Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
57ee7c54 by security tracker role at 2026-10-20T19:14:56+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,23 +1,585 @@
+CVE-2026-9589 (Missing authorization in the configuration cascade operations
of the C ...)
+ TODO: check
+CVE-2026-97406 (XERJ Console API bearer tokens can bypass the
passkey\u2011only authen ...)
+ TODO: check
+CVE-2026-97400 (In Eclipse OpenJ9 versions up to 0.63, opening a supplied
diagnostic d ...)
+ TODO: check
+CVE-2026-96582 (A HID report descriptor is a sequence of items, each declaring
in its ...)
+ TODO: check
+CVE-2026-96406 (A VideoStreaming interface reports the size of its whole
class-specifi ...)
+ TODO: check
+CVE-2026-96402 (A malicious USB MTP/PTP device can cause the USBX host to read
past a ...)
+ TODO: check
+CVE-2026-95168 (An issue in nvbn thefuck v.3.32 allows a local attacker to
execute arb ...)
+ TODO: check
+CVE-2026-95111 (A memory-protected ThreadX module's queue request reaches the
Module M ...)
+ TODO: check
+CVE-2026-95109 (The Cortex-A7 MMU Modules port validates a caller-supplied
buffer by t ...)
+ TODO: check
+CVE-2026-95108 (One logical thread of a user-mode ThreadX module costs the
Module Mana ...)
+ TODO: check
+CVE-2026-95107 (A ThreadX module chooses `object_size` when it calls
`txm_module_objec ...)
+ TODO: check
+CVE-2026-94202 (The Module Manager's block-pool create dispatcher proved that
two `ALI ...)
+ TODO: check
+CVE-2026-94192 (A ThreadX module allocates the control blocks of its kernel
objects fr ...)
+ TODO: check
+CVE-2026-94024 (The Module Manager's object lookup validated one byte of a
memory-prot ...)
+ TODO: check
+CVE-2026-94023 (A ThreadX module reaches a kernel object's delete service
through the ...)
+ TODO: check
+CVE-2026-94018 (The Web add-on's HTTP server dereferences and releases an
uninitialize ...)
+ TODO: check
+CVE-2026-93475 (The X.509 parser in NetX Secure accepts an RSA public key of
any size, ...)
+ TODO: check
+CVE-2026-93446 (Incomplete cleanup vulnerability in Apache Tomcat could cause
TLS 1.3 ...)
+ TODO: check
+CVE-2026-93003 (The Web add-on's HTTP server searches the entire request
packet for he ...)
+ TODO: check
+CVE-2026-92853 (The TLS 1.3 Certificate-message parser in NetX Secure
decrements the m ...)
+ TODO: check
+CVE-2026-92843 (A missing bounds check in the TLS 1.3 Certificate-message
parser of Ne ...)
+ TODO: check
+CVE-2026-92539 (A service account with user-management permissions in one
organization ...)
+ TODO: check
+CVE-2026-92454 (The GUIX software JPEG decoder reads four kinds of marker
segment with ...)
+ TODO: check
+CVE-2026-92449 (`_gx_binres_pixelmap_table_load()` in the GUIX binary resource
(theme) ...)
+ TODO: check
+CVE-2026-92446 (`gx_binres_theme_load()` and `gx_binres_font_load()` take the
resource ...)
+ TODO: check
+CVE-2026-92287 (Pass-through of unvalidated KMS URLs to KMS clients in Apache
C++ Parq ...)
+ TODO: check
+CVE-2026-91189 (The GUIX binary resource loader never checks that a font
page's glyph ...)
+ TODO: check
+CVE-2026-91186 (The PNG chunk reader has no notion of chunk ordering. It
records wheth ...)
+ TODO: check
+CVE-2026-91059 (The GUIX JPEG software decoder enforces no ordering on JPEG
markers. A ...)
+ TODO: check
+CVE-2026-91057 (`_gx_multi_line_text_view_display_info_get()` reads one byte
past the ...)
+ TODO: check
+CVE-2026-91041 (Mounting an attacker-controlled FAT image with fault tolerance
enabled ...)
+ TODO: check
+CVE-2026-90800 (Missing authorisation checks in chttpd in Apache CouchDB 3.5.2
and bel ...)
+ TODO: check
+CVE-2026-90799 (Unsafe binary deserialisation in chttpd in Apache CouchDB
3.5.2 and be ...)
+ TODO: check
+CVE-2026-90798 (A missing circuit-breaker in the replicator in Apache CouchDB
3.5.2 an ...)
+ TODO: check
+CVE-2026-90797 (An unlimited gzip decompression routine in chttpd in Apache
CouchDB 3. ...)
+ TODO: check
+CVE-2026-88041 (Incomplete cleanup vulnerability in Apache Tomcat allowed an
trailer i ...)
+ TODO: check
+CVE-2026-86471 (An unvalidated runtime configuration value in Apache CouchDB
3.5.2 and ...)
