Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
79d7ea5b by security tracker role at 2026-10-15T19:14:54+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,7 +1,743 @@
-CVE-2026-99999 [ipv4: validate checksum_start before completing checksum]
+CVE-2026-9703 (Grafana's data source proxy did not apply role-based access
control to ...)
+ TODO: check
+CVE-2026-97712 (Sonatype Nexus Repository 3 allows a user that holds the role
create o ...)
+ TODO: check
+CVE-2026-97667 (Sonatype Nexus Repository 3 allows a user account that holds
the edit ...)
+ TODO: check
+CVE-2026-97666 (Sonatype Nexus Repository 3 allows an unauthenticated remote
attacker ...)
+ TODO: check
+CVE-2026-97665 (A missing authorization check in Nexus Repository 3's NuGet
Components ...)
+ TODO: check
+CVE-2026-97394 (kin-openapi is a Go project for handling OpenAPI files. From
0.136.0 u ...)
+ TODO: check
+CVE-2026-97370 (Junrar is an open source Java RAR archive library. Prior to
7.6.1, Rar ...)
+ TODO: check
+CVE-2026-96614 ("\u30b2\u30aa\u30a2\u30d7\u30ea" provided by GEO CORPORATION
is vulner ...)
+ TODO: check
+CVE-2026-96449 (Missing Authorization vulnerability in WPExperts WP EasyPay
wp-easy-pa ...)
+ TODO: check
+CVE-2026-95180 (An issue in Justson agentweb-core v5.1.6-androidx and earlier
allows a ...)
+ TODO: check
+CVE-2026-95179 (An issue in lottie-android 6.7.1 and earlier (and master)
allows a rem ...)
+ TODO: check
+CVE-2026-95155 (FasterXML Jackson 1.x, confirmed in jackson-mapper-asl
versions 1.8.3, ...)
+ TODO: check
+CVE-2026-94621 (AliasVault is a privacy-first password manager with built-in
email ali ...)
+ TODO: check
+CVE-2026-93649 (In the Eclipse Adoptium website (adoptium.net), in every
deployment bu ...)
+ TODO: check
+CVE-2026-92982 (A flaw was found in Ansible Operator Plugins. A low-privileged
Kuberne ...)
+ TODO: check
+CVE-2026-92707 (MessagePack for C# is a MessagePack serializer for C#. Prior
to 2.5.30 ...)
+ TODO: check
+CVE-2026-8145 (The WholesaleX \u2013 B2B & Wholesale Plugin for WooCommerce
with Whol ...)
+ TODO: check
+CVE-2026-88794 (Enterprise Architect is vulnerable to XML External Entity
(XXE) inject ...)
+ TODO: check
+CVE-2026-88753 (A Regular-Expression Denial of Service (ReDoS) in the
Markdown2. extra ...)
+ TODO: check
+CVE-2026-87029 (undici is an HTTP client library for Node.js. In versions
7.15.0 throu ...)
+ TODO: check
+CVE-2026-87018 (undici is an HTTP client library for Node.js. In versions
4.2.1 throug ...)
+ TODO: check
+CVE-2026-85634 (A flaw was found in the
ContentRepositoryImpl.copyExplodedContent func ...)
+ TODO: check
+CVE-2026-84731 (An unauthenticated remote attacker can bypass authentication
and gain ...)
+ TODO: check
+CVE-2026-79843 (A corrupted file may cause out-of-bounds read in HPE NonStop
SQL/MX EX ...)
+ TODO: check
+CVE-2026-79841 (A buffer overflow vulnerability inHPE NonStop RDMA SERVICES
NSK may ca ...)
+ TODO: check
+CVE-2026-79840 (A buffer overflow vulnerability inHPE NonStop XABroker may
cause memor ...)
+ TODO: check
+CVE-2026-79839 (A buffer overflow vulnerability inHPE NonStop ODBC/MX Server
may cause ...)
+ TODO: check
+CVE-2026-79838 (A buffer overflow vulnerability inHPE NonStop ODBC/MX Services
may cau ...)
+ TODO: check
+CVE-2026-79837 (A vulnerability inHPE NonStop SQL/MX UDR SERVER may allow a
crafted me ...)
+ TODO: check
+CVE-2026-79836 (A vulnerability HPE NonStop SQL/MX Run-Time Statistics may
allow an at ...)
+ TODO: check
+CVE-2026-79835 (A crafted input message can cause a buffer overflow in HPE
Nonstop KMS ...)
+ TODO: check
+CVE-2026-79834 (A security vulnerability in HPE NonStop SQL/MX SQLCAT may
allow an una ...)
+ TODO: check
+CVE-2026-79833 (A vulnerability inHPE NonStop ANSI SQLUTIL may allow a remote
unauthen ...)
+ TODO: check
+CVE-2026-79832 (A stack buffer overflow vulnerability in HPE NonStop SQL/MX
Executor m ...)
+ TODO: check
+CVE-2026-79831 (A heap buffer overflow in HPE NonStop Posix User Threads may
allow arb ...)
+ TODO: check
+CVE-2026-79830 (A vulnerability inHPE NonStop Kernel Level Thread Model Lib
can cause ...)
+ TODO: check
+CVE-2026-79829 (A security vulnerability inHPE NonStop HTTP WEBSERVER can
cause memory ...)
+ TODO: check
+CVE-2026-79828 (A heap buffer overflow in HPE NonStop Debug Utilities could
corrupt r ...)
+ TODO: check
+CVE-2026-79827 (A heap buffer overflow in HPE NonStop Inspect Subsystem could
corrupt ...)
+ TODO: check
+CVE-2026-79826 (A heap buffer overflow in HPE NonStop OCAX could corrupt
address space ...)
+ TODO: check
+CVE-2026-79825 (A heap buffer overflow in HPE NonStop NDSREST could corrupt
resume-exe ...)
+ TODO: check
+CVE-2026-79824 (A directory traversal vulnerability inHPE NonStop Python 3.x
could all ...)
+ TODO: check
+CVE-2026-79823 (HPE NonStop EMS Distributor is vulnerable to buffer overflow
condition ...)
+ TODO: check
+CVE-2026-78851 (Directory Traversal vulnerability in Grav CMS 2.0.3 through
2.0.6 allo ...)
+ TODO: check
+CVE-2026-78850 (An issue in Matomo v.5.11.2 allows a remote attacker to obtain
sensiti ...)
+ TODO: check
+CVE-2026-77711 (When Jetty's `HttpClient` make a request to a server through a
forward ...)
+ TODO: check
+CVE-2026-77470 (Lychee is a free, open-source photo-management tool. Prior to
7.7.1, t ...)
+ TODO: check
+CVE-2026-77468 (Lychee is a free, open-source photo-management tool. Prior to
7.7.0, G ...)
+ TODO: check
+CVE-2026-77467 (Lychee is a free, open-source photo-management tool. Prior to
7.7.0, L ...)
+ TODO: check
+CVE-2026-77466 (Lychee is a free, open-source photo-management tool. Prior to
7.7.0, L ...)
+ TODO: check
+CVE-2026-77460 (EspoCRM is an open source customer relationship management
application ...)
+ TODO: check
+CVE-2026-76184 (In Eclipse Jetty, HttpClient may receive a redirect of the
form: `` ...)
+ TODO: check
+CVE-2026-76182 (In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can
be config ...)
+ TODO: check
+CVE-2026-75559 (The smartphone application "Vehicle Inspection Certificate
Viewer" con ...)
+ TODO: check
+CVE-2026-75505 (EspoCRM is an open source customer relationship management
application ...)
+ TODO: check
+CVE-2026-72528 ("Handmade Marketplace App - Creema" provided by CREEMA LTD.
contains a ...)
+ TODO: check
+CVE-2026-71490 (OPNsense is a FreeBSD based firewall and routing platform.
Prior to 26 ...)
+ TODO: check
+CVE-2026-63442 (OPNsense is a FreeBSD based firewall and routing platform.
Prior to ve ...)
+ TODO: check
+CVE-2026-63430 (ammonia is a Rust library for repairing and securing untrusted
HTML. P ...)
+ TODO: check
+CVE-2026-63315 (WebCTI service for Slican IPx telephone
exchangesstorestemporary subsc ...)
+ TODO: check
+CVE-2026-63314 (WebCTI service for Slican IPx telephone exchangesis vulnerable
to SQL ...)
+ TODO: check
+CVE-2026-63130 (EspoCRM is an open source customer relationship management
application ...)
+ TODO: check
+CVE-2026-62679 (Lychee is a free, open-source photo-management tool. Prior to
7.6.4, S ...)
+ TODO: check
+CVE-2026-62322 (Python Social Auth is a social authentication/registration
mechanism. ...)
+ TODO: check
+CVE-2026-61838 (Lychee is a free, open-source photo-management tool. Prior to
7.6.3, G ...)
+ TODO: check
+CVE-2026-61611 (Lychee is a free, open-source photo-management tool. Prior to
7.6.1, P ...)
+ TODO: check
+CVE-2026-61610 (Lychee is a free, open-source photo-management tool. Prior to
7.6.1, w ...)
+ TODO: check
+CVE-2026-59994 (EspoCRM is an open source customer relationship management
application ...)
+ TODO: check
+CVE-2026-58395 (OPNsense is a FreeBSD based firewall and routing platform.
Prior to ve ...)
+ TODO: check
+CVE-2026-58394 (OPNsense is a FreeBSD based firewall and routing platform.
Prior to ve ...)
+ TODO: check
+CVE-2026-58393 (OPNsense is a FreeBSD based firewall and routing platform.
