Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
812babbb by security tracker role at 2026-10-30T19:15:09+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,777 @@
+CVE-2026-9239 (The Meow Gallery plugin for WordPress is vulnerable to Stored
Cross-Si ...)
+ TODO: check
+CVE-2026-97638 (The Forminator Forms \u2013 Contact Form, Payment Form &
Custom Form B ...)
+ TODO: check
+CVE-2026-97209 (Insecure Temporary File vulnerability in Mix deps.partition in
Elixir ...)
+ TODO: check
+CVE-2026-96894 (The ERP: Complete HR, Accounting & CRM Suite Built for
WooCommerce plu ...)
+ TODO: check
+CVE-2026-94175 (Unauthenticated Cross Site Scripting (XSS) in All In One Login
<= 2.4. ...)
+ TODO: check
+CVE-2026-93327 (A Deserialization of Untrusted Data vulnerability in the
SubWorkflow t ...)
+ TODO: check
+CVE-2026-91917 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
+ TODO: check
+CVE-2026-91915 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
+ TODO: check
+CVE-2026-91914 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Authe ...)
+ TODO: check
+CVE-2026-91913 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
+ TODO: check
+CVE-2026-91912 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Use o ...)
+ TODO: check
+CVE-2026-90888 (Unauthenticated PHP Object Injection in LeadSnap <= 1.25
versions.)
+ TODO: check
+CVE-2026-87768 (DateTime::Lite versions before 0.8.1 for Perl allow CPU
exhaustion via ...)
+ TODO: check
+CVE-2026-86715 (Plaintext storage of a password vulnerability in Crypttech
Crypto and ...)
+ TODO: check
+CVE-2026-85268 (A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the
auth/handle ...)
+ TODO: check
+CVE-2026-84243 (The gettext family of functions in the GNU C Library version
2.0 and l ...)
+ TODO: check
+CVE-2026-82104 (In Teltonika Networks RUTOS devices running versions from 7.22
through ...)
+ TODO: check
+CVE-2026-7004 (WIT SynApps Runtime through 1.4.11 contains a
pre-authentication refle ...)
+ TODO: check
+CVE-2026-7003 (WIT SynApps Runtime through 1.4.11 contains a hardcoded
credentials vu ...)
+ TODO: check
+CVE-2026-78527 (Contributor PHP Object Injection in GS Testimonial Slider <=
3.3.10 ve ...)
+ TODO: check
+CVE-2026-76012 (The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN
Gallery ...)
+ TODO: check
+CVE-2026-75882 (An improper access control vulnerability in ESET Endpoint
Encryption a ...)
+ TODO: check
+CVE-2026-73322 (Incorrect Authorization vulnerability in the single-stage
query engine ...)
+ TODO: check
+CVE-2026-73186 (Subscriber PHP Object Injection in Enable Media Replace <=
4.2.2 versi ...)
+ TODO: check
+CVE-2026-69446 (Incorrect authorization in Microsoft Edge (Chromium-based)
allows an a ...)
+ TODO: check
+CVE-2026-66026
+ REJECTED
+CVE-2026-66025
+ REJECTED
+CVE-2026-65874 (This issue affects Apache Fineract versions up to and
including 1.15.0 ...)
+ TODO: check
+CVE-2026-65566 (Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps
AI Engine ...)
+ TODO: check
+CVE-2026-65444 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-64860
+ REJECTED
+CVE-2026-64618 (Improper Neutralization of Special Elements used in an SQL
Command ("S ...)
+ TODO: check
+CVE-2026-62303 (Pistache is a high-performance REST toolkit written in C++.
From 0.0.5 ...)
+ TODO: check
+CVE-2026-62298 (mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN
TYPE` dec ...)
+ TODO: check
+CVE-2026-62264 (PDF Reader MCP is a Model Context Protocol server for reading
PDF docu ...)
+ TODO: check
+CVE-2026-62162 (Hydra is a layer-two scalability solution for Cardano. Prior
to 2.1.0, ...)
+ TODO: check
+CVE-2026-62160 (Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26,
the globa ...)
+ TODO: check
+CVE-2026-62141 (Missing Authorization vulnerability in WP ManageNinja LLC
Fluent CRM f ...)
+ TODO: check
+CVE-2026-62122 (Missing Authorization vulnerability in Arraytics Booktics
booktics all ...)
+ TODO: check
+CVE-2026-62121 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
+ TODO: check
+CVE-2026-62057 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-62056 (Missing Authorization vulnerability in WP ManageNinja LLC
Fluent CRM f ...)
+ TODO: check
+CVE-2026-62055 (Missing Authorization vulnerability in Liquid Web / StellarWP
Event Ti ...)
+ TODO: check
+CVE-2026-62047 (Missing Authorization vulnerability in Liquid Web / StellarWP
Event Ti ...)
+ TODO: check
+CVE-2026-62023 (Missing Authorization vulnerability in Unlimited Elements
Unlimited El ...)
+ TODO: check
+CVE-2026-62019 (Missing Authorization vulnerability in Liquid Web / StellarWP
BookIt b ...)
+ TODO: check
+CVE-2026-61854 (VoiceSentinel is a real-time voice moderation system for
Minecraft ser ...)
+ TODO: check
+CVE-2026-61848 (Crass is a Ruby CSS parser that's fully compliant with the CSS
Syntax ...)
+ TODO: check
+CVE-2026-61847 (Crass is a Ruby CSS parser that's fully compliant with the CSS
Syntax ...)
+ TODO: check
+CVE-2026-61846 (Crass is a Ruby CSS parser that's fully compliant with the CSS
Syntax ...)
+ TODO: check
+CVE-2026-61845 (Crass is a Ruby CSS parser that's fully compliant with the CSS
Syntax ...)
+ TODO: check
+CVE-2026-61840 (Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the
`image to ...)
