Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
57458f59 by security tracker role at 2026-10-26T19:13:19+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,53 +1,617 @@
-CVE-2026-99099 [x86/CPU/AMD: Fix AMD TLBI Erratum #1718]
+CVE-2026-97295 (Cross-Site Request Forgery (CSRF) vulnerability in David
Lingren Media ...)
+ TODO: check
+CVE-2026-97255 (Authorization Bypass Through User-Controlled Key vulnerability
in WPro ...)
+ TODO: check
+CVE-2026-97254 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-97200 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-96581 (Authorization Bypass Through User-Controlled Key vulnerability
in ash- ...)
+ TODO: check
+CVE-2026-96432 (A malicious or compromised HTTP/2 server withholding SETTINGS
ACK can ...)
+ TODO: check
+CVE-2026-95664 (Improper Neutralization of Special Elements used in an
Expression Lang ...)
+ TODO: check
+CVE-2026-95663 (Insufficient Session Expiration vulnerability in Apache Camel
Keycloak ...)
+ TODO: check
+CVE-2026-95629 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
+ TODO: check
+CVE-2026-95628 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
+ TODO: check
+CVE-2026-94386 (Use of Cache Containing Sensitive Information vulnerability in
Apache ...)
+ TODO: check
+CVE-2026-94380 (Weak Password Recovery Mechanism for Forgotten Password
vulnerability ...)
+ TODO: check
+CVE-2026-93850 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x
<= 11.7 ...)
+ TODO: check
+CVE-2026-93849 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x
<= 11.7 ...)
+ TODO: check
+CVE-2026-93848 (Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound
internal- ...)
+ TODO: check
+CVE-2026-93847 (Mattermost versions 11.7.x <= 11.7.10 fail to validate
reserved system ...)
+ TODO: check
+CVE-2026-93846 (Mattermost versions 11.7.x <= 11.7.10 fail to restrict which
built-in ...)
+ TODO: check
+CVE-2026-93328 (Path Traversal and Missing Authorization in cloud-storage
source in Go ...)
+ TODO: check
+CVE-2026-92171 (A flaw was found in the Infinispan Operator for Red Hat Data
Grid. Whe ...)
+ TODO: check
+CVE-2026-90885 (Improper Restriction of XML External Entity Reference
vulnerability in ...)
+ TODO: check
+CVE-2026-89209 (A vulnerability has been identified in Mendix SAML (Mendix 10
compatib ...)
+ TODO: check
+CVE-2026-85297 (Bucket Squatting in Google Cloud Run MCP versions prior to
1.11.0 on G ...)
+ TODO: check
+CVE-2026-82947 (SOEM version 2.0.0 and earlier contains multiple
vulnerabilities in fr ...)
+ TODO: check
+CVE-2026-82946 (SOEM version 2.0.0 and earlier contains a vulnerability where
a malici ...)
+ TODO: check
+CVE-2026-82945 (SOEM version 2.0.0 and earlier contains a vulnerability during
device ...)
+ TODO: check
+CVE-2026-82944 (SOEM version 2.0.0 and earlier contains a vulnerability in
multi-segme ...)
+ TODO: check
+CVE-2026-82943 (SOEM version 2.0.0 and earlier contains vulnerabilities where
a malici ...)
+ TODO: check
+CVE-2026-82390 (The Espressif AES driver drivers/crypto/crypto_esp32_aes.c
advertises ...)
+ TODO: check
+CVE-2026-82389 (In the Bluetooth Classic Hands-Free Profile Audio Gateway
role, hfp_ag ...)
+ TODO: check
+CVE-2026-82388 (bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c
allocate ...)
+ TODO: check
+CVE-2026-81509 (nforwardauth is a forward auth service that allows the use of
a single ...)
+ TODO: check
+CVE-2026-81039 (The Bluetooth host pre-allocates a bt_conn object (a
"reservation") fr ...)
+ TODO: check
+CVE-2026-81038 (The Object Transfer Service server builds its Object Action
Control Po ...)
+ TODO: check
+CVE-2026-77062 (The boneIO Black web interface lacks proper clickjacking
protections. ...)
+ TODO: check
+CVE-2026-77061 (boneIO Black directly excludes several API endpoints from the
authenti ...)
+ TODO: check
+CVE-2026-77060 (boneIO black_debian_images stores the Mosquitto MQTT broker
password f ...)
+ TODO: check
+CVE-2026-77059 (boneIO Black contains a TOCTOU race condition in the
create_timedatect ...)
+ TODO: check
+CVE-2026-77058 (boneIO Black is vulnerable to Cross-Site Request Forgery
(CSRF) on all ...)
+ TODO: check
+CVE-2026-77057 (boneIO Black does not limit authentication attempts on its web
interfa ...)
+ TODO: check
+CVE-2026-77056 (boneIO black_debian_images ships with a Mosquitto MQTT broker
that use ...)
+ TODO: check
+CVE-2026-77055 (boneIO black_debian_images gives the boneio service account
excessive ...)
+ TODO: check
+CVE-2026-77054 (boneIO Black stores passwords, including the MQTT broker and
web panel ...)
+ TODO: check
+CVE-2026-77053 (boneIO Black firmware ships with authentication disabled by
default. I ...)
+ TODO: check
+CVE-2026-77052 (boneIO Black exposes a Node-RED instance without
authentication at the ...)
+ TODO: check
+CVE-2026-72758 (When parsing an AS range in Routinator, if the maximum value
of the ra ...)
+ TODO: check
+CVE-2026-72757 (Routinator runs out of open connections on the HTTP server
when many c ...)
+ TODO: check
+CVE-2026-72756 (Routinator exits when an rsync URI for a file obtained over
RRDP conta ...)
+ TODO: check
+CVE-2026-72755 (Routinator stores a newly-retrieved TA certificate via HTTPS
in cache ...)
+ TODO: check
+CVE-2026-72754 (When Routinator encounters a CRL with many entries, it may
hang or run ...)
+ TODO: check
+CVE-2026-72753 (When Routinator encounters an RRDP notification file with gaps
in the ...)
+ TODO: check
+CVE-2026-72752 (Routinator runs out of memory when the JSON output is
requested many t ...)
+ TODO: check
+CVE-2026-71456 (Use of hard-coded cryptographic key vulnerability in Johnson
Controls ...)
+ TODO: check
+CVE-2026-71455 (Cleartext storage of sensitive information in memory
vulnerability in ...)
+ TODO: check
+CVE-2026-70388 (SOEM version 2.0.0 and earlier contains vulnerabilities where
a malici ...)
+ TODO: check
+CVE-2026-70379 (When the vSolution Matrix feature is enabled, affected devices
may mak ...)
+ TODO: check
+CVE-2026-65226
+ REJECTED
+CVE-2026-65222
+ REJECTED
+CVE-2026-65221
+ REJECTED
+CVE-2026-65218
+ REJECTED
+CVE-2026-65217
+ REJECTED
+CVE-2026-65216
+ REJECTED
+CVE-2026-65215
+ REJECTED
+CVE-2026-65214
+ REJECTED
+CVE-2026-65212
+ REJECTED
+CVE-2026-65203
+ REJECTED
+CVE-2026-65202
+ REJECTED
+CVE-2026-65184 (The root-privileged `wsserver` terminal-bridge daemon builds a
shell c ...)
+ TODO: check
+CVE-2026-59107 (A security vulnerability has been identified in the vSolution
Matrix f ...)
+ TODO: check
+CVE-2026-59106 (A security vulnerability has been identified in the WolfProt
interface ...)
+ TODO: check
+CVE-2026-50096 (There is a reflected cross site scripting vulnerability in
Esri Portal ...)
+ TODO: check
+CVE-2026-50095 (There is a stored cross site scripting issue in Esri ArcGIS
Server 11. ...)
+ TODO: check
+CVE-2026-4316 (Reflected Cross-Site Scripting (XSS) in Gym Management Software
IsMyGy ...)
+ TODO: check
+CVE-2026-3322 (Due to improper permission checks inLobster_pro, attackers are
able to ...)
+ TODO: check
+CVE-2026-36698 (Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and
APS-B 2.10 ...)
+ TODO: check
+CVE-2026-33522 (Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote,
unauthe ...)