Prior to ve ...)
+ TODO: check
+CVE-2026-58392 (OPNsense is a FreeBSD based firewall and routing platform.
Prior to ve ...)
+ TODO: check
+CVE-2026-58391 (OPNsense is a FreeBSD based firewall and routing platform.
Prior to ve ...)
+ TODO: check
+CVE-2026-58390 (OPNsense is a FreeBSD based firewall and routing platform.
Prior to ve ...)
+ TODO: check
+CVE-2026-57569 (Lychee is a free, open-source photo-management tool. Prior to
7.6.0, t ...)
+ TODO: check
+CVE-2026-57568 (Lychee is a free, open-source photo-management tool. Prior to
7.6.0, L ...)
+ TODO: check
+CVE-2026-57496 (NetLicensing MCP Server is a natural-language interface that
enables a ...)
+ TODO: check
+CVE-2026-57183 (Scoold is a Q&A and a knowledge sharing platform for teams.
Prior to 1 ...)
+ TODO: check
+CVE-2026-57155 (OPNsense is a FreeBSD based firewall and routing platform.
Prior to ve ...)
+ TODO: check
+CVE-2026-55876 (Helium is a free online student planner for classes, homework,
grades, ...)
+ TODO: check
+CVE-2026-55875 (Helium is a free online student planner for classes, homework,
grades, ...)
+ TODO: check
+CVE-2026-55872 (GYM One is open-source gym management software for fitness
centers, pe ...)
+ TODO: check
+CVE-2026-55871 (GYM One is open-source gym management software for fitness
centers, pe ...)
+ TODO: check
+CVE-2026-55842 (Scoold is a Q&A and a knowledge sharing platform for teams.
Prior to 1 ...)
+ TODO: check
+CVE-2026-55840 (Scoold is a Q&A and a knowledge sharing platform for teams.
Prior to 1 ...)
+ TODO: check
+CVE-2026-55587 (AliasVault is a privacy-first password manager with built-in
email ali ...)
+ TODO: check
+CVE-2026-55467 (OpenPrinting CUPS is an open source printing system for Linux
and othe ...)
+ TODO: check
+CVE-2026-55414 (NL Portal Backend Libraries provide backend components for
Dutch gover ...)
+ TODO: check
+CVE-2026-55246 (bincookie is a header-only binarycookies parser. Prior to
0.1.9, binco ...)
+ TODO: check
+CVE-2026-55240 (Tianji is an open source analytics, uptime monitoring, and
server stat ...)
+ TODO: check
+CVE-2026-55239 (Tianji is an open source analytics, uptime monitoring, and
server stat ...)
+ TODO: check
+CVE-2026-55184 (EspoCRM is an open source customer relationship management
application ...)
+ TODO: check
+CVE-2026-55154 (EspoCRM is an open source customer relationship management
application ...)
+ TODO: check
+CVE-2026-55103 (Discourse ActivityPub adds ActivityPub support to Discourse.
Prior to ...)
+ TODO: check
+CVE-2026-54683 (NL Portal Backend Libraries provide backend components for
Dutch gover ...)
+ TODO: check
+CVE-2026-53882 (An improper link resolution before file access ('link
following') vuln ...)
+ TODO: check
+CVE-2026-53582 (OPNsense is a FreeBSD based firewall and routing platform.
Prior to ve ...)
+ TODO: check
+CVE-2026-53575 (EspoCRM is an open source customer relationship management
application ...)
+ TODO: check
+CVE-2026-53574 (EspoCRM is an open source customer relationship management
application ...)
+ TODO: check
+CVE-2026-52167 (A stack overflow in the gensub_ParsePsb() function of AOC
LC32D1320 v2 ...)
+ TODO: check
+CVE-2026-50619 (A path traversal vulnerability has been reported to affect
Qsirch. If ...)
+ TODO: check
+CVE-2026-50612 (An unix symbolic link (symlink) following vulnerability has
been repor ...)
+ TODO: check
+CVE-2026-47790 (A cross-site scripting (XSS) vulnerability has been reported
to affect ...)
+ TODO: check
+CVE-2026-47786 (An OS command injection vulnerability has been reported to
affect Hybr ...)
+ TODO: check
+CVE-2026-47218 (runwasi facilitates running Wasm and WASI workloads managed by
contain ...)
+ TODO: check
+CVE-2026-47168 (EspoCRM is an open source customer relationship management
application ...)
+ TODO: check
+CVE-2026-46708 (EspoCRM is an open source customer relationship management
application ...)
+ TODO: check
+CVE-2026-46694 (EspoCRM is an open source customer relationship management
application ...)
+ TODO: check
+CVE-2026-46691 (EspoCRM is an open source customer relationship management
application ...)
+ TODO: check
+CVE-2026-45452 (Use of Externally-Controlled format string vulnerability in
Unitronics ...)
+ TODO: check
+CVE-2026-45451 (: Improper Authentication vulnerability in Unitronics
Unitronics UniSt ...)
+ TODO: check
+CVE-2026-45450 (: Improper Restriction of Operations within the Bounds of a
Memory Buf ...)
+ TODO: check
+CVE-2026-45449 (: Improper Neutralization of Special Elements used in an OS
Command (' ...)
+ TODO: check
+CVE-2026-44084 (An authorization bypass through user-controlled key
vulnerability has ...)
+ TODO: check
+CVE-2026-41545 (A relative path traversal vulnerability has been reported to
affect Qu ...)
+ TODO: check
+CVE-2026-41544 (A path traversal vulnerability has been reported to affect
QcalAgent. ...)
+ TODO: check
+CVE-2026-41541 (An unix symbolic link (symlink) following vulnerability has
been repor ...)
+ TODO: check
+CVE-2026-39997 (A missing authentication for critical function vulnerability
has been ...)
+ TODO: check
+CVE-2026-39993 (A relative path traversal vulnerability has been reported to
affect Do ...)
+ TODO: check
+CVE-2026-39991 (A cross-site scripting (XSS) vulnerability has been reported
to affect ...)
+ TODO: check
+CVE-2026-39989 (A server-side request forgery (SSRF) vulnerability has been
reported t ...)
+ TODO: check
+CVE-2026-35088 (Slican telephone exchangesuse symmetric encryption for TCP/IP
communic ...)
+ TODO: check
+CVE-2026-34015 (A path traversal vulnerability has been reported to affect
Video Stati ...)
+ TODO: check
+CVE-2026-34014 (An incorrect permission assignment for critical resource
vulnerability ...)
+ TODO: check
+CVE-2026-34009 (An improper isolation or compartmentalization vulnerability
has been r ...)
+ TODO: check
+CVE-2026-34008 (An incorrect permission assignment for critical resource
vulnerability ...)
+ TODO: check
+CVE-2026-34007 (An OS command injection vulnerability has been reported to
affect Note ...)
+ TODO: check
+CVE-2026-34006 (A missing authentication for critical function vulnerability
has been ...)
+ TODO: check
+CVE-2026-26245 (A SQL injection vulnerability has been reported to affect
Video Statio ...)
+ TODO: check
+CVE-2026-26244 (A SQL injection vulnerability has been reported to affect
Video Statio ...)
+ TODO: check
+CVE-2026-26243 (A path traversal vulnerability has been reported to affect
Qsync Centr ...)
+ TODO: check
+CVE-2026-24723 (A NULL pointer dereference vulnerability has been reported to
affect F ...)
+ TODO: check
+CVE-2026-24722 (A NULL pointer dereference vulnerability has been reported to
affect F ...)
+ TODO: check
+CVE-2026-24721 (A NULL pointer dereference vulnerability has been reported to
affect F ...)
+ TODO: check
+CVE-2026-24718 (A path traversal vulnerability has been reported to affect
Qsync Centr ...)
+ TODO: check
+CVE-2026-24715 (An observable timing discrepancy vulnerability has been
reported to af ...)
+ TODO: check
+CVE-2026-22896 (A cross-site scripting (XSS) vulnerability has been reported
to affect ...)
+ TODO: check
+CVE-2026-19864 (Eclipse Jetty's `SessionAuthentication` retains authentication
credent ...)
+ TODO: check
+CVE-2026-19863 (An unauthenticated client may access certain protected
resources when ...)
+ TODO: check
+CVE-2026-19377 (Improper certificate validation in the tunnel handshake in
Cato Client ...)
+ TODO: check
+CVE-2026-18662 (In Eclipse Jetty, across various versions of `jetty-security`,
and `je ...)
+ TODO: check
+CVE-2026-18661 (In Eclipse Jetty, across various versions of
`jetty-annotations`, and ...)
+ TODO: check
+CVE-2026-18660 (In Eclipse Jetty, across various versions of `jetty-server`,
and `jett ...)
+ TODO: check
+CVE-2026-18659 (In Eclipse Jetty, across various versions of `jetty-security`,
and `je ...)
+ TODO: check
+CVE-2026-17525 (Incomplete cleanup vulnerability in ABB My Control System.
This issue ...)
+ TODO: check
+CVE-2026-16438 (Incorrect Privilege Assignment vulnerability in Mitsubishi
Electric GE ...)
+ TODO: check
+CVE-2026-16437 (Weak Password Recovery Mechanism for Forgotten Password
vulnerability ...)
+ TODO: check
+CVE-2026-16436 (Weak Password Recovery Mechanism for Forgotten Password
vulnerability ...)
+ TODO: check
+CVE-2026-111252 (A denial of service vulnerability exists in the XML parsing
of multipl ...)