+ TODO: check
+CVE-2026-85267 (A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell
prior to ...)
+ TODO: check
+CVE-2026-80353 (Time-of-check time-of-use (TOCTOU) race condition
vulnerability in Apa ...)
+ TODO: check
+CVE-2026-75997
+ REJECTED
+CVE-2026-75751
+ REJECTED
+CVE-2026-75747
+ REJECTED
+CVE-2026-74049 (Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This ...)
+ TODO: check
+CVE-2026-74048 (Not Failing Securely ('Failing Open') vulnerability in Apache
Tomcat. ...)
+ TODO: check
+CVE-2026-48279
+ REJECTED
+CVE-2026-43858 (A stack-based buffer overflow vulnerability could allow a
remote authe ...)
+ TODO: check
+CVE-2026-43857 (A vulnerability could allow a remote authenticated attacker to
achieve ...)
+ TODO: check
+CVE-2026-43856 (A stack-based buffer overflow vulnerability in the
FileProcess::CheckD ...)
+ TODO: check
+CVE-2026-43855 (A heap-based buffer overflow vulnerability could allow a
remote authen ...)
+ TODO: check
+CVE-2026-43854 (A vulnerability could allow an attacker with access to an
encrypted pr ...)
+ TODO: check
+CVE-2026-43853 (A vulnerability could allow an attacker to send a crafted
message to t ...)
+ TODO: check
+CVE-2026-43852 (A vulnerability could allow an authenticated attacker to write
files t ...)
+ TODO: check
+CVE-2026-43851 (A path traversal vulnerability could allow an authenticated
attacker t ...)
+ TODO: check
+CVE-2026-43850 (A command injection vulnerability could allow an authenticated
attacke ...)
+ TODO: check
+CVE-2026-43849 (A heap memory read vulnerability could allow an attacker to
exfiltrate ...)
+ TODO: check
+CVE-2026-43848 (A vulnerability in the bulk port configuration functionality
could all ...)
+ TODO: check
+CVE-2026-43847 (A vulnerability in the proprietary protocol could allow an
attacker to ...)
+ TODO: check
+CVE-2026-43846 (A stack-based buffer overflow vulnerability in a
non-functional featur ...)
+ TODO: check
+CVE-2026-43845 (A vulnerability in the password reset mechanism could allow an
attacke ...)
+ TODO: check
+CVE-2026-43844 (A vulnerability in the proprietary protocol could allow an
attacker to ...)
+ TODO: check
+CVE-2026-43843 (An integer overflow vulnerability in the license manager
service could ...)
+ TODO: check
+CVE-2026-43842 (A NULL pointer dereference vulnerability in the license
manager servic ...)
+ TODO: check
+CVE-2026-43841 (A NULL pointer dereference vulnerability in the license
manager servic ...)
+ TODO: check
+CVE-2026-43840 (A NULL pointer dereference vulnerability in the license
manager servic ...)
+ TODO: check
+CVE-2026-43839 (A NULL pointer dereference vulnerability in the logs
management functi ...)
+ TODO: check
+CVE-2026-43838 (A stack-based buffer overflow vulnerability in the login
functionality ...)
+ TODO: check
+CVE-2026-43837 (A buffer overflow vulnerability in the password verification
functiona ...)
+ TODO: check
+CVE-2026-43836 (A vulnerability could allow an attacker to forge a packet to
execute a ...)
+ TODO: check
+CVE-2026-43835 (A vulnerability in the firmware upgrade functionality could
allow an a ...)
+ TODO: check
+CVE-2026-43834 (A stack-based buffer overflow vulnerability in the logs
settings funct ...)
+ TODO: check
+CVE-2026-34485 (Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL
Bypass vulne ...)
+ TODO: check
+CVE-2026-34484 (Nokia 1830 Global Express GX is vulnerable to a local
privilege escala ...)
+ TODO: check
+CVE-2026-28331 (SolarWinds Patch Manager exposes sensitive information
accessible to l ...)
+ TODO: check
+CVE-2026-28330 (SolarWinds Observability Self-Hosted was found to be affected
by a sto ...)
+ TODO: check
+CVE-2026-28329 (SolarWinds Observability Self-Hosted was found to be affected
by a Ser ...)
+ TODO: check
+CVE-2026-28328 (SolarWinds Observability Self-Hosted was found to be affected
by a bro ...)
+ TODO: check
+CVE-2026-21356
+ REJECTED
+CVE-2026-21270
+ REJECTED
+CVE-2026-21266
+ REJECTED
+CVE-2026-18205 (Improper neutralization of input during web page generation
('cross-si ...)
+ TODO: check
+CVE-2026-14933 (Cross-site scripting in the embedded co-browsing feature in
Unblu inc. ...)
+ TODO: check
+CVE-2026-11960 (Enumeration of unauthenticated users in FacturaScripts,
version 2025.6 ...)