+ TODO: check
+CVE-2026-61826 (Bazarr is a companion application to Sonarr and Radarr. Prior
to 1.5.7 ...)
+ TODO: check
+CVE-2026-61806 (Frappe Learning Management System (LMS) is a learning system
that help ...)
+ TODO: check
+CVE-2026-61805 (Frappe Learning Management System (LMS) is a learning system
that help ...)
+ TODO: check
+CVE-2026-61804 (myTinyWMS is a free, open-source warehouse management system.
Prior to ...)
+ TODO: check
+CVE-2026-61803 (Frappe Learning Management System (LMS) is a learning system
that help ...)
+ TODO: check
+CVE-2026-61789 (DBHub is a database MCP server for Postgres, MySQL, SQL
Server, Oracle ...)
+ TODO: check
+CVE-2026-61739 (SOCFortress CoPilot focuses on providing a single pane of
glass for al ...)
+ TODO: check
+CVE-2026-61738 (SOCFortress CoPilot focuses on providing a single pane of
glass for al ...)
+ TODO: check
+CVE-2026-61737 (ng-antd-admin is an Angular and NestJS administration system
template. ...)
+ TODO: check
+CVE-2026-61730 (SOCFortress CoPilot focuses on providing a single pane of
glass for al ...)
+ TODO: check
+CVE-2026-61729 (SOCFortress CoPilot focuses on providing a single pane of
glass for al ...)
+ TODO: check
+CVE-2026-61728 (SOCFortress CoPilot focuses on providing a single pane of
glass for al ...)
+ TODO: check
+CVE-2026-61708 (SOCFortress CoPilot focuses on providing a single pane of
glass for al ...)
+ TODO: check
+CVE-2026-61586 (Copernik XML Factory provides secure-by-default JAXP factory
creation ...)
+ TODO: check
+CVE-2026-59978 (AdminNeo is a full-featured database management tool written
in PHP. F ...)
+ TODO: check
+CVE-2026-59396 (A denial-of-service vulnerability exists in UAA's
private_key_jwt clie ...)
+ TODO: check
+CVE-2026-59388 (Cloud Controller (CAPI) leaks sensitive data into audit logs
in multip ...)
+ TODO: check
+CVE-2026-59387 (The Nginx routing configuration for Cloud Controller blocks
unauthenti ...)
+ TODO: check
+CVE-2026-59386 (A SpaceSupporter could improperly modify an application's
start comman ...)
+ TODO: check
+CVE-2026-59385 (A user with SpaceDeveloper privileges could modify the URL of
a space- ...)
+ TODO: check
+CVE-2026-55551 (ZAC is an open-source, workflow-based Common Ground component
for Dutc ...)
+ TODO: check
+CVE-2026-54855 (Unauthenticated Cross Site Scripting (XSS) in Profile Builder
<= 4.0.5 ...)
+ TODO: check
+CVE-2026-54854 (Contributor Privilege Escalation in Profile Builder <= 4.0.5
versions.)
+ TODO: check
+CVE-2026-54850 (Subscriber Broken Access Control in Booking and Rental Manager
<= 2.8. ...)
+ TODO: check
+CVE-2026-52710 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-50000 (SecureDrop is an open-source whistleblower submission system
that medi ...)
+ TODO: check
+CVE-2026-49116
+ REJECTED
+CVE-2026-49115
+ REJECTED
+CVE-2026-48201 (Unauthenticated Cross Site Scripting (XSS) in Fast Velocity
Minify <= ...)
+ TODO: check
+CVE-2026-48164 (Collabora Online is a collaborative online office suite based
on Libre ...)
+ TODO: check
+CVE-2026-46560 (Open Access Management (OpenAM) is an access management
solution. Prio ...)
+ TODO: check
+CVE-2026-46499 (Collabora Online is a collaborative online office suite based
on Libre ...)
+ TODO: check
+CVE-2026-45145 (Chamilo LMS is an open-source learning management system.
Prior to 2.0 ...)
+ TODO: check
+CVE-2026-45144 (Chamilo LMS is an open-source learning management system. From
2.0.0 u ...)
+ TODO: check
+CVE-2026-45141 (Chamilo LMS is an open-source learning management system.
Prior to 2.0 ...)
+ TODO: check
+CVE-2026-44344 (Chamilo LMS is an open-source learning management system. In
the 1.x l ...)
+ TODO: check
+CVE-2026-39786 (Unauthenticated Cross Site Scripting (XSS) in BA Book
Everything <= 1. ...)
+ TODO: check
+CVE-2026-39739 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-39738 (Unauthenticated PHP Object Injection in FunnelKit Automations
<= 3.8.6 ...)
+ TODO: check
+CVE-2026-39734 (Unauthenticated Path Traversal in WP EasyPay <= 4.5.4
versions.)
+ TODO: check
+CVE-2026-39732 (Unauthenticated SQL Injection in Transliterator <= 2.5.13
versions.)
+ TODO: check
+CVE-2026-39375 (Frappe Learning Management System (LMS) is a learning system
that help ...)
+ TODO: check
+CVE-2026-37468 (Cross Site Scripting vulnerability in BeeHome MyBeeHome before
2025-11 ...)
+ TODO: check
+CVE-2026-28160 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <=
1.4.10 ver ...)
+ TODO: check
+CVE-2026-27061 (Subscriber Cross Site Scripting (XSS) in User Registration <=
5.3.0 ve ...)
+ TODO: check
+CVE-2026-22114 (HTTP basic auth enforces no retry limit or backoff. Combined
with the ...)
+ TODO: check
+CVE-2026-22110 (The web server does not check authentication on POST or PUT.
An unauth ...)
+ TODO: check
+CVE-2026-22109 (The shipped WebUI template database retains the factory
default passwo ...)
+ TODO: check
+CVE-2026-22105 (Delta UFC500 charging stations derive the default credentials
of the S ...)
