Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
4309abf2 by security tracker role at 2026-10-16T07:14:14+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,4 +1,540 @@
-CVE-2026-104715
+CVE-2026-97640 (The WPConsent \u2013 Cookie Banner & Cookie Consent for
Privacy Compli ...)
+ TODO: check
+CVE-2026-97339 (The Complianz GDPR/CCPA Cookie Consent Banner plugin for
WordPress is ...)
+ TODO: check
+CVE-2026-97296 (Deserialization of Untrusted Data vulnerability in
Rocketgenius, Inc G ...)
+ TODO: check
+CVE-2026-96806 (The Apache Airflow Keycloak auth manager did not end the
session on lo ...)
+ TODO: check
+CVE-2026-96570 (The Schema & Structured Data for WP & AMP plugin for WordPress
is vuln ...)
+ TODO: check
+CVE-2026-96562 (The The Broken Link Checker plugin for WordPress is vulnerable
to arbi ...)
+ TODO: check
+CVE-2026-96339 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-95809 (The Opti-Behavior \u2013 Self-Hosted Heatmaps, Session
Recordings, Fun ...)
+ TODO: check
+CVE-2026-95686 (The Opti-Behavior \u2013 Self-Hosted Heatmaps, Session
Recordings, Fun ...)
+ TODO: check
+CVE-2026-94388 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-94169 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
+ TODO: check
+CVE-2026-94135 (The Apache Airflow SFTP provider's deferrable code paths
(`SFTPTrigger ...)
+ TODO: check
+CVE-2026-94134 (The Apache Airflow SSH provider hook disables SSH host-key
verificatio ...)
+ TODO: check
+CVE-2026-93953 (The Backuply \u2013 Backup, Restore, Migrate and Clone plugin
for Word ...)
+ TODO: check
+CVE-2026-93767 (The Tainacan plugin for WordPress is vulnerable to Directory
Traversal ...)
+ TODO: check
+CVE-2026-93535 (The Dark Mode \u2013 Improve Accessibility with AI Powered
Dark Theme ...)
+ TODO: check
+CVE-2026-92777 (A potential vulnerability was reported in some Lenovo Tablets
that cou ...)
+ TODO: check
+CVE-2026-92629 (A potential improper authorization vulnerability was reported
in Lenov ...)
+ TODO: check
+CVE-2026-92553 (The YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking &
Reports pl ...)
+ TODO: check
+CVE-2026-92427 (The Coinsnap Bitcoin Crowdfunding WordPress plugin through
1.2.0 does ...)
+ TODO: check
+CVE-2026-92228 (The Apache Airflow Keycloak provider's multi-team provisioning
(`_atta ...)
+ TODO: check
+CVE-2026-92115 (The WP Photo Album Plus plugin for WordPress is vulnerable to
authenti ...)
+ TODO: check
+CVE-2026-91833 (The WX Subscribe
\u5fae\u4fe1\u652f\u4ed8\u4ed8\u8d39\u8ba2\u9605 Wor ...)
+ TODO: check
+CVE-2026-91830 (The Subscribe to Comments WordPress plugin before 2.3.3 does
not sign ...)
+ TODO: check
+CVE-2026-8311
+ REJECTED
+CVE-2026-89280 (The Dokan: AI Powered WooCommerce Multivendor Marketplace
Solution \u2 ...)
+ TODO: check
+CVE-2026-89079 (The Theme My Login plugin for WordPress is vulnerable to
privilege esc ...)
+ TODO: check
+CVE-2026-89062 (A potential out-of-bounds write vulnerability was reported in
the Leno ...)
+ TODO: check
+CVE-2026-89057 (A potential authentication bypass vulnerability was reported
in some L ...)
+ TODO: check
+CVE-2026-89051 (The WP Ghost (Hide My WP Ghost) \u2013 Security & Firewall
plugin for ...)
+ TODO: check
+CVE-2026-88963 (The Tutor LMS \u2013 eLearning and online course solution
plugin for W ...)
+ TODO: check
+CVE-2026-85659 (The PilotPress plugin for WordPress is vulnerable to Privilege
Escalat ...)
+ TODO: check
+CVE-2026-84823 (A flaw was found in WildFly. A user with the `Monitor` role,
which is ...)
+ TODO: check
+CVE-2026-77829 (The Cooked \u2013 Recipe Management plugin for WordPress is
vulnerable ...)
+ TODO: check
+CVE-2026-75941 (A potential vulnerability was reported in the Lenovo Legion
Zone appli ...)
+ TODO: check
+CVE-2026-74923 (The Document Gallery WordPress plugin through 5.1.1 does not
perform a ...)
+ TODO: check
+CVE-2026-5819
+ REJECTED
+CVE-2026-45165 (An authorization flaw in Idira Conjur version 13.9.0 allows an
authent ...)
+ TODO: check
+CVE-2026-36436 (An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP
credenti ...)
+ TODO: check
+CVE-2026-2937
+ REJECTED
+CVE-2026-19867 (Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1,
11.8.x <= 11 ...)
+ TODO: check
+CVE-2026-19798 (The Wp Map Block plugin for WordPress is vulnerable to
unauthorized mo ...)
+ TODO: check
+CVE-2026-19603 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x
<= 11.7 ...)