+ TODO: check
+CVE-2026-11959 (Stored Cross-Site Scripting (XSS) in FacturaScripts, version
2025.61, ...)
+ TODO: check
+CVE-2026-113810 (A Stored Cross-Site Scripting vulnerability exists in the SNS
enrollme ...)
+ TODO: check
+CVE-2026-113808 (A Stored Cross-Site Scripting vulnerability exists in the SNS
enrollme ...)
+ TODO: check
+CVE-2026-113802 (Wavlink WL-WN530BE1-A firmware through M30BE1_V251117
contains an OS c ...)
+ TODO: check
+CVE-2026-113711 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113710 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113709 (Argo CD is a declarative, GitOps continuous delivery tool for
Kubernet ...)
+ TODO: check
+CVE-2026-113708 (Argo CD is a declarative, GitOps continuous delivery tool for
Kubernet ...)
+ TODO: check
+CVE-2026-113703 (SuggestArr before 3.0.0 contains an authentication bypass
vulnerabilit ...)
+ TODO: check
+CVE-2026-113683 (VPL (Virtual Programming Lab) for Moodle before 5.0.0
contains a refle ...)
+ TODO: check
+CVE-2026-113682 (Networknt light-4j from 2.1.5 before 2.4.0 contains an
authentication ...)
+ TODO: check
+CVE-2026-113681 (OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x
before 3 ...)
+ TODO: check
+CVE-2026-113680 (HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer
dereference ...)
+ TODO: check
+CVE-2026-113679 (HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write
vulnerab ...)
+ TODO: check
+CVE-2026-113678 (Froxlor before 2.3.15 contains a symlink following
vulnerability in St ...)
+ TODO: check
+CVE-2026-113677 (Froxlor from 0.10.0 before 2.3.15 contains a missing
authorization vul ...)
+ TODO: check
+CVE-2026-113676 (Froxlor from 0.10.0 before 2.3.15 contains an authorization
bypass vul ...)
+ TODO: check
+CVE-2026-113672 (Argo CD is a declarative, GitOps continuous delivery tool for
Kubernet ...)
+ TODO: check
+CVE-2026-113671 (ApostropheCMS is an open-source Node.js content management
system. Fro ...)
+ TODO: check
+CVE-2026-113670 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113669 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113668 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113667 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113666 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113665 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113664 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113662 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113661 (ApostropheCMS is an open-source Node.js content management
system, and ...)
+ TODO: check
+CVE-2026-113660 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113659 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113658 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113657 (ApostropheCMS is an open-source Node.js content management
system, and ...)
+ TODO: check
+CVE-2026-113656 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113655 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113654 (ApostropheCMS is an open-source Node.js content management
system, and ...)
+ TODO: check
+CVE-2026-113653 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113652 (ApostropheCMS is an open-source Node.js content management
system. Fro ...)
+ TODO: check
+CVE-2026-113651 (ApostropheCMS is an open-source Node.js content management
system, and ...)
+ TODO: check
+CVE-2026-113650 (ApostropheCMS is an open-source Node.js content management
system. In ...)
+ TODO: check
+CVE-2026-113649 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113648 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-113643 (A vulnerability was found in EspoCRM up to 9.3.10/10.0.10.
This affect ...)
+ TODO: check
+CVE-2026-113620 (In Eclipse ioFog Controller versions 3.8.0 through 3.9.1,
operator Web ...)
+ TODO: check
+CVE-2026-113619 (In Eclipse ioFog Controller versions 3.8.0 through 3.9.1,
POST, PUT, a ...)
+ TODO: check
+CVE-2026-113613 (FlexGet before 3.20.7 contains a path traversal vulnerability
in the d ...)
+ TODO: check
+CVE-2026-113612 (SparkyFitness before 0.17.0 contains a missing authorization
vulnerabi ...)
+ TODO: check
+CVE-2026-113611 (Outline before 1.8.0 contains an improper access revocation
vulnerabil ...)
+ TODO: check
+CVE-2026-113610 (Xen Orchestra before 6.9.0 contains an authorization bypass
vulnerabil ...)
+ TODO: check
+CVE-2026-113609 (Bandisoft Bandizip before 7.47 fails to propagate
Mark-of-the-Web to e ...)
+ TODO: check
+CVE-2026-113608 (Configurable Reports block for Moodle
(moodle-block_configurablereport ...)
+ TODO: check
+CVE-2026-113607 (Configurable Reports block for Moodle before 5.3.0 contains
an authori ...)
+ TODO: check
+CVE-2026-113606 (Stirling-PDF 3.0.0 through 3.2.0 contains an authorization
bypass vuln ...)
+ TODO: check
+CVE-2026-113605 (Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete
denylist ...)
+ TODO: check
+CVE-2026-113604 (Ghidra 10.2 through 12.1.4 contains a denial of service
vulnerability ...)
+ TODO: check
+CVE-2026-113603 (The x402 SIWX server extension in @x402/extensions 2.3.1
through 2.28. ...)