+ TODO: check
+CVE-2026-111235 (An authorization bypass vulnerability exists in the REST API
of multip ...)
+ TODO: check
+CVE-2026-111234 (SimplePie through 1.9.0 contains a local file read
vulnerability that ...)
+ TODO: check
+CVE-2026-111233 (Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected
cross-site ...)
+ TODO: check
+CVE-2026-111232 (Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored
cross-site sc ...)
+ TODO: check
+CVE-2026-111231 (Netgate pfSense CE through 2.9.0 contains an authorization
bypass vuln ...)
+ TODO: check
+CVE-2026-111230 (Netgate pfSense CE through 2.9.0 contains a local file read
vulnerabil ...)
+ TODO: check
+CVE-2026-111229 (pfSense CE 2.7.0 through 2.9.0 contains a command injection
vulnerabil ...)
+ TODO: check
+CVE-2026-111228 (Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF
injection ...)
+ TODO: check
+CVE-2026-111227 (Netgate pfSense CE through 2.9.0 contains a CRLF injection
vulnerabili ...)
+ TODO: check
+CVE-2026-111226 (pfSense CE 2.4.5 through 2.9.0 contains an OS command
injection vulner ...)
+ TODO: check
+CVE-2026-111225 (Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command
injectio ...)
+ TODO: check
+CVE-2026-111224 (pfSense CE through 2.9.0 contains an OS command injection
vulnerabilit ...)
+ TODO: check
+CVE-2026-111223 (Netgate pfSense CE 2.7.0 through 2.9.0 contains a
configuration inject ...)
+ TODO: check
+CVE-2026-111222 (Netgate pfSense CE through 2.9.0 contains a php.ini injection
vulnerab ...)
+ TODO: check
+CVE-2026-111221 (Netgate pfSense CE through 2.9.0 contains a configuration
injection vu ...)
+ TODO: check
+CVE-2026-111220 (pfSense CE through 2.9.0 contains a crontab injection
vulnerability in ...)
+ TODO: check
+CVE-2026-111219 (Netgate pfSense CE through 2.9.0 contains a newline injection
vulnerab ...)
+ TODO: check
+CVE-2026-111218 (Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command
injectio ...)
+ TODO: check
+CVE-2026-111217 (Netgate pfSense CE through 2.9.0 contains an OS command
injection vuln ...)
+ TODO: check
+CVE-2026-111216 (Netgate pfSense CE through 2.9.0 contains an OS command
injection vuln ...)
+ TODO: check
+CVE-2026-111215 (Netgate pfSense CE through 2.9.0 contains an OS command
injection vuln ...)
+ TODO: check
+CVE-2026-111214 (Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command
injectio ...)
+ TODO: check
+CVE-2026-111172 (@casl/ability 6.7.5 before 7.0.2 contains a prototype
pollution vulner ...)
+ TODO: check
+CVE-2026-111171 (Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0
contains a ser ...)
+ TODO: check
+CVE-2026-111170 (kedro-datasets from 9.3.0 through 9.6.0 contains a path
traversal vuln ...)
+ TODO: check
+CVE-2026-111169 (La Suite Docs through 6.0.0 contains an authorization bypass
vulnerabi ...)
+ TODO: check
+CVE-2026-111168 (LibreDesk before 2.9.0-rc.8 contains a stored cross-site
scripting vul ...)
+ TODO: check
+CVE-2026-111167 (GNU LibreDWG through 0.14.8612 contains a global
out-of-bounds read vu ...)
+ TODO: check
+CVE-2026-111166 (libmikmod through 3.3.15 contains a heap out-of-bounds read
vulnerabil ...)
+ TODO: check
+CVE-2026-111165 (libmikmod through 3.3.15 contains a global out-of-bounds read
vulnerab ...)
+ TODO: check
+CVE-2026-111164 (UADE through 3.05 contains an out-of-bounds read
vulnerability in uade ...)
+ TODO: check
+CVE-2026-111163 (WildMIDI through 0.5.0 contains a heap out-of-bounds read
vulnerabilit ...)
+ TODO: check
+CVE-2026-111162 (WildMIDI through 0.5.0 contains a heap out-of-bounds read
vulnerabilit ...)
+ TODO: check
+CVE-2026-111161 (libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack
out-of-b ...)
+ TODO: check
+CVE-2026-111160 (LightLLM through 1.2.0 contains a denial of service
vulnerability that ...)
+ TODO: check
+CVE-2026-111159 (libewf through 20260924 contains a heap out-of-bounds read
vulnerabili ...)
+ TODO: check
+CVE-2026-111158 (EarthScope libmseed through 3.5.4 contains a heap
out-of-bounds read v ...)
+ TODO: check
+CVE-2026-111157 (SoX through 14.4.2 contains a heap out-of-bounds write
vulnerability i ...)
+ TODO: check
+CVE-2026-111156 (libTiMidity through 0.2.8 contains an out-of-bounds access
vulnerabili ...)
+ TODO: check
+CVE-2026-111155 (libTiMidity through 0.2.8 contains a heap out-of-bounds read
vulnerabi ...)
+ TODO: check
+CVE-2026-111154 (libTiMidity through 0.2.8 contains a stack out-of-bounds
write vulnera ...)
+ TODO: check
+CVE-2026-111153 (Game Music Emu (libgme) through 0.6.5 contains a global
out-of-bounds ...)
+ TODO: check
+CVE-2026-111152 (Game Music Emu (libgme) through 0.6.5 contains a heap
out-of-bounds re ...)
+ TODO: check
+CVE-2026-111151 (OpenJPH through 0.32.0 contains a heap out-of-bounds write
vulnerabili ...)
+ TODO: check
+CVE-2026-111150 (ValleyBell libvgm through commit a6eed945 contains a heap
out-of-bound ...)
+ TODO: check
+CVE-2026-111149 (FreeImage (danoli3 fork) through 3.19.23 contains a heap
out-of-bounds ...)
+ TODO: check
+CVE-2026-111148 (libsidplayfp through 3.1.1 contains a heap out-of-bounds read
vulnerab ...)
+ TODO: check
+CVE-2026-111147 (Libyal libesedb through 20260704 contains a heap
out-of-bounds read vu ...)
+ TODO: check
+CVE-2026-111146 (ytnef through 2.1.2 contains a heap out-of-bounds read
vulnerability i ...)
+ TODO: check
+CVE-2026-111145 (ytnef through 2.1.2 contains a heap out-of-bounds read
vulnerability i ...)
+ TODO: check
+CVE-2026-111144 (libansilove 1.3.0 through 1.4.2 contains a NULL pointer
dereference vu ...)
+ TODO: check
+CVE-2026-111143 (Ansilove libansilove through 1.4.2 contains an out-of-bounds
read vuln ...)
+ TODO: check
+CVE-2026-111142 (Zziplib through 0.13.80 contains an out-of-bounds read
vulnerability i ...)
+ TODO: check
+CVE-2026-111141 (zziplib through 0.13.80 contains an out-of-bounds read
vulnerability i ...)
+ TODO: check
+CVE-2026-111140 (libregf through 20260526 contains a heap out-of-bounds read
in libregf ...)
+ TODO: check
+CVE-2026-111139 (NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read
vulnerab ...)
+ TODO: check
+CVE-2026-111138 (NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read
vulnerab ...)
+ TODO: check
+CVE-2026-111137 (libsmi through 0.5.0 contains an out-of-bounds write
vulnerability in ...)
+ TODO: check
+CVE-2026-111136 (libInstPatch through 1.1.7 contains a heap out-of-bounds
write vulnera ...)
+ TODO: check
+CVE-2026-111135 (libfwsi through 20260522 contains a heap out-of-bounds read
vulnerabil ...)
+ TODO: check
+CVE-2026-111134 (libfwsi through 20260522 contains a heap out-of-bounds read
vulnerabil ...)
+ TODO: check
+CVE-2026-111133 (libfsapfs through 20260921 contains an integer underflow in
libfsapfs_ ...)
+ TODO: check
+CVE-2026-111132 (GNOME libgxps through 0.3.2 contains a heap out-of-bounds
read in path ...)
+ TODO: check
+CVE-2026-111131 (libxmp through 4.7.4 contains an off-by-one stack
out-of-bounds read v ...)
+ TODO: check
+CVE-2026-111130 (OpenSlide through 4.0.1 contains a heap out-of-bounds read
vulnerabili ...)
+ TODO: check
+CVE-2026-111129 (Open Asset Import Library (assimp) through 6.0.5 contains a
NULL point ...)
+ TODO: check
+CVE-2026-111128 (Assimp through 6.0.5 contains a NULL pointer dereference
vulnerability ...)
+ TODO: check
+CVE-2026-111127 (catdoc through 0.95 contains an out-of-bounds read
vulnerability in co ...)
+ TODO: check
+CVE-2026-111126 (catdoc through 0.95 contains an out-of-bounds read
vulnerability in th ...)
+ TODO: check
+CVE-2026-111125 (CFITSIO through 4.7.0 contains a heap-based out-of-bounds
read vulnera ...)
+ TODO: check
+CVE-2026-111124 (CFITSIO through 4.7.0 contains a heap-based out-of-bounds
read vulnera ...)
+ TODO: check
+CVE-2026-111123 (FluidSynth through 2.6.1 contains an out-of-bounds write
vulnerability ...)
+ TODO: check
+CVE-2026-111105 (Telegram rlottie Numeric Truncation Remote Code Execution
Vulnerabilit ...)
+ TODO: check
+CVE-2026-111096 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8
stored XSS ...)
