Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
5c201df3 by Salvatore Bonaccorso at 2026-10-24T21:36:10+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -91,7 +91,7 @@ CVE-2026-110892 (Missing Authorization vulnerability in
Brainstorm Force SureDas
CVE-2026-110018 (The aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder,
Popup Bui ...)
NOT-FOR-US: WordPress plugin
CVE-2026-114629 (Web::Simple versions before 0.035 for Perl allocate a buffer
sized by ...)
- - libweb-simple-perl <unfixed>
+ - libweb-simple-perl <unfixed> (bug #1151935)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44599125/
NOTE: Fixed by:
https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695
(v0.035)
CVE-2026-115936
@@ -159,7 +159,7 @@ CVE-2026-87901 (Improper sanitization in the registration
module allows reflecte
CVE-2026-87835 (The Front End Users WordPress plugin through 3.2.35 does not
restrict ...)
NOT-FOR-US: WordPress plugin
CVE-2026-83813 (Twisted is an event-based framework for internet applications,
support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1151938)
[trixie] - twisted <no-dsa> (Minor issue)
NOTE:
https://github.com/twisted/twisted/security/advisories/GHSA-jj36-9pvh-vj5r
NOTE: https://github.com/twisted/twisted/pull/12700
@@ -355,7 +355,7 @@ CVE-2026-115885 (The LangGraph CLI is the official
command-line interface for La
CVE-2026-115883 (LangGraph checkpoint savers provide Postgres- and
SQLite-backed state ...)
NOT-FOR-US: LangGraph
CVE-2026-115877 (Twisted is an event-based framework for internet
applications, support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1151938)
[trixie] - twisted <no-dsa> (Minor issue)
NOTE:
https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4
NOTE: https://github.com/twisted/twisted/pull/12755
@@ -394,33 +394,33 @@ CVE-2026-115786 (A mailbox quota-accounting vulnerability
in Zimbra Collaboratio
CVE-2026-115785 (An SMTP command injection vulnerability in the data-source
testing fun ...)
NOT-FOR-US: Zimbra
CVE-2026-115778 (Twisted is an event-based framework for internet
applications, support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1151938)
[trixie] - twisted <no-dsa> (Minor issue)
NOTE:
https://github.com/twisted/twisted/security/advisories/GHSA-cwm5-jh59-mwxr
NOTE: https://github.com/twisted/twisted/pull/12750
NOTE: Fixed by:
https://github.com/twisted/twisted/commit/073ba878c6c07d569cb61abc5ae76d46eff1b529
(twisted-26.10.0rc1)
NOTE: Fixed by:
https://github.com/twisted/twisted/commit/5d91cc66a3591faba758a80a1479e0103602facc
(twisted-26.10.0rc1)
CVE-2026-115776 (Twisted is an event-based framework for internet
applications, support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1151938)
[trixie] - twisted <no-dsa> (Minor issue)
NOTE:
https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798
NOTE: https://github.com/twisted/twisted/pull/12771
NOTE: Fixed by:
https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30
(twisted-26.10.0rc1)
NOTE: Fixed by:
https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059
(twisted-26.10.0rc1)
CVE-2026-115775 (Twisted is an event-based framework for internet
applications, support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1151938)
[trixie] - twisted <no-dsa> (Minor issue)
NOTE:
https://github.com/twisted/twisted/security/advisories/GHSA-3476-c5c2-fr73
NOTE: https://github.com/twisted/twisted/pull/12751
NOTE: Fixed by:
https://github.com/twisted/twisted/commit/8873814bec8288e2466fad4d2c4d64039beb88b0
(twisted-26.10.0rc1)
CVE-2026-115774 (Twisted is an event-based framework for internet
applications, support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1151938)
[trixie] - twisted <no-dsa> (Minor issue)
NOTE:
https://github.com/twisted/twisted/security/advisories/GHSA-2qrf-pqgx-qh9v
NOTE: https://github.com/twisted/twisted/pull/12764
NOTE: Fixed by:
https://github.com/twisted/twisted/commit/3d125548bcbe955007cb97f480bb699a5e074741
(twisted-26.10.0rc1)
CVE-2026-115754 (serialize-javascript from 7.0.1 before 7.1.3 contains a
cross-site scr ...)
- - node-serialize-javascript <unfixed>
+ - node-serialize-javascript <unfixed> (bug #1151937)
NOTE:
https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v
NOTE: https://github.com/yahoo/serialize-javascript/pull/235
NOTE: Fixed by:
https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61
(v7.1.3)
@@ -1951,13 +1951,13 @@ CVE-2026-115496 (Overly informative error messages in
the catalog functionality
CVE-2026-115494 (A flaw in the cross-site request forgery (CSRF) prevention of
KNIME Bu ...)