+ TODO: check
+CVE-2026-113602 (json-smart through 2.6.0 contains an input validation bypass
vulnerabi ...)
+ TODO: check
+CVE-2026-113601 (Memos before 0.27.0 contains a missing authorization
vulnerability in ...)
+ TODO: check
+CVE-2026-113600 (Fat Free CRM before 0.26.0 contains an insecure direct object
referenc ...)
+ TODO: check
+CVE-2026-113599 (Modoboa before 2.8.0 contains an insecure direct object
reference vuln ...)
+ TODO: check
+CVE-2026-113598 (Modoboa before 2.8.0 contains an insecure direct object
reference vuln ...)
+ TODO: check
+CVE-2026-113597 (Blinko through 1.8.8 contains an insecure direct object
reference vuln ...)
+ TODO: check
+CVE-2026-113596 (Webstudio before 0.256.0 contains a missing authorization
vulnerabilit ...)
+ TODO: check
+CVE-2026-113595 (Sharkord before 0.0.26 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-113594 (Sharkord before 0.0.8 contains a missing authorization
vulnerability t ...)
+ TODO: check
+CVE-2026-113583 (Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based
cross-site scr ...)
+ TODO: check
+CVE-2026-113507 (A vulnerability was found in aaPanel up to 8.25.0. The
impacted elemen ...)
+ TODO: check
+CVE-2026-113506 (A vulnerability has been found in aaPanel up to 8.25.0. The
affected e ...)
+ TODO: check
+CVE-2026-113505 (A flaw has been found in aaPanel up to 8.25.0. Impacted is
the functio ...)
+ TODO: check
+CVE-2026-113496 (A flaw was found in cockpit-machines. When saving Virtual
Network Comp ...)
+ TODO: check
+CVE-2026-113495 (A flaw was found in cockpit-machines. Red Hat Subscription
Management ...)
+ TODO: check
+CVE-2026-113469 (A failure has been identified in the SNS during dynamic data
files sig ...)
+ TODO: check
+CVE-2026-113468 (The payment notification endpoint for PayPal accepts incoming
data wit ...)
+ TODO: check
+CVE-2026-113466 (A security vulnerability has been detected in MinIO up to
RELEASE.2025 ...)
+ TODO: check
+CVE-2026-113465 (It is possible to execute a DOM-based Cross-Site Scripting
attack agai ...)
+ TODO: check
+CVE-2026-113459 (In versions running on TYPO3 10 and 11, the configured OpenAI
API key ...)
+ TODO: check
+CVE-2026-113442 (Values entered by visitors were placed into the HTML summary
email wit ...)
+ TODO: check
+CVE-2026-113411 (A vulnerability was found in Nerimity Desktop up to 2.2.2.
Affected by ...)
+ TODO: check
+CVE-2026-113407 (BA-Workflow developed by YS-infoware has a SQL Injection
vulnerability ...)
+ TODO: check
+CVE-2026-113406 (BA-Workflow developed by YS-infoware has a SQL Injection
vulnerability ...)
+ TODO: check
+CVE-2026-113405 (BA-Workflow developed by YS-infoware has a SQL Injection
vulnerability ...)
+ TODO: check
+CVE-2026-113403 (ArmorX Spam developed by ArmorX Global Technology has a
Command Inject ...)
+ TODO: check
+CVE-2026-113397 (A security vulnerability has been detected in DrayTek
Vigor2960 1.5.1. ...)
+ TODO: check
+CVE-2026-113396 (A weakness has been identified in DrayTek Vigor2960 1.5.1.6
Revision 8 ...)
+ TODO: check
+CVE-2026-113395 (A security flaw has been discovered in DrayTek Vigor2960
1.5.1.6 Revis ...)
+ TODO: check
+CVE-2026-113394 (A vulnerability was identified in DrayTek Vigor2960 1.5.1.6
Revision 8 ...)
+ TODO: check
+CVE-2026-113393 (A vulnerability was determined in DrayTek Vigor2960 1.5.1.6
Revision 8 ...)
+ TODO: check
+CVE-2026-113392 (A vulnerability was found in DrayTek Vigor2960 1.5.1.6
Revision 8218. ...)
+ TODO: check
+CVE-2026-113391 (A vulnerability has been found in DrayTek Vigor2960 1.5.1.6
Revision 8 ...)
+ TODO: check
+CVE-2026-113390 (A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision
8218. Affe ...)
+ TODO: check
+CVE-2026-113389 (A vulnerability was detected in DrayTek Vigor2960 1.5.1.6
Revision 821 ...)
+ TODO: check
+CVE-2026-113388 (A security flaw has been discovered in
opensource-socialnetwork up to ...)
+ TODO: check
+CVE-2026-113385 (A vulnerability has been found in LeeDrOiD Labs Shortcutter 2
App 9.0. ...)
