Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
72ba1f9b by security tracker role at 2026-10-15T07:13:54+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,379 @@
+CVE-2026-96540 (An improper access control vulnerability has been identified
in the So ...)
+ TODO: check
+CVE-2026-96537 (The Tutor LMS WordPress plugin before 4.1.1 does not perform
a capabi ...)
+ TODO: check
+CVE-2026-93484 (Znuny through 7.3.6 constructs a ticket-search database query
by direc ...)
+ TODO: check
+CVE-2026-93483 (In Znuny through 7.3.6, an attacker can bypass specific
standard login ...)
+ TODO: check
+CVE-2026-92429 (The Rede Ita\xfa for WooCommerce WordPress plugin before 5.5.3
does no ...)
+ TODO: check
+CVE-2026-92428 (The Rede Ita\xfa for WooCommerce WordPress plugin before 5.5.3
does no ...)
+ TODO: check
+CVE-2026-88043 (The Mang Board WP plugin for WordPress is vulnerable to Stored
Cross-S ...)
+ TODO: check
+CVE-2026-86803 (The The Ocean Extra plugin for WordPress is vulnerable to
arbitrary sh ...)
+ TODO: check
+CVE-2026-81534 (The Email Customizer for WooCommerce (Pro) plugin for
WordPress is vul ...)
+ TODO: check
+CVE-2026-79822 (A security vulnerability inHPE NonStop TNS/X Native Inspect
may cause ...)
+ TODO: check
+CVE-2026-79821 (A security vulnerability inHPE NonStop SOAP 4.0 may cause
memory corr ...)
+ TODO: check
+CVE-2026-78087 (The VK Blocks plugin for WordPress is vulnerable to Stored
Cross-Site ...)
+ TODO: check
+CVE-2026-78001 (The Post and Page Builder by BoldGrid \u2013 Visual Drag and
Drop Edit ...)
+ TODO: check
+CVE-2026-77931 (MoviePilot through 3.1.5 contains a command injection
vulnerability th ...)
+ TODO: check
+CVE-2026-77427 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-76668 (A security vulnerability inHPE NonStop Kernel may allow user
space acc ...)
+ TODO: check
+CVE-2026-76667 (A security vulnerability inHPE NonStop EXPAND may result in
out-of-bou ...)
+ TODO: check
+CVE-2026-76666 (A security vulnerability inHPE NonStop EXPAND may result in
out-of-bou ...)
+ TODO: check
+CVE-2026-76665 (A security vulnerability inHPE NonStop EXPAND may cause
out-of-bounds ...)
+ TODO: check
+CVE-2026-76664 (A security vulnerability inHPE NonStop EXPAND may result in
out-of-bou ...)
+ TODO: check
+CVE-2026-76663 (A stack-based buffer overflow vulnerability inHPE NonStop
TELSERV can ...)
+ TODO: check
+CVE-2026-76662 (A buffer overflow vulnerability inHPE NonStop TELSERV can
cause memory ...)
+ TODO: check
+CVE-2026-76661 (A vulnerability in HPE NonStop QIOMON allows an out-of-bounds
write th ...)
+ TODO: check
+CVE-2026-76660 (A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds
write ...)
+ TODO: check
+CVE-2026-76659 (A vulnerability in the finger daemon of HPE NonStop TCP/IP
UTILITIES c ...)
+ TODO: check
+CVE-2026-76656 (A vulnerability in HPE NonStop TCP/IP UTILITIES could allow
an unaut ...)
+ TODO: check
+CVE-2026-76066 (IntentKit through 2.6.3 contains an authorization bypass
vulnerability ...)
+ TODO: check
+CVE-2026-74920 (The Document Gallery WordPress plugin through 5.1.1 does not
properly ...)
+ TODO: check
+CVE-2026-73799 (A security vulnerability inHPE NonStop SNMP Trap Multiplexer
may cause ...)
+ TODO: check
+CVE-2026-71854 (OpenAEV is an open source platform allowing organizations to
plan, sch ...)
+ TODO: check
+CVE-2026-69194 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-69193 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-69191 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-64856 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-62664 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-61844 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-61843 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-58100 (kqueue_fork_copy_knote() indexed into the child's file
descriptor tabl ...)
+ TODO: check
+CVE-2026-58099 (When copying knotes from a parent kqueue to a child, the copy
code did ...)