+ TODO: check
+CVE-2026-33521 (There is s denial of service vulnerability in Esri ArcGIS
Server versi ...)
+ TODO: check
+CVE-2026-33520 (There is a reflected cross site scripting vulnerability in
Esri Portal ...)
+ TODO: check
+CVE-2026-31158 (SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka
softtradein ...)
+ TODO: check
+CVE-2026-19742 (The IPv6 stack derived the long-lived secret key used to
compute RFC 7 ...)
+ TODO: check
+CVE-2026-116638 (The Windows Recovery Environment (WinRE) in Windows 10 and 11
may allo ...)
+ TODO: check
+CVE-2026-116634 (OmniRoute 3.8.50 before 3.8.52 contains a missing
authentication vulne ...)
+ TODO: check
+CVE-2026-116632 (A malicious web page could insert arbitrary text into the
FaceTime cal ...)
+ TODO: check
+CVE-2026-116631 (A malicious web page could open a tel link in a window that
was showin ...)
+ TODO: check
+CVE-2026-116612 (A flaw was found in GStreamer Editing Services
(gst-editing-services). ...)
+ TODO: check
+CVE-2026-116596 (Pyrus Sync for Windows contains a local privilege escalation
vulnerabi ...)
+ TODO: check
+CVE-2026-116544 (Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read
vulnerabili ...)
+ TODO: check
+CVE-2026-116543 (Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds
write vulner ...)
+ TODO: check
+CVE-2026-116542 (Netty netty-tcnative before 2.0.84.Final contains an SNI
hostname spoo ...)
+ TODO: check
+CVE-2026-116541 (Netty netty-tcnative before 2.0.84.Final contains a denial of
service ...)
+ TODO: check
+CVE-2026-116540 (netty-tcnative 2.0.66.Final before 2.0.84.Final built against
OpenSSL ...)
+ TODO: check
+CVE-2026-116539 (Netty netty-tcnative before 2.0.84.Final contains a heap
buffer overfl ...)
+ TODO: check
+CVE-2026-116538 (HtmlSanitizer before 9.2.1039 and 10.0 prereleases before
10.0.1037-be ...)
+ TODO: check
+CVE-2026-116516 (Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to
validate Zo ...)
+ TODO: check
+CVE-2026-116497 (A NULL pointer dereference vulnerability was found in
gssproxy. When a ...)
+ TODO: check
+CVE-2026-116492 (Frappe CRM app before 1.89.1 contains a missing authorization
vulnerab ...)
+ TODO: check
+CVE-2026-116489 (Timescale pgvectorscale before 0.9.1 contains a type
confusion vulnera ...)
+ TODO: check
+CVE-2026-116488 (NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb)
before 2.13 ...)
+ TODO: check
+CVE-2026-116487 (NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb)
before 2.13 ...)
+ TODO: check
+CVE-2026-116486 (Objenesis before 3.6 contains a type confusion vulnerability
that allo ...)
+ TODO: check
+CVE-2026-116485 (danmu_api before 1.21.7 contains an authentication bypass
vulnerabilit ...)
+ TODO: check
+CVE-2026-116476 (A weakness has been identified in a2aproject a2a-dotnet up to
1.0.0-pr ...)
+ TODO: check
+CVE-2026-116471 (A security flaw has been discovered in BKWLD Decoy up to
5.11.1. The i ...)
+ TODO: check
+CVE-2026-116469 (MISP Guard, a proxy-based security filter for MISP (Malware
Informatio ...)
+ TODO: check
+CVE-2026-116467 (A security flaw has been discovered in ggml-org llama.cpp up
to 0.7.0. ...)
+ TODO: check
+CVE-2026-116463 (A vulnerability was identified in FastStone Image Viewer up
to 8.5. Af ...)
+ TODO: check
+CVE-2026-116461 (A vulnerability was determined in Omega Solution Restro POS
up to 2026 ...)
+ TODO: check
+CVE-2026-116408 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-116403 (Concurrent Execution using Shared Resource with Improper
Synchronizati ...)
+ TODO: check
+CVE-2026-116400 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-116398 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-116396 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-116395 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-116394 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-116388 (Missing Authorization vulnerability in TMS Amelia
ameliabooking allows ...)
+ TODO: check
+CVE-2026-116385 (A security vulnerability has been detected in Bdtask Garage
24 Garage ...)
+ TODO: check
+CVE-2026-116384 (A weakness has been identified in Bdtask Garage 24 Garage
Management S ...)
+ TODO: check
+CVE-2026-116372 (MISP mispguard is a security filtering proxy that inspects
and blocks ...)
+ TODO: check
+CVE-2026-116371 (A weakness has been identified in Akuvox Akubela HyPanel PS51
51.130.4 ...)
+ TODO: check
+CVE-2026-116370 (A security flaw has been discovered in 2K Games Sid Meier's
Civilizati ...)
+ TODO: check
+CVE-2026-116369 (A vulnerability was identified in Sunwood-ai-labs
github-kanban-mcp-se ...)
+ TODO: check
+CVE-2026-116368 (A vulnerability was determined in DeepSeek Harness up to
0.2.0-rc.2. T ...)
+ TODO: check
+CVE-2026-116367 (A vulnerability was found in DeepSeek Harness up to
0.1.0-rc.5. This v ...)
+ TODO: check
+CVE-2026-116340 (A vulnerability was identified in iFlytek astron-agent up to
1.1.2. Th ...)
+ TODO: check
+CVE-2026-116339 (A vulnerability was determined in iFlytek astron-agent up to
1.1.2. Th ...)
+ TODO: check
+CVE-2026-116284 (A security vulnerability has been detected in Kameleo up to
5.3.1. Thi ...)
+ TODO: check
+CVE-2026-116283 (A weakness has been identified in Kameleo up to 5.0.1.26.
This affects ...)
+ TODO: check
+CVE-2026-116282 (A security flaw has been discovered in Kameleo up to 5.3.1.
Affected b ...)
+ TODO: check
+CVE-2026-116281 (A vulnerability was identified in Kameleo up to 5.0.1.26.
Affected by ...)
+ TODO: check
+CVE-2026-116280 (A vulnerability was determined in Kameleo up to 5.0.1.26.
Affected is ...)
+ TODO: check
+CVE-2026-116275 (A vulnerability was found in AllenAI AllenNLP up to 2.10.1.
This impac ...)
+ TODO: check
+CVE-2026-116274 (A vulnerability has been found in JIZHICMS up to 2.5.6. This
affects t ...)
+ TODO: check
+CVE-2026-116263 (A flaw has been found in HaschekSolutions PictShare up to
3.7.1. The i ...)
+ TODO: check
+CVE-2026-116262 (A vulnerability was detected in libimobiledevice up to 1.4.0.
The affe ...)
+ TODO: check
+CVE-2026-116261 (A security vulnerability has been detected in
libimobiledevice up to 1 ...)
+ TODO: check
+CVE-2026-116260 (A weakness has been identified in libimobiledevice up to
1.4.0. This i ...)
+ TODO: check
+CVE-2026-116259 (A security flaw has been discovered in libimobiledevice up to
1.4.0. T ...)
+ TODO: check
+CVE-2026-116258 (A vulnerability was identified in libimobiledevice up to
1.4.0. This a ...)
+ TODO: check
+CVE-2026-116257 (A vulnerability was determined in BillaBear up to 2025.01.03.
Affected ...)
+ TODO: check
+CVE-2026-116256 (A vulnerability was found in geesondog RhaPHP up to
7ae639ccf8dcb627fa ...)
+ TODO: check
+CVE-2026-116255 (A vulnerability has been found in PGYER codefever up to
0c35e60f006f9d ...)
+ TODO: check
+CVE-2026-116254 (A vulnerability was identified in rathena FluxCP up to
98cd4b8fd83228c ...)
+ TODO: check
+CVE-2026-116253 (A vulnerability was determined in DedeCMS 5.7.118. This
vulnerability ...)
+ TODO: check
+CVE-2026-116237 (A vulnerability was found in Oray Pugongying X5 Pro 7.6.1.
This affect ...)