+ TODO: check
+CVE-2026-14467 (An information disclosure vulnerability in the Forocoches
comments edi ...)
+ TODO: check
+CVE-2026-13747 (The Meow Gallery plugin for WordPress is vulnerable to
authorization b ...)
+ TODO: check
+CVE-2026-13576 (CallBackery versions before 0.62.0 for Perl store user
passwords as un ...)
+ TODO: check
+CVE-2026-120046 (Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference
vulnerabi ...)
+ TODO: check
+CVE-2026-120007 (NodeBB 1.18.0 through 4.16.5 contains an authorization bypass
vulnerab ...)
+ TODO: check
+CVE-2026-119979 (LM Studio before 0.4.22+1 contains a path traversal
vulnerability in t ...)
+ TODO: check
+CVE-2026-119978 (Flowise through 3.1.4 contains a sandbox escape vulnerability
that all ...)
+ TODO: check
+CVE-2026-119842 (A flaw was found in GStreamer's gst-plugins-base MicroDVD
subtitle par ...)
+ TODO: check
+CVE-2026-119777 (A flaw was found in GStreamer's gst-plugins-bad H.266/VVC
parser. When ...)
+ TODO: check
+CVE-2026-119764 (Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site
scripting ...)
+ TODO: check
+CVE-2026-119763 (changelog.com before commit 7b35e829 contains a missing
authorization ...)
+ TODO: check
+CVE-2026-119762 (Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and
10.7.x b ...)
+ TODO: check
+CVE-2026-119761 (Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains
a stored ...)
+ TODO: check
+CVE-2026-119760 (sniproxy through 0.7.0 contains a NULL pointer dereference
vulnerabili ...)
+ TODO: check
+CVE-2026-119729 (A flaw was found in GStreamer. An integer overflow
vulnerability in th ...)
+ TODO: check
+CVE-2026-119728 (A flaw was found in the H.264 video parser in
gst-plugins-bad. When pr ...)
+ TODO: check
+CVE-2026-119727 (A flaw was found in GStreamer's gst-plugins-bad H.265 video
parser. Wh ...)
+ TODO: check
+CVE-2026-119722 (Blender before 4.5.15 and 5.x before 5.2.3 contains a heap
out-of-boun ...)
+ TODO: check
+CVE-2026-119721 (Blender before 4.5.15 and 5.x before 5.2.3 contains an
out-of-bounds r ...)
+ TODO: check
+CVE-2026-119720 (Blender before 4.5.15 and 5.x before 5.2.3 contains a heap
out-of-boun ...)
+ TODO: check
+CVE-2026-119719 (Blender before 4.5.15 and 5.x before 5.2.3 contains a heap
buffer over ...)
+ TODO: check
+CVE-2026-119718 (Blender before 4.5.15 and 5.x before 5.2.3 contains a heap
buffer over ...)
+ TODO: check
+CVE-2026-119717 (pybars4 through 0.9.13 contains a code injection
vulnerability in pyba ...)
+ TODO: check
+CVE-2026-119716 (pybars3 through 0.9.7 contains a code injection vulnerability
in pybar ...)
+ TODO: check
+CVE-2026-119715 (NocoDB before 2026.08.0 contains a clickjacking vulnerability
that all ...)
+ TODO: check
+CVE-2026-119714 (My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a
shortcode ...)
+ TODO: check
+CVE-2026-119713 (Paperclip 2026.403.0 before 2026.416.0 contains a remote code
executio ...)
+ TODO: check
+CVE-2026-119712 (PipesHub before 0.10.0 contains a server-side request forgery
vulnerab ...)
+ TODO: check
+CVE-2026-119711 (PipesHub before 0.10.0 contains a rate limit bypass
vulnerability in g ...)
+ TODO: check
+CVE-2026-119710 (PipesHub 0.3.0 before 0.10.0 contains an event type injection
vulnerab ...)
+ TODO: check
+CVE-2026-119709 (Grimoire before 1.0.0 contains an unauthenticated server-side
request ...)
+ TODO: check
+CVE-2026-119708 (abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant
authoriza ...)
+ TODO: check
+CVE-2026-119707 (SonicJS through 3.0.0 contains a missing authorization
vulnerability i ...)
+ TODO: check
+CVE-2026-119706 (InternLM LMDeploy 0.9.0 through 0.18.0 contains an
unauthenticated rem ...)
+ TODO: check
+CVE-2026-119705 (SerpBear before 3.1.1 contains a missing authentication
vulnerability ...)
+ TODO: check
+CVE-2026-119704 (Bastille through 1.4.4 contains a symlink following
vulnerability in t ...)
+ TODO: check
+CVE-2026-119703 (xiaozhi-esp32-server through 0.9.8 contains an authentication
bypass v ...)
+ TODO: check
+CVE-2026-119702 (WPGraphQL before 2.24.1 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-119701 (WPGraphQL before 2.24.1 contains a missing rate limiting
vulnerability ...)
+ TODO: check
+CVE-2026-119700 (WPGraphQL before 2.24.2 contains an information disclosure
vulnerabili ...)
+ TODO: check
+CVE-2026-119699 (WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled
resource c ...)
+ TODO: check
+CVE-2026-119682 (An improper access control vulnerability exists in the
multi-factor au ...)
+ TODO: check
+CVE-2026-119680 (A stored cross-site scripting (XSS) vulnerability exists in
the chart ...)
+ TODO: check
+CVE-2026-119665 (WHartTest 2.2.0 through 2.8.1 contains a missing
authorization vulnera ...)
+ TODO: check
+CVE-2026-119664 (Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an
authorization ...)
+ TODO: check
+CVE-2026-119663 (Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a
broken authori ...)
+ TODO: check
+CVE-2026-119662 (Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials
vulnerab ...)
+ TODO: check
+CVE-2026-119661 (ShowDoc through 3.9.5 contains an authorization bypass
vulnerability i ...)