+ TODO: check
+CVE-2026-111095 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8
stored XSS ...)
+ TODO: check
+CVE-2026-111094 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8
remote code ...)
+ TODO: check
+CVE-2026-111093 (In JetBrains Datalore before 2026.2.1 unauthenticated path
traversal v ...)
+ TODO: check
+CVE-2026-111092 (In JetBrains YouTrack before 2026.2.19575 2026.3.16075
2026.3.16397 20 ...)
+ TODO: check
+CVE-2026-111091 (In JetBrains Junie CLI before 26.8.3 code execution was
possible via a ...)
+ TODO: check
+CVE-2026-110958 (A vulnerability was found in Wavlink WN530HG4B
M30HG4B_V260724. The im ...)
+ TODO: check
+CVE-2026-110957 (A vulnerability has been found in Wavlink WL-WN530BE2-A up to
M30BE2_V ...)
+ TODO: check
+CVE-2026-110936 (A vulnerability has been identified in Siemens Software
Center (All ve ...)
+ TODO: check
+CVE-2026-110927 (A flaw was found in OpenSSH. After compression is negotiated,
a compre ...)
+ TODO: check
+CVE-2026-110924 (A flaw was found in OpenSSH. With GSSAPI authentication
enabled, a fai ...)
+ TODO: check
+CVE-2026-110891 (Missing Authorization vulnerability in WordLift Srl WordLift
wordlift ...)
+ TODO: check
+CVE-2026-110890 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-110888 (Missing Authorization vulnerability in Meow Apps AI Engine
ai-engine a ...)
+ TODO: check
+CVE-2026-110878 (Aureus ERP through 1.6.0 contains a stored cross-site
scripting vulner ...)
+ TODO: check
+CVE-2026-110877 (AdPlug through 2.4 contains a heap out-of-bounds read
vulnerability in ...)
+ TODO: check
+CVE-2026-110876 (AdPlug through 2.4 contains an out-of-bounds read
vulnerability in src ...)
+ TODO: check
+CVE-2026-110875 (AdPlug through 2.4 contains a heap-based buffer overflow in
CksmPlayer ...)
+ TODO: check
+CVE-2026-110874 (Dolibarr before 23.0.4 contains a PHP object injection
vulnerability i ...)
+ TODO: check
+CVE-2026-110812 (Deserialization of untrusted data in the Gremlin graph data
import com ...)
+ TODO: check
+CVE-2026-110746 (A local privilege escalation vulnerability in TotalAV allows
an unpriv ...)
+ TODO: check
+CVE-2026-110726 (In `api-gateway` versions till `1.7.3`, The default
rate-limit key res ...)
+ TODO: check
+CVE-2026-110724 (In `api-gateway` versions till `1.7.3`, The default
rate-limit key res ...)
+ TODO: check
+CVE-2026-110723 (In `api-gateway` versions till `1.7.3`, The default
rate-limit key res ...)
+ TODO: check
+CVE-2026-110381 (Authorization Bypass Through User-Controlled Key
vulnerability in NSqu ...)
+ TODO: check
+CVE-2026-110378 (Missing Authorization vulnerability in WP E-Signature Ninja
Forms Sign ...)
+ TODO: check
+CVE-2026-110375 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-110374 (Missing Authorization vulnerability in Hamid Alinia Login
with phone n ...)
+ TODO: check
+CVE-2026-110371 (Missing Authorization vulnerability in WP Chill Strong
Testimonials st ...)
+ TODO: check
+CVE-2026-110367 (Missing Authorization vulnerability in WPExperts APIExperts
Square for ...)
+ TODO: check
+CVE-2026-110364 (Missing Authorization vulnerability in WP Desk Flexible
Quantity \u201 ...)
+ TODO: check
+CVE-2026-110362 (Missing Authorization vulnerability in Planet studio
PlanetStudio Paym ...)
+ TODO: check
+CVE-2026-110361 (Insertion of Sensitive Information Into Sent Data
vulnerability in Cli ...)
+ TODO: check
+CVE-2026-110360 (Missing Authorization vulnerability in WPdreams Ajax Search
Lite ajax- ...)
+ TODO: check
+CVE-2026-109932 (undici is an HTTP client library for Node.js. In versions
5.15.0 throu ...)
+ TODO: check
+CVE-2026-109924 (undici is an HTTP client library for Node.js. In versions
6.5.0 throug ...)
+ TODO: check
+CVE-2026-109897 (Missing Authorization vulnerability in WP Chill Strong
Testimonials st ...)
+ TODO: check
+CVE-2026-109893 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-109892 (Incorrect Privilege Assignment vulnerability in Shabti Kaplan
Frontend ...)
+ TODO: check
+CVE-2026-109869 (undici is an HTTP client library for Node.js. In versions
6.23.0 throu ...)
+ TODO: check
+CVE-2026-109855 (undici is an HTTP client library for Node.js. In versions
8.11.0 and 8 ...)
+ TODO: check
+CVE-2026-109841 (undici is an HTTP client library for Node.js. In versions
7.15.0 throu ...)
+ TODO: check
+CVE-2026-109829 (undici is an HTTP client library for Node.js. In versions
7.0.0 throug ...)
+ TODO: check
+CVE-2026-109702 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-109698 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-109695 (Insertion of Sensitive Information Into Sent Data
vulnerability in WPM ...)
+ TODO: check
+CVE-2026-109694 (Incorrect Privilege Assignment vulnerability in WP
ManageNinja LLC Flu ...)
+ TODO: check
+CVE-2026-109693 (Incorrect Privilege Assignment vulnerability in WP
ManageNinja LLC Flu ...)
+ TODO: check
+CVE-2026-109692 (Missing Authorization vulnerability in ThemeGrill User
Registration us ...)
+ TODO: check
+CVE-2026-109689 (Missing Authorization vulnerability in WP Sunshine Sunshine
Photo Cart ...)
+ TODO: check
+CVE-2026-109688 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-109686 (Deserialization of Untrusted Data vulnerability in Link
Whisper INC Li ...)
+ TODO: check
+CVE-2026-109685 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-109449 (InSymfony Expression Language versions prior to 5.4.54,
6.4.48, 7.4.21 ...)
+ TODO: check
+CVE-2026-109413 (In Symfony YAML prior to versions5.4.54,6.4.45,7.4.18,
and8.1.6,Yaml\P ...)
+ TODO: check
+CVE-2026-109383 (undici is an HTTP client library for Node.js. In versions
4.0.0 throug ...)
+ TODO: check
+CVE-2026-109131 (The Hub collection module documentation renderer in the
unified Ansibl ...)
+ TODO: check
+CVE-2026-108499 (Missing Authorization vulnerability in WebberZone Knowledge
Base knowl ...)
+ TODO: check
+CVE-2026-108498 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-108497 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-108491 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-108334 (A flaw was found in the internal WebAssembly (WASM) shim used
by the K ...)
+ TODO: check
+CVE-2026-108175 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-108116 (In Progress Kendo UI for jQuery prior to v2026.3.1015,
specially craft ...)
+ TODO: check
+CVE-2026-108092 (The Blog2Social \u2013 Social Media Auto Post & Scheduler
plugin for W ...)
+ TODO: check
+CVE-2026-108082 (Symfony is a PHP framework for web and console applications
and a set ...)
+ TODO: check
+CVE-2026-107416 (Authorization Bypass Through User-Controlled Key
vulnerability in Webb ...)
+ TODO: check
+CVE-2026-106707 (XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site
Scripting (XSS) ...)
+ TODO: check
+CVE-2026-106706 (XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored
cross-site scri ...)
+ TODO: check
+CVE-2026-106701 (ELADMIN v2.7 and before is vulnerable to Cross Site Scripting
(XSS) vi ...)
+ TODO: check
+CVE-2026-106604 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-106163 (In Progress\xae Kendo\xae UI for jQuery versions starting
with v2023.1 ...)
+ TODO: check
+CVE-2026-106162 (In Progress\xae Kendo\xae UI for jQuery versions starting
with 2023.3. ...)
+ TODO: check
+CVE-2026-106161 (In Progress\xae Kendo\xae UI for jQuery releases starting
with v2020.1 ...)
+ TODO: check
+CVE-2026-106160 (In Progress\xae Kendo\xae UI for jQuery prior to 2026.3.1015,
Model.ac ...)
+ TODO: check
+CVE-2026-106159 (In Progress\xae Kendo\xae UI for jQuery versions starting
with 2022.3. ...)
+ TODO: check
+CVE-2026-106158 (In Progress\xae Kendo\xae UI for jQuery, in v2026.3.811 and
earlier, t ...)
+ TODO: check
+CVE-2026-106157 (In Progress\xae Kendo\xae UI for jQuery versions starting
with 2019.2. ...)
+ TODO: check
+CVE-2026-106153 (In Progress\xae Kendo\xae UI for jQuery prior to version
2026.3.1015, ...)
+ TODO: check
+CVE-2026-106151 (In Progress\xae Kendo\xae UI for jQuery versions starting
with 2012.2. ...)
+ TODO: check
+CVE-2026-106150 (In Progress\xae Kendo\xae UI for jQuery prior to 2026.3.1015,
the Spli ...)
+ TODO: check
+CVE-2026-106149 (In Progress\xae Kendo\xae UI for jQuery prior to
v2026.3.1015, the Men ...)
+ TODO: check
+CVE-2026-106148 (In Progress\xae Kendo\xae UI for jQuery prior to 2026.3.1015,
the TabS ...)