+ TODO: check
+CVE-2026-58098 (When semop(2) blocks waiting for a semaphore condition, it
releases th ...)
+ TODO: check
+CVE-2026-57493 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-57492 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-57491 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-57490 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-57489 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-55684 (WeGIA is a web manager for charitable institutions. Prior to
3.8.6, th ...)
+ TODO: check
+CVE-2026-55683 (WeGIA is a web manager for charitable institutions. Prior to
3.8.6, th ...)
+ TODO: check
+CVE-2026-55682 (WeGIA is a web manager for charitable institutions. Prior to
3.8.6, th ...)
+ TODO: check
+CVE-2026-55681 (WeGIA is a web manager for charitable institutions. Prior to
3.8.6, an ...)
+ TODO: check
+CVE-2026-55680 (WeGIA is a web manager for charitable institutions. Prior to
3.8.6, un ...)
+ TODO: check
+CVE-2026-55679 (WeGIA is a web manager for charitable institutions. Prior to
3.8.6, th ...)
+ TODO: check
+CVE-2026-55498 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-55387 (InvoiceShelf is an open-source web & mobile app that helps
track expen ...)
+ TODO: check
+CVE-2026-55386 (InvoiceShelf is an open-source web & mobile app that helps
track expen ...)
+ TODO: check
+CVE-2026-55385 (InvoiceShelf is an open-source web & mobile app that helps
track expen ...)
+ TODO: check
+CVE-2026-55384 (InvoiceShelf is an open-source web & mobile app that helps
track expen ...)
+ TODO: check
+CVE-2026-55383 (InvoiceShelf is an open-source web & mobile app that helps
track expen ...)
+ TODO: check
+CVE-2026-55382 (InvoiceShelf is an open-source web & mobile app that helps
track expen ...)
+ TODO: check
+CVE-2026-55381 (InvoiceShelf is an open-source web & mobile app that helps
track expen ...)
+ TODO: check
+CVE-2026-54703 (Markdown Preview Enhanced is a Markdown preview extension for
Visual S ...)
+ TODO: check
+CVE-2026-54702 (Markdown Preview Enhanced is a Markdown preview extension for
Visual S ...)
+ TODO: check
+CVE-2026-54701 (Markdown Preview Enhanced is a Markdown preview extension for
Visual S ...)
+ TODO: check
+CVE-2026-54566 (Markdown Preview Enhanced is a Markdown preview extension for
Visual S ...)
+ TODO: check
+CVE-2026-3712 (The PhastPress plugin for WordPress is vulnerable to
Server-Side Reque ...)
+ TODO: check
+CVE-2026-18586 (The Premium Packages \u2013 Sell Digital Products Securely
plugin for ...)
+ TODO: check
+CVE-2026-18557 (The Photo Gallery by 10Web \u2013 Mobile-Friendly Image
Gallery plugin ...)
+ TODO: check
+CVE-2026-18548 (The Groundhogg \u2014 CRM, Newsletters, and Marketing
Automation plugi ...)
+ TODO: check
+CVE-2026-17031 (The Checkout Field Manager (Checkout Manager) for WooCommerce
plugin f ...)
+ TODO: check
+CVE-2026-17001 (The Import and export users and customers plugin for WordPress
is vuln ...)
+ TODO: check
+CVE-2026-15180 (The Tracking Code Manager plugin for WordPress is vulnerable
to Reflec ...)
+ TODO: check
+CVE-2026-15090 (The Link Library plugin for WordPress is vulnerable to
time-based SQL ...)
+ TODO: check
+CVE-2026-14572 (The Kirki \u2013 Freeform Page Builder, Website Builder &
Customizer p ...)
+ TODO: check
+CVE-2026-11905 (The Elementor Website Builder \u2013 more than just a page
builder plu ...)
+ TODO: check
+CVE-2026-110934 (Improper validation of array index vulnerability in Samsung
Open Sourc ...)
+ TODO: check
+CVE-2026-110933 (Uncaught exception vulnerability in Samsung Open Source Vyond
allows I ...)
+ TODO: check
+CVE-2026-110926 (A flaw was found in OpenSSH. When compression is negotiated,
channels ...)
+ TODO: check
+CVE-2026-110925 (A flaw was found in OpenSSH. A username entered on the ssh
command lin ...)