+ TODO: check
+CVE-2026-119660 (MuseBot before 2.0.0 contains an authentication bypass
vulnerability t ...)
+ TODO: check
+CVE-2026-119659 (Blossom through 1.17.1 contains an authorization bypass
vulnerability ...)
+ TODO: check
+CVE-2026-119658 (PowerDNS-Admin through 2026.08.1 contains an authorization
bypass vuln ...)
+ TODO: check
+CVE-2026-119657 (FilePress through 3.0.1 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-119656 (CoreShop by CoreUnion through 1.5.5 contains an
unauthenticated sql in ...)
+ TODO: check
+CVE-2026-119655 (CoreShop through 1.5.5 contains an unauthenticated sql
injection vulne ...)
+ TODO: check
+CVE-2026-119654 (DataCap through 2025.1.1 contains a missing authorization
vulnerabilit ...)
+ TODO: check
+CVE-2026-119653 (Nging through 5.3.5 contains an information disclosure
vulnerability t ...)
+ TODO: check
+CVE-2026-119652 (HuLa-Server through 3.0.7 contains an insecure direct object
reference ...)
+ TODO: check
+CVE-2026-119651 (HuLa-Server through 3.0.7 contains an insecure direct object
reference ...)
+ TODO: check
+CVE-2026-119650 (HuLa-Server through 3.0.7 contains an insecure direct object
reference ...)
+ TODO: check
+CVE-2026-119649 (Orchard CMS 1.10.3 through 1.11 contains an improper
authorization vul ...)
+ TODO: check
+CVE-2026-119648 (Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a
missing auth ...)
+ TODO: check
+CVE-2026-119647 (RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass
vulnerab ...)
+ TODO: check
+CVE-2026-119646 (Open Web Analytics before 1.14.1 contains an authorization
vulnerabili ...)
+ TODO: check
+CVE-2026-119645 (ZenTao PMS through 22.6 contains a missing authorization
vulnerability ...)
+ TODO: check
+CVE-2026-119644 (Blossom through 1.17.1 contains an authorization bypass
vulnerability ...)
+ TODO: check
+CVE-2026-119620 (A vulnerability was determined in 37954679
cak-filemanagement-system u ...)
+ TODO: check
+CVE-2026-119619 (A vulnerability was found in 37954679
cak-filemanagement-system up to ...)
+ TODO: check
+CVE-2026-119602 (libmspack through 0.11alpha contains an uninitialized memory
disclosur ...)
+ TODO: check
+CVE-2026-119601 (AFFLIB through 3.7.22 contains a heap out-of-bounds write
vulnerabilit ...)
+ TODO: check
+CVE-2026-119600 (tcpflow through 1.6.1 contains an out-of-bounds read
vulnerability tha ...)
+ TODO: check
+CVE-2026-119599 (AxonHub through 1.0.0-beta11 contains a privilege escalation
vulnerabi ...)
+ TODO: check
+CVE-2026-119598 (Miaomiaowu before 0.9.3 contains an insecure direct object
reference v ...)
+ TODO: check
+CVE-2026-119597 (OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing
key vulne ...)
+ TODO: check
+CVE-2026-119596 (UNIT3D through 9.2.0 contains a missing authorization
vulnerability in ...)
+ TODO: check
+CVE-2026-119591 (SQLite before 3.54.0 contains a stack exhaustion
vulnerability in coun ...)
+ TODO: check
+CVE-2026-119586 (SQLite command-line shell through 3.54.1 contains a command
injection ...)
+ TODO: check
+CVE-2026-119578 (MONAI from 1.6.0 before 1.6.1 contains a remote code
execution vulnera ...)
+ TODO: check
+CVE-2026-119577 (ArcadeDB before 26.10.2 contains an improper authorization
vulnerabili ...)
+ TODO: check
+CVE-2026-119576 (ArcadeDB from 21.12.1 before 26.10.2 contains an
authorization bypass ...)
+ TODO: check
+CVE-2026-119575 (ArcadeDB from 26.8.1 before 26.10.2 contains a server-side
request for ...)
+ TODO: check
+CVE-2026-119574 (Traefik from 3.2.0 before 3.7.15 contains a data race in the
experimen ...)
+ TODO: check
+CVE-2026-119573 (Traefik 3.7.11 before 3.7.15 contains an authorization bypass
in the K ...)
+ TODO: check
+CVE-2026-119572 (Traefik from 3.7.0-ea.1 before 3.7.15 contains an
authentication bypas ...)
+ TODO: check
+CVE-2026-119571 (Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an
authorizati ...)
+ TODO: check
+CVE-2026-119570 (Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an
information ...)
+ TODO: check
+CVE-2026-119569 (Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9
contains a ...)
+ TODO: check
+CVE-2026-119568 (vsftpd through 3.0.5 contains an authentication bypass
vulnerability i ...)
+ TODO: check
+CVE-2026-119567 (vsftpd through 3.0.5 contains an access control bypass
vulnerability t ...)
+ TODO: check
+CVE-2026-119566 (Prometheus through 3.15.1 contains a credential leak
vulnerability tha ...)
+ TODO: check
+CVE-2026-119565 (Plausible Analytics through 3.2.1 contains a mass assignment
vulnerabi ...)
+ TODO: check
+CVE-2026-119564 (Plausible Analytics Community Edition through 3.2.1 contains
an inform ...)
+ TODO: check
+CVE-2026-119563 (phpMyAdmin through 5.2.3 contains a stored cross-site
scripting vulner ...)
+ TODO: check
+CVE-2026-119562 (phpMyAdmin through 5.2.3 contains an sql injection
vulnerability that ...)
+ TODO: check
+CVE-2026-119561 (phpMyAdmin through 5.2.3 contains an authentication bypass
vulnerabili ...)