+ TODO: check
+CVE-2026-116236 (A vulnerability has been found in Oray Pugongying X5 Pro
7.6.1. Affect ...)
+ TODO: check
+CVE-2026-116235 (A flaw has been found in Oray Pugongying X5 Pro 7.6.1.
Affected by thi ...)
+ TODO: check
+CVE-2026-116234 (A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1.
Affected ...)
+ TODO: check
+CVE-2026-116233 (A security vulnerability has been detected in Oray Pugongying
X5 Pro 7 ...)
+ TODO: check
+CVE-2026-116232 (A weakness has been identified in Oray Pugongying X5 Pro
7.6.1. This a ...)
+ TODO: check
+CVE-2026-116231 (A security flaw has been discovered in Oray Pugongying X5 Pro
7.6.1. T ...)
+ TODO: check
+CVE-2026-116230 (A vulnerability was identified in Ndemic Creations Plague Inc
Evolved ...)
+ TODO: check
+CVE-2026-116229 (A vulnerability was determined in ffxiv-teamcraft FFXIV
Teamcraft up t ...)
+ TODO: check
+CVE-2026-116219 (Dolibarr ERP CRM before 24.0.0 contains an OS command
injection vulner ...)
+ TODO: check
+CVE-2026-116218 (Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL
injection vulner ...)
+ TODO: check
+CVE-2026-116217 (RosarioSIS before 12.9.2 contains a reflected cross-site
scripting vul ...)
+ TODO: check
+CVE-2026-116216 (MacCMS v10 through 2026.1000.4056 contains a mass assignment
vulnerabi ...)
+ TODO: check
+CVE-2026-116215 (MacCMS v10 through 2026.1000.4056 contains a race condition
vulnerabil ...)
+ TODO: check
+CVE-2026-116214 (MacCMS v10 before 2026.1000.4054 contains an authentication
bypass vul ...)
+ TODO: check
+CVE-2026-116213 (Webasyst Framework through 4.4.0 contains an arbitrary file
read vulne ...)
+ TODO: check
+CVE-2026-116212 (Webasyst Framework through 4.4.0 contains a stored cross-site
scriptin ...)
+ TODO: check
+CVE-2026-116210 (Webasyst Framework through 4.4.0 contains a cross-site
request forgery ...)
+ TODO: check
+CVE-2026-115966 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-115961 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-115960 (Missing Authorization vulnerability in WPExperts APIExperts
Square for ...)
+ TODO: check
+CVE-2026-115959 (Missing Authorization vulnerability in WPExperts APIExperts
Square for ...)
+ TODO: check
+CVE-2026-115958 (Missing Authorization vulnerability in WP Discussion Board WP
Discussi ...)
+ TODO: check
+CVE-2026-115956 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-115955 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-115954 (Missing Authorization vulnerability in Dylan Kuhn Geo Mashup
geo-mash ...)
+ TODO: check
+CVE-2026-115953 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-115951 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-115950 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-115949 (Missing Authorization vulnerability in WP Smart Widgets
Better Post & ...)
+ TODO: check
+CVE-2026-115948 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-115930 (The MongoDB Shell (mongosh) relies on Node.jsas a third-party
runtime ...)
+ TODO: check
+CVE-2026-115923 (Backstage is an open framework for building developer
portals. Prior t ...)
+ TODO: check
+CVE-2026-115922 (Open Neural Network Exchange (ONNX) is an open standard for
machine le ...)
+ TODO: check
+CVE-2026-115921 (Open Neural Network Exchange (ONNX) is an open standard for
machine le ...)
+ TODO: check
+CVE-2026-115920 (Open Neural Network Exchange (ONNX) is an open standard for
machine le ...)
+ TODO: check
+CVE-2026-115919 (Open Neural Network Exchange (ONNX) is an open standard for
machine le ...)
+ TODO: check
+CVE-2026-115918 (vLLM is an inference and serving engine for large language
models. Fro ...)
+ TODO: check
+CVE-2026-115917 (vLLM is an inference and serving engine for large language
models. Pri ...)
+ TODO: check
+CVE-2026-115916 (vLLM is an inference and serving engine for large language
models. Pri ...)
+ TODO: check
+CVE-2026-115915 (vLLM is an inference and serving engine for large language
models. Pri ...)
+ TODO: check
+CVE-2026-115914 (vLLM is an inference and serving engine for large language
models. Fro ...)
+ TODO: check
+CVE-2026-115913 (vLLM is an inference and serving engine for large language
models. Pri ...)
+ TODO: check
+CVE-2026-115912 (vLLM is an inference and serving engine for large language
models. Pri ...)
+ TODO: check
+CVE-2026-115911 (vLLM is an inference and serving engine for large language
models. Fro ...)
+ TODO: check
+CVE-2026-115910 (Python Social Auth is a social authentication and
registration mechani ...)
+ TODO: check
+CVE-2026-115909 (zip is a zip library for Rust that supports reading and
writing simple ...)
+ TODO: check
+CVE-2026-115908 (zip is a zip library for Rust that supports reading and
writing simple ...)
+ TODO: check
+CVE-2026-115907 (zip is a zip library for Rust that supports reading and
writing simple ...)
+ TODO: check
+CVE-2026-115906 (zip is a zip library for Rust that supports reading and
writing simple ...)
+ TODO: check
+CVE-2026-115905 (zip is a zip library for Rust that supports reading and
writing simple ...)
+ TODO: check
+CVE-2026-115804 (HashiCorp Consul and Consul Enterprise are vulnerable to an
authorizat ...)
+ TODO: check
+CVE-2026-115748 (**UNSUPPORTED WHEN ASSIGNED**Authorization bypass in Apache
Vysper, al ...)
+ TODO: check
+CVE-2026-115721 (**UNSUPPORTED WHEN ASSIGNED**Unbounded allocation in XML
parsing in Ap ...)
+ TODO: check
+CVE-2026-115720 (Frappe Builder before 1.36.1 contains a server-side request
forgery vu ...)
+ TODO: check
+CVE-2026-115718 (Frappe Builder versions 1.33.0 before1.36.0 contain a missing
authoriz ...)
+ TODO: check
+CVE-2026-115717 (Frappe Builder versions before 1.36.1 contain a server-side
request fo ...)
+ TODO: check
+CVE-2026-115700 (Interpretation Conflict vulnerability in hackney_url in
benoitc hackne ...)
+ TODO: check
+CVE-2026-115693 (Improper Certificate Validation vulnerability in hackney_ssl
in benoit ...)
+ TODO: check
+CVE-2026-115680 (Arm Keil MDK-Middleware 8.0.0-8.3.0 may allowDHCPv6
Option-Walk Over-R ...)
+ TODO: check
+CVE-2026-115679 (Arm Keil MDK-Middleware 8.3.0 may allowout-of-boundsreads and
writes t ...)
+ TODO: check
+CVE-2026-115678 (Arm Keil MDK-Middleware 8.0.0-8.3.0 may
allowpre-authentication out-of ...)
+ TODO: check
+CVE-2026-115614 (Missing Authorization vulnerability in Magepeople inc.
Booking and Ren ...)
+ TODO: check
+CVE-2026-115613 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-115608 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2026-115602 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-115598 (Missing Authorization vulnerability in ThimPress LearnPress
learnpress ...)
+ TODO: check
+CVE-2026-115597 (Missing Authorization vulnerability in ThimPress LearnPress
learnpress ...)
+ TODO: check
+CVE-2026-115595 (Missing Authorization vulnerability in Supsystic Contact Form
by Supsy ...)
+ TODO: check
+CVE-2026-115594 (Insertion of Sensitive Information Into Sent Data
vulnerability in Dav ...)
+ TODO: check
+CVE-2026-115425 (Multiple cross site scripting (XSS) vulnerabilities
affectOPNsense fir ...)
+ TODO: check
+CVE-2026-115418 (SQL injection in the database-query custom resource handlers
in the Am ...)
+ TODO: check
+CVE-2026-115269 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-115196 (An Open Redirect vulnerability exists in the public form
submission en ...)
+ TODO: check
+CVE-2026-115195 (A broken access control vulnerability exists in the Mautic
Stats API ( ...)
+ TODO: check
+CVE-2026-115194 (A path traversal vulnerability exists in the Mautic Asset
API. When cr ...)