+ TODO: check
+CVE-2026-106147 (In Progress\xae Kendo\xae UI for jQuery releases starting
with R1 2020 ...)
+ TODO: check
+CVE-2026-105882 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-105660 (Improper Validation of Syntactic Correctness of Input
vulnerability in ...)
+ TODO: check
+CVE-2026-105474 (A server-side template injection exists in SolusVM 2 up to
version 2.0 ...)
+ TODO: check
+CVE-2026-105271 ("\u30b2\u30aa\u30a2\u30d7\u30ea" provided by GEO CORPORATION
contains ...)
+ TODO: check
+CVE-2026-105065 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-104828 (HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to
5.4.0, H ...)
+ TODO: check
+CVE-2026-104827 (react/http is an event-driven, streaming HTTP client and
server implem ...)
+ TODO: check
+CVE-2026-104618 (On request the `sdbootutil` script creates a world-readable
debug log ...)
+ TODO: check
+CVE-2026-104617 (There are two invocations of `qrencode` to display a QR code
for scann ...)
+ TODO: check
+CVE-2026-104586 (AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains
an OS Comm ...)
+ TODO: check
+CVE-2026-104266 (tinytag is a Python library for reading audio file metadata.
From 2.0. ...)
+ TODO: check
+CVE-2026-104150 (AdonisJS HTTP Server is a package for handling HTTP requests
in the Ad ...)
+ TODO: check
+CVE-2026-104025 (Path Traversal (CWE-22) in the execute_obj function of the
archive obj ...)
+ TODO: check
+CVE-2026-104024 (Incomplete List of Disallowed Inputs (CWE-184) in the
dangerous-extens ...)
+ TODO: check
+CVE-2026-103936 (libp2p is a JavaScript implementation of the libp2p
networking stack. ...)
+ TODO: check
+CVE-2026-103509 (P4 Search (formerly Helix Search) returns stored credentials
in cleart ...)
+ TODO: check
+CVE-2026-103508 (P4 Search (formerly Helix Search) allows an authenticated
user holding ...)
+ TODO: check
+CVE-2026-103350 (Improper Validation of Specified Quantity in Input
vulnerability in Ma ...)
+ TODO: check
+CVE-2026-103224 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-103223 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-103083 (Authorization Bypass Through User-Controlled Key
vulnerability in ELEX ...)
+ TODO: check
+CVE-2026-102946 (joserfc is a Python library that provides an implementation
of several ...)
+ TODO: check
+CVE-2026-102740 (The AsyncHttpClient library allows Java applications to
execute HTTP r ...)
+ TODO: check
+CVE-2026-102631 (In authd before 0.7.1, the user identity matching in
UpdateUser (inter ...)
+ TODO: check
+CVE-2026-102527 (Nuxt OG Image generates OG Images with Vue templates in Nuxt.
From 6.2 ...)
+ TODO: check
+CVE-2026-102477 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-102475 (In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or
[5.2.0, ...)
+ TODO: check
+CVE-2026-102469 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-102467 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-102466 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-102465 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-102464 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-102463 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-102462 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-102461 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
+ TODO: check
+CVE-2026-102389 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
+ TODO: check
+CVE-2026-101311 (The framebuffer device model's maximum resolution constants
were dupli ...)
+ TODO: check
+CVE-2026-101310 (The HDA audio device model did not check for zero-length
Buffer Descri ...)
+ TODO: check
+CVE-2026-101309 (The xHCI (USB 3) device model did not validate or save the
event ring ...)
+ TODO: check
+CVE-2026-101308 (When an audio channel's buffer needs to be resized, the
sound(4) drive ...)
+ TODO: check
+CVE-2026-101307 (When the PCM sample array needs to grow, the RACK stack
doubles a 16-b ...)
+ TODO: check
+CVE-2026-101303 (The IPv6 UDP send path for unconnected sockets did not apply
the jail ...)
+ TODO: check
+CVE-2026-101290 (A remote attacker may send a specially crafted network packet
that cau ...)
+ TODO: check
+CVE-2026-101287 (Authentication bypass vulnerability in Stela, versions prior
to 1.60.1 ...)
+ TODO: check
+CVE-2026-100409 (OpenNext Cloudflare is an open Next.js adapter for
Cloudflare. From 0. ...)
+ TODO: check
+CVE-2026-100354 (kin-openapi is a Go project for handling OpenAPI files. Prior
to 0.149 ...)
+ TODO: check
+CVE-2026-100353 (kin-openapi is a Go project for handling OpenAPI files. From
0.136.0 u ...)
+ TODO: check
+CVE-2026-100352 (kin-openapi is a Go project for handling OpenAPI files. Prior
to 0.148 ...)
+ TODO: check
+CVE-2026-100351 (kin-openapi is a Go project for handling OpenAPI files. From
0.144.0 u ...)
+ TODO: check
+CVE-2026-100350 (kin-openapi is a Go project for handling OpenAPI files. From
0.145.0 u ...)
+ TODO: check
+CVE-2026-100349 (kin-openapi is a Go project for handling OpenAPI files. Prior
to 0.146 ...)
+ TODO: check
+CVE-2026-100348 (kin-openapi is a Go project for handling OpenAPI files. Prior
to 0.145 ...)
+ TODO: check
+CVE-2026-100347 (kin-openapi is a Go project for handling OpenAPI files. Prior
to 0.145 ...)
+ TODO: check
+CVE-2025-68404 (A time-of-check time-of-use (toctou) race condition
vulnerability has ...)
+ TODO: check
+CVE-2025-68403 (An external control of system or configuration setting
vulnerability h ...)
+ TODO: check
+CVE-2025-66275 (A path traversal vulnerability has been reported to affect
Video Stati ...)
+ TODO: check
+CVE-2025-66272 (A path traversal vulnerability has been reported to affect
Video Stati ...)
+ TODO: check
+CVE-2025-29897 (A buffer copy without checking size of input vulnerability has
been re ...)
+ TODO: check
+CVE-2025-29896 (A NULL pointer dereference vulnerability has been reported to
affect Q ...)
+ TODO: check
+CVE-2025-23390 (A vulnerability has been identified within Fleet where, by
default, Fl ...)
+ TODO: check
+CVE-2024-22031 (A vulnerability has been identified within Rancher where a
user with t ...)
+ TODO: check
+CVE-2023-32198 (A vulnerability has been identified in Steve where by default
it was u ...)
+ TODO: check
+CVE-2026-99999 (In the Linux kernel, the following vulnerability has been
resolved: i ...)
- linux <unfixed>
NOTE:
https://git.kernel.org/linus/6785011f8b16abf40b1e9d8b2e332232b3e68822 (7.3-rc7)
-CVE-2026-98432 [ipv4: free inet_opt and ireq_opt after an RCU grace period]
+CVE-2026-98432 (In the Linux kernel, the following vulnerability has been
resolved: i ...)
- linux 7.2.10-1
NOTE:
https://git.kernel.org/linus/e3f33b0a1d89d738e2b913dab519226eaf76e15b (7.3-rc7)
CVE-2026-96540 (An improper access control vulnerability has been identified
in the So ...)
@@ -5400,78 +6136,115 @@ CVE-2026-87864
NOTE: Introduced with:
https://github.com/curl/curl/commit/f8c8c76d39ac2fa825481ba42ab2247cd122f963
(curl-7_30_0)
NOTE: Fixed by:
https://github.com/curl/curl/commit/3b547de301342b347fb3c6ea6ae7979070793a66
(curl-8_22_0)
CVE-2026-110152 (Buffer overflow in ANGLE in Google Chrome on on Android prior
to 155.0 ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110149 (Use after free in Browser in Google Chrome prior to
155.0.8059.79 allo ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110136 (Use after free in PDF in Google Chrome prior to 155.0.8059.79
allowed ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110161 (Use after free in Network in Google Chrome prior to
155.0.8059.79 allo ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110165 (Use after free in Core in Google Chrome on on Android prior
to 155.0.8 ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110148 (Use after free in SVG in Google Chrome prior to 155.0.8059.79
allowed ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110151 (Use after free in Media in Google Chrome prior to
155.0.8059.79 allowe ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110162 (Use after free in Desktop in Google Chrome prior to
155.0.8059.79 allo ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110170 (Use after free in Bindings in Google Chrome prior to
155.0.8059.79 all ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110160 (Missing authorization in ReadingMode in Google Chrome prior
to 155.0.8 ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110143 (Use of uninitialized variable in ThirdParty lmza_sdk in
Google Chrome ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110146 (Information leak in Passwords in Google Chrome prior to
155.0.8059.79 ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110150 (Privilege elevation in Installer in Google Chrome on on
Windows prior ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110156 (Incorrect reference resolution in Extensions in Google Chrome
on on Ma ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110137 (Use after free in WebRTC in Google Chrome prior to
155.0.8059.79 allow ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110140 (Type confusion in V8 in Google Chrome prior to 155.0.8059.79
allowed a ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110158 (Use after free in Passwords in Google Chrome prior to
155.0.8059.79 al ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110145 (Use after free in Passwords in Google Chrome prior to
155.0.8059.79 al ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110159 (Incorrect authorization in Updater in Google Chrome prior to
155.0.805 ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110144 (Incorrect authorization in Mojo in Google Chrome on on
Windows prior t ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110153 (Use after free in Media in Google Chrome prior to
155.0.8059.79 allowe ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110166 (Buffer overflow in Animation in Google Chrome prior to
155.0.8059.79 a ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110169 (Use after free in V8 in Google Chrome prior to 155.0.8059.79
allowed a ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110168 (Use after free in V8 in Google Chrome prior to 155.0.8059.79
allowed a ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110139 (Use after free in Media in Google Chrome prior to
155.0.8059.79 allowe ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110172 (Use after free in Media in Google Chrome prior to
155.0.8059.79 allowe ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110164 (Use after free in DOM in Google Chrome prior to 155.0.8059.79
allowed ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110163 (Use after free in DOM in Google Chrome prior to 155.0.8059.79
allowed ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110141 (Observable discrepancy in Media in Google Chrome prior to
155.0.8059.7 ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110138 (Use after free in ShapeDetection in Google Chrome prior to
155.0.8059. ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110157 (Use after free in SVG in Google Chrome prior to 155.0.8059.79
allowed ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110147 (Use after free in PDF in Google Chrome prior to 155.0.8059.79
allowed ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110154 (Use after free in Canvas in Google Chrome prior to
155.0.8059.79 allow ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110155 (Buffer overflow in PDFium in Google Chrome prior to
155.0.8059.79 allo ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110167 (Use after free in Media in Google Chrome prior to
155.0.8059.79 allowe ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110171 (Use after free in Media in Google Chrome prior to
155.0.8059.79 allowe ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-110142 (Use after free in FileSystem in Google Chrome prior to
155.0.8059.79 a ...)