+ TODO: check
+CVE-2026-119560 (OPNsense core through 26.7.8 contains a configuration
injection vulner ...)
+ TODO: check
+CVE-2026-119559 (OpenLiteSpeed through 1.9.4 contains an authentication bypass
vulnerab ...)
+ TODO: check
+CVE-2026-119558 (OpenCart through 4.1.0.4 contains a business logic
vulnerability that ...)
+ TODO: check
+CVE-2026-119557 (n8n from 2.14.0 through 2.46.3 contains a path traversal
vulnerability ...)
+ TODO: check
+CVE-2026-119556 (Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0
through 5.1.8 ...)
+ TODO: check
+CVE-2026-119555 (Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0
through 5.1.8 ...)
+ TODO: check
+CVE-2026-119554 (Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0
through ...)
+ TODO: check
+CVE-2026-119553 (Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0
through ...)
+ TODO: check
+CVE-2026-119552 (Uptime Kuma through 2.5.8 contains a race condition in the
Socket.IO f ...)
+ TODO: check
+CVE-2026-119551 (Jellyfin through 12.4 contains an authorization bypass
vulnerability i ...)
+ TODO: check
+CVE-2026-119550 (Jellyfin through 12.4 contains an information disclosure
vulnerability ...)
+ TODO: check
+CVE-2026-119549 (Jellyfin through 12.4 contains a server-side request forgery
vulnerabi ...)
+ TODO: check
+CVE-2026-119548 (Lago through 1.55.0 contains an authorization bypass
vulnerability in ...)
+ TODO: check
+CVE-2026-119547 (Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0
through 17. ...)
+ TODO: check
+CVE-2026-119546 (Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0
through 17. ...)
+ TODO: check
+CVE-2026-119545 (Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0
through 17. ...)
+ TODO: check
+CVE-2026-119542 (A flaw was found in the Ickle query parser in Infinispan. A
query cont ...)
+ TODO: check
+CVE-2026-119528 (A flaw was found in GIMP. The PSD plug-in\u2019s image
resource header ...)
+ TODO: check
+CVE-2026-119526 (Deserialization of Untrusted Data vulnerability in ThemeREX
Royal Even ...)
+ TODO: check
+CVE-2026-119482 (Missing Authorization vulnerability in Crocoblock
JetFormBuilder jetfo ...)
+ TODO: check
+CVE-2026-119479 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-119466 (Cross-Site Request Forgery (CSRF) vulnerability in WPExperts
APIExpert ...)
+ TODO: check
+CVE-2026-119429 (phpMyAdmin through 5.2.3 contains a missing re-authentication
vulnerab ...)
+ TODO: check
+CVE-2026-119428 (phpMyAdmin through 5.2.3 contains a server-side request
forgery vulner ...)
+ TODO: check
+CVE-2026-119427 (phpMyAdmin through 5.2.3 contains an sql injection
vulnerability in De ...)
+ TODO: check
+CVE-2026-119426 (phpMyAdmin through 5.2.3 contains a cross-site request
forgery vulnera ...)
+ TODO: check
+CVE-2026-119425 (OPNsense core 26.1.6 through 26.7.7 contains an
authentication bypass ...)
+ TODO: check
+CVE-2026-119424 (OPNsense core before 26.7.8 contains a configuration line
injection vu ...)
+ TODO: check
+CVE-2026-119423 (OPNsense core before 26.7.8 contains a log injection
vulnerability tha ...)
+ TODO: check
+CVE-2026-119422 (Juspay Hyperswitch before 1.128.0 contains an authentication
bypass vu ...)
+ TODO: check
+CVE-2026-119421 (Juspay Hyperswitch through 1.128.0 (and builds before
2026.10.19.0) co ...)
+ TODO: check
+CVE-2026-119420 (Lago through 1.55.0 contains an authentication bypass
vulnerability th ...)
+ TODO: check
+CVE-2026-119419 (CakePHP through 5.4.3 contains an sql injection vulnerability
that all ...)
+ TODO: check
+CVE-2026-119418 (CakePHP through 5.4.3 contains an sql injection vulnerability
that all ...)
+ TODO: check
+CVE-2026-119417 (CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through
5.2.15, 5. ...)
+ TODO: check
+CVE-2026-119416 (CakePHP through 5.4.3 contains an improper cookie domain
validation vu ...)
+ TODO: check
+CVE-2026-119415 (CakePHP through 5.4.3 contains a header injection
vulnerability in For ...)
+ TODO: check
+CVE-2026-119414 (Bitwarden Server before 2026.10.1 on Entity Framework
backends contain ...)
+ TODO: check
+CVE-2026-119409 (OPNsense before 26.7.8 contains a command injection
vulnerability that ...)
+ TODO: check
+CVE-2026-119408 (n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1
contains ...)
+ TODO: check
+CVE-2026-119407 (Element Web and Element Desktop before 1.12.32 accept guest
credential ...)
+ TODO: check
+CVE-2026-119379 (SQLite before 3.54.0 built with the session extension
contains a heap ...)
+ TODO: check
+CVE-2026-119378 (SQLite before 3.54.0 contains a use-after-free vulnerability
in the R- ...)
+ TODO: check
+CVE-2026-119377 (SQLite before 3.54.0 contains an authorization bypass
vulnerability in ...)
+ TODO: check
+CVE-2026-119376 (SQLite before 3.54.0 contains a stack exhaustion
vulnerability that al ...)
+ TODO: check
+CVE-2026-119375 (SQLite before 3.54.0 contains an information disclosure
vulnerability ...)
+ TODO: check
+CVE-2026-119374 (SQLite before 3.54.0 built with FTS5 contains a heap buffer
overflow i ...)
+ TODO: check
+CVE-2026-119373 (SQLite before 3.54.0 built with FTS5 contains a heap buffer
overflow i ...)
+ TODO: check
+CVE-2026-119372 (SQLite before 3.54.0 built with FTS3/FTS4 and
SQLITE_ENABLE_FTS3_PAREN ...)
