Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
281a27c4 by Moritz Muehlenhoff at 2026-10-16T14:58:08+02:00
bugnums
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2311,7 +2311,7 @@ CVE-2026-109968 (A flaw was found in the clevis PKCS#11
pin. The clevis-pkcs11-a
CVE-2026-109901 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-109527 (The Model Context Protocol Python SDK is the official Python
SDK for M ...)
- - python-mcp <unfixed>
+ - python-mcp <unfixed> (bug #1151047)
NOTE:
https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc
NOTE:
https://github.com/modelcontextprotocol/python-sdk/commit/4dc224fab201bdef2fd5a065976b7ca31420187c
(v1.29.1)
NOTE:
https://github.com/modelcontextprotocol/python-sdk/commit/5f0b6af9f2b0aad3be3ba5cbfe80a9e4ea32e189
(v1.29.0)
@@ -31992,17 +31992,17 @@ CVE-2026-88845 (The MasterStudy LMS WordPress Plugin
WordPress plugin before 3.
CVE-2026-88843 (The MasterStudy LMS WordPress Plugin WordPress plugin before
3.7.50 d ...)
NOT-FOR-US: WordPress plugin
CVE-2026-88840 (BusyBox TLS get_client_hello() reads past the end of the input
buffer ...)
- - busybox <unfixed>
+ - busybox <unfixed> (bug #1151053)
[trixie] - busybox <not-affected> (Vulnerable code not present)
[bookworm] - busybox <not-affected> (Vulnerable code not present)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531354
NOTE: Introduced by:
https://git.busybox.net/busybox/commit/archival?id=657fbcd62c6cb1e15692ad471bc94cfe6efd8a5f
(1_38_0)
CVE-2026-88839 (BusyBox passwd/group tokenize() references a stale endpoint
pointer af ...)
- - busybox <unfixed>
+ - busybox <unfixed> (bug #1151052)
[trixie] - busybox <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531353
CVE-2026-88837 (BusyBox httpd treats yescrypt ($y$) password hashes as
plaintext durin ...)
- - busybox <unfixed>
+ - busybox <unfixed> (bug #1151051)
[trixie] - busybox <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531351
CVE-2026-88835 (BusyBox dpkg read_package_field() steps past a NUL terminator
on malfo ...)
@@ -32010,15 +32010,15 @@ CVE-2026-88835 (BusyBox dpkg read_package_field()
steps past a NUL terminator on
NOTE: ttps://bugzilla.redhat.com/show_bug.cgi?id=2531349
NOTE: Crash in CLI tool, no security impact
CVE-2026-88832 (BusyBox romfs volume ID parsing uses unbounded strlen on
attacker-cont ...)
- - busybox <unfixed>
+ - busybox <unfixed> (bug #1151050)
[trixie] - busybox <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531345
CVE-2026-88831 (BusyBox httpd IP deny rules with invalid CIDR prefix lengths
fail open ...)
- - busybox <unfixed>
+ - busybox <unfixed> (bug #1151049)
[trixie] - busybox <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531346
CVE-2026-88830 (A unit confusion in BusyBox TLS Montgomery reduction buffer
allocation ...)
- - busybox <unfixed>
+ - busybox <unfixed> (bug #1151048)
[trixie] - busybox <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531344
CVE-2026-87978 (The Paymob for WooCommerce WordPress plugin before 4.1.14 does
not ver ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/281a27c45bca54761a6b654b99521f7ffd0d495d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/281a27c45bca54761a6b654b99521f7ffd0d495d
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