NOT-FOR-US: KNIME Business Hub
CVE-2026-115486 (A flaw was found in the iscsiuio component of open-iscsi. The
IPv6 Nei ...)
- - open-iscsi <unfixed>
+ - open-iscsi <unfixed> (bug #1151936)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2556267
CVE-2026-115485 (A flaw was found in the iscsiuio component of open-iscsi. The
DHCPv6 o ...)
- - open-iscsi <unfixed>
+ - open-iscsi <unfixed> (bug #1151936)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2556266
CVE-2026-115484 (A flaw was found in the iscsiuio component of open-iscsi. The
DHCPv4 o ...)
- - open-iscsi <unfixed>
+ - open-iscsi <unfixed> (bug #1151936)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2556265
CVE-2026-115482 (In lsquic before 4.9.0, the HTTP/3 implementation can use an
excessive ...)
NOT-FOR-US: lsquic
@@ -8478,7 +8478,7 @@ CVE-2026-111762 (A2A Java SDK is the official Java SDK
for the Agent2Agent (A2A)
CVE-2026-111761 (A2A Java SDK is the official Java SDK for the Agent2Agent
(A2A) Protoc ...)
NOT-FOR-US: A2A Java SDK
CVE-2026-111756 (follow-redirects is a Node.js HTTP and HTTPS client wrapper
that autom ...)
- - node-follow-redirects <unfixed>
+ - node-follow-redirects <unfixed> (bug #1151931)
NOTE:
https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8
NOTE: Fixed by:
https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff
(v1.16.1)
CVE-2026-111090 (A logic error exists in the signature verification routine
resulting i ...)
@@ -8948,7 +8948,7 @@ CVE-2026-112254 (A vulnerability was found in agit8or1
clientst0r up to 3.17.586
CVE-2026-112148 (A vulnerability has been identified in LIFF SDK versions
2.20.0 throug ...)
NOT-FOR-US: LIFF SDK
CVE-2026-111766 (markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3,
when the ...)
- - node-markdown-it <unfixed>
+ - node-markdown-it <unfixed> (bug #1151932)
NOTE:
https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q
NOTE: Fixed by:
https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79
(15.0.3)
NOTE: Fixed by:
https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503
(14.3.3)
@@ -9476,7 +9476,7 @@ CVE-2026-11319 (TickTick Android application
(com.ticktick.task) 8.2.2.0 contain
CVE-2026-112377 (CCC Attestation SIG attested-tls-poc through commit 731ca82
fails to b ...)
NOT-FOR-US: CCC Attestation SIG attested-tls-poc
CVE-2026-112368 (An uncontrolled recursion weakness in the BSON decoding logic
of the M ...)
- - php-mongodb <unfixed>
+ - php-mongodb <unfixed> (bug #1151934)
[trixie] - php-mongodb <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/PHPC-276
NOTE: Fixed by:
https://github.com/mongodb/mongo-php-driver/commit/795e914e6f7cc631a2f80c89aedcdd2a1df4ada9
(2.5.5, 2.1.12, 1.21.12)
@@ -9754,7 +9754,7 @@ CVE-2026-111759 (markdown-it is a Markdown parser. Prior
to 14.3.2 and 15.0.2, w
CVE-2026-111757 (Hono is a Web application framework that provides support for
any Java ...)
NOT-FOR-US: Hono
CVE-2026-111755 (follow-redirects is a Node.js HTTP and HTTPS client wrapper
that autom ...)
- - node-follow-redirects <unfixed>
+ - node-follow-redirects <unfixed> (bug #1151930)
NOTE:
https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c
NOTE: Fixed by:
https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8
(v1.16.1)
CVE-2026-111750 (AIOHTTP is an asynchronous HTTP client/server framework for
asyncio an ...)
@@ -10257,7 +10257,7 @@ CVE-2026-111999 (Vanus 0.8.0 through 0.9.0 contains a
missing authentication vul
CVE-2026-111998 (Vanus 0.8.0 through 0.9.0 contains a default credentials
vulnerability ...)
NOT-FOR-US: Vanus
CVE-2026-111997 (ip-address before 10.7.4 allows a denial of service (CPU
consumption f ...)
- - node-ip-address <unfixed>
+ - node-ip-address <unfixed> (bug #1151933)
NOTE:
https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5
CVE-2026-111993 (A flaw has been found in Soarkey StudentManagement up to
e08f7f1d5015a ...)
NOT-FOR-US: Soarkey StudentManagement
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5c201df354d157540071262322ff470e25f06a1d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5c201df354d157540071262322ff470e25f06a1d
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