+ {DSA-6562-1}
- chromium 155.0.8059.79-1
CVE-2026-109117
- oath-toolkit 2.6.15-1
@@ -6474,11 +7247,11 @@ CVE-2024-34320 (ProPhoenix Law RMS v2022.2403.3.101 was
discovered to contain an
CVE-2024-34319 (A Server-Side Request Forgery (SSRF) in the serviceURL
parameter of Pr ...)
TODO: check
CVE-2026-109783 (Mitigation bypass in the File Handling component. This
vulnerability w ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox-esr 153.5.0esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109783
CVE-2026-109782 (Mitigation bypass in the File Handling component. This
vulnerability w ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox-esr 153.5.0esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109782
CVE-2026-109704 (Privilege escalation in the Application Update component.
This vulnera ...)
@@ -6489,7 +7262,7 @@ CVE-2026-109704 (Privilege escalation in the Application
Update component. This
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109704
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109704
CVE-2026-109705 (Sandbox escape, site isolation issue due to incorrect
boundary conditi ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6497,7 +7270,7 @@ CVE-2026-109705 (Sandbox escape, site isolation issue due
to incorrect boundary
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109705
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109705
CVE-2026-109706 (Use-after-free in the Storage: IndexedDB component. This
vulnerability ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6505,7 +7278,7 @@ CVE-2026-109706 (Use-after-free in the Storage: IndexedDB
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109706
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109706
CVE-2026-109707 (Sandbox escape due to use-after-free in the Networking
component. This ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6513,7 +7286,7 @@ CVE-2026-109707 (Sandbox escape due to use-after-free in
the Networking componen
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109707
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109707
CVE-2026-109708 (Sandbox escape due to incorrect boundary conditions in the
Networking ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6521,7 +7294,7 @@ CVE-2026-109708 (Sandbox escape due to incorrect boundary
conditions in the Netw
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109708
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109708
CVE-2026-109709 (Information disclosure, privilege escalation in the Security:
Process ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6529,7 +7302,7 @@ CVE-2026-109709 (Information disclosure, privilege
escalation in the Security: P
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109709
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109709
CVE-2026-109710 (Use-after-free in the Graphics: Text component. This
vulnerability was ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6537,7 +7310,7 @@ CVE-2026-109710 (Use-after-free in the Graphics: Text
component. This vulnerabil
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109710
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109710
CVE-2026-109711 (Use-after-free in the Graphics: Canvas2D component. This
vulnerability ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6545,7 +7318,7 @@ CVE-2026-109711 (Use-after-free in the Graphics: Canvas2D
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109711
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109711
CVE-2026-109712 (Sandbox escape due to uninitialized memory in the Graphics
component. ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6553,7 +7326,7 @@ CVE-2026-109712 (Sandbox escape due to uninitialized
memory in the Graphics comp
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109712
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109712
CVE-2026-109713 (Use-after-free in the Crash Reporting component. This
vulnerability wa ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6564,7 +7337,7 @@ CVE-2026-109714 (Incorrect boundary conditions in the
Layout component. This vul
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109714
CVE-2026-109715 (Incorrect boundary conditions in the JavaScript Engine
component. This ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6572,7 +7345,7 @@ CVE-2026-109715 (Incorrect boundary conditions in the
JavaScript Engine componen
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109715
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109715
CVE-2026-109716 (Incorrect boundary conditions in the JavaScript Engine
component. This ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6580,7 +7353,7 @@ CVE-2026-109716 (Incorrect boundary conditions in the
JavaScript Engine componen
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109716
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109716
CVE-2026-109717 (Use-after-free in the DOM: Bindings (WebIDL) component. This
vulnerabi ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6588,7 +7361,7 @@ CVE-2026-109717 (Use-after-free in the DOM: Bindings
(WebIDL) component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109717
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109717
CVE-2026-109718 (Use-after-free in the XML component. This vulnerability was
fixed in F ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6596,7 +7369,7 @@ CVE-2026-109718 (Use-after-free in the XML component.
This vulnerability was fix
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109718
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109718
CVE-2026-109719 (Race condition, use-after-free in the Graphics: CanvasWebGL
component. ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6604,7 +7377,7 @@ CVE-2026-109719 (Race condition, use-after-free in the
Graphics: CanvasWebGL com
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109719
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109719
CVE-2026-109720 (JIT miscompilation in the JavaScript: WebAssembly component.
This vuln ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6612,7 +7385,7 @@ CVE-2026-109720 (JIT miscompilation in the JavaScript:
WebAssembly component. Th
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109720
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109720
CVE-2026-109721 (Incorrect boundary conditions in the JavaScript Engine: JIT
component. ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6620,7 +7393,7 @@ CVE-2026-109721 (Incorrect boundary conditions in the
JavaScript Engine: JIT com
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109721
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109721
CVE-2026-109722 (JIT miscompilation in the JavaScript Engine: JIT component.
This vulne ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6628,7 +7401,7 @@ CVE-2026-109722 (JIT miscompilation in the JavaScript
Engine: JIT component. Thi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109722
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109722
CVE-2026-109723 (Integer overflow in the Layout: Text and Fonts component.
This vulnera ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6636,7 +7409,7 @@ CVE-2026-109723 (Integer overflow in the Layout: Text and
Fonts component. This
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109723
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109723
CVE-2026-109724 (Use-after-free in the DOM: Core & HTML component. This
vulnerability w ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6644,14 +7417,14 @@ CVE-2026-109724 (Use-after-free in the DOM: Core & HTML
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109724
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109724
CVE-2026-109725 (Use-after-free in the DOM: Core & HTML component. This
vulnerability w ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109725
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109725
CVE-2026-109726 (Use-after-free in the SVG component. This vulnerability was
fixed in F ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6659,7 +7432,7 @@ CVE-2026-109726 (Use-after-free in the SVG component.
This vulnerability was fix
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109726
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109726
CVE-2026-109727 (Use-after-free in the Audio/Video component. This
vulnerability was fi ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6667,7 +7440,7 @@ CVE-2026-109727 (Use-after-free in the Audio/Video
component. This vulnerability
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109727
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109727
CVE-2026-109728 (Use-after-free in the DOM: Animation component. This
vulnerability was ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6675,7 +7448,7 @@ CVE-2026-109728 (Use-after-free in the DOM: Animation
component. This vulnerabil
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109728
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109728
CVE-2026-109729 (Use-after-free in the JavaScript Engine: JIT component. This
vulnerabi ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6683,7 +7456,7 @@ CVE-2026-109729 (Use-after-free in the JavaScript Engine:
JIT component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109729
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109729
CVE-2026-109730 (Integer overflow in the Graphics component. This
vulnerability was fix ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6691,7 +7464,7 @@ CVE-2026-109730 (Integer overflow in the Graphics
component. This vulnerability
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109730
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109730
CVE-2026-109731 (Incorrect boundary conditions in the Graphics: Canvas2D
component. Thi ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6699,7 +7472,7 @@ CVE-2026-109731 (Incorrect boundary conditions in the
Graphics: Canvas2D compone
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109731
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109731
CVE-2026-109732 (Use-after-free in the DOM: Streams component. This
vulnerability was f ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6707,7 +7480,7 @@ CVE-2026-109732 (Use-after-free in the DOM: Streams
component. This vulnerabilit
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109732
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109732
CVE-2026-109733 (JIT miscompilation in the JavaScript Engine: JIT component.
This vulne ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6715,7 +7488,7 @@ CVE-2026-109733 (JIT miscompilation in the JavaScript
Engine: JIT component. Thi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109733
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109733
CVE-2026-109734 (Mitigation bypass in the DOM: Security component. This
vulnerability w ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6726,7 +7499,7 @@ CVE-2026-109735 (Use-after-free in the DOM: Animation
component. This vulnerabil
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109735
CVE-2026-109736 (Frame poisoning in the Layout component. This vulnerability
was fixed ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6734,7 +7507,7 @@ CVE-2026-109736 (Frame poisoning in the Layout component.