+ TODO: check
+CVE-2026-113384 (A flaw has been found in Optimal IdM OptimalCloud 5.0. This
vulnerabil ...)
+ TODO: check
+CVE-2026-113383 (A vulnerability was detected in Optimal IdM OptimalCloud 5.0.
This aff ...)
+ TODO: check
+CVE-2026-113382 (A security vulnerability has been detected in arizu-id
fast-tunnel 1.0 ...)
+ TODO: check
+CVE-2026-113381 (A weakness has been identified in Osclass up to 8.3.1.
Affected by thi ...)
+ TODO: check
+CVE-2026-113378 (A security flaw has been discovered in mcollina mcp-ripgrep
up to 0.4. ...)
+ TODO: check
+CVE-2026-113359 (Baserow before 2.3.0 contains a missing authorization
vulnerability th ...)
+ TODO: check
+CVE-2026-113358 (LavaLite CMS through 10.1.2 contains a missing authentication
vulnerab ...)
+ TODO: check
+CVE-2026-113357 (@e2e-dev/github before 0.4.1 contains an improper
authorization vulner ...)
+ TODO: check
+CVE-2026-113356 (DokuWiki before 2026-07-14c contains a PHP object injection
vulnerabil ...)
+ TODO: check
+CVE-2026-113355 (Chatwoot before 4.14.0 contains a stored cross-site scripting
vulnerab ...)
+ TODO: check
+CVE-2026-113354 (Dockhand before 1.0.46 contains an arbitrary file read
vulnerability t ...)
+ TODO: check
+CVE-2026-113353 (LearnPress before 4.4.10 contains a missing authorization
vulnerabilit ...)
+ TODO: check
+CVE-2026-113352 (uTox through 0.18.1 contains a path traversal vulnerability
that allow ...)
+ TODO: check
+CVE-2026-113351 (libexpat 2.7.2 through 2.9.0 contains a denial of service
vulnerabilit ...)
+ TODO: check
+CVE-2026-113350 (react-admin before 5.15.5 contains a stored cross-site
scripting vulne ...)
+ TODO: check
+CVE-2026-113349 (OpenCATS before 0.10.0 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-112958 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-112957 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-112956 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-112955 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-112954 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-112953 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-112952 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-112951 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
+ TODO: check
+CVE-2026-112950 (Vitest is a Vite-native testing framework for JavaScript and
TypeScrip ...)
+ TODO: check
+CVE-2026-112949 (Vitest is a Vite-native testing framework for JavaScript and
TypeScrip ...)
+ TODO: check
+CVE-2026-112948 (Vitest is a testing framework powered by Vite. From
5.0.0-beta.6 until ...)
+ TODO: check
+CVE-2026-112947 (Vite is a frontend tooling framework for JavaScript. From
8.2.0 until ...)
+ TODO: check
+CVE-2026-112946 (Vite is a frontend tooling framework for JavaScript. Prior to
6.4.4, 7 ...)
+ TODO: check
+CVE-2026-112945 (Vite is a frontend tooling framework for JavaScript. Prior to
6.4.4, 7 ...)
+ TODO: check
+CVE-2026-112944 (launch-editor allows users to open files with line numbers in
editor f ...)
+ TODO: check
+CVE-2026-112943 (launch-editor allows users to open files with line numbers in
editor f ...)
+ TODO: check
+CVE-2026-112942 (launch-editor allows users to open files with line numbers in
editor f ...)
+ TODO: check
+CVE-2026-112941 (filelock is a platform-independent file lock for Python. From
4.1.0 un ...)
+ TODO: check
+CVE-2026-112940 (filelock is a platform-independent file lock for Python. From
3.20.4 u ...)
+ TODO: check
+CVE-2026-112939 (filelock is a platform-independent file lock for Python. From
3.22.0 u ...)
+ TODO: check
+CVE-2026-112937 (filelock is a platform-independent file lock for Python. From
4.1.0 un ...)
+ TODO: check
+CVE-2026-112936 (filelock is a platform-independent file lock for Python. From
3.20.4 u ...)
+ TODO: check
+CVE-2026-112935 (filelock is a platform-independent file lock for Python. From
3.22.0 u ...)
+ TODO: check
+CVE-2026-112934 (filelock is a platform-independent file lock for Python. From
4.0.0 un ...)
+ TODO: check
+CVE-2026-112915 (filelock is a platform-independent file lock for Python. From
3.20.4 u ...)
+ TODO: check
+CVE-2026-112914 (filelock is a platform-independent file lock for Python. From
4.1.0 un ...)
+ TODO: check
+CVE-2026-112912 (filelock is a platform-independent file lock for Python. From
3.32.6 u ...)
+ TODO: check
+CVE-2026-112911 (filelock is a platform-independent file lock for Python. From
3.30.0 u ...)
+ TODO: check
+CVE-2026-112909 (filelock is a platform-independent file lock for Python.
Prior to 4.2. ...)