+ TODO: check
+CVE-2026-110923 (A flaw was found in OpenSSH. During an sftp copy, a malicious
server c ...)
+ TODO: check
+CVE-2026-110912 (In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input
handlers ...)
+ TODO: check
+CVE-2026-110911 (Wheels 1.1.8 through 4.1.1 allows SQL injection when
caller-supplied q ...)
+ TODO: check
+CVE-2026-110909 (Wheels CLI through 4.1.0 does not verify that the local
development se ...)
+ TODO: check
+CVE-2026-110908 (Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and
source revis ...)
+ TODO: check
+CVE-2026-110907 (Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before
1.34.6 mishan ...)
+ TODO: check
+CVE-2026-110904 (ApostropheCMS before 4.33.0 allows authentication bypass for
REST API ...)
+ TODO: check
+CVE-2026-110873 (Heym from 0.0.55 before 0.0.121 contains a privilege
escalation vulner ...)
+ TODO: check
+CVE-2026-110872 (Nodemailer from 3.0.0 before 10.0.10 contains a quadratic
complexity d ...)
+ TODO: check
+CVE-2026-110871 (Nodemailer from 3.0.0 before 10.0.10 contains a denial of
service vuln ...)
+ TODO: check
+CVE-2026-110870 (Nodemailer from 3.0.0 before 10.0.13 contains an improper
input valida ...)
+ TODO: check
+CVE-2026-110869 (Nodemailer 3.0.0 before 10.0.13 has a regular expression
denial of ser ...)
+ TODO: check
+CVE-2026-110868 (Renovate before 44.79.0 contains a server-side request
forgery vulnera ...)
+ TODO: check
+CVE-2026-110867 (Renovate before 44.60.1 contains an allowlist bypass
vulnerability tha ...)
+ TODO: check
+CVE-2026-110866 (Renovate before 44.61.3 contains a protection mechanism
bypass vulnera ...)
+ TODO: check
+CVE-2026-110865 (Renovate before 44.60.1 contains an allowlist bypass
vulnerability tha ...)
+ TODO: check
+CVE-2026-110864 (Better Auth from 1.5.0-beta.12 before 1.7.7 contains an
authentication ...)
+ TODO: check
+CVE-2026-110863 (Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3
contains an ...)
+ TODO: check
+CVE-2026-110862 (Better Auth from 1.4.0-beta.18 before 1.7.7 contains an
authentication ...)
+ TODO: check
+CVE-2026-110861 (Better Auth @better-auth/drizzle-adapter and better-auth from
1.6.17 b ...)
+ TODO: check
+CVE-2026-110860 (GitPython from 3.1.62 before 3.2.0 contains a
symlink-following flaw i ...)
+ TODO: check
+CVE-2026-110859 (GitPython before 3.2.0 contains an argument injection
vulnerability in ...)
+ TODO: check
+CVE-2026-110858 (GitPython from 3.1.30 before 3.2.0 contains a remote code
execution vu ...)
+ TODO: check
+CVE-2026-110857 (GitPython before 3.2.0 contains a remote code execution
vulnerability ...)
+ TODO: check
+CVE-2026-110856 (GitPython before 3.2.0 contains a regular expression denial
of service ...)
+ TODO: check
+CVE-2026-110855 (GitPython before 3.2.0 contains an information disclosure
vulnerabilit ...)
+ TODO: check
+CVE-2026-110854 (Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6
does not ha ...)
+ TODO: check
+CVE-2026-110853 (n8n before 1.123.83 contains an authorization bypass
vulnerability tha ...)
+ TODO: check
+CVE-2026-110852 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before
2.42.1 conta ...)
+ TODO: check
+CVE-2026-110851 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an
authorization b ...)
+ TODO: check
+CVE-2026-110850 (n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate
credentia ...)
+ TODO: check
+CVE-2026-110849 (n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored
cross-site s ...)
+ TODO: check
+CVE-2026-110848 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before
2.42.1 conta ...)
+ TODO: check
+CVE-2026-110847 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before
2.42.1 conta ...)
+ TODO: check
+CVE-2026-110846 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains a
signature bypass ...)
+ TODO: check
+CVE-2026-110845 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before
2.42.1 conta ...)
+ TODO: check
+CVE-2026-110844 (n8n before 1.123.83 contains an authorization bypass
vulnerability tha ...)