This vulnerability was
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109736
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109736
CVE-2026-109737 (Mitigation bypass in the Enterprise Policies component. This
vulnerabi ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6742,7 +7515,7 @@ CVE-2026-109737 (Mitigation bypass in the Enterprise
Policies component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109737
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109737
CVE-2026-109738 (Use-after-free in the Audio/Video: Playback component. This
vulnerabil ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6760,7 +7533,7 @@ CVE-2026-109740 (Sandbox escape due to incorrect boundary
conditions in the Widg
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109740
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109740
CVE-2026-109741 (Use-after-free in the Storage: Bucket File System component.
This vuln ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6768,7 +7541,7 @@ CVE-2026-109741 (Use-after-free in the Storage: Bucket
File System component. Th
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109741
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109741
CVE-2026-109742 (Information disclosure in the PDF Viewer component. This
vulnerability ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6776,7 +7549,7 @@ CVE-2026-109742 (Information disclosure in the PDF Viewer
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109742
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109742
CVE-2026-109743 (Privilege escalation in the Panning and Zooming component.
This vulner ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6784,7 +7557,7 @@ CVE-2026-109743 (Privilege escalation in the Panning and
Zooming component. This
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109743
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109743
CVE-2026-109744 (Other issue in the DOM: File component. This vulnerability
was fixed i ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6792,7 +7565,7 @@ CVE-2026-109744 (Other issue in the DOM: File component.
This vulnerability was
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109744
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109744
CVE-2026-109745 (Sandbox escape due to uninitialized memory in the DOM: Web
Serial comp ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6815,7 +7588,7 @@ CVE-2026-109750 (Site isolation issue in the DOM: Web
Authentication component.
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109750
CVE-2026-109751 (Information disclosure in the Networking component. This
vulnerability ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6823,7 +7596,7 @@ CVE-2026-109751 (Information disclosure in the Networking
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109751
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109751
CVE-2026-109752 (Use-after-free in the DOM: Workers component. This
vulnerability was f ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6831,7 +7604,7 @@ CVE-2026-109752 (Use-after-free in the DOM: Workers
component. This vulnerabilit
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109752
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109752
CVE-2026-109753 (Incorrect boundary conditions in the Layout component. This
vulnerabil ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6839,7 +7612,7 @@ CVE-2026-109753 (Incorrect boundary conditions in the
Layout component. This vul
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109753
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109753
CVE-2026-109754 (Incorrect boundary conditions in the DOM: Editor component.
This vulne ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6850,7 +7623,7 @@ CVE-2026-109755 (Sandbox escape in the DOM: Content
Processes component. This vu
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109755
CVE-2026-109756 (Privilege escalation in the DOM: Navigation component. This
vulnerabil ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6858,7 +7631,7 @@ CVE-2026-109756 (Privilege escalation in the DOM:
Navigation component. This vul
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109756
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109756
CVE-2026-109757 (Sandbox escape due to race condition in the Networking
component. This ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6866,7 +7639,7 @@ CVE-2026-109757 (Sandbox escape due to race condition in
the Networking componen
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109757
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109757
CVE-2026-109759 (Site isolation issue in the Networking component. This
vulnerability w ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6874,7 +7647,7 @@ CVE-2026-109759 (Site isolation issue in the Networking
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109759
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109759
CVE-2026-109760 (Mitigation bypass in the Networking: HTTP component. This
vulnerabilit ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6885,7 +7658,7 @@ CVE-2026-109761 (Use-after-free in the JavaScript:
WebAssembly component. This v
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109761
CVE-2026-109762 (Incorrect boundary conditions in the SVG component. This
vulnerability ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6893,7 +7666,7 @@ CVE-2026-109762 (Incorrect boundary conditions in the SVG
component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109762
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109762
CVE-2026-109763 (Mitigation bypass in the File Handling component. This
vulnerability w ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6901,7 +7674,7 @@ CVE-2026-109763 (Mitigation bypass in the File Handling
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109763
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109763
CVE-2026-109764 (Mitigation bypass in the Enterprise Policies component. This
vulnerabi ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6909,7 +7682,7 @@ CVE-2026-109764 (Mitigation bypass in the Enterprise
Policies component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109764
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109764
CVE-2026-109765 (Race condition, use-after-free in the Graphics: Text
component. This v ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6917,7 +7690,7 @@ CVE-2026-109765 (Race condition, use-after-free in the
Graphics: Text component.
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109765
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109765
CVE-2026-109766 (Mitigation bypass in the Enterprise Policies component. This
vulnerabi ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6925,7 +7698,7 @@ CVE-2026-109766 (Mitigation bypass in the Enterprise
Policies component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109766
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109766
CVE-2026-109767 (Information disclosure in the Networking component. This
vulnerability ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6939,7 +7712,7 @@ CVE-2026-109769 (Information disclosure in the
Networking: Cache component. This
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109769
CVE-2026-109770 (Spoofing issue in the DOM: Web Serial component. This
vulnerability wa ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6959,7 +7732,7 @@ CVE-2026-109774 (Invalid pointer, undefined behavior in
the DOM: Notifications c
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109774
CVE-2026-109775 (Denial-of-service in the WebRTC component. This vulnerability
was fixe ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6967,7 +7740,7 @@ CVE-2026-109775 (Denial-of-service in the WebRTC
component. This vulnerability w
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109775
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109775
CVE-2026-109776 (Race condition in the XPCOM component. This vulnerability was
fixed in ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6975,7 +7748,7 @@ CVE-2026-109776 (Race condition in the XPCOM component.
This vulnerability was f
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109776
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109776
CVE-2026-109777 (Information disclosure in the Storage: IndexedDB component.
This vulne ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6983,7 +7756,7 @@ CVE-2026-109777 (Information disclosure in the Storage:
IndexedDB component. Thi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109777
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109777
CVE-2026-109778 (Privilege escalation in the WebExtensions component. This
vulnerabilit ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -6997,7 +7770,7 @@ CVE-2026-109780 (Mitigation bypass in the DOM: Core &
HTML component. This vulne
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109780
CVE-2026-109781 (Denial-of-service in the Printing: Output component. This
vulnerabilit ...)
- {DSA-6560-1}
+ {DSA-6560-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird <unfixed>
@@ -11517,7 +12290,7 @@ CVE-2026-107565 (A flaw was found in luksmeta. A local
attacker with administrat
NOTE: Fixed by:
https://github.com/latchset/luksmeta/commit/ba140c8f628237ed12e47e9829fec9c62fc5f89a
CVE-2026-107510 (An authenticated high privilege user can inject arguments in
troublesh ...)
NOT-FOR-US: Infoblox NIOS
-CVE-2026-107503 (Unvalidated environments URL allows OAuth authorization code
+ PKCE ve ...)
+CVE-2026-107503 (In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7,
the Ditt ...)
NOT-FOR-US: Eclipse
CVE-2026-107406 (Memory overflow vulnerability leading to Remote Code
Execution or Deni ...)
NOT-FOR-US: NetScaler
@@ -13892,7 +14665,7 @@ CVE-2026-39785 (Improper Neutralization of Special
Elements used in an SQL Comma
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39784 (Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <=
3.8 ver ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-39781 (Unauthenticated Cross Site Scripting (XSS) in Document Gallery
<= 5.1. ...)
+CVE-2026-39781 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39780 (Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7
version ...)
NOT-FOR-US: WordPress plugin or theme
@@ -16221,7 +16994,7 @@ CVE-2026-0461 (Insufficient boundary validation in the
USB boot mode implementat
NOT-FOR-US: AMD
CVE-2026-104380 (Punk versions from 0.48 before 0.55 for Perl route Extended
CONNECT re ...)
NOT-FOR-US: Punk Perl module
-CVE-2026-55480
+CVE-2026-55480 (OpenPrinting CUPS is an open source printing system for Linux
and othe ...)
- cups <unfixed> (bug #1150561)
NOTE:
https://github.com/OpenPrinting/cups/security/advisories/GHSA-jj94-x3qh-ffp9
NOTE: Fixed by:
https://github.com/OpenPrinting/cups/commit/98adfd855950e806508f961d5438ad32e26aac62
(v2.4.20)
@@ -16229,7 +17002,7 @@ CVE-2026-XXXX [GHSA-7j85-5r23-xhvh: Unauthenticated
read-only IPP attribute filt
- cups <unfixed>
NOTE:
https://github.com/OpenPrinting/cups/security/advisories/GHSA-7j85-5r23-xhvh
NOTE: Fixed by:
https://github.com/OpenPrinting/cups/commit/d641482ad909243bc331ebe5308297cd81a557b3
(v2.4.20
-CVE-2026-61702
+CVE-2026-61702 (OpenPrinting CUPS is an open source printing system for Linux
and othe ...)
- cups <unfixed> (bug #1150562)
NOTE:
https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g
NOTE: Fixed by:
https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3
(v2.4.20)
@@ -16249,7 +17022,7 @@ CVE-2026-107890 (OpenPrinting CUPS before 2.4.20
contains a NULL pointer derefer
- cups <unfixed> (bug #1150559)
NOTE:
https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x
NOTE: Fixed by:
https://github.com/OpenPrinting/cups/commit/f3fb41912e4e29dbbbe7c4afd4fe48508af21bc0
(v2.4.20)
-CVE-2026-55453
+CVE-2026-55453 (OpenPrinting CUPS is an open source printing system for Linux
and othe ...)
- cups <unfixed> (bug #1150560)
NOTE:
https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v
NOTE: Fixed by:
https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a
(v2.4.20)
@@ -21996,7 +22769,7 @@ CVE-2026-103229 (A vulnerability was found in
AdithyaYelloju Restaurant-Manageme
NOT-FOR-US: AdithyaYelloju Restaurant-Management-System
CVE-2026-103227 (A weakness has been identified in GPAC up to 26.07.0.