+ TODO: check
+CVE-2026-112906 (filelock is a platform-independent file lock for Python. From
4.1.0 un ...)
+ TODO: check
+CVE-2026-112861 (Authorization Bypass Through User-Controlled Key
vulnerability in xnau ...)
+ TODO: check
+CVE-2026-112840 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-112836 (Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp
VikRentCar ...)
+ TODO: check
+CVE-2026-112834 (Missing Authorization vulnerability in Castos Seriously
Simple Podcast ...)
+ TODO: check
+CVE-2026-112833 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-112829 (Missing Authorization vulnerability in Arraytics Booktics
booktics all ...)
+ TODO: check
+CVE-2026-112824 (Missing Authorization vulnerability in Magepeople inc. Bus
Ticket Book ...)
+ TODO: check
+CVE-2026-112823 (Missing Authorization vulnerability in WP User Manager WP
User Manager ...)
+ TODO: check
+CVE-2026-112787 (OpenCATS before 0.10.0 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-112786 (OpenCATS before 0.10.0 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-112785 (OpenCATS before 0.10.0 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-112784 (OpenCATS before 0.10.0 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-112783 (OpenCATS before 0.10.0 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-112240 (The download link for files uploaded through a form relied on
a token ...)
+ TODO: check
+CVE-2026-112239 (The extension provides a backend endpoint that writes a
submitted valu ...)
+ TODO: check
+CVE-2026-112238 (The file search of the extension builds its database
conditions by wra ...)
+ TODO: check
+CVE-2026-112237 (The extension provides a public proxy endpoint that fetches a
URL on b ...)
+ TODO: check
+CVE-2026-112177 (A flaw was found in Ghostscript as shipped with Red Hat
Enterprise Lin ...)
+ TODO: check
+CVE-2026-112071 (The order cancellation function accepts an order identifier
from the r ...)
+ TODO: check
+CVE-2026-112070 (The AJAX routes of the extension do not check whether a
backend user h ...)
+ TODO: check
+CVE-2026-112069 (The extension no longer applied its access protection to
files in file ...)
+ TODO: check
+CVE-2026-112068 (The backend module does not check whether a backend user has
access to ...)
+ TODO: check
+CVE-2026-112067 (The extension hides the correct answer to each CAPTCHA inside
the imag ...)
+ TODO: check
+CVE-2026-112066 (The JSON import of the cookie consent configuration did not
respect th ...)
+ TODO: check
+CVE-2026-112065 (The routes that provide consent history and statistics data
did not ch ...)
+ TODO: check
+CVE-2026-112064 (The backend module for reviewing the consent history accepted
sorting, ...)
+ TODO: check
+CVE-2026-111844 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-111843 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-111767 (MCP TypeScript SDK is the official TypeScript SDK for Model
Context Pr ...)
+ TODO: check
+CVE-2026-111765 (A2A Java SDK is the official Java SDK for the Agent2Agent
(A2A) Protoc ...)
+ TODO: check
+CVE-2026-111764 (A2A Java SDK is the official Java SDK for the Agent2Agent
(A2A) Protoc ...)
+ TODO: check
+CVE-2026-111763 (A2A Java SDK is the official Java SDK for the Agent2Agent
(A2A) Protoc ...)
+ TODO: check
+CVE-2026-111762 (A2A Java SDK is the official Java SDK for the Agent2Agent
(A2A) Protoc ...)
+ TODO: check
+CVE-2026-111761 (A2A Java SDK is the official Java SDK for the Agent2Agent
(A2A) Protoc ...)
+ TODO: check
+CVE-2026-111756 (follow-redirects is a Node.js HTTP and HTTPS client wrapper
that autom ...)
+ TODO: check
+CVE-2026-111090 (A logic error exists in the signature verification routine
resulting i ...)
+ TODO: check
+CVE-2026-111088 (A Stored Cross-Site Scripting vulnerability exists in the SNS
VPN log ...)
+ TODO: check
+CVE-2026-110725 (fast-uri is a dependency-free RFC 3986 URI parser and
serializer for N ...)
+ TODO: check
+CVE-2026-110306 (fast-uri is a dependency-free RFC 3986 URI parser and
serializer for N ...)
+ TODO: check
+CVE-2026-110180 (fast-uri is a dependency-free RFC 3986 URI parser and
serializer for N ...)
+ TODO: check
+CVE-2026-109700 (Missing Authorization vulnerability in eLightUp Meta Box
\u2013 WordPr ...)
+ TODO: check
+CVE-2026-108089 (** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system
informati ...)
+ TODO: check
+CVE-2026-108088 (** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing
sensitive info ...)
+ TODO: check
+CVE-2026-108087 (** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of
special ele ...)
+ TODO: check
+CVE-2026-108086 (** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of
recursive enti ...)
+ TODO: check
+CVE-2026-108062 (Pre-authentication OIDC discovery and JWKS fetches run
synchronously o ...)