+ TODO: check
+CVE-2026-110843 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an
uncontrolled re ...)
+ TODO: check
+CVE-2026-110842 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains a
prototype pollut ...)
+ TODO: check
+CVE-2026-110841 (n8n before 2.41.4 and 2.42.0 contains an authorization bypass
in the a ...)
+ TODO: check
+CVE-2026-110840 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL
injection v ...)
+ TODO: check
+CVE-2026-110839 (FreeRDP 3.3.0 before 3.32.0, when built with
WINPR_UTILS_IMAGE_JPEG=ON ...)
+ TODO: check
+CVE-2026-110838 (FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches
input PDUs d ...)
+ TODO: check
+CVE-2026-110837 (FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and
WITH_DSP ...)
+ TODO: check
+CVE-2026-110836 (FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop
vulnerabili ...)
+ TODO: check
+CVE-2026-110835 (FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in
its proxy ...)
+ TODO: check
+CVE-2026-110834 (FreeRDP from 2.0.0 before 3.32.0 contains a null pointer
dereference v ...)
+ TODO: check
+CVE-2026-110833 (FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce
cumulative or ...)
+ TODO: check
+CVE-2026-110832 (FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion
vulnerab ...)
+ TODO: check
+CVE-2026-110831 (FreeRDP versions 3.13.0 before 3.32.0 contain a resource
retention fla ...)
+ TODO: check
+CVE-2026-110830 (FreeRDP before 3.32.0 fails to close prior serial handles in
serial_pr ...)
+ TODO: check
+CVE-2026-110829 (FreeRDP versions from 3.0.0 before 3.32.0 contain a null
pointer deref ...)
+ TODO: check
+CVE-2026-110816 (### Summary `qs.stringify` with `arrayFormat: 'comma'`
throws `Type ...)
+ TODO: check
+CVE-2026-110810 (A vulnerability was detected in ggml-org whisper.cpp up to
1.9.4. This ...)
+ TODO: check
+CVE-2026-110809 (A security vulnerability has been detected in sgl-project
SGLang up to ...)
+ TODO: check
+CVE-2026-110807 (A weakness has been identified in sgl-project SGLang up to
0.5.19. Aff ...)
+ TODO: check
+CVE-2026-110698 (A security vulnerability has been detected in Praat up to
7.0.02. Affe ...)
+ TODO: check
+CVE-2026-110696 (A weakness has been identified in itsmeravitejak
Online-Examination-Sy ...)
+ TODO: check
+CVE-2026-110695 (A vulnerability was detected in turboderp ExLlamaV2 up to
0.3.2. Affec ...)
+ TODO: check
+CVE-2026-110694 (A vulnerability has been found in OAID Tengine up to 1.12.0.
This vuln ...)
+ TODO: check
+CVE-2026-110689 (A security flaw has been discovered in OpenClaw ClawScan up
to 0.1.6. ...)
+ TODO: check
+CVE-2026-110679 (A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1.
The impa ...)
+ TODO: check
+CVE-2026-110670 (A vulnerability was found in cemtan sar2html 4.0.0. The
affected eleme ...)
+ TODO: check
+CVE-2026-110669 (A security vulnerability has been detected in cemtan sar2html
4.0.0. T ...)
+ TODO: check
+CVE-2026-110668 (A weakness has been identified in cemtan sar2html 4.0.0.
Affected by t ...)
+ TODO: check
+CVE-2026-110310 (A remote user who can read encrypted objects in the S3 bucket
can forc ...)
+ TODO: check
+CVE-2026-109430 (Ellucian WebAdvisor 3.2 contains an unauthenticated XML
External Entit ...)
+ TODO: check
+CVE-2026-109145 (The User Rights Access Manager WordPress plugin through 1.1.3
does not ...)
+ TODO: check
+CVE-2026-108587 (The 10Web Booster \u2013 Website speed optimization, Cache &
Page Spee ...)
+ TODO: check
+CVE-2026-108337 (An administrator could retrieve the password reset code for
any user a ...)
+ TODO: check
+CVE-2026-108336 (When the default self-signed certificate is used, an attacker
could ga ...)
+ TODO: check
+CVE-2026-108335 (When the password reset functionality is enabled, and email
is configu ...)