+ TODO: check
+CVE-2026-115193 (A stored Cross-Site Scripting (XSS) vulnerability exists in
the contac ...)
+ TODO: check
+CVE-2026-115192 (An SQL Injection vulnerability exists in the dashboard widget
data API ...)
+ TODO: check
+CVE-2026-115191 (A SQL injection vulnerability exists in a contact lookup AJAX
endpoint ...)
+ TODO: check
+CVE-2026-115190 (An insecure deserialization (PHP object injection)
vulnerability exist ...)
+ TODO: check
+CVE-2026-115189 (A server-side template injection vulnerability exists in the
Twig them ...)
+ TODO: check
+CVE-2026-115188 (An unrestricted file upload vulnerability exists in the
campaign impor ...)
+ TODO: check
+CVE-2026-114710 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-114709 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-114708 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-114707 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-114216 (Inconsistent Interpretation of HTTP Requests ('HTTP
Request/Response S ...)
+ TODO: check
+CVE-2026-114213 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-113440 (Insufficiently Protected Credentials vulnerability in hackney
in benoi ...)
+ TODO: check
+CVE-2026-113438 (Pleasanter provided fails to properly verify passwords in
LDAP authent ...)
+ TODO: check
+CVE-2026-113436 (Inefficient Algorithmic Complexity vulnerability in the
header integer ...)
+ TODO: check
+CVE-2026-112880 (Improper Neutralization of CRLF Sequences in HTTP Headers
('HTTP Reque ...)
+ TODO: check
+CVE-2026-112865 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-112839 (Missing Authorization vulnerability in VillaTheme Customer
Coupons for ...)
+ TODO: check
+CVE-2026-112828 (Missing Authorization vulnerability in Meow Apps AI Engine
ai-engine a ...)
+ TODO: check
+CVE-2026-112346 (OpenHands Software Agent SDK before 1.52.0 contains an
unauthenticated ...)
+ TODO: check
+CVE-2026-112345 (TTLock Android application before v9.8.260718 and associated
smart-loc ...)
+ TODO: check
+CVE-2026-112344 (Syncplify Server! before 8.8.0 contains a path traversal
vulnerability ...)
+ TODO: check
+CVE-2026-112343 (Syncplify Server! before 8.8.0 contains an access control
bypass vulne ...)
+ TODO: check
+CVE-2026-112250 (A vulnerability has been identified in BRAIN2 versions up to
and inclu ...)
+ TODO: check
+CVE-2026-111841 (Cross-Site Request Forgery (CSRF) vulnerability in Aman
FunnelKit Auto ...)
+ TODO: check
+CVE-2026-111590 (A wide range of Harbor versions allow SSRF via its webhook
delivery co ...)
+ TODO: check
+CVE-2026-111404 (Concurrent Execution using Shared Resource with Improper
Synchronizati ...)
+ TODO: check
+CVE-2026-111103 (Improper Cleanup on Thrown Exception vulnerability in the
HTTP/2 handl ...)
+ TODO: check
+CVE-2026-111101 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-110748 (This issue affects Apache SIS from version 0.7 through 1.6
inclusive. ...)
+ TODO: check
+CVE-2026-110733 (Vulnerability in the SQL storage module of Apache SIS. When
sorting a ...)
+ TODO: check
+CVE-2026-110720 (Consul-k8s versions 0.42.0 and later are vulnerable to a
cross-namespa ...)
+ TODO: check
+CVE-2026-110499 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-110475 (This vulnerability exists in the CreditNirvana Collections
Platform du ...)
+ TODO: check
+CVE-2026-110474 (This vulnerability exists in the CreditNirvana Agentic AI
Call Centre ...)
+ TODO: check
+CVE-2026-110377 (Missing Authorization vulnerability in VillaTheme Bopo \u2013
WooComme ...)
+ TODO: check
+CVE-2026-110376 (Missing Authorization vulnerability in VillaTheme DEPART
depart-deposi ...)
+ TODO: check
+CVE-2026-110314 (Client-Side Enforcement of Server-Side Security vulnerability
in the W ...)
+ TODO: check
+CVE-2026-10757 (There is a SQL injection vulnerability in Esri ArcGIS Server
versions ...)
+ TODO: check
+CVE-2026-109584 (Improper Handling of Highly Compressed Data (Data
Amplification) vulne ...)
+ TODO: check
+CVE-2026-108529 (Inefficient Algorithmic Complexity vulnerability in the
HTTP/2 impleme ...)
+ TODO: check
+CVE-2026-108525 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-107656 (An authentication bypass using an alternate path or channel
vulnerabil ...)
+ TODO: check
+CVE-2026-107157 (Out-of-bounds read vulnerability in QCborValue::fromCbor()
impacts Qt ...)
+ TODO: check
+CVE-2026-107092 (NexoPOS v6.2.4 is vulnerable to Directory Traversal via the
api/update ...)
+ TODO: check
+CVE-2026-107091 (An issue in HUION Inspiroy Frego S (L310) Windows Driver
20.0.1.118 al ...)
+ TODO: check
+CVE-2026-107090 (An issue in Maltego Technologies GmbH Maltego Windows
Installer 4.13.0 ...)
+ TODO: check
+CVE-2026-107080 (OpenJPEG 2.4.0 through 2.5.4, and git master through commit
8314119b, ...)
+ TODO: check
+CVE-2026-106781 (An issue in WCH CH340/CH341 USB-to-Serial Windows Driver
setup package ...)
+ TODO: check
+CVE-2026-106677 (Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in
ChatServ ...)
+ TODO: check
+CVE-2026-106676 (qiujie mall-server 0.0.1-SNAPSHOT contains an integer
overflow in Cart ...)
+ TODO: check
+CVE-2026-105947 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
+ TODO: check
+CVE-2026-105765 (HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are
vulnerab ...)
+ TODO: check
+CVE-2026-105626 (HashiCorp Consul and Consul Enterprise are vulnerable to a
denial of s ...)
+ TODO: check
+CVE-2026-105608 (HashiCorp Consul and Consul Enterprise are vulnerable to an
authorizat ...)
+ TODO: check
+CVE-2026-104594 (libosmocore through 1.14.1 contains out-of-bounds reads in
the IPA CCM ...)
+ TODO: check
+CVE-2026-104593 (osmo-msc through 1.15.0 contains a stack-based buffer
overflow in deco ...)
+ TODO: check
+CVE-2026-104592 (libosmocore through 1.14.1 contains an out-of-bounds read in
the CBSP ...)
+ TODO: check
+CVE-2026-104591 (libosmocore through 1.14.1 contains a buffer overflow in
osmo_iuup_com ...)
+ TODO: check
+CVE-2026-103377 (A reflected Cross-Site Scripting (XSS) vulnerability has been
identifi ...)
+ TODO: check
+CVE-2026-102649 (Burrito is a Terraform Automation Collaboration Software
(TACoS) Kuber ...)
+ TODO: check
+CVE-2026-101259 (Generation of Error Message Containing Sensitive Information
vulnerabi ...)
+ TODO: check
+CVE-2013-10077 (A weakness has been identified in OctoPrint 1.0.0. This
impacts the fu ...)
+ TODO: check
+CVE-2012-20006
+ REJECTED
+CVE-2026-99099 (In the Linux kernel, the following vulnerability has been
resolved: x ...)
- linux 7.2.11-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/87db7795cbaaf636ae22ae031f4906db7bb77803 (7.3-rc7)
-CVE-2026-99097 [tee: shm: reject zero-sized allocations in
tee_dyn_shm_alloc_helper()]
+CVE-2026-99097 (In the Linux kernel, the following vulnerability has been
resolved: t ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/b7f925fd5226deb953c8dcdc9677d3fcc2717c00 (7.3-rc7)
-CVE-2026-99096 [io_uring/register: don't exempt disabled rings from task
restrictions]
+CVE-2026-99096 (In the Linux kernel, the following vulnerability has been
resolved: i ...)