+ TODO: check
+CVE-2026-19601 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x
<= 11.7 ...)
+ TODO: check
+CVE-2026-19541 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x
<= 11.7 ...)
+ TODO: check
+CVE-2026-18795 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
+ TODO: check
+CVE-2026-18551 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
+ TODO: check
+CVE-2026-16755 (A potential vulnerability was reported in Lenovo Smart Camera
C33, dis ...)
+ TODO: check
+CVE-2026-16754 (A potential improper certificate validation vulnerability was
reported ...)
+ TODO: check
+CVE-2026-15222 (The The User Registration & Membership \u2013 Free & Paid
Memberships, ...)
+ TODO: check
+CVE-2026-12272 (The Lightweight Cookie Notice \u2013 Cookie Banner for Cookie
Consent ...)
+ TODO: check
+CVE-2026-111458 (The fanx_fingerprint function in ssl/sslxprint.c of ssldump
allocates ...)
+ TODO: check
+CVE-2026-111451 (Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or
escapes cal ...)
+ TODO: check
+CVE-2026-111450 (Wheels through 4.1.1 derives its default production
error-email addres ...)
+ TODO: check
+CVE-2026-111449 (Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions
when allow ...)
+ TODO: check
+CVE-2026-111448 (Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons
in path-c ...)
+ TODO: check
+CVE-2026-111447 (Wheels 1.1 through 4.1.2 resolves nestedProperties() records
by posted ...)
+ TODO: check
+CVE-2026-111446 (Wheels 4.0.0 through 4.1.2 exposes password-less development
tools und ...)
+ TODO: check
+CVE-2026-111445 (Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming
scope condit ...)
+ TODO: check
+CVE-2026-111444 (Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB
with backsl ...)
+ TODO: check
+CVE-2026-111443 (Wheels 4.0.6 through 4.1.2 lets an unauthenticated client
switch a req ...)
+ TODO: check
+CVE-2026-111442 (Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before
1.34.6 does n ...)
+ TODO: check
+CVE-2026-111389 (Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and
16.x before ...)
+ TODO: check
+CVE-2026-111388 (Frappe Framework before 15.120.0 and 16.x before 16.33.0 does
not enfo ...)
+ TODO: check
+CVE-2026-111387 (Nezha from 2.2.5 before 2.3.15 contains an information
disclosure vuln ...)
+ TODO: check
+CVE-2026-111386 (Nezha from 1.7.0 before 2.3.15 contains an information
disclosure vuln ...)
+ TODO: check
+CVE-2026-111385 (Nezha from 2.1.0 before 2.3.15 contains a host header
injection vulner ...)
+ TODO: check
+CVE-2026-111384 (Nezha 1.0.0 before 2.3.15 contains a memory exhaustion
vulnerability i ...)
+ TODO: check
+CVE-2026-111383 (Nezha from 2.0.13 before 2.3.15 contains a resource
exhaustion vulnera ...)
+ TODO: check
+CVE-2026-111382 (FreeRDP before 3.32.0 contains a client-side heap
out-of-bounds write ...)
+ TODO: check
+CVE-2026-111381 (FreeRDP before 3.32.0 contains a heap buffer overflow
vulnerability in ...)
+ TODO: check
+CVE-2026-111380 (FreeRDP from 3.29.0 before 3.32.0 contains an integer
overflow in the ...)
+ TODO: check
+CVE-2026-111379 (FreeRDP before 3.32.0 contains a heap buffer overflow
vulnerability in ...)
+ TODO: check
+CVE-2026-111378 (FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled
resource con ...)
+ TODO: check
+CVE-2026-111377 (FreeRDP from 2.0.0 before 3.32.0 contains an unbounded
reassembly vuln ...)
+ TODO: check
+CVE-2026-111376 (FreeRDP from 3.30.0 before 3.32.0 contains a heap
out-of-bounds read v ...)
+ TODO: check
+CVE-2026-111375 (FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds
read vulner ...)
+ TODO: check
+CVE-2026-111374 (FreeRDP from 3.30.0 before 3.32.0 contains a resource
exhaustion vulne ...)
+ TODO: check
+CVE-2026-111373 (FreeRDP before 3.32.0 contains a NULL pointer dereference
vulnerabilit ...)
+ TODO: check
+CVE-2026-111369 (ClassroomIO through 1.0.0 contains an incorrect authorization
vulnerab ...)
+ TODO: check
+CVE-2026-111368 (ClassroomIO through 1.0.0 contains an insecure direct object
reference ...)
+ TODO: check
+CVE-2026-111367 (BillionMail through 4.9 contains a hard-coded cryptographic
key vulner ...)
+ TODO: check
+CVE-2026-111366 (cool-admin-midway through 8.0.0 contains an authorization
bypass vulne ...)
+ TODO: check
+CVE-2026-111365 (cool-admin-midway through 8.0.0 contains an authorization
bypass vulne ...)
+ TODO: check
+CVE-2026-111364 (MinDoc through 2.2-beta.2 contains an insecure direct object
reference ...)
+ TODO: check
+CVE-2026-111363 (BISHENG through 3.0.0-beta4 contains an insecure direct
object referen ...)