+ TODO: check
+CVE-2026-119371 (SQLite before 3.54.0 contains a stack exhaustion
vulnerability that al ...)
+ TODO: check
+CVE-2026-119370 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-119369 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-119368 (Missing Authorization vulnerability in Liquid Web / StellarWP
The Even ...)
+ TODO: check
+CVE-2026-119367 (Missing Authorization vulnerability in Liquid Web / StellarWP
The Even ...)
+ TODO: check
+CVE-2026-119365 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-119364 (ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4
contains a link ...)
+ TODO: check
+CVE-2026-119300 (Wekan is open source kanban built with Meteor. Prior to
11.11, the use ...)
+ TODO: check
+CVE-2026-119299 (gopacket provides packet processing capabilities for Go.
Prior to 1.7. ...)
+ TODO: check
+CVE-2026-119298 (croc is a tool that allows any two computers to simply and
securely tr ...)
+ TODO: check
+CVE-2026-119291 (Zuke is a code-first, strongly typed build automation system
for Deno. ...)
+ TODO: check
+CVE-2026-119290 (Zuke is a code-first, strongly typed build automation system
for Deno. ...)
+ TODO: check
+CVE-2026-119289 (Zuke is a code-first, strongly typed build automation system
for Deno. ...)
+ TODO: check
+CVE-2026-119288 (Zuke is a code-first, strongly typed build automation system
for Deno. ...)
+ TODO: check
+CVE-2026-119287 (Zuke is a code-first, strongly typed build automation system
for Deno. ...)
+ TODO: check
+CVE-2026-119176 (The CP Multi View Events Calendar plugin for WordPress is
vulnerable t ...)
+ TODO: check
+CVE-2026-119148 (Incomplete string validation in AWS aws-nitro-enclaves-sdk-c
before 0. ...)
+ TODO: check
+CVE-2026-119147 (ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization
bypass i ...)
+ TODO: check
+CVE-2026-119146 (ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer
overflow vulnera ...)
+ TODO: check
+CVE-2026-119117 (Insertion of sensitive information into a log file in Amazon
Kinesis P ...)
+ TODO: check
+CVE-2026-119116 (A use-after-free and double-free issue in the SetClient
command handle ...)
+ TODO: check
+CVE-2026-119113 (The GeoDirectory \u2013 WP Business Directory Plugin and
Classified Li ...)
+ TODO: check
+CVE-2026-119086 (Missing queue-set type validation in the queue-set selection
system ca ...)
+ TODO: check
+CVE-2026-119038 (Business::GoCardless versions before 1.01 for Perl complete
redirect f ...)
+ TODO: check
+CVE-2026-119037 (Business::GoCardless versions before 1.01 for Perl accept
forged webho ...)
+ TODO: check
+CVE-2026-119036 (Business::GoCardless versions before 1.01 for Perl allow
memory exhaus ...)
+ TODO: check
+CVE-2026-118996 (CallBackery versions before 0.62.0 for Perl send users their
own passw ...)
+ TODO: check
+CVE-2026-118995 (CallBackery versions before 0.62.0 for Perl accept unintended
values i ...)
+ TODO: check
+CVE-2026-118994 (CallBackery versions before 0.62.0 for Perl allow log
injection via ne ...)
+ TODO: check
+CVE-2026-118993 (CallBackery versions before 0.62.0 for Perl allow denial of
service vi ...)
+ TODO: check
+CVE-2026-118992 (CallBackery versions before 0.62.0 for Perl allow OS command
execution ...)
+ TODO: check
+CVE-2026-118991 (CallBackery versions before 0.62.0 for Perl encrypt
configuration back ...)
+ TODO: check
+CVE-2026-118990 (CallBackery versions before 0.62.0 for Perl leave a
world-readable dum ...)
+ TODO: check
+CVE-2026-118988 (CallBackery versions before 0.60.1 for Perl let
unauthenticated client ...)
+ TODO: check
+CVE-2026-118987 (CallBackery versions before 0.62.0 for Perl accept session
cookies of ...)
+ TODO: check
+CVE-2026-118986 (CallBackery versions before 0.62.0 for Perl allow session
cookie forge ...)
+ TODO: check
+CVE-2026-118697 (In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ
IDEA before ...)
+ TODO: check
+CVE-2026-118696 (In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and
WebStorm b ...)
+ TODO: check
+CVE-2026-118635 (The The GeoDirectory \u2013 WP Business Directory Plugin and
Classifie ...)
+ TODO: check
+CVE-2026-118238 (The Tenda W18E web management server is vulnerable to OS
command injec ...)
+ TODO: check
+CVE-2026-118205 (The Essential Addons for Elementor \u2013 Popular Elementor
Templates ...)
+ TODO: check
+CVE-2026-118090 (Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55
versions.)
+ TODO: check
+CVE-2026-118089 (Shop manager PHP Object Injection in Product Feed Manager <=
7.14.1 ve ...)
+ TODO: check
+CVE-2026-118086 (Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2
versions.)
+ TODO: check
+CVE-2026-117350 (Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable
to an OO ...)
+ TODO: check
+CVE-2026-117349 (Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable
to an OO ...)
+ TODO: check
+CVE-2026-117346 (Bitcoin Core through 31.1 is vulnerable to Denial of Service
via undo ...)
+ TODO: check
+CVE-2026-117184 (An issue in the GraphQL endpoint of traggo server v0.8.3
allows attack ...)
+ TODO: check
+CVE-2026-117183 (A path traversal vulnerability in the FeaturedImage component
of astro ...)
+ TODO: check
+CVE-2026-117182 (An authenticated cross-site scripting (XSS) vulnerability in
the /spin ...)
+ TODO: check
+CVE-2026-117028 (Skuul School Management System through version 2.6.5 is
vulnerable to ...)