- linux 7.2.11-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/6da8f402e362b2f546e2efb7167fc9597aef6faf (7.3-rc7)
-CVE-2026-99094 [Bluetooth: btintel_pcie: fix TX descriptor bounds check]
+CVE-2026-99094 (In the Linux kernel, the following vulnerability has been
resolved: B ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/baa53af641c9e3644e717b8dfd1b95a55a0c111b (7.3-rc7)
-CVE-2026-99093 [mm: don't schedule deferred kernel page table freeing while
booting]
+CVE-2026-99093 (In the Linux kernel, the following vulnerability has been
resolved: m ...)
- linux 7.2.11-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/2fb552b0bee70c24c092720028ab4620f5eb2646 (7.3-rc7)
-CVE-2026-99098 [dm-integrity: fix buffer overflow in inline mode with large
tag size]
+CVE-2026-99098 (In the Linux kernel, the following vulnerability has been
resolved: d ...)
- linux 7.2.11-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/764b683a6180fd72c931c13fea98d383506a3475 (7.3-rc7)
-CVE-2026-99095 [drm/vc4: drain the hangcheck timer and works on V3D unbind]
+CVE-2026-99095 (In the Linux kernel, the following vulnerability has been
resolved: d ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
NOTE:
https://git.kernel.org/linus/94cf5971b1d04c6382437387c4dc3836cc7a1437 (7.3-rc7)
-CVE-2026-99092 [riscv: patch: fix handling of bpf-jit execmem addresses]
+CVE-2026-99092 (In the Linux kernel, the following vulnerability has been
resolved: r ...)
- linux 7.2.11-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06 (7.3-rc7)
-CVE-2026-99091 [Bluetooth: MGMT: Fix status of pending commands flushed on
power off]
+CVE-2026-99091 (In the Linux kernel, the following vulnerability has been
resolved: B ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
NOTE:
https://git.kernel.org/linus/86ef0f58bdecdedb3a1240971c56d71b7e4ce3fc (7.3-rc7)
-CVE-2026-99090 [drm/amdgpu: serialize vblank counter reads against GPU reset]
+CVE-2026-99090 (In the Linux kernel, the following vulnerability has been
resolved: d ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
NOTE:
https://git.kernel.org/linus/1a6023edfbb5673f55fab6348f135fb3b1428ea5 (7.3-rc7)
-CVE-2026-99089 [ASoC: samsung: i2s: enable op_clk in probe to balance runtime
PM]
+CVE-2026-99089 (In the Linux kernel, the following vulnerability has been
resolved: A ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
NOTE:
https://git.kernel.org/linus/7529254014764ae0b8c33d5c61a58f36c65b1a1c (7.3-rc7)
-CVE-2026-99088 [net: openvswitch: validate transport header presence in
set_ipv6_addr]
+CVE-2026-99088 (In the Linux kernel, the following vulnerability has been
resolved: n ...)
- linux 7.2.11-1
[trixie] - linux 6.12.113-1
NOTE:
https://git.kernel.org/linus/3c6a4b11330fe424557538a98fca9f0a4c5bf313 (7.3-rc7)
@@ -2376,7 +2940,7 @@ CVE-2026-79846 (Command injection vulnerabilities exist
in the affected interfac
NOT-FOR-US: HPE
CVE-2026-79844 (Authentication bypass vulnerabilities in the affected
interface of AOS ...)
NOT-FOR-US: HPE
-CVE-2026-78846 (AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to
Buffer Overfl ...)
+CVE-2026-78846 (Multiple AiDot devices are vulnerable to a heap-based buffer
overflow ...)
NOT-FOR-US: AiDot Linkind Matter Smart Plug
CVE-2026-78801 (An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6
Dual-Band Fib ...)
NOT-FOR-US: SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band
Fiber Router (AX1800M)
@@ -4674,6 +5238,7 @@ CVE-2026-91489 (Vulnerability in the Oracle Identity
Manager Connector product o
CVE-2026-91488 (Vulnerability in the Oracle Identity Manager Connector product
of Orac ...)
NOT-FOR-US: Oracle
CVE-2026-91487 (Vulnerability in Oracle Java SE (component: Compiler).
Supported vers ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4721,6 +5286,7 @@ CVE-2026-91466 (Vulnerability in the PeopleSoft
Enterprise FIN Common Objects Ar
CVE-2026-91465 (Vulnerability in the PeopleSoft Enterprise FIN Common Objects
Argentin ...)
NOT-FOR-US: Oracle
CVE-2026-91464 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4729,6 +5295,7 @@ CVE-2026-91464 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91463 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4737,6 +5304,7 @@ CVE-2026-91463 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91462 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4745,6 +5313,7 @@ CVE-2026-91462 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91461 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4763,6 +5332,7 @@ CVE-2026-91457 (Vulnerability in the Oracle Outside In
Technology product of Ora
CVE-2026-91455 (Vulnerability in the JD Edwards EnterpriseOne Tools product of
Oracle ...)
NOT-FOR-US: Oracle
CVE-2026-91453 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4771,6 +5341,7 @@ CVE-2026-91453 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91452 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4779,6 +5350,7 @@ CVE-2026-91452 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91451 (Vulnerability in Oracle Java SE (component: Networking).
Supported ve ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4849,6 +5421,7 @@ CVE-2026-91420 (Vulnerability in the Siebel CRM
Deployment product of Oracle Sie
CVE-2026-91419 (Vulnerability in the Oracle HTTP Server product of Oracle
Fusion Middl ...)
NOT-FOR-US: Oracle
CVE-2026-91418 (Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle
GraalVM for ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4860,6 +5433,7 @@ CVE-2026-91417 (Vulnerability in the Oracle Java SE,
Oracle GraalVM Enterprise E
- openjdk-8 <unfixed> (bug #1151673)
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91415 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4874,12 +5448,14 @@ CVE-2026-91413 (Vulnerability in the Siebel CRM
Development product of Oracle Si
CVE-2026-91412 (Vulnerability in the Siebel CRM End User product of Oracle
Siebel CRM ...)
NOT-FOR-US: Oracle
CVE-2026-91411 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
- openjdk-21 21.0.13+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91410 (Vulnerability in Oracle Java SE (component: Libraries).
Supported ver ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4905,6 +5481,7 @@ CVE-2026-91402 (Vulnerability in the Oracle Java SE,
Oracle JavaFX, Oracle Graal
[bookworm] - openjfx <not-affected> (Vulnerable code not present, only
affects 21 and later)
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91400 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4915,6 +5492,7 @@ CVE-2026-91400 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
CVE-2026-91399 (Vulnerability in the Primavera P6 Enterprise Project Portfolio
Managem ...)
NOT-FOR-US: Oracle
CVE-2026-91398 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4923,6 +5501,7 @@ CVE-2026-91398 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91397 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4939,6 +5518,7 @@ CVE-2026-91395 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
- openjdk-11 <unfixed>
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91394 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK
product of ...)
+ {DLA-4861-1}
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
- openjdk-21 21.0.13+9-1
@@ -4971,6 +5551,7 @@ CVE-2026-91384 (Vulnerability in the JD Edwards
EnterpriseOne Tools product of O
CVE-2026-91383 (Vulnerability in the JD Edwards EnterpriseOne Tools product of
Oracle ...)
NOT-FOR-US: Oracle
CVE-2026-91382 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4980,6 +5561,7 @@ CVE-2026-91381 (Vulnerability in the Oracle Java SE,
Oracle GraalVM Enterprise E
- openjdk-8 <unfixed> (bug #1151673)
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91380 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -4988,6 +5570,7 @@ CVE-2026-91380 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91379 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5002,6 +5585,7 @@ CVE-2026-91377 (Vulnerability in the Siebel CRM
Integration product of Oracle Si
CVE-2026-91376 (Vulnerability in the Primavera P6 Enterprise Project Portfolio
Managem ...)
NOT-FOR-US: Oracle
CVE-2026-91375 (Vulnerability in Oracle Java SE (component: Libraries).
Supported ver ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5010,6 +5594,7 @@ CVE-2026-91375 (Vulnerability in Oracle Java SE
(component: Libraries). Support
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91374 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5018,6 +5603,7 @@ CVE-2026-91374 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91373 (Vulnerability in Oracle Java SE (component: JSSE). Supported
versions ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5100,6 +5686,7 @@ CVE-2026-91337 (Vulnerability in the iProcurement product
of Oracle E-Business S
CVE-2026-91336 (Vulnerability in the Oracle Solaris product of Oracle Systems
(compone ...)
