trixie] - mariadb <no-dsa> (Minor issue)
- mysql-9.7 9.7.2-1 (bug #1142644)
@@ -108080,6 +109213,7 @@ CVE-2026-60587 (Vulnerability in the Oracle Project
Foundation product of Oracle
CVE-2026-60586 (Vulnerability in the MySQL Connectors product of Oracle MySQL
(compone ...)
- mysql-connector-java <removed>
CVE-2026-60585 (Vulnerability in the MySQL Server, MySQL Cluster product of
Oracle MyS ...)
+ {DLA-4835-1}
- mariadb 1:11.8.9+ds-1
[trixie] - mariadb <no-dsa> (Minor issue)
- mysql-9.7 9.7.2-1 (bug #1142644)
@@ -108484,6 +109618,7 @@ CVE-2026-60333 (Vulnerability in the Oracle Access
Manager product of Oracle Fus
CVE-2026-60332 (Vulnerability in the MySQL Server, MySQL Cluster product of
Oracle MyS ...)
- mysql-9.7 9.7.2-1 (bug #1142644)
CVE-2026-60331 (Vulnerability in the MySQL Server, MySQL Cluster product of
Oracle MyS ...)
+ {DLA-4835-1}
- mariadb 1:11.8.9+ds-1
[trixie] - mariadb <no-dsa> (Minor issue)
- mysql-9.7 9.7.2-1 (bug #1142644)
@@ -108780,6 +109915,7 @@ CVE-2026-60186 (Vulnerability in the MySQL Server,
MySQL Cluster product of Orac
CVE-2026-60185 (Vulnerability in the MySQL Server, MySQL Cluster product of
Oracle MyS ...)
- mysql-9.7 9.7.2-1 (bug #1142644)
CVE-2026-60184 (Vulnerability in the MySQL Server, MySQL Cluster product of
Oracle MyS ...)
+ {DLA-4835-1}
- mariadb 1:11.8.9+ds-1
[trixie] - mariadb <no-dsa> (Minor issue)
- mysql-9.7 9.7.2-1 (bug #1142644)
@@ -109048,6 +110184,7 @@ CVE-2026-47026 (Vulnerability in the PeopleSoft
Enterprise PeopleTools product o
CVE-2026-47024 (Vulnerability in the PeopleSoft Enterprise PeopleTools product
of Orac ...)
NOT-FOR-US: Oracle
CVE-2026-47023 (Vulnerability in the MySQL Server, MySQL Cluster product of
Oracle MyS ...)
+ {DLA-4835-1}
- mariadb 1:11.8.9+ds-1
[trixie] - mariadb <no-dsa> (Minor issue)
- mysql-9.7 9.7.2-1 (bug #1142644)
@@ -138290,13 +139427,13 @@ CVE-2025-15642 (Netskope is notified about a
potential gap in its Netskoped Clie
NOT-FOR-US: Netskope
CVE-2025-15641 (Netskope was notified about a potential gap in its Netskope
Client for ...)
NOT-FOR-US: Netskope
-CVE-2026-53615 [Integer Overflow or Wraparound in
libblkid/src/partitions/dos.c]
+CVE-2026-53615 (util-linux is a random collection of Linux utilities. Before
util-linu ...)
- util-linux 2.42-1 (bug #1140197)
[trixie] - util-linux 2.41.5-0+deb13u1
NOTE:
https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5
NOTE: Fixed by:
https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31
(v2.42)
NOTE: Fixed by:
https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623
(v2.41.4)
-CVE-2026-53614 [Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2
Environment Variable - nosuid/noexec Bypass in SUID mount(8)]
+CVE-2026-53614 (util-linux is a random collection of Linux utilities. In
util-linux 2. ...)
{DSA-6442-1}
- util-linux 2.42.2-1 (bug #1140196)
[bookworm] - util-linux <not-affected> (Vulnerable code introduced
later)
@@ -138304,13 +139441,13 @@ CVE-2026-53614 [Local Privilege Escalation via
LIBMOUNT_FORCE_MOUNT2 Environment
NOTE:
https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx
NOTE: Fixed by:
https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661
(v2.42.2)
NOTE: Fixed by:
https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f
(v2.41.5)
-CVE-2026-53613 [Local Privilege Escalation via TOCTOU in mount(8) - Target
Path Redirection]
+CVE-2026-53613 (util-linux is a random collection of Linux utilities. In
util-linux 2. ...)
{DSA-6442-1}
- util-linux 2.42.2-1 (bug #1140195)
NOTE:
https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g
NOTE: Fixed by:
https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0
(v2.42.2)
NOTE: Fixed by:
https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2
(v2.41.5)
-CVE-2026-53612 [Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c
chmod/chown]
+CVE-2026-53612 (util-linux is a random collection of Linux utilities. In
util-linux 2. ...)
{DSA-6442-1}
- util-linux 2.42.2-1 (bug #1140194)
[bookworm] - util-linux <not-affected> (Vulnerable code introduced
later)
@@ -178811,7 +179948,7 @@ CVE-2026-39110 (SQL Injection vulnerability in
Apartment Visitors Management Sys
NOT-FOR-US: Apartment Visitors Management System
CVE-2026-39109 (SQL Injection vulnerability in Apartment Visitors Management
System Ap ...)
NOT-FOR-US: Apartment Visitors Management System
-CVE-2026-35154 (Dell PowerProtect Data Domain Feature Release versions 7.7.1.0
through ...)
+CVE-2026-35154 (Dell PowerProtect Data Domain appliances, versions 7.7.1.0
through 8.6 ...)
NOT-FOR-US: Dell / EMC
CVE-2026-34429 (Vvveb prior to1.0.8.1 contains a stored cross-site scripting
vulnerabi ...)
NOT-FOR-US: Vvveb
@@ -179467,13 +180604,13 @@ CVE-2026-3464 (The WP Customer Area plugin for
WordPress is vulnerable to arbitr
NOT-FOR-US: WordPress plugin
CVE-2026-37749 (A SQL injection vulnerability in CodeAstro Simple Attendance
Managemen ...)
NOT-FOR-US: CodeAstro
-CVE-2026-35153 (Dell PowerProtect Data Domain Feature Release versions 7.7.1.0
through ...)
+CVE-2026-35153 (Dell PowerProtect Data Domain, versions 7.7.1.0 through
8.6.0.0 andver ...)
NOT-FOR-US: Dell / EMC
-CVE-2026-35074 (Dell PowerProtect Data Domain Feature Release versions 7.7.1.0
through ...)
+CVE-2026-35074 (Dell PowerProtect Data Domain, versions 7.7.1.0 through
8.6.0.0 andver ...)
NOT-FOR-US: Dell / EMC
-CVE-2026-35073 (Dell PowerProtect Data Domain Feature Release versions 7.7.1.0
through ...)
+CVE-2026-35073 (Dell PowerProtect Data Domain, versions 7.7.1.0 through
8.6.0.0 andver ...)
NOT-FOR-US: Dell / EMC
-CVE-2026-35072 (Dell PowerProtect Data Domain Feature Release versions 7.7.1.0
through ...)
+CVE-2026-35072 (Dell PowerProtect Data Domain, versions 7.7.1.0 through
8.6.0.0 andver ...)
NOT-FOR-US: Dell / EMC
CVE-2026-33392 (In JetBrains YouTrack before 2025.3.131383 high privileged
user can ac ...)
NOT-FOR-US: JetBrains
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d914914942a9e3f936f9e0b54db647bd993c0828
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d914914942a9e3f936f9e0b54db647bd993c0828
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