+ TODO: check
+CVE-2026-111359 (CRMEB 5.6.1 through 6.0.0 contains an insecure direct object
reference ...)
+ TODO: check
+CVE-2026-111358 (SendPortal sendportal-core through 4.0.1 contains an
authorization byp ...)
+ TODO: check
+CVE-2026-111357 (Ivanti Connect Secure 22.8R2.4 mishandles the manner in which
the dsin ...)
+ TODO: check
+CVE-2026-111356 (MacCMS v10 through 2026.1000.4056 does not limit attempts on
the six-d ...)
+ TODO: check
+CVE-2026-111355 (zhontai Admin.Core through 10.1.0 contains an authorization
bypass vul ...)
+ TODO: check
+CVE-2026-111354 (crmeb_java through 3.1 contains an authorization bypass
vulnerability ...)
+ TODO: check
+CVE-2026-111353 (Peppermint through 0.5.5 contains a missing authorization
vulnerabilit ...)
+ TODO: check
+CVE-2026-111352 (ThinkCMF through 8.0.1 contains an incorrect authorization
vulnerabili ...)
+ TODO: check
+CVE-2026-111351 (metasfresh through 5.175 contains a missing record-level
authorization ...)
+ TODO: check
+CVE-2026-111350 (Papermark through 0.22.0 contains a missing authorization
vulnerabilit ...)
+ TODO: check
+CVE-2026-111349 (Craftplan through 0.7.5 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-111348 (Likeshop through 3.5.1 contains an insecure direct object
reference vu ...)
+ TODO: check
+CVE-2026-111347 (go-ldap-admin through 0.6.2 embeds a hard-coded RSA private
key, publi ...)
+ TODO: check
+CVE-2026-111346 (ZenTao PMS through 22.6 contains an authorization bypass
vulnerability ...)
+ TODO: check
+CVE-2026-111345 (Trudesk through 1.2.11 contains an authorization bypass
vulnerability ...)
+ TODO: check
+CVE-2026-111344 (APITable through 1.14.0-beta contains an authorization bypass
vulnerab ...)
+ TODO: check
+CVE-2026-111343 (pig through 4.1.1 contains a missing authorization
vulnerability in Sy ...)
+ TODO: check
+CVE-2026-111332 (OxiCloud 0.9.1 through 0.9.3 contains an incorrect
authorization vulne ...)
+ TODO: check
+CVE-2026-111331 (Dokploy through 0.30.8 contains a cross-organization
authorization byp ...)
+ TODO: check
+CVE-2026-111330 (JuggleIM im-server through 1.8.16 contains a weak password
hashing vul ...)
+ TODO: check
+CVE-2026-111329 (JuggleIM im-server through 1.8.16 ships default administrator
credenti ...)
+ TODO: check
+CVE-2026-111324 (rustdesk-api through 2.7 contains an authorization bypass
vulnerabilit ...)
+ TODO: check
+CVE-2026-111323 (RedAmon through 7.0.1 contains an unauthenticated server-side
request ...)
+ TODO: check
+CVE-2026-111322 (Archon 0.2.13 through 0.11.1 contains a missing
authentication vulnera ...)
+ TODO: check
+CVE-2026-111321 (TaskingAI through 0.3.0 contains a server-side request
forgery vulnera ...)
+ TODO: check
+CVE-2026-111320 (ValueCell through 0.1.20 contains an unauthenticated
server-side reque ...)
+ TODO: check
+CVE-2026-111313 (JobOps through 0.13.1 contains a server-side request forgery
vulnerabi ...)
+ TODO: check
+CVE-2026-111312 (OpenHealth through 0.2.0 contains a missing authentication
and authori ...)
+ TODO: check
+CVE-2026-111284 (Aureus ERP through 1.6.0 contains a stored cross-site
scripting vulner ...)
+ TODO: check
+CVE-2026-111283 (BMC Helix Network Management on-prem before 26.3.01 contains
an authen ...)
+ TODO: check
+CVE-2026-111282 (Driftregion iso14229 before 0.10.1 contains an integer
wraparound in H ...)
+ TODO: check
+CVE-2026-111281 (Jooan JA-A12 IP cameras with firmware 009_20171107 and
05.02.31.105 co ...)
+ TODO: check
+CVE-2026-111280 (snap7 through 1.4.3 contains an out-of-bounds write
vulnerability in T ...)
+ TODO: check
+CVE-2026-111279 (Dragonfly through 2.0.2 contains an unbounded memory
allocation vulner ...)
+ TODO: check
+CVE-2026-111278 (NivoCart through 2.5.1 contains a CAPTCHA bypass
vulnerability that al ...)
+ TODO: check
+CVE-2026-111277 (NivoCart through 2.5.1 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-111275 (nifti_clib through 3.0.1 contains a stack-based out-of-bounds
read and ...)
+ TODO: check
+CVE-2026-111274 (unarr through 1.1.1 contains a heap-based out-of-bounds read
in zip_pa ...)
+ TODO: check
+CVE-2026-111273 (unarr through 1.1.1 contains an off-by-one heap-based buffer
overflow ...)
+ TODO: check
+CVE-2026-111272 (LibRaw through 0.22.2 contains a heap-based out-of-bounds
read in LibR ...)