NOT-FOR-US: Oracle
CVE-2026-91335 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5108,6 +5695,7 @@ CVE-2026-91335 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91334 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5121,6 +5709,7 @@ CVE-2026-91333 (Vulnerability in Oracle Java SE
(component: Security). Supporte
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-91332 (Vulnerability in Oracle Java SE (component: Networking).
Supported ve ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5489,6 +6078,7 @@ CVE-2026-87370 (Vulnerability in the Oracle WebCenter
Content product of Oracle
CVE-2026-87369 (Vulnerability in the Oracle Service Bus product of Oracle
Fusion Middl ...)
NOT-FOR-US: Oracle
CVE-2026-87367 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5639,6 +6229,7 @@ CVE-2026-87296 (Vulnerability in the Oracle Access
Manager product of Oracle Fus
CVE-2026-87295 (Vulnerability in the Oracle HRMS (India) product of Oracle
E-Business ...)
NOT-FOR-US: Oracle
CVE-2026-87294 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5650,6 +6241,7 @@ CVE-2026-87293 (Vulnerability in Oracle Java SE
(component: RMI). Supported ver
- openjdk-8 <unfixed> (bug #1151673)
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-87292 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5663,6 +6255,7 @@ CVE-2026-87291 (Vulnerability in Oracle Java SE
(component: Networking). Suppor
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-87290 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5701,6 +6294,7 @@ CVE-2026-83402 (Vulnerability in the Oracle Identity
Manager product of Oracle F
CVE-2026-83401 (Vulnerability in the Oracle Identity Manager product of Oracle
Fusion ...)
NOT-FOR-US: Oracle
CVE-2026-83400 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5717,6 +6311,7 @@ CVE-2026-83397 (Vulnerability in the Oracle Data
Integrator product of Oracle Fu
CVE-2026-83396 (Vulnerability in the Oracle Data Integrator product of Oracle
Fusion M ...)
NOT-FOR-US: Oracle
CVE-2026-83395 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5739,6 +6334,7 @@ CVE-2026-83389 (Vulnerability in the Oracle HRMS (UK)
product of Oracle E-Busine
CVE-2026-83388 (Vulnerability in the Oracle Applications Manager product of
Oracle E-B ...)
NOT-FOR-US: Oracle
CVE-2026-83387 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5757,6 +6353,7 @@ CVE-2026-83383 (Vulnerability in the Oracle HRMS (US)
product of Oracle E-Busine
CVE-2026-83382 (Vulnerability in the Oracle Report Manager product of Oracle
E-Busines ...)
NOT-FOR-US: Oracle
CVE-2026-83381 (Vulnerability in Oracle Java SE (component: Security).
Supported vers ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5765,6 +6362,7 @@ CVE-2026-83381 (Vulnerability in Oracle Java SE
(component: Security). Supporte
- openjdk-27 27.0.1+9-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-83380 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5782,6 +6380,7 @@ CVE-2026-83378 (Vulnerability in Oracle Java SE
(component: Compiler). Supporte
CVE-2026-83377 (Vulnerability in the Oracle HRMS (US) product of Oracle
E-Business Sui ...)
NOT-FOR-US: Oracle
CVE-2026-83376 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -5792,6 +6391,7 @@ CVE-2026-83376 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
CVE-2026-83375 (Vulnerability in the PeopleSoft Enterprise HCM Human Resources
product ...)
NOT-FOR-US: Oracle
CVE-2026-83374 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
+ {DLA-4861-1}
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- openjdk-17 17.0.21+9-1
@@ -6090,15 +6690,15 @@ CVE-2026-113869 (When Thunderbird asked for a security
device password (for exam
- thunderbird <not-affected> (Only affects Thunderbird post ESR153)
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-114/#CVE-2026-113869
CVE-2026-113868 (When authenticating to a POP3 or SMTP server using NTLM,
Thunderbird d ...)
- {DSA-6585-1}
+ {DSA-6585-1 DLA-4863-1}
- thunderbird 1:153.5.1esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/#CVE-2026-113868
CVE-2026-113867 (Thunderbird did not escape attribute values when serializing
outgoing ...)
- {DSA-6585-1}
+ {DSA-6585-1 DLA-4863-1}
- thunderbird 1:153.5.1esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/#CVE-2026-113867
CVE-2026-113866 (When setting up an account, Thunderbird's Exchange
AutoDiscover lookup ...)
- {DSA-6585-1}
+ {DSA-6585-1 DLA-4863-1}
- thunderbird 1:153.5.1esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/#CVE-2026-113866
CVE-2026-113776 (virtualenv is a tool for creating isolated virtual python
environments ...)
@@ -9149,7 +9749,7 @@ CVE-2026-113400 (Uninitialized memory in the Audio/Video:
cubeb component. This
- firefox 158.0.1-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113400
CVE-2026-113470 (Cryptographic issue in the Security Block-lists, Allow-lists,
and othe ...)
- {DSA-6585-1 DSA-6573-1 DLA-4847-1}
+ {DSA-6585-1 DSA-6573-1 DLA-4863-1 DLA-4847-1}
- firefox 158.0.1-1
- firefox-esr 153.5.1esr-1
- thunderbird 1:153.5.1esr-1
@@ -21425,7 +22025,7 @@ CVE-2026-74045 (Wazuh from 3.12.0 before 4.14.8
contains a heap buffer overflow
NOT-FOR-US: Wazuh
CVE-2026-74043 (Wazuh from 4.1.1 before 4.14.8 contains a path traversal
vulnerability ...)
NOT-FOR-US: Wazuh
-CVE-2026-74041 (Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity
mismatch betwee ...)
+CVE-2026-74041 (Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a
case-sensitivity mism ...)
NOT-FOR-US: Wazuh
CVE-2026-74040 (Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary
file over ...)
NOT-FOR-US: Wazuh
@@ -21606,7 +22206,7 @@ CVE-2026-11731 (An authentication bypass vulnerability
in the listed NETGEAR RAX
CVE-2026-11730 (Insufficient session randomness vulnerability in the listed
NETGEAR Ex ...)
NOT-FOR-US: Netgear
CVE-2026-110249 (A malicious, compromised, or MITM-controlled Exchange server
can retur ...)
- {DSA-6585-1}
+ {DSA-6585-1 DLA-4863-1}
- thunderbird 1:153.5.0esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-110249
CVE-2026-110247 (Several buffer-growth sites in libmime performed size
arithmetic in 32 ...)
@@ -22272,7 +22872,7 @@ CVE-2026-109704 (Privilege escalation in the
Application Update component. This
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109704
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109704
CVE-2026-109705 (Sandbox escape, site isolation issue due to incorrect
boundary conditi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22280,7 +22880,7 @@ CVE-2026-109705 (Sandbox escape, site isolation issue
due to incorrect boundary
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109705
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109705
CVE-2026-109706 (Use-after-free in the Storage: IndexedDB component. This
vulnerability ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22288,7 +22888,7 @@ CVE-2026-109706 (Use-after-free in the Storage:
IndexedDB component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109706
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109706
CVE-2026-109707 (Sandbox escape due to use-after-free in the Networking
component. This ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22296,7 +22896,7 @@ CVE-2026-109707 (Sandbox escape due to use-after-free
in the Networking componen
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109707
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109707
CVE-2026-109708 (Sandbox escape due to incorrect boundary conditions in the
Networking ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22304,7 +22904,7 @@ CVE-2026-109708 (Sandbox escape due to incorrect
boundary conditions in the Netw
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109708
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109708
CVE-2026-109709 (Information disclosure, privilege escalation in the Security:
Process ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22312,7 +22912,7 @@ CVE-2026-109709 (Information disclosure, privilege
escalation in the Security: P
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109709
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109709
CVE-2026-109710 (Use-after-free in the Graphics: Text component. This
vulnerability was ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22320,7 +22920,7 @@ CVE-2026-109710 (Use-after-free in the Graphics: Text
component. This vulnerabil
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109710
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109710
CVE-2026-109711 (Use-after-free in the Graphics: Canvas2D component. This
vulnerability ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22328,7 +22928,7 @@ CVE-2026-109711 (Use-after-free in the Graphics:
Canvas2D component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109711
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109711
CVE-2026-109712 (Sandbox escape due to uninitialized memory in the Graphics
component. ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22336,7 +22936,7 @@ CVE-2026-109712 (Sandbox escape due to uninitialized
memory in the Graphics comp
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109712
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109712
CVE-2026-109713 (Use-after-free in the Crash Reporting component. This
vulnerability wa ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22347,7 +22947,7 @@ CVE-2026-109714 (Incorrect boundary conditions in the
Layout component. This vul
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109714
CVE-2026-109715 (Incorrect boundary conditions in the JavaScript Engine
component. This ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22355,7 +22955,7 @@ CVE-2026-109715 (Incorrect boundary conditions in the
JavaScript Engine componen
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109715
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109715
CVE-2026-109716 (Incorrect boundary conditions in the JavaScript Engine
component. This ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22363,7 +22963,7 @@ CVE-2026-109716 (Incorrect boundary conditions in the
JavaScript Engine componen
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109716
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109716
CVE-2026-109717 (Use-after-free in the DOM: Bindings (WebIDL) component. This
vulnerabi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22371,7 +22971,7 @@ CVE-2026-109717 (Use-after-free in the DOM: Bindings
(WebIDL) component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109717
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109717
CVE-2026-109718 (Use-after-free in the XML component. This vulnerability was
fixed in F ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22379,7 +22979,7 @@ CVE-2026-109718 (Use-after-free in the XML component.