+ TODO: check
+CVE-2026-107795 (Omada Controller's MSP and OpenAPI certificate/private-key
management ...)
+ TODO: check
+CVE-2026-106485
+ REJECTED
+CVE-2026-106068
+ REJECTED
+CVE-2026-106031 (The Spin Wheel WordPress plugin before 2.2.1 does not verify
that a v ...)
+ TODO: check
+CVE-2026-106006
+ REJECTED
+CVE-2026-105627
+ REJECTED
+CVE-2026-104643 (The Easy HTTPS Redirection (SSL) WordPress plugin before
2.0.2 does no ...)
+ TODO: check
+CVE-2026-104110 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-104109 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-104108 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-104107 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-104106 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-104105 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-103988 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-103977 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
+ TODO: check
+CVE-2026-103324 (The Cardinity Payment Gateway for WooCommerce WordPress
plugin before ...)
+ TODO: check
+CVE-2026-103304 (The eaSYNC Booking WordPress plugin before 1.3.31 does not
perform au ...)
+ TODO: check
+CVE-2026-102986 (Plane is an open-source project management tool. In 1.3.1 and
earlier, ...)
+ TODO: check
+CVE-2026-102985 (Plane is an open-source project management tool. In 1.3.1 and
earlier, ...)
+ TODO: check
+CVE-2026-102980 (Plane is an open-source project management tool. Prior to
1.4.0, PageV ...)
+ TODO: check
+CVE-2026-102298 (In Omada Controller MSP mode, the user-confirmation endpoint
fails to ...)
+ TODO: check
+CVE-2026-101306 (SCM_RIGHTS file descriptor passing did not preserve
FD_RESOLVE_BENEATH ...)
+ TODO: check
+CVE-2026-101305 (renameat(2) did not enforce FD_RESOLVE_BENEATH on its
directory argume ...)
+ TODO: check
+CVE-2026-101304 (When fdescfs(4) was mounted in a jail with the "nodup"
option, opening ...)
+ TODO: check
+CVE-2026-101302 (TLS 1.3 embeds the actual record type as the last non-zero
byte of the ...)
+ TODO: check
+CVE-2026-100232 (Post-authentication Improper Neutralization of Special
Elements used i ...)
+ TODO: check
+CVE-2026-0993 (SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a
buffer ove ...)
+ TODO: check
+CVE-2026-0321 (Denial of service vulnerabilities in Palo Alto Networks
PAN-OS\xae sof ...)
+ TODO: check
+CVE-2026-0320 (A command injection vulnerability in Palo Alto Networks
PAN-OS\xae sof ...)
+ TODO: check
+CVE-2026-0319 (An improper input handling vulnerability in the
GlobalProtect\u2122 ga ...)
+ TODO: check
+CVE-2026-0318 (A stack-based buffer overflow vulnerability in the log
processing func ...)
+ TODO: check
+CVE-2026-0317 (A denial of service vulnerability in Palo Alto Networks PAN-OS
softwar ...)
+ TODO: check
+CVE-2026-0316 (A stored cross-site scripting (XSS) vulnerability in Palo Alto
Network ...)
+ TODO: check
+CVE-2026-0315 (A local privilege escalation vulnerability in the Palo Alto
Networks G ...)
+ TODO: check
+CVE-2026-0314 (A type confusion vulnerability in Palo Alto Networks
GlobalProtect\u21 ...)
+ TODO: check
+CVE-2026-0313 (A command injection vulnerability in Palo Alto Networks Cortex
XSOAR a ...)
+ TODO: check
+CVE-2026-0312 (Path traversal vulnerabilities in Palo Alto Networks Checkov by
Prisma ...)
+ TODO: check
+CVE-2026-0311 (A server-side request forgery vulnerability in Palo Alto
Networks Chec ...)
+ TODO: check
+CVE-2025-29895 (A NULL pointer dereference vulnerability has been reported to
affect Q ...)
+ TODO: check
CVE-2026-XXXX [BUG/MAJOR: mux-h2: properly handle short reads on PING frames]
- haproxy 3.2.26-1
NOTE: Fixed by:
https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=dc338d875ec907f18143ee369552658b750b7297
(v3.2.16)
@@ -379,7 +755,7 @@ CVE-2026-110761 (ILIAS before 9.24, 10.12, and 11.5
contains a PHP object inject
TODO: check
CVE-2026-110736 (Godot Engine through 4.7.2 has an out-of-bounds read in the
optimized ...)