+ TODO: check
+CVE-2026-111271 (libmodplug through 0.8.9.1 contains a heap-based
out-of-bounds read vu ...)
+ TODO: check
+CVE-2026-111270 (libmodplug through 0.8.9.1 contains a heap-based
out-of-bounds write i ...)
+ TODO: check
+CVE-2026-111269 (libical through 4.0.6 contains a heap-based out-of-bounds
read in ical ...)
+ TODO: check
+CVE-2026-111237 (A weakness has been identified in Ultralytics FastSAM up to
b4ed20c2fe ...)
+ TODO: check
+CVE-2026-111212 (A security flaw has been discovered in ImprintLab
Medical-SAM-Adapter ...)
+ TODO: check
+CVE-2026-111210 (A vulnerability was determined in bitcoinj up to 0.17.
Affected is the ...)
+ TODO: check
+CVE-2026-111178 (The WP Booking System \u2013 Booking Calendar plugin for
WordPress is ...)
+ TODO: check
+CVE-2026-111122 (The SiteOrigin CSS plugin for WordPress is vulnerable to
Stored DOM-Ba ...)
+ TODO: check
+CVE-2026-111114 (The Nexter Extension \u2013 Security, Performance, Code
Snippets & Sit ...)
+ TODO: check
+CVE-2026-111106 (The Mail Mint plugin for WordPress is vulnerable to SQL
Injection via ...)
+ TODO: check
+CVE-2026-111069 (The GeoDirectory \u2013 WP Business Directory Plugin and
Classified Li ...)
+ TODO: check
+CVE-2026-110922 (Use after free in Prerender in Google Chrome prior to
155.0.8059.84 al ...)
+ TODO: check
+CVE-2026-110921 (Use after free in V8 in Google Chrome prior to 155.0.8059.84
allowed a ...)
+ TODO: check
+CVE-2026-110920 (Memory corruption in V8 in Google Chrome prior to
155.0.8059.84 allowe ...)
+ TODO: check
+CVE-2026-110919 (Use after free in V8 in Google Chrome prior to 155.0.8059.84
allowed a ...)
+ TODO: check
+CVE-2026-110918 (Memory corruption in Core in Google Chrome prior to
155.0.8059.84 allo ...)
+ TODO: check
+CVE-2026-110917 (Memory corruption in SVG in Google Chrome prior to
155.0.8059.84 allow ...)
+ TODO: check
+CVE-2026-110916 (Improper input validation in Desktop in Google Chrome prior
to 155.0.8 ...)
+ TODO: check
+CVE-2026-110915 (Use after free in Compositing in Google Chrome prior to
155.0.8059.84 ...)
+ TODO: check
+CVE-2026-110914 (Memory corruption in Workers in Google Chrome prior to
155.0.8059.84 a ...)
+ TODO: check
+CVE-2026-110913 (Memory corruption in DOM in Google Chrome prior to
155.0.8059.84 allow ...)
+ TODO: check
+CVE-2026-110721 (The NotificationX plugin for WordPress is vulnerable to
Missing Author ...)
+ TODO: check
+CVE-2026-110701 (The CP Multi View Events Calendar plugin for WordPress is
vulnerable t ...)
+ TODO: check
+CVE-2026-110664 (The Premium Packages \u2013 Sell Digital Products Securely
plugin for ...)
+ TODO: check
+CVE-2026-110590 (The Klarna for WooCommerce plugin for WordPress is vulnerable
to autho ...)
+ TODO: check
+CVE-2026-110366 (Missing Authorization vulnerability in Gemini Labs Site
Reviews site-r ...)
+ TODO: check
+CVE-2026-110290 (The WebberZone Top 10 \u2014 Popular Posts plugin for
WordPress is vul ...)
+ TODO: check
+CVE-2026-110252 (The WPeMatico RSS Feed Fetcher plugin for WordPress is
vulnerable to S ...)
+ TODO: check
+CVE-2026-110191 (The Product Delivery Date for WooCommerce WordPress plugin
before 3.3 ...)
+ TODO: check
+CVE-2026-110179 (The affiliate-toolkit WordPress plugin before 3.8.9 does not
validate ...)
+ TODO: check
+CVE-2026-110135 (The OTP Login & Register Woocommerce WordPress plugin before
2.7.3 doe ...)
+ TODO: check
+CVE-2026-110039 (The Smush WordPress plugin before 4.3.4 does not restrict
changes to ...)
+ TODO: check
+CVE-2026-110019 (The Bulk Page Generator \u2013 LPagery plugin for WordPress
is vulnera ...)
+ TODO: check
+CVE-2026-110017 (The Quick PayPal Payments: Payment Button & Form plugin for
WordPress ...)
+ TODO: check
+CVE-2026-110015 (The Salon Booking System WordPress plugin before 10.31.9
does not cor ...)
+ TODO: check
+CVE-2026-110014 (The Salon Booking System WordPress plugin before 10.31.9
does not pro ...)
+ TODO: check
+CVE-2026-110013 (The Salon Booking System WordPress plugin before 10.31.9
does not gen ...)
+ TODO: check
+CVE-2026-110012 (The Salon Booking System WordPress plugin before 10.31.3
does not res ...)