+ TODO: check
+CVE-2026-107755 (Insufficient filtering of credentials in the _replicator
database in A ...)
+ TODO: check
+CVE-2026-107597 (PIA's token verification (`verify_token` in `pia/oidc.py`)
fetches the ...)
+ TODO: check
+CVE-2026-105949 (Cruise Control's Jetty ConstraintSecurityHandler registers
security co ...)
+ TODO: check
+CVE-2026-105941 (The Azure Key Vault KMS provider in Kroxylicious accepts an
untrusted ...)
+ TODO: check
+CVE-2026-105772 (Path Traversal (CWE-22) in FileArtifactService in Google ADK
TypeScrip ...)
+ TODO: check
+CVE-2026-105312 (A Kubernetes tenant with create permission on Console custom
resources ...)
+ TODO: check
+CVE-2026-105311 (The StreamsHub Console operator acts as a confused deputy: a
Kubernete ...)
+ TODO: check
+CVE-2026-103119 (Buffer under-read vulnerability in Apache Tomcat meant that a
large no ...)
+ TODO: check
+CVE-2026-101356 (Incorrect object recycling and re-use vulnerability in Apache
Tomcat a ...)
+ TODO: check
+CVE-2026-101296 (A missing critical step in authentication vulnerability in
Apache Tomc ...)
+ TODO: check
+CVE-2026-101201 (A malformed header in the binary file fed to
QBinaryJson::fromBinaryDa ...)
+ TODO: check
+CVE-2026-100134 (Acrobat for Edge is affected by an out-of-bounds write
vulnerability t ...)
+ TODO: check
+CVE-2026-100132 (Acrobat for Edge is affected by an out-of-bounds read
vulnerability th ...)
+ TODO: check
+CVE-2025-71436 (Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains
a heap-b ...)
+ TODO: check
+CVE-2024-2323 (The RemoteUserStoreManagerService does not sufficiently
validate passw ...)
+ TODO: check
CVE-2026-71195
- manila <unfixed> (bug #1151439)
NOTE: https://security.openstack.org/ossa/OSSA-2026-046.html
CVE-2026-93856
- cinder <unfixed> (bug #1151437)
NOTE: https://security.openstack.org/ossa/OSSA-2026-045.html
-CVE-2026-113401
+CVE-2026-113401 (Denial-of-service in the PDF Viewer component. This
vulnerability was ...)
- firefox <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113401
-CVE-2026-113400
+CVE-2026-113400 (Uninitialized memory in the Audio/Video: cubeb component.
This vulnera ...)
- firefox <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113400
-CVE-2026-113470
+CVE-2026-113470 (Mozilla blocked compromised intermediate eMudhra certificates
via OneC ...)
- firefox <unfixed>
- firefox-esr <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113470
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-112/#CVE-2026-113470
NOTE: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
NOTE: https://www.openwall.com/lists/oss-security/2026/10/20/1
-CVE-2026-113399
+CVE-2026-113399 (Incorrect boundary conditions in the SVG component. This
vulnerability ...)
- firefox <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113399
CVE-2026-97627 (Hidden functionality issue exists in Multiple DVRs (Digital
Video Reco ...)
@@ -630,7 +1192,7 @@ CVE-2026-111879
NOTE: Fixed by:
https://github.com/perl5-dbi/dbi/commit/99bbf2ab9d137e6f042a770bd3bbba3bc0b3a901
(1.656)
CVE-2026-111946 (Plack::Middleware::ETag versions from 0.04 before 0.06 for
Perl disclo ...)
NOT-FOR-US: Plack::Middleware::ETag Perl module
-CVE-2026-113386 [Fix IMAP command injection via CRLF in _uid parameter of
mail/headers and mail/viewsource action]
+CVE-2026-113386 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are
affected by ...)
- roundcube 1.6.20+dfsg-1 (bug #1151279)
NOTE:
https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
(1.6.20)
@@ -4937,7 +5499,7 @@ CVE-2026-111312 (OpenHealth through 0.2.0 contains a
missing authentication and
NOT-FOR-US: OpenHealth
CVE-2026-111284 (Aureus ERP through 1.6.0 contains a stored cross-site
scripting vulner ...)
NOT-FOR-US: Aureus ERP
-CVE-2026-111283 (BMC Helix Network Management on-prem before 26.3.01 contains
an authen ...)
+CVE-2026-111283 (BMC Helix Network Management on-prem 26.3.00 before 26.3.01
contains a ...)
NOT-FOR-US: BMC Helix Network Management on-prem
CVE-2026-111282 (Driftregion iso14229 before 0.10.1 contains an integer
wraparound in H ...)
NOT-FOR-US: Driftregion iso14229
@@ -11307,7 +11869,7 @@ CVE-2026-102206 (Heap-based buffer overflow in Windows
Portable Device MTP Drive
NOT-FOR-US: Microsoft
CVE-2026-102205 (Heap-based buffer overflow in Windows Universal Disk Format
File Syste ...)