TODO: check
-CVE-2026-110735 (Godot Engine through 4.7.2 has a heap out-of-bounds write
exists in th ...)
+CVE-2026-110735 (Godot Engine through 4.7.2 has a heap out-of-bounds write in
the binar ...)
TODO: check
CVE-2026-110734 (Godot Engine through 4.7.2 has a heap out-of-bounds write in
the Radia ...)
TODO: check
@@ -35331,7 +35707,7 @@ CVE-2026-57847
REJECTED
CVE-2026-57846
REJECTED
-CVE-2026-55946 (Improper neutralization of special elements used in a command
('comman ...)
+CVE-2026-55946 (Ai command injection in Microsoft Copilot allows an
unauthorized attac ...)
NOT-FOR-US: Microsoft
CVE-2026-54918 (NetBox Device Type Library is a collection of
community-sourced device ...)
NOT-FOR-US: NetBox Device Type Library
@@ -53055,7 +53431,7 @@ CVE-2026-78462 (Authorization bypass through
user-controlled key in Visual Studi
NOT-FOR-US: Microsoft
CVE-2026-78461 (Improper limitation of a pathname to a restricted directory
('path tra ...)
NOT-FOR-US: Microsoft
-CVE-2026-78457 (Use after free in Windows Security Health Service allows an
authorized ...)
+CVE-2026-78457 (Use after free in Windows Security App allows an authorized
attacker t ...)
NOT-FOR-US: Microsoft
CVE-2026-78456 (Heap-based buffer overflow in SQL Server allows an authorized
attacker ...)
NOT-FOR-US: Microsoft
@@ -53470,7 +53846,7 @@ CVE-2026-72927 (Heap-based buffer overflow in Winsock
allows an authorized attac
NOT-FOR-US: Microsoft
CVE-2026-72926 (Use after free in Windows Internet Connection Sharing (ICS)
allows an ...)
NOT-FOR-US: Microsoft
-CVE-2026-72923 (In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until
2.12.0 and ...)
+CVE-2026-72923 (The OpenAPI.NET SDK contains a useful object model for OpenAPI
documen ...)
NOT-FOR-US: Microsoft
CVE-2026-71377 (Command Argument Injection Vulnerability in Cosminexus
Component Conta ...)
NOT-FOR-US: Hitachi
@@ -138493,7 +138869,7 @@ CVE-2025-60223 (Subscriber Arbitrary File Deletion in
WPBot Pro Wordpress Chatbo
NOT-FOR-US: WordPress plugin or theme
CVE-2025-60218 (Subscriber Arbitrary File Upload in PT Luxa Addons <= 1.2.2
versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2025-60205 (Unauthenticated PHP Object Injection in ThemeREX Addons <=
2.36.1.1 ve ...)
+CVE-2025-60205 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Them ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-59872 (HCL ZIE for Web is affetced by an Unrestricted File Upload
vulnerabili ...)
NOT-FOR-US: HCL
@@ -143212,7 +143588,7 @@ CVE-2025-66273 (A command injection vulnerability has
been reported to affect se
NOT-FOR-US: QNAP
CVE-2025-62851 (A path traversal vulnerability has been reported to affect
License Cen ...)
NOT-FOR-US: QNAP
-CVE-2025-62850 (A NULL pointer dereference vulnerability has been reported to
affect s ...)
+CVE-2025-62850 (A NULL pointer dereference vulnerability has been reported to
affect Q ...)
NOT-FOR-US: QNAP
CVE-2025-59382 (QTS, QuTS hero, QuTScloud are not affected. We have already
fixed the ...)
NOT-FOR-US: QNAP
@@ -176981,7 +177357,7 @@ CVE-2026-25775 (A vulnerability
inSenseLiveX3050\u2019s remote management servic
NOT-FOR-US: SenseLive
CVE-2026-25720 (A vulnerability exists inSenseLive X3050\u2019s web
management interf ...)
NOT-FOR-US: SenseLive
-CVE-2026-24303 (Improper access control in Microsoft Partner Center allows an
authoriz ...)
+CVE-2026-24303 (Improper certificate validation in Microsoft Partner Center
allows an ...)