+ TODO: check
+CVE-2026-109998 (The Mang Board plugin for WordPress is vulnerable to Stored
Cross-Site ...)
+ TODO: check
+CVE-2026-109990 (The Flying Scripts: Delay JavaScript to Improve Site Speed &
Performan ...)
+ TODO: check
+CVE-2026-109982 (The MB Custom Post Types & Custom Taxonomies WordPress plugin
before 2 ...)
+ TODO: check
+CVE-2026-109813 (A hard-coded cryptographic key vulnerability exists in the
`/usr/bin/s ...)
+ TODO: check
+CVE-2026-109812 (A missing authorization vulnerability exists in the internal
API `/api ...)
+ TODO: check
+CVE-2026-109515 (The MailOptin \u2013 Popup, Optin Forms & Email Newsletters
for Mailch ...)
+ TODO: check
+CVE-2026-109513 (The NotificationX \u2013 FOMO, Live Sales Notification,
WooCommerce Sa ...)
+ TODO: check
+CVE-2026-109512 (The Mang Board plugin for WordPress is vulnerable to Stored
Cross-Site ...)
+ TODO: check
+CVE-2026-109468 (Allocation of resources without limits or throttling in
ASP.NET Core a ...)
+ TODO: check
+CVE-2026-109447 (The User Profile Builder \u2013 Beautiful User Registration
Forms, Use ...)
+ TODO: check
+CVE-2026-109414 (The Vitepos \u2013 Point of Sale (POS) for WooCommerce plugin
for Word ...)
+ TODO: check
+CVE-2026-109401 (The WP Mail Logging plugin for WordPress is vulnerable to
Sensitive In ...)
+ TODO: check
+CVE-2026-109400 (The InstaWP Connect \u2013 1-click WP Staging & Migration
plugin for W ...)
+ TODO: check
+CVE-2026-109388 (The HivePress \u2013 Business Directory, Listings &
Classified Ads Plu ...)
+ TODO: check
+CVE-2026-109382 (The WSP MCP AI Agents Connector plugin for WordPress is
vulnerable to ...)
+ TODO: check
+CVE-2026-109232 (The Salon Booking System \u2013 Appointment Booking for
Salons, Barber ...)
+ TODO: check
+CVE-2026-109221 (The Groundhogg \u2014 CRM, Newsletters, and Marketing
Automation plugi ...)
+ TODO: check
+CVE-2026-109219 (The Mang Board plugin for WordPress is vulnerable to
Arbitrary File Up ...)
+ TODO: check
+CVE-2026-109207 (The RSS Aggregator by Feedzy \u2013 Feed to Post,
Autoblogging, News & ...)
+ TODO: check
+CVE-2026-109193 (The HivePress \u2013 Business Directory, Listings &
Classified Ads Plu ...)
+ TODO: check
+CVE-2026-109191 (The Image Hub \u2013 Free Images from Unsplash, Pixabay,
Pexels, Openv ...)
+ TODO: check
+CVE-2026-108455 (Out-of-bounds read in Microsoft Office PowerPoint allows an
unauthoriz ...)
+ TODO: check
+CVE-2026-108454 (Buffer over-read in Microsoft Office PowerPoint allows an
unauthorized ...)
+ TODO: check
+CVE-2026-108453 (Out-of-bounds read in Microsoft Office PowerPoint allows an
unauthoriz ...)
+ TODO: check
+CVE-2026-108452 (Improper limitation of a pathname to a restricted directory
('path tra ...)
+ TODO: check
+CVE-2026-108451 (Numeric truncation error in Microsoft Office Word allows an
unauthoriz ...)
+ TODO: check
+CVE-2026-108450 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
+ TODO: check
+CVE-2026-108449 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
+ TODO: check
+CVE-2026-108448 (Heap-based buffer overflow in Microsoft Office Outlook allows
an unaut ...)
+ TODO: check
+CVE-2026-108447 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
+ TODO: check
+CVE-2026-108446 (Use after free in Microsoft Office Excel allows an
unauthorized attack ...)
+ TODO: check
+CVE-2026-108445 (Stack-based buffer overflow in Microsoft Office Word allows
an unautho ...)
+ TODO: check
+CVE-2026-108444 (Heap-based buffer overflow in Microsoft Office allows an
unauthorized ...)
+ TODO: check
+CVE-2026-108443 (Off-by-one error in Microsoft Office Word allows an
unauthorized attac ...)
+ TODO: check
+CVE-2026-108442 (Use after free in Microsoft Office Word allows an
unauthorized attacke ...)
+ TODO: check
+CVE-2026-108441 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
+ TODO: check
+CVE-2026-108440 (Stack-based buffer overflow in Microsoft Office Word allows
an unautho ...)
+ TODO: check
+CVE-2026-108439 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
+ TODO: check
+CVE-2026-108438 (Use after free in Microsoft Office Word allows an
unauthorized attacke ...)
+ TODO: check
+CVE-2026-108437 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
+ TODO: check
+CVE-2026-108436 (Out-of-bounds read in Microsoft Office Word allows an
unauthorized att ...)
+ TODO: check
+CVE-2026-108435 (Untrusted pointer dereference in Microsoft Office Word allows
an unaut ...)