NOT-FOR-US: Microsoft
-CVE-2026-102204 (Improper link resolution before file access ('link
following') in Micr ...)
+CVE-2026-102204 (Improper link resolution before file access ('link
following') in Wind ...)
NOT-FOR-US: Microsoft
CVE-2026-102203 (Access of resource using incompatible type ('type confusion')
in RPC R ...)
NOT-FOR-US: Microsoft
@@ -26171,7 +26733,7 @@ CVE-2026-97248 (Unauthenticated PHP Object Injection in
Booking Activities <= 1.
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97247 (Unauthenticated Broken Access Control in Blocksy Companion <=
2.1.55 v ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-97246 (Subscriber PHP Object Injection in ShortPixel Image Optimizer
<= 6.5.5 ...)
+CVE-2026-97246 (Deserialization of Untrusted Data vulnerability in ShortPixel
ShortPix ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97245 (Shop Worker Privilege Escalation in SureCart <= 4.7.2
versions.)
NOT-FOR-US: WordPress plugin or theme
@@ -97002,7 +97564,7 @@ CVE-2026-96279 (A malicious OCI registry can hardlink
arbitrary host files into
[bullseye] - flatpak <not-affected> (Vulnerable code not present)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-9rww-v4mm-x4jg
NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/e6fa2f9b416ec382644694c8737dc8fbe7f07b89
(1.18.1)
-CVE-2026-92162 [GHSA-v2gw-v9h5-9q4x]
+CVE-2026-92162 (Flatpak is a system for building, distributing, and running
sandboxed ...)
{DSA-6524-1 DSA-6432-1}
- flatpak 1.18.1-1 (bug #1144130)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-v2gw-v9h5-9q4x
@@ -105991,15 +106553,15 @@ CVE-2026-54715 (GoAccess is a real-time web log
analyzer and interactive viewer
NOTE: Fixed by:
https://github.com/allinurl/goaccess/commit/81f90d9dafd6956c188dea9f944d24946d3d3351
(v1.11)
CVE-2026-52539 (Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing
secret. When t ...)
NOT-FOR-US: Outstatic CMS
-CVE-2026-43833 (Full details and mitigation steps are currently restricted and
will be ...)
+CVE-2026-43833 (A stack-based buffer overflow vulnerability in the upload
functionalit ...)
NOT-FOR-US: Advantech
-CVE-2026-43832 (Full details and mitigation steps are currently restricted and
will be ...)
+CVE-2026-43832 (A stack-based buffer overflow vulnerability in the Cookie
parsing meth ...)
NOT-FOR-US: Advantech
-CVE-2026-43831 (Full details and mitigation steps are currently restricted and
will be ...)
+CVE-2026-43831 (A stack-based buffer overflow vulnerability in the log message
functio ...)
NOT-FOR-US: Advantech
-CVE-2026-43830 (Full details and mitigation steps are currently restricted and
will be ...)
+CVE-2026-43830 (A command injection vulnerability in the firmware upgrade file
verific ...)
NOT-FOR-US: Advantech
-CVE-2026-43829 (Full details and mitigation steps are currently restricted and
will be ...)
+CVE-2026-43829 (A stack-based buffer overflow vulnerability in the password
functional ...)
NOT-FOR-US: Advantech
CVE-2026-38709 (TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23,
WR1300 ...)
NOT-FOR-US: Cudy
@@ -245986,7 +246548,7 @@ CVE-2025-50401 (Mercury D196G
d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to
NOT-FOR-US: Mercury D196G
CVE-2025-50398 (Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable
to Buffe ...)
NOT-FOR-US: Mercury D196G
-CVE-2025-49300 (Insertion of Sensitive Information Into Sent Data
vulnerability in shi ...)
+CVE-2025-49300 (Insertion of Sensitive Information Into Sent Data
vulnerability in Shi ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-46296 (An authorization bypass vulnerability in FileMaker Server
Admin Consol ...)
NOT-FOR-US: Apple
@@ -479129,7 +479691,7 @@ CVE-2023-44093 (Vulnerability of package names'
public keys not being verified i
NOT-FOR-US: Huawei
CVE-2023-43960 (An issue in DLINK DPH-400SE FRU 2.2.15.8 allows a remote
attacker to e ...)
NOT-FOR-US: DLINK
-CVE-2023-43661 (Cachet, the open-source status page system. Prior to the 2.4
branch, a ...)
+CVE-2023-43661 (Cachet is an open-source status page system. Prior to the 2.4
branch, ...)
NOT-FOR-US: Cachet
CVE-2023-42138 (Out-of-bounds read vulnerability exists in KV STUDIO Ver.
11.62 and ea ...)
NOT-FOR-US: KV STUDIO
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57ee7c54b1ac0da809f11979218ad9f847a6462a
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57ee7c54b1ac0da809f11979218ad9f847a6462a
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