Affected by this ...)
- gpac <removed>
-CVE-2026-103226 (A vulnerability was identified in Artifex Ghostscript up to
10.09.0. A ...)
+CVE-2026-103226 (A vulnerability was identified in Artifex Ghostscript up to
10.07.0. A ...)
{DSA-6550-1}
- ghostscript 10.08.0~dfsg-1
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=709672
@@ -33121,12 +33894,12 @@ CVE-2016-15059 (Net::IDN::Punycode versions before
2.301 for Perl allow a heap b
NOTE: https://lists.security.metacpan.org/cve-announce/msg/43753031/
NOTE: https://rt.cpan.org/Ticket/Display.html?id=118924
NOTE: Fixed by:
https://github.com/robrwo/Net-IDN-Encode/commit/9a3ba07f15d22c0347eefee9625b012cbc803657
(Net-IDN-Encode-2.303)
-CVE-2026-93484 [ZSA-2026-15]
+CVE-2026-93484 (Znuny through 7.3.6 constructs a ticket-search database query
by direc ...)
- znuny 6.5.25-1
[trixie] - znuny <no-dsa> (Non-free not supported)
[bookworm] - znuny <ignored> (Non-free not supported)
NOTE: https://www.znuny.org/en/advisories/zsa-2026-15
-CVE-2026-93483 [ZSA-2026-14]
+CVE-2026-93483 (In Znuny through 7.3.6, an attacker can bypass specific
standard login ...)
- znuny 6.5.25-1
[trixie] - znuny <no-dsa> (Non-free not supported)
[bookworm] - znuny <ignored> (Non-free not supported)
@@ -49911,6 +50684,7 @@ CVE-2025-57231 (Path Traversal in avatar attachments in
Docmost v0.21.0 allows a
CVE-2025-15695 (The Translate WordPress with GTranslate WordPress plugin
before 3.0.10 ...)
NOT-FOR-US: WordPress plugin
CVE-2026-88914 (A flaw was found in GStreamer's gst-plugins-good isomp4
plugin. When p ...)
+ {DLA-4837-1}
- gst-plugins-good1.0 1.28.7-1
[trixie] - gst-plugins-good1.0 <no-dsa> (Minor issue)
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0079.html
@@ -73699,6 +74473,7 @@ CVE-2026-18300 (GIMP HDR File Parsing Integer Overflow
Remote Code Execution Vul
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-26-453/
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/gegl/-/commit/d3d262008299341c5b032b354021632ceadb2799
CVE-2026-18299 (GStreamer rtpsbcdepay Use-After-Free Remote Code Execution
Vulnerabili ...)
+ {DLA-4837-1}
- gst-plugins-good1.0 1.28.5-1
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0051.html
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042
@@ -73709,6 +74484,7 @@ CVE-2026-18299 (GStreamer rtpsbcdepay Use-After-Free
Remote Code Execution Vulne
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/223becb0e39d6178c215cb8a2b956686b701c314
(1.28.5)
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/3745e22c706054822d9e25fa2b3cdfb83127e40c
(1.28.5)
CVE-2026-18298 (GStreamer PNG File Parsing Heap-based Buffer Overflow Remote
Code Exec ...)
+ {DLA-4837-1}
- gst-plugins-good1.0 1.28.5-1
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0052.html
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043
@@ -86951,6 +87727,7 @@ CVE-2026-73490 (Loofah is a general library for
manipulating and transforming HT
NOTE: https://github.com/flavorjones/loofah/pull/308
NOTE: Fixed by:
https://github.com/flavorjones/loofah/commit/20867b9be689521887364b74822c41ef830523c9
(v2.25.2)
CVE-2026-73434 (A flaw was found in GStreamer gst-plugins-good (avidemux). In
gst_avi_ ...)
+ {DLA-4837-1}
- gst-plugins-good1.0 1.28.6-1
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12241
@@ -86962,6 +87739,7 @@ CVE-2026-73434 (A flaw was found in GStreamer
gst-plugins-good (avidemux). In gs
NOTE: Fixed by:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c429d2a33496b54b8e6c00dbf1fdc4e3f52d8481
(1.26.8)
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0072.html
CVE-2026-73433 (A flaw was found in GStreamer gst-plugins-good (avidemux).
When parsin ...)
+ {DLA-4837-1}
- gst-plugins-good1.0 1.28.6-1
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12241
@@ -103125,6 +103903,7 @@ CVE-2026-18029 (Our payment integration with
GiroCheckout did not properly valid
CVE-2026-18028 (The "quick setup" view presented to users after they first
create an ...)
NOT-FOR-US: rami.io products
CVE-2026-17072 (A flaw was found in GStreamer's gst-plugins-good. A heap-based
out-of- ...)
+ {DLA-4837-1}
- gst-plugins-good1.0 1.28.6-1
[trixie] - gst-plugins-good1.0 <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2506750
@@ -132069,7 +132848,7 @@ CVE-2026-9086 (A flaw was found in Keycloak. A remote
attacker with administrati
- keycloak <itp> (bug #1088287)
CVE-2026-9083 (A flaw was found in Keycloak. A realm administrator with the
"manage-r ...)
- keycloak <itp> (bug #1088287)
-CVE-2026-6432 (Improper bounds validation in EmberZNet SDK versions 9.0.2 and
earlier ...)
+CVE-2026-6432 (Improper bounds validation in the ZAP command parser of
EmberZNet SDK ...)
NOT-FOR-US: Silicon Labs
CVE-2026-6291 (Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When
decrypti ...)
- wolfssl 5.9.2-1 (bug #1140765)
@@ -140485,13 +141264,13 @@ CVE-2026-46331 (In the Linux kernel, the following
vulnerability has been resolv
NOTE:
https://git.kernel.org/linus/899ee91156e57784090c5565e4f31bd7dbffbc5a (7.1-rc7)
NOTE: https://github.com/sgkdev/packet_edit_meme
CVE-2026-39043
- {DSA-6359-1}
+ {DSA-6359-1 DLA-4837-1}
- gst-plugins-good1.0 1.28.2-1
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0022.html
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8647118624fd14983507edbb509d0e534a0353a9
(main)
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/6db6dd058ebc3607452311b7dc47b0359b40b293
(1.28)
CVE-2026-39044
- {DSA-6359-1}
+ {DSA-6359-1 DLA-4837-1}
- gst-plugins-good1.0 1.28.2-1
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0021.html
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/83becc83eac477ecb97171f8278b0047dd7b6d5f
(main)
@@ -141181,6 +141960,7 @@ CVE-2026-52717
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/b99a3d8d5c1c3f508f3eaa220a369175c614c7cd
(1.26 branch)
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11819 (1.24
branch)
CVE-2026-53705 (A flaw was found in GStreamer's WavPack audio decoder in
gst-plugins-g ...)
+ {DLA-4837-1}
- gst-plugins-good1.0 1.28.4-1
[trixie] - gst-plugins-good1.0 <no-dsa> (Minor issue)
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0035.html
@@ -202930,13 +203710,13 @@ CVE-2026-3086 (GStreamer H.266 Codec Parser
Out-Of-Bounds Write Remote Code Exec
NOTE: Fixed by:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/aa1f5a80085ef65154a982dd3b23181100265c7e
(main)
NOTE: Fixed by:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/a2edc745bfea8835186a264c5e666be93f65a38e
(1.28.1)
CVE-2026-3083 (GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code
Execution Vulne ...)
- {DSA-6359-1}
+ {DSA-6359-1 DLA-4837-1}
- gst-plugins-good1.0 1.28.1-1
[bullseye] - gst-plugins-good1.0 <postponed> (Minor issue, obsolete
codec, dropped upstream as a fix)
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0008.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8349cdd35f85246e113b18e55fd11abf9cb248bf
(main)
CVE-2026-3085 (GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code
Executio ...)
- {DSA-6359-1}
+ {DSA-6359-1 DLA-4837-1}
- gst-plugins-good1.0 1.28.1-1
[bullseye] - gst-plugins-good1.0 <postponed> (Minor issue, obsolete
codec, dropped upstream as a fix)
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0008.html
@@ -202983,7 +203763,7 @@ CVE-2026-2921 (GStreamer RIFF Palette Integer
Overflow Remote Code Execution Vul
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0004.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/66d1f79c78b573db714434cf08e7531bed4f4473
(main)
CVE-2026-1940 (An incomplete fix for CVE-2024-47778 allows an out-of-bounds
read in g ...)
- {DSA-6359-1}
+ {DSA-6359-1 DLA-4837-1}
- gst-plugins-good1.0 1.28.1-1
[bullseye] - gst-plugins-good1.0 <postponed> (Minor issue, OOB read)
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0001.html
@@ -285473,7 +286253,7 @@ CVE-2025-47219 (In GStreamer through 1.26.1, the
isomp4 plugin's qtdemux_parse_t
CVE-2025-47188 (A vulnerability in the Mitel 6800 Series, 6900 Series, and
6900w Serie ...)
NOT-FOR-US: Mitel
CVE-2025-47183 (In GStreamer through 1.26.1, the isomp4 plugin's
qtdemux_parse_tree fu ...)
- {DLA-4419-1}
+ {DLA-4837-1 DLA-4419-1}
- gst-plugins-good1.0 1.26.2-1
NOTE:
https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md
NOTE: https://gstreamer.freedesktop.org/security/sa-2025-0005.html
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/79d7ea5b6ee891efbb76247812984bb1023d4871
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/79d7ea5b6ee891efbb76247812984bb1023d4871
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