+ TODO: check
+CVE-2026-108434 (Out-of-bounds read in Microsoft Office Word allows an
unauthorized att ...)
+ TODO: check
+CVE-2026-108433 (Reliance on untrusted inputs in a security decision in
Microsoft Offic ...)
+ TODO: check
+CVE-2026-108432 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
+ TODO: check
+CVE-2026-108431 (Stack-based buffer overflow in Microsoft Office Word allows
an unautho ...)
+ TODO: check
+CVE-2026-108430 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
+ TODO: check
+CVE-2026-108429 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
+ TODO: check
+CVE-2026-108428 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
+ TODO: check
+CVE-2026-108427 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
+ TODO: check
+CVE-2026-108426 (Heap-based buffer overflow in Microsoft Office Word allows an
unauthor ...)
+ TODO: check
+CVE-2026-108126 (temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted
payloads to ...)
+ TODO: check
+CVE-2026-107770 (The Photo Engine (Media Organizer & Lightroom) plugin for
WordPress is ...)
+ TODO: check
+CVE-2026-107768 (The TranslatePress \u2013 Translate Multilingual sites with
AI Transla ...)
+ TODO: check
+CVE-2026-107764 (The SiteOrigin CSS plugin for WordPress is vulnerable to
Stored DOM-Ba ...)
+ TODO: check
+CVE-2026-107758 (The Colibri Page Builder plugin for WordPress is vulnerable
to Stored ...)
+ TODO: check
+CVE-2026-107748 (The User Profile Builder \u2013 Beautiful User Registration
Forms, Use ...)
+ TODO: check
+CVE-2026-107746 (The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout
plugin fo ...)
+ TODO: check
+CVE-2026-107659 (The Modula Image Gallery \u2013 Photo Grid & Video Gallery
plugin for ...)
+ TODO: check
+CVE-2026-107646 (The HUSKY \u2013 Products Filter for WooCommerce Professional
plugin f ...)
+ TODO: check
+CVE-2026-107316
+ REJECTED
+CVE-2026-107172
+ REJECTED
+CVE-2026-106708 (XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site
Request Forge ...)
+ TODO: check
+CVE-2026-106700 (ELADMIN v2.7 and earlier contains an improper access control
vulnerabi ...)
+ TODO: check
+CVE-2026-105974 (The Visual Form Builder WordPress plugin through 3.1 does not
perform ...)
+ TODO: check
+CVE-2026-105973 (The Visual Form Builder WordPress plugin through 3.1 does not
perform ...)
+ TODO: check
+CVE-2026-105228 (This vulnerability allows remote attackers to disclose
sensitive infor ...)
+ TODO: check
+CVE-2026-105227 (This vulnerability allows remote attackers to disclose
sensitive infor ...)
+ TODO: check
+CVE-2026-105040 (The EnergizeLab Eilik NestJS auth service accepts a
user-controlled us ...)
+ TODO: check
+CVE-2026-105039 (EnergizeLab station-middleware (NestJS) Docker images 1.6.5
through 1. ...)
+ TODO: check
+CVE-2026-105038 (The EnergizeLab Eilik and EilikO FastAPI AI inference and
profiling se ...)
+ TODO: check
+CVE-2026-105037 (EnergizeLab station-middleware (NestJS) Docker images 1.6.5
through 1. ...)
+ TODO: check
+CVE-2026-105036 (EnergizeLab AI Station firmware, EilikO Linux robot firmware
v2.1_2026 ...)
+ TODO: check
+CVE-2026-105035 (The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in
the CDN b ...)
+ TODO: check
+CVE-2026-105034 (The EnergizeLab Eilik NestJS auth service issues device
tokens for arb ...)
+ TODO: check
+CVE-2026-105033 (The EnergizeLab AI Station (RK3562) firmware image ships with
default ...)
+ TODO: check
+CVE-2026-105032 (The EnergizeLab Eilik and EilikO AI skill upload endpoint,
served by t ...)
+ TODO: check
+CVE-2026-104932 (The Search Regex plugin for WordPress is vulnerable to PHP
Object Inje ...)
+ TODO: check
+CVE-2026-104798 (The My Calendar \u2013 Accessible Event Manager plugin for
WordPress i ...)
+ TODO: check
+CVE-2026-104769 (The Debloat \u2013 Remove Unused CSS, Optimize JS plugin for
WordPress ...)
+ TODO: check
+CVE-2026-104755 (The WP Compress \u2013 Instant Performance & Speed
Optimization plugin ...)
+ TODO: check
+CVE-2026-104745 (The Customer Email Verification for WooCommerce plugin for
WordPress i ...)
+ TODO: check
+CVE-2026-104730 (The Sunshine Photo Cart \u2013 Client Photo Gallery & Photo
Proofing f ...)
+ TODO: check
+CVE-2026-104198 (ZoneMinder is a free, open source closed-circuit television
software a ...)
+ TODO: check
+CVE-2026-104001 (The The Slim SEO \u2013 AI SEO Plugin, Lightweight, Fast &
Automated p ...)
+ TODO: check
+CVE-2026-104000 (The Simply Schedule Appointments plugin for WordPress is
vulnerable to ...)
