Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
cec43dc0 by Moritz Muehlenhoff at 2026-10-14T23:36:35+02:00
bugnums
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -5077,15 +5077,15 @@ CVE-2026-95122 (mp4v2 2.0.0 contains a NULL pointer
dereference vulnerability in
CVE-2026-95121 (An issue in mp4v2 2.0.0 allows an attacker to execute
arbitrary code v ...)
- mp4v2 <removed>
CVE-2026-95117 (Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6
allows ...)
- - jsmn <unfixed>
+ - jsmn <unfixed> (bug #1150931)
NOTE: https://github.com/zserge/jsmn/issues/249
NOTE: https://github.com/zserge/jsmn/pull/250
CVE-2026-95115 (Buffer Overflow vulnerability in libwebsockets main 106d542c
allows a ...)
- - libwebsockets <unfixed>
+ - libwebsockets <unfixed> (bug #1150938)
NOTE: https://github.com/warmcat/libwebsockets/issues/3663
NOTE:
https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a
CVE-2026-95114 (libwebsockets contains an out-of-bounds read vulnerability in
the LEJP ...)
- - libwebsockets <unfixed>
+ - libwebsockets <unfixed> (bug #1150938)
NOTE: https://github.com/warmcat/libwebsockets/issues/3664
NOTE:
https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a
CVE-2026-94410 (A low privileged remote attacker is able to view a list of
roles that ...)
@@ -5147,12 +5147,12 @@ CVE-2026-89196 (A vulnerability has been identified in
RUGGEDCOM CROSSBOW (All v
CVE-2026-89097 (The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for
WordPress i ...)
NOT-FOR-US: WordPress plugin
CVE-2026-88838 (A flaw was found in BusyBox's mount utility. A non-root user
can bypas ...)
- - busybox <unfixed>
+ - busybox <unfixed> (bug #1150940)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531352
CVE-2026-88836
REJECTED
CVE-2026-88834 (A flaw was found in BusyBox's httpd web server. When
configured with s ...)
- - busybox <unfixed>
+ - busybox <unfixed> (bug #1150941)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531348
CVE-2026-88833 (A flaw was found in BusyBox's udhcpc DHCP client. When
processing raw ...)
- busybox <unfixed>
@@ -5404,7 +5404,7 @@ CVE-2026-110239 (Rapyd Admin before 9.20.0 contains a
stored cross-site scriptin
CVE-2026-110238 (Rapyd Admin from 9.0.0 before 9.20.0 contains an
authorization bypass ...)
NOT-FOR-US: Rapyd Admin
CVE-2026-110237 (Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO
in the s ...)
- - vifm <unfixed>
+ - vifm <unfixed> (bug #1150939)
CVE-2026-110236 (KDE Dolphin 24.08.0 through 26.08.2 contains an OS command
injection v ...)
- dolphin <unfixed>
NOTE: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJCMaGsizg
@@ -7039,7 +7039,7 @@ CVE-2026-109565 (Rapyd Admin from 9.4.0 before 9.20.0
contains a stored cross-si
CVE-2026-109564 (LearnHouse before 1.4.0 contains a missing authorization
vulnerability ...)
NOT-FOR-US: LearnHouse
CVE-2026-109563 (N3.js before 2.11.1 contains a regular expression denial of
service vu ...)
- - node-n3 <unfixed>
+ - node-n3 <unfixed> (bug #1150935)
NOTE: https://github.com/rdfjs/N3.js/pull/760
NOTE: Fixed by:
https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d
(v2.11.1)
CVE-2026-109562 (SnapOtter 1.15.10 through 2.2.0 contains a missing
authorization vulne ...)
@@ -7059,7 +7059,7 @@ CVE-2026-109427 (Telegram-Stremio through 5.1.0 contains
a broken object-level a
CVE-2026-109426 (Telegram-Stremio through 5.1.0 contains an insecure storage
vulnerabil ...)
NOT-FOR-US: Telegram-Stremio
CVE-2026-109425 (Tink-go (tink-crypto/tink-go) through 2.8.0 contains an
input-validati ...)
- - golang-github-tink-crypto-tink-go <unfixed>
+ - golang-github-tink-crypto-tink-go <unfixed> (bug #1150934)
NOTE: https://github.com/tink-crypto/tink-go/issues/68
CVE-2026-109424 (NetEase Cloud Music client for Windows (cloudmusic.exe)
versions 3.1.3 ...)
NOT-FOR-US: NetEase Cloud Music client for Windows
@@ -7907,9 +7907,11 @@ CVE-2026-108835 (A flaw has been found in Yungengxin Yun
Jia Security Guard up t
CVE-2026-108834 (A vulnerability was detected in Cairo-dock Glx-Dock up to
3.4.0. This ...)
NOT-FOR-US: Cairo-dock Glx-Dock
CVE-2026-108831 (A security vulnerability has been detected in meetecho
janus-gateway u ...)
- - janus <unfixed>
+ - janus <unfixed> (unimportant)
+ NOTE: Only affects demo application
CVE-2026-108830 (A weakness has been identified in meetecho janus-gateway up
to 1.4.2. ...)
- - janus <unfixed>
+ - janus <unfixed> (bug #1150933)
+ NOTE:
https://github.com/meetecho/janus-gateway/commit/27c0d1af888153e818675b56a4e6267f62d57097
CVE-2026-108829 (A security flaw has been discovered in Zen Cart up to 2.2.2.
Affected ...)
NOT-FOR-US: Zen Cart
CVE-2026-108828 (A vulnerability was identified in Zen Cart 2.2.2. Affected by
this vul ...)
@@ -7923,7 +7925,7 @@ CVE-2026-108825 (A vulnerability has been found in
yangzongzhuan RuoYi up to 4.8
CVE-2026-108824 (A flaw has been found in DataEase up to 3.0.0. The impacted
element is ...)
NOT-FOR-US: DataEase
CVE-2026-108822 (A vulnerability was detected in Kamailio up to 6.0.7/6.1.3.
The affect ...)
- - kamailio <unfixed>
+ - kamailio <unfixed> (bug #1150937)
NOTE: https://github.com/kamailio/kamailio/pull/4905
NOTE: Fixed by:
https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21
CVE-2026-108821 (A security vulnerability has been detected in Tencent WeKnora
up to 0. ...)
@@ -7969,7 +7971,7 @@ CVE-2026-108475 (Missing Authorization vulnerability in
VideoWhisper.com Broadca
CVE-2026-108168 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108094 (A use-after-free flaw was found in mutter in the Wayland
color-managem ...)
- - mutter <unfixed>
+ - mutter <unfixed> (bug #1150932)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2549511
NOTE: https://gitlab.gnome.org/GNOME/mutter/-/issues/5025
NOTE: https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/5313
@@ -8000,7 +8002,7 @@ CVE-2026-107418 (Missing Authorization vulnerability in
Arraytics Booktics bookt
CVE-2026-107248 (Thelia 3.0.0's back-office Email/Messages feature contains a
server\u2 ...)
NOT-FOR-US: Thelia
CVE-2026-107226 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - async-http-client <unfixed> (bug #1150936)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-p2jm-6hj6-9rjg
NOTE: Fixed by:
https://github.com/AsyncHttpClient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1
(async-http-client-project-3.0.14)
CVE-2026-106605 (Improper Validation of Specified Quantity in Input
vulnerability in WP ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cec43dc02a5960ce3bb8917e6f4c8df854e696bf
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cec43dc02a5960ce3bb8917e6f4c8df854e696bf
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