This vulnerability was fix
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109718
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109718
CVE-2026-109719 (Race condition, use-after-free in the Graphics: CanvasWebGL
component. ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22387,7 +22987,7 @@ CVE-2026-109719 (Race condition, use-after-free in the
Graphics: CanvasWebGL com
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109719
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109719
CVE-2026-109720 (JIT miscompilation in the JavaScript: WebAssembly component.
This vuln ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22395,7 +22995,7 @@ CVE-2026-109720 (JIT miscompilation in the JavaScript:
WebAssembly component. Th
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109720
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109720
CVE-2026-109721 (Incorrect boundary conditions in the JavaScript Engine: JIT
component. ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22403,7 +23003,7 @@ CVE-2026-109721 (Incorrect boundary conditions in the
JavaScript Engine: JIT com
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109721
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109721
CVE-2026-109722 (JIT miscompilation in the JavaScript Engine: JIT component.
This vulne ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22411,7 +23011,7 @@ CVE-2026-109722 (JIT miscompilation in the JavaScript
Engine: JIT component. Thi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109722
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109722
CVE-2026-109723 (Integer overflow in the Layout: Text and Fonts component.
This vulnera ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22419,7 +23019,7 @@ CVE-2026-109723 (Integer overflow in the Layout: Text
and Fonts component. This
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109723
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109723
CVE-2026-109724 (Use-after-free in the DOM: Core & HTML component. This
vulnerability w ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22427,14 +23027,14 @@ CVE-2026-109724 (Use-after-free in the DOM: Core &
HTML component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109724
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109724
CVE-2026-109725 (Use-after-free in the DOM: Core & HTML component. This
vulnerability w ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109725
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109725
CVE-2026-109726 (Use-after-free in the SVG component. This vulnerability was
fixed in F ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22442,7 +23042,7 @@ CVE-2026-109726 (Use-after-free in the SVG component.
This vulnerability was fix
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109726
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109726
CVE-2026-109727 (Use-after-free in the Audio/Video component. This
vulnerability was fi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22450,7 +23050,7 @@ CVE-2026-109727 (Use-after-free in the Audio/Video
component. This vulnerability
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109727
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109727
CVE-2026-109728 (Use-after-free in the DOM: Animation component. This
vulnerability was ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22458,7 +23058,7 @@ CVE-2026-109728 (Use-after-free in the DOM: Animation
component. This vulnerabil
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109728
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109728
CVE-2026-109729 (Use-after-free in the JavaScript Engine: JIT component. This
vulnerabi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22466,7 +23066,7 @@ CVE-2026-109729 (Use-after-free in the JavaScript
Engine: JIT component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109729
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109729
CVE-2026-109730 (Integer overflow in the Graphics component. This
vulnerability was fix ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22474,7 +23074,7 @@ CVE-2026-109730 (Integer overflow in the Graphics
component. This vulnerability
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109730
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109730
CVE-2026-109731 (Incorrect boundary conditions in the Graphics: Canvas2D
component. Thi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22482,7 +23082,7 @@ CVE-2026-109731 (Incorrect boundary conditions in the
Graphics: Canvas2D compone
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109731
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109731
CVE-2026-109732 (Use-after-free in the DOM: Streams component. This
vulnerability was f ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22490,7 +23090,7 @@ CVE-2026-109732 (Use-after-free in the DOM: Streams
component. This vulnerabilit
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109732
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109732
CVE-2026-109733 (JIT miscompilation in the JavaScript Engine: JIT component.
This vulne ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22498,7 +23098,7 @@ CVE-2026-109733 (JIT miscompilation in the JavaScript
Engine: JIT component. Thi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109733
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109733
CVE-2026-109734 (Mitigation bypass in the DOM: Security component. This
vulnerability w ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22509,7 +23109,7 @@ CVE-2026-109735 (Use-after-free in the DOM: Animation
component. This vulnerabil
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109735
CVE-2026-109736 (Frame poisoning in the Layout component. This vulnerability
was fixed ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22517,7 +23117,7 @@ CVE-2026-109736 (Frame poisoning in the Layout
component. This vulnerability was
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109736
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109736
CVE-2026-109737 (Mitigation bypass in the Enterprise Policies component. This
vulnerabi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22525,7 +23125,7 @@ CVE-2026-109737 (Mitigation bypass in the Enterprise
Policies component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109737
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109737
CVE-2026-109738 (Use-after-free in the Audio/Video: Playback component. This
vulnerabil ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22543,7 +23143,7 @@ CVE-2026-109740 (Sandbox escape due to incorrect
boundary conditions in the Widg
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109740
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109740
CVE-2026-109741 (Use-after-free in the Storage: Bucket File System component.
This vuln ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22551,7 +23151,7 @@ CVE-2026-109741 (Use-after-free in the Storage: Bucket
File System component. Th
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109741
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109741
CVE-2026-109742 (Information disclosure in the PDF Viewer component. This
vulnerability ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22559,7 +23159,7 @@ CVE-2026-109742 (Information disclosure in the PDF
Viewer component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109742
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109742
CVE-2026-109743 (Privilege escalation in the Panning and Zooming component.
This vulner ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22567,7 +23167,7 @@ CVE-2026-109743 (Privilege escalation in the Panning
and Zooming component. This
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109743
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109743
CVE-2026-109744 (Other issue in the DOM: File component. This vulnerability
was fixed i ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22575,7 +23175,7 @@ CVE-2026-109744 (Other issue in the DOM: File
component. This vulnerability was
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109744
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109744
CVE-2026-109745 (Sandbox escape due to uninitialized memory in the DOM: Web
Serial comp ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22598,7 +23198,7 @@ CVE-2026-109750 (Site isolation issue in the DOM: Web
Authentication component.
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109750
CVE-2026-109751 (Information disclosure in the Networking component. This
vulnerability ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22606,7 +23206,7 @@ CVE-2026-109751 (Information disclosure in the
Networking component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109751
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109751
CVE-2026-109752 (Use-after-free in the DOM: Workers component. This
vulnerability was f ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22614,7 +23214,7 @@ CVE-2026-109752 (Use-after-free in the DOM: Workers
component. This vulnerabilit
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109752
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109752
CVE-2026-109753 (Incorrect boundary conditions in the Layout component. This
vulnerabil ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22622,7 +23222,7 @@ CVE-2026-109753 (Incorrect boundary conditions in the
Layout component. This vul
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109753
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109753
CVE-2026-109754 (Incorrect boundary conditions in the DOM: Editor component.