+ TODO: check
+CVE-2026-116862 (Unauthenticated Broken Access Control in WP REST Cache <=
2026.3.1 ver ...)
+ TODO: check
+CVE-2026-116861 (Unauthenticated Sensitive Data Exposure in Flexible Chat <=
1.1.0 vers ...)
+ TODO: check
+CVE-2026-116860 (Missing Authorization vulnerability in Arraytics Timetics
timetics all ...)
+ TODO: check
+CVE-2026-116854 (Subscriber Cross Site Scripting (XSS) in WP Customer Area <=
8.4.0 ver ...)
+ TODO: check
+CVE-2026-116853 (Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1
versions.)
+ TODO: check
+CVE-2026-116852 (Author Remote Code Execution (RCE) in Widget Options <= 4.2.5
versions ...)
+ TODO: check
+CVE-2026-116851 (Unauthenticated Cross Site Scripting (XSS) in eCommerce
Product Catalo ...)
+ TODO: check
+CVE-2026-116847 (Unauthenticated Cross Site Scripting (XSS) in Mang Board WP
<= 2.4.6 v ...)
+ TODO: check
+CVE-2026-116552 (The Like Button Rating \u2665 LikeBtn plugin for WordPress is
vulnerab ...)
+ TODO: check
+CVE-2026-116410 (Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS
<= 3.4.3 ...)
+ TODO: check
+CVE-2026-116407 (Missing Authorization vulnerability in Webba Plugins Webba
Booking web ...)
+ TODO: check
+CVE-2026-116405 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <=
1.4.9 vers ...)
+ TODO: check
+CVE-2026-116401 (Unauthenticated Broken Access Control in HUSKY <= 1.4.6
versions.)
+ TODO: check
+CVE-2026-116386 (Unauthenticated Privilege Escalation in SMS Alert Order
Notifications ...)
+ TODO: check
+CVE-2026-116366 (An issue has been discovered in ClickHouse Server that, under
certain ...)
+ TODO: check
+CVE-2026-116130 (HTTP::Parser::XS versions before 0.18 for Perl truncate
PATH_INFO at a ...)
+ TODO: check
+CVE-2026-116128 (Starlet versions from 0.20 before 0.33 for Perl allow memory
exhaustio ...)
+ TODO: check
+CVE-2026-116127 (Starlet versions before 0.33 for Perl send a body in
responses to HEAD ...)
+ TODO: check
+CVE-2026-115947 (Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6
versions.)
+ TODO: check
+CVE-2026-115869 (The Themify Builder plugin for WordPress is vulnerable to
Stored Cross ...)
+ TODO: check
+CVE-2026-115866 (Starlet versions from 0.20 before 0.33 for Perl allow CPU
exhaustion v ...)
+ TODO: check
+CVE-2026-115865 (Starlet versions before 0.33 for Perl allow a request
declaring a larg ...)
+ TODO: check
+CVE-2026-115820 (The Majestic Support \u2013 The Leading-Edge Help Desk &
Customer Supp ...)
+ TODO: check
+CVE-2026-115604 (Subscriber Arbitrary File Deletion in SureDash <= 1.12.3
versions.)
+ TODO: check
+CVE-2026-115456 (A flaw was found in gcc. An attacker could cause a Denial of
Service ( ...)
+ TODO: check
+CVE-2026-115455 (A flaw was found in GCC libstdc++. When an application
extracts data i ...)
+ TODO: check
+CVE-2026-115346 (The Avada | Website Builder For WordPress & WooCommerce theme
for Word ...)
+ TODO: check
+CVE-2026-115274 (Improper Validation of Specified Quantity in Input
vulnerability in th ...)
+ TODO: check
+CVE-2026-114711 (Subscriber Cross Site Scripting (XSS) in MultiVendorX <=
5.0.20 versio ...)
+ TODO: check
+CVE-2026-114691 (A flaw was found in the libstdc++ component of GCC. An
attacker who ca ...)
+ TODO: check
+CVE-2026-114690 (A flaw was found in GCC. An out-of-bounds memory access
vulnerability ...)
+ TODO: check
+CVE-2026-112905 (Vvveb is a powerful and easy to use CMS with page builder to
build web ...)
+ TODO: check
+CVE-2026-112816 (Improper certificate validation in the HTTPS listener in
Canonical LXD ...)
+ TODO: check
+CVE-2026-112374 (FOSSBilling before 0.8.9 contains a Cross-Site Request
Forgery vulnera ...)
+ TODO: check
+CVE-2026-112365 (The easy.jobs \u2013 AI powered Job Listing, Job Board,
Career Page, R ...)
+ TODO: check
+CVE-2026-112348 (Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA
bypass vu ...)
+ TODO: check
+CVE-2026-112347 (Kirki plugin for WordPress before 6.4.1 contains a broken
object-level ...)
+ TODO: check
+CVE-2026-111505 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
+ TODO: check
+CVE-2026-111504 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
+ TODO: check
+CVE-2026-111503 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
+ TODO: check
+CVE-2026-111502 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Insuf ...)
+ TODO: check
+CVE-2026-111501 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
+ TODO: check
+CVE-2026-111500 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
a Missin ...)
+ TODO: check
+CVE-2026-111499 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Incor ...)
+ TODO: check
+CVE-2026-111498 (OpenManage Enterprise, versions prior to 4.8.0, contains an
Improper R ...)
+ TODO: check
+CVE-2026-111487 (An out-of-bounds write vulnerability in the Qt Framework
assimp scene ...)
+ TODO: check
+CVE-2026-110972 (P\u0142atnik performs client-side authentication. An attacker
with acc ...)
+ TODO: check
+CVE-2026-110971 (Use of a weak password encoding algorithm in P\u0142atnik
software all ...)
+ TODO: check
+CVE-2026-110970 (P\u0142atnikuses HTTP protocol to downloadupdates, libraries
and suppo ...)