+ TODO: check
+CVE-2026-103999 (The Ultra Addons for Contact Form 7 plugin for WordPress is
vulnerable ...)
+ TODO: check
+CVE-2026-103911 (The The Forminator Forms \u2013 Contact Form, Payment Form &
Custom Fo ...)
+ TODO: check
+CVE-2026-103910
+ REJECTED
+CVE-2026-103896 (The 10Web Booster \u2013 Website speed optimization, Cache &
Page Spee ...)
+ TODO: check
+CVE-2026-103895 (The miniOrange OTP Login, Verification and SMS Notifications
plugin fo ...)
+ TODO: check
+CVE-2026-103768 (The ELEX WordPress HelpDesk & Customer Ticketing System
plugin for Wor ...)
+ TODO: check
+CVE-2026-103696 (The Mobile builder WordPress plugin through 1.4.2 does not
sanitise an ...)
+ TODO: check
+CVE-2026-103525 (The FluentCart A New Era of eCommerce \u2013 Faster, Lighter,
and Simp ...)
+ TODO: check
+CVE-2026-103518 (The FluentCart A New Era of eCommerce \u2013 Faster, Lighter,
and Simp ...)
+ TODO: check
+CVE-2026-103481 (The Gwolle Guestbook plugin for WordPress is vulnerable to
Reflected C ...)
+ TODO: check
+CVE-2026-103480 (The Tourfic \u2013 AI Powered Travel Booking, Hotel Booking &
Car Rent ...)
+ TODO: check
+CVE-2026-102764 (The vulnerability exists within internal components of
BeyondTrust\u20 ...)
+ TODO: check
+CVE-2026-101335 (The Forminator Forms \u2013 Contact Form, Payment Form &
Custom Form B ...)
+ TODO: check
+CVE-2026-100186 (The User Profile Builder \u2013 Beautiful User Registration
Forms, Use ...)
+ TODO: check
+CVE-2026-100159 (The Popup Box plugin for WordPress is vulnerable to Arbitrary
Shortcod ...)
+ TODO: check
+CVE-2026-100158 (The SQL Chart Builder plugin for WordPress is vulnerable to
Stored Cro ...)
+ TODO: check
+CVE-2025-3778
+ REJECTED
+CVE-2024-58397 (MP4v2 through 2.1.3 contains a heap-based out-of-bounds read
in MP4Fil ...)
+ TODO: check
+CVE-2026-104715 (A flaw was found in cifs-utils. This flaw allows an
unprivileged local ...)
- cifs-utils 2:7.9-1
NOTE: Fixed by:
https://git.samba.org/?p=cifs-utils.git;a=commit;h=d561eb914a389f6f2f009f13f0d09df0887bae72
(cifs-utils-7.9)
NOTE: Fixed by:
https://git.samba.org/?p=cifs-utils.git;a=commit;h=fa0ba5a155ef925bb7547cb4cdc36425a2f5b8f9
(cifs-utils-7.9)
@@ -12316,6 +12852,7 @@ CVE-2026-107573 (Incorrect default permissions in the
Windows installer of Progr
CVE-2026-107572 (Inefficient complexity in the Sieve filter evaluation of
Progressive R ...)
NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107570 (heap OOB write in convert_file_from_to() via a crafted
Content-Type he ...)
+ {DSA-6563-1}
- mutt <unfixed> (bug #1150407)
NOTE: https://gitlab.com/muttmua/mutt/-/work_items/533
NOTE: Fixed by:
https://gitlab.com/muttmua/mutt/-/commit/7752d93f26f8f1384905fad874afff5abb0f3e54
(mutt-2-4-3-rel)
@@ -17074,7 +17611,7 @@ CVE-2026-XXXX [GHSA-gj33-wxpv-6fgg: ZDI-CAN-33033:
OpenPrinting CUPS Scheduler C
- cups <unfixed>
NOTE:
https://github.com/OpenPrinting/cups/security/advisories/GHSA-gj33-wxpv-6fgg
NOTE: Fixed by:
https://github.com/OpenPrinting/cups/commit/a7bd8ba80c2abb1d15dffc6c5ad7aece0c7b9db9
(v2.4.20)
-CVE-2026-55467 [GHSA-69qc-prxg-h2c7: CUPS fax option values bypass the
CVE-2026-34980 control-character sanitizer (incomplete fix)]
+CVE-2026-55467 (OpenPrinting CUPS is an open source printing system for Linux
and othe ...)
- cups 2.4.20-1
NOTE:
https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7
NOTE: Fixed by:
https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681
(v2.4.20)
@@ -23948,10 +24485,12 @@ CVE-2026-102635 (ImageMagick versions before 7.1.2-32
and 6.9.13-57 contain unin
CVE-2026-102634 (SGLang through 0.5.20 in prefill/decode disaggregation mode
fails to v ...)
NOT-FOR-US: SGLang
CVE-2026-77214 (libexpat before commit 13c5f63 contains a heap buffer
over-read vulner ...)
+ {DSA-6566-1}
- expat 2.9.0-1 (bug #1150320)
NOTE: https://github.com/libexpat/libexpat/pull/1393
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/4d9b1c499ecb66323260a7274edcf86c5eab0517
(R_2_9_0)
CVE-2026-102633 (libexpat versions 2.7.2 through 2.8.5 contain an integer
overflow vuln ...)