This vulne ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22633,7 +23233,7 @@ CVE-2026-109755 (Sandbox escape in the DOM: Content
Processes component. This vu
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109755
CVE-2026-109756 (Privilege escalation in the DOM: Navigation component. This
vulnerabil ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22641,7 +23241,7 @@ CVE-2026-109756 (Privilege escalation in the DOM:
Navigation component. This vul
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109756
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109756
CVE-2026-109757 (Sandbox escape due to race condition in the Networking
component. This ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22649,7 +23249,7 @@ CVE-2026-109757 (Sandbox escape due to race condition
in the Networking componen
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109757
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109757
CVE-2026-109759 (Site isolation issue in the Networking component. This
vulnerability w ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22657,7 +23257,7 @@ CVE-2026-109759 (Site isolation issue in the Networking
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109759
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109759
CVE-2026-109760 (Mitigation bypass in the Networking: HTTP component. This
vulnerabilit ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22668,7 +23268,7 @@ CVE-2026-109761 (Use-after-free in the JavaScript:
WebAssembly component. This v
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109761
CVE-2026-109762 (Incorrect boundary conditions in the SVG component. This
vulnerability ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22676,7 +23276,7 @@ CVE-2026-109762 (Incorrect boundary conditions in the
SVG component. This vulner
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109762
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109762
CVE-2026-109763 (Mitigation bypass in the File Handling component. This
vulnerability w ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22684,7 +23284,7 @@ CVE-2026-109763 (Mitigation bypass in the File Handling
component. This vulnerab
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109763
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109763
CVE-2026-109764 (Mitigation bypass in the Enterprise Policies component. This
vulnerabi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22692,7 +23292,7 @@ CVE-2026-109764 (Mitigation bypass in the Enterprise
Policies component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109764
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109764
CVE-2026-109765 (Race condition, use-after-free in the Graphics: Text
component. This v ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22700,7 +23300,7 @@ CVE-2026-109765 (Race condition, use-after-free in the
Graphics: Text component.
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109765
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109765
CVE-2026-109766 (Mitigation bypass in the Enterprise Policies component. This
vulnerabi ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22708,7 +23308,7 @@ CVE-2026-109766 (Mitigation bypass in the Enterprise
Policies component. This vu
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109766
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109766
CVE-2026-109767 (Information disclosure in the Networking component. This
vulnerability ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22722,7 +23322,7 @@ CVE-2026-109769 (Information disclosure in the
Networking: Cache component. This
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109769
CVE-2026-109770 (Spoofing issue in the DOM: Web Serial component. This
vulnerability wa ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22742,7 +23342,7 @@ CVE-2026-109774 (Invalid pointer, undefined behavior in
the DOM: Notifications c
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109774
CVE-2026-109775 (Denial-of-service in the WebRTC component. This vulnerability
was fixe ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22750,7 +23350,7 @@ CVE-2026-109775 (Denial-of-service in the WebRTC
component. This vulnerability w
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109775
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109775
CVE-2026-109776 (Race condition in the XPCOM component. This vulnerability was
fixed in ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22758,7 +23358,7 @@ CVE-2026-109776 (Race condition in the XPCOM component.
This vulnerability was f
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109776
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109776
CVE-2026-109777 (Information disclosure in the Storage: IndexedDB component.
This vulne ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22766,7 +23366,7 @@ CVE-2026-109777 (Information disclosure in the Storage:
IndexedDB component. Thi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109777
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109777
CVE-2026-109778 (Privilege escalation in the WebExtensions component. This
vulnerabilit ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -22780,7 +23380,7 @@ CVE-2026-109780 (Mitigation bypass in the DOM: Core &
HTML component. This vulne
- firefox 158.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109780
CVE-2026-109781 (Denial-of-service in the Printing: Output component. This
vulnerabilit ...)
- {DSA-6585-1 DSA-6560-1 DLA-4836-1}
+ {DSA-6585-1 DSA-6560-1 DLA-4863-1 DLA-4836-1}
- firefox 158.0-1
- firefox-esr 153.5.0esr-1
- thunderbird 1:153.5.0esr-1
@@ -33128,9 +33728,9 @@ CVE-2026-17005 (The Horizontal scrolling announcements
WordPress plugin through
NOT-FOR-US: WordPress plugin
CVE-2026-105135 (A vulnerability has been found in InternLM MindSearch 0.1.0.
This issu ...)
NOT-FOR-US: InternLM MindSearch
-CVE-2026-105134 (A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This
vulnerabili ...)
+CVE-2026-105134 (A flaw has been found in Ahsay AhsayCBS up to
9.15.2.69/10.3.4.44. Thi ...)
NOT-FOR-US: Ahsay AhsayCBS
-CVE-2026-105133 (A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2.
This affe ...)
+CVE-2026-105133 (A vulnerability was detected in Ahsay AhsayCBS up to
9.15.2.69/10.3.4. ...)
NOT-FOR-US: Ahsay AhsayCBS
CVE-2026-105131 (ezBookkeeping 1.2.0 before 2.0.1 contains a privilege
escalation vulne ...)
NOT-FOR-US: ezBookkeeping
@@ -111489,7 +112089,8 @@ CVE-2026-65549 (Author PHP Object Injection in Jeg
Kit for Elementor <= 3.2.10 v
NOT-FOR-US: WordPress plugin or theme
CVE-2026-65548 (Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2
versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-65547 (Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.)
+CVE-2026-65547
+ REJECTED
NOT-FOR-US: WordPress plugin or theme
CVE-2026-65546 (Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1
versions.)
NOT-FOR-US: WordPress plugin or theme
@@ -111617,7 +112218,7 @@ CVE-2026-28179 (Shop manager Cross Site Scripting
(XSS) in FiboSearch <= 1.33.0
NOT-FOR-US: WordPress plugin or theme
CVE-2026-28178 (Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0
versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-28177 (Unauthenticated Cross Site Scripting (XSS) in Popup Maker <=
1.23.0 ve ...)
+CVE-2026-28177 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-28172 (Unauthenticated Cross Site Request Forgery (CSRF) in Tracking
Code Man ...)
NOT-FOR-US: WordPress plugin or theme
@@ -208193,6 +208794,7 @@ CVE-2026-4984 (The Twilio integration webhook handler
accepts any POST request w
CVE-2026-4982 (A user with permission "update world" in any Venueless world is
able t ...)
NOT-FOR-US: rami.io products
CVE-2026-4980 (A local file disclosure vulnerability in the XInclude
processing compo ...)
+ {DLA-4862-1}
- inkscape 1.4-4
[bullseye] - inkscape <not-affected> (XInclude support added in v1.1)
NOTE: https://gitlab.com/inkscape/inkscape/-/work_items/3557
@@ -238701,7 +239303,7 @@ CVE-2025-69037 (Improper Control of Filename for
Include/Require Statement in PH
NOT-FOR-US: WordPress plugin or theme
CVE-2025-69036 (Deserialization of Untrusted Data vulnerability in
strongholdthemes Te ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2025-69035 (Deserialization of Untrusted Data vulnerability in
strongholdthemes De ...)
+CVE-2025-69035 (Deserialization of Untrusted Data vulnerability in
Strongholdthemes De ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-69005 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
NOT-FOR-US: WordPress plugin or theme
@@ -345952,9 +346554,9 @@ CVE-2025-2746 (An authentication bypass vulnerability
in Kentico Xperience allow
NOT-FOR-US: Kentico
CVE-2025-2709 (A vulnerability has been found in Yonyou UFIDA ERP-NC 5.0 and
classifi ...)
NOT-FOR-US: Yonyou UFIDA ERP-NC
-CVE-2025-2708 (A vulnerability, which was classified as critical, was found in
zhijia ...)
+CVE-2025-2708 (A vulnerability was identified in zhijiantianya ruoyi-vue-pro
2.4.1. A ...)
NOT-FOR-US: zhijiantianya ruoyi-vue-pro
-CVE-2025-2707 (A vulnerability, which was classified as critical, has been
found in z ...)
+CVE-2025-2707 (A vulnerability was determined in zhijiantianya ruoyi-vue-pro
2.4.1. T ...)
NOT-FOR-US: zhijiantianya ruoyi-vue-pro
CVE-2025-2706 (A vulnerability classified as critical was found in Digiwin ERP
5.0.1. ...)
NOT-FOR-US: Digiwin ERP
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57458f59f63fba0735ec5fb0fc738cbcfe0c9d86
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57458f59f63fba0735ec5fb0fc738cbcfe0c9d86
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