NOT-FOR-US: Microsoft
CVE-2026-1952 (Delta Electronics AS320T has denial of service via the
undocumented su ...)
NOT-FOR-US: Delta Electronics
@@ -182054,7 +182430,7 @@ CVE-2026-33095 (Use after free in Microsoft Office
Word allows an unauthorized a
NOT-FOR-US: Microsoft
CVE-2026-32226 (Concurrent execution using shared resource with improper
synchronizati ...)
NOT-FOR-US: Microsoft
-CVE-2026-32225 (Protection mechanism failure in Windows Shell allows an
unauthorized a ...)
+CVE-2026-32225 (Improper neutralization of special elements used in a command
('comman ...)
NOT-FOR-US: Microsoft
CVE-2026-32224 (Use after free in Windows Server Update Service allows an
authorized a ...)
NOT-FOR-US: Microsoft
@@ -190112,7 +190488,7 @@ CVE-2026-4819 (In Search Guard FLX versions from
1.0.0 up to 4.0.1, the audit lo
NOT-FOR-US: Search Guard FLX
CVE-2026-4818 (In Search Guard FLX versions from 3.0.0 up to 4.0.1, there
exists an i ...)
NOT-FOR-US: Search Guard FLX
-CVE-2026-4800 (Impact: The fix for CVE-2021-23337
(https://github.com/advisories/GHS ...)
+CVE-2026-4800 (The fix for CVE-2021-23337 added validation for the variable
option in ...)
{DLA-4820-1 DLA-4663-1}
- node-lodash 4.18.1+dfsg-1 (bug #1132500)
[trixie] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
@@ -190519,7 +190895,7 @@ CVE-2026-30277 (An arbitrary file overwrite
vulnerability in PDF Reader App : TA
NOT-FOR-US: TA/UTAX Mobile Print
CVE-2026-30276 (An arbitrary file overwrite vulnerability in DeftPDF Document
Translat ...)
NOT-FOR-US: DeftPDF
-CVE-2026-2950 (Impact: Lodash versions 4.17.23 and earlier are vulnerable to
prototy ...)
+CVE-2026-2950 (The _.unset and _.omit functions in Lodash are vulnerable to
prototype ...)
{DLA-4820-1 DLA-4663-1}
- node-lodash 4.18.1+dfsg-1
[trixie] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
@@ -218073,7 +218449,7 @@ CVE-2026-22224 (A command injection vulnerability may
be exploited after the adm
NOT-FOR-US: TP-Link
CVE-2026-22223 (An OS Command Injection vulnerability in TP-Link Archer BE230
v1.2 and ...)
NOT-FOR-US: TP-Link
-CVE-2026-22222 (An OS Command Injection vulnerability in TP-Link Archer BE230
v1.2(web ...)
+CVE-2026-22222 (An OS Command Injection vulnerability in TP-Link Archer BE230
v1.2 and ...)
NOT-FOR-US: TP-Link
CVE-2026-22221 (An OS Command Injection vulnerability in TP-Link Archer BE230
v1.2(vpn ...)
NOT-FOR-US: TP-Link
@@ -222529,7 +222905,7 @@ CVE-2025-13878 (Malformed BRID/HHIT records can cause
`named` to terminate unexp
NOTE: Fixed by:
https://gitlab.isc.org/isc-projects/bind9/-/commit/d556bde1231edf81427d577e35f48f764b6a37b8
(v9.18.44)
NOTE: Fixed by:
https://gitlab.isc.org/isc-projects/bind9/-/commit/d4c0d617015625330f08a3f86a10a533cec0f6ec
(v9.20.18)
NOTE: Fixed by:
https://gitlab.isc.org/isc-projects/bind9/-/commit/7bf83f69a80bdc6094c2adee3595e28b1b3e19ea
(v9.21.17)
-CVE-2025-13465 (Lodash versions 4.0.0 through 4.17.22 are vulnerable to
prototype poll ...)
+CVE-2025-13465 (The _.unset and _.omit functions in Lodash are vulnerable to
prototype ...)
{DLA-4820-1 DLA-4663-1}
- node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-10 (bug #1126265)
[trixie] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72ba1f9ba9a6afb66cda0e2b17b85f219136b2e9
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72ba1f9ba9a6afb66cda0e2b17b85f219136b2e9
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