+ {DSA-6566-1}
- expat 2.8.5-2 (bug #1149507)
[bookworm] - expat <postponed> (Minor issue; CVE-2025-59375 back-port
code is compiled out, XML_GE unset)
NOTE: https://github.com/libexpat/libexpat/pull/1392
@@ -34825,7 +35364,7 @@ CVE-2026-93992 (Gopeed through 2.0.0-beta.3 contains a
path traversal vulnerabil
CVE-2026-93991 (Argo Workflows versions 4.1.0 through 4.1.3 contain an
authorization b ...)
NOT-FOR-US: Argo Workflows
CVE-2026-93990 (Expat before 2.8.5 fails to validate that a high surrogate in
UTF-16 i ...)
- {DLA-4807-1}
+ {DSA-6566-1 DLA-4807-1}
- expat 2.8.4-2 (bug #1148665)
NOTE: https://github.com/libexpat/libexpat/pull/1282
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/0cfd15bdf4b2c22d6b0df73610709dfb60921091
(R_2_8_5)
@@ -48935,7 +49474,8 @@ CVE-2026-89604 (In the Linux kernel, the following
vulnerability has been resolv
{DSA-6528-1 DLA-4817-1}
- linux 7.2.6-1
NOTE:
https://git.kernel.org/linus/b2326338dc683e8c1067c0cbf7a47986c4190902 (7.3-rc1)
-CVE-2026-89603 (In the Linux kernel, the following vulnerability has been
resolved: e ...)
+CVE-2026-89603
+ REJECTED
{DSA-6528-1 DLA-4817-1}
- linux 7.2.6-1
NOTE:
https://git.kernel.org/linus/4a3591287fb7f808e209b4974ed337f609a2006b (7.3-rc1)
@@ -74713,12 +75253,13 @@ CVE-2026-75803 (Issue summary: ChaCha20-Poly1305 and
AES-OCB decryption with an
CVE-2026-8619 (An unauthenticated denial-of-service vulnerability was
identified in T ...)
NOT-FOR-US: TPLink
CVE-2026-76957 (libexpat before 2.8.4 lacks handler call depth tracking with
custom en ...)
- {DLA-4765-1}
+ {DSA-6566-1 DLA-4765-1}
- expat 2.8.4-1 (bug #1144927)
NOTE: https://github.com/libexpat/libexpat/pull/1322
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/127b7d4beb8fe7e5ce5cb021c2e56379c95863d0
(R_2_8_4)
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/acbd2e1179c04fe9a8c3f3837701904d05de71fc
(R_2_8_4)
CVE-2026-76956 (In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of
getentr ...)
+ {DSA-6566-1}
- expat 2.8.4-1 (bug #1144926)
[bookworm] - expat <not-affected> (Vulnerable code not present)
[bullseye] - expat <not-affected> (Vulnerable code not present)
@@ -79242,7 +79783,7 @@ CVE-2026-66621 (Improper Neutralization of Input During
Web Page Generation ('Cr
CVE-2026-66620 (Editor PHP Object Injection in OptionTree <= 2.7.3 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-66046 (Expat through 2.8.3 contains a denial of service vulnerability
caused ...)
- {DLA-4807-1}
+ {DSA-6566-1 DLA-4807-1}
- expat 2.8.4-1 (bug #1144925)
NOTE: https://github.com/libexpat/libexpat/pull/1321
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/98f5acc146af76859cd7c345c0906e9e9e8ea656
(R_2_8_4)
@@ -116187,6 +116728,7 @@ CVE-2026-53727 (css_parser is a Ruby CSS parser. From
2.2.0 until 3.0.0, CssPars
NOTE: Fixed by:
https://github.com/premailer/css_parser/commit/7d2ddf0189cd54b54f378f59daefa10cb036e476
(v3.0.0)
NOTE: Fixed by:
https://github.com/premailer/css_parser/commit/e0a151458b2a801ae265ba420862ef8b1127b3ae
(v3.0.0)
CVE-2026-52584 (Buffer Overflow vulnerability in libjxl v.0.11.2 and before
allows a l ...)
+ {DSA-6564-1}
- jpeg-xl 0.11.2-5.1 (bug #1142476)
NOTE: https://github.com/libjxl/libjxl/issues/4803
NOTE: https://github.com/libjxl/libjxl/pull/4804
@@ -125123,7 +125665,7 @@ CVE-2026-XXXX [RUSTSEC-2026-0190]
[bullseye] - rust-anyhow <postponed> (Minor issue)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0190.html
NOTE: https://github.com/dtolnay/anyhow/issues/451
-CVE-2026-63430 [RUSTSEC-2026-0193]
+CVE-2026-63430 (ammonia is a Rust library for repairing and securing untrusted
HTML. P ...)
- rust-ammonia 4.1.3-1 (bug #1141594)
[trixie] - rust-ammonia <no-dsa> (Minor issue)
[bookworm] - rust-ammonia <postponed> (Limited support, minor issue)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4309abf23e2432b687a1e9cc76fb04e125b50c67
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4309abf23e2432b687a1e9cc76fb04e125b50c67
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