+ TODO: check
+CVE-2026-110799 (Vvveb is a powerful and easy to use CMS with page builder to
build web ...)
+ TODO: check
+CVE-2026-110533 (The FV Flowplayer Video Player plugin for WordPress is
vulnerable to S ...)
+ TODO: check
+CVE-2026-110305 (The Advanced Custom Fields: Extended plugin for WordPress is
vulnerabl ...)
+ TODO: check
+CVE-2026-110001 (The FV Flowplayer Video Player plugin for WordPress is
vulnerable to S ...)
+ TODO: check
+CVE-2026-109984 (The FV Flowplayer Video Player plugin for WordPress is
vulnerable to S ...)
+ TODO: check
+CVE-2026-109821 (Improper Validation of Specified Quantity in Input
vulnerability in th ...)
+ TODO: check
+CVE-2026-109592 (The OpenStation: Desktop Windows, Dock & Virtual Desktops for
WP Admin ...)
+ TODO: check
+CVE-2026-107868 (Unauthenticated Bypass Vulnerability in YITH WooCommerce
Product Add-O ...)
+ TODO: check
+CVE-2026-107630 (The Email Templates Customizer and Designer for WordPress and
WooComme ...)
+ TODO: check
+CVE-2026-105924 (A NULL pointer dereference vulnerability in the Qt QCborValue
to JSON ...)
+ TODO: check
+CVE-2026-105894 (The Ak Framework plugin for WordPress, included in the Newsy
- Viral N ...)
+ TODO: check
+CVE-2026-105456 (RTIR extends RT's HTML scrubber to allow an internal link
placeh ...)
+ TODO: check
+CVE-2026-105455 (RTIR's ticket creation forms show the subject of the related
tic ...)
+ TODO: check
+CVE-2026-105077 (Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <=
2.8.19 ve ...)
+ TODO: check
+CVE-2026-104744 (The Independent Analytics Pro plugin for WordPress is
vulnerable to St ...)
+ TODO: check
+CVE-2026-104739 (The JS Help Desk \u2013 AI-Powered Support & Ticketing System
plugin f ...)
+ TODO: check
+CVE-2026-104674 (Missing Authorization vulnerability in Arraytics Booktics
booktics all ...)
+ TODO: check
+CVE-2026-104623 (A security vulnerability exists in the authorization handling
for the ...)
+ TODO: check
+CVE-2026-104615 (A security vulnerability was discovered in SUSE Rancher
Fleet's cluste ...)
+ TODO: check
+CVE-2026-104067 (Scribus before 1.6.7 contains an out-of-bounds memory access
vulnerabi ...)
+ TODO: check
+CVE-2026-104066 (Scribus before 1.6.7 contains a heap buffer overflow
vulnerability in ...)
+ TODO: check
+CVE-2026-104065 (Scribus before 1.6.7 contains an out-of-bounds write
vulnerability in ...)
+ TODO: check
+CVE-2026-104064 (Scribus before 1.6.7 contains an integer overflow
vulnerability in the ...)
+ TODO: check
+CVE-2026-104063 (Scribus before 1.6.7 contains an out-of-bounds read
vulnerability in t ...)
+ TODO: check
+CVE-2026-104062 (Scribus before 1.6.7 contains a heap buffer overflow
vulnerability in ...)
+ TODO: check
+CVE-2026-104061 (Scribus before 1.6.7 contains a heap out-of-bounds write
vulnerability ...)
+ TODO: check
+CVE-2026-102918 (The Redux Framework plugin for WordPress is vulnerable to
Stored Cross ...)
+ TODO: check
+CVE-2026-102905 (The The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin
for WordPre ...)
+ TODO: check
+CVE-2026-101214 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
+ TODO: check
+CVE-2026-101213 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
+ TODO: check
+CVE-2026-101210 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
+ TODO: check
+CVE-2026-101209 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
a Server ...)
+ TODO: check
+CVE-2026-100355 (Campfire is a web-based chat application. In version 1.4.4
and earlier ...)
+ TODO: check
+CVE-2025-8574 (The Database Cleaner plugin for WordPress is vulnerable to
arbitrary t ...)
+ TODO: check
+CVE-2025-68395 (ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a
note editor ...)
+ TODO: check
+CVE-2025-68394 (ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable
to SQL ...)
+ TODO: check
+CVE-2025-68393 (ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable
to SQL ...)
+ TODO: check
+CVE-2025-68392 (ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low
privileged u ...)
+ TODO: check
+CVE-2025-68391 (ARKETEAM Protectel modulesPROTECTELMAJ andBDF are vulnerable
to arbitr ...)
+ TODO: check
+CVE-2025-49602 (An issue was discovered in Keyfactor EJBCA 9. When an
administrator is ...)
+ TODO: check
+CVE-2025-31704 (A vulnerability has been found in the Dahua Intelligent
Connection Cen ...)
+ TODO: check
+CVE-2015-20130 (Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a
reflected c ...)
+ TODO: check
+CVE-2010-20125 (DedeCMS before 5.7 contains a file inclusion vulnerability in
plus/car ...)
+ TODO: check
CVE-2026-97645 (The Gravity Forms plugin for WordPress is vulnerable to Stored
Cross-S ...)
NOT-FOR-US: WordPress plugin
CVE-2026-96389 (Missing Authorization vulnerability in Drupal Xray Audit
allows Forcef ...)
@@ -700,7 +1474,7 @@ CVE-2026-108281
- request-tracker5 <unfixed> (bug #1152514)
NOTE: https://github.com/bestpractical/rt/releases/tag/rt-5.0.11
TODO: check details from upstream and affected versions
-CVE-2026-105454
+CVE-2026-105454 (RT's automatic link creation for URLs in HTML ticket content
does ...)
- request-tracker5 <unfixed> (bug #1152514)
NOTE: https://github.com/bestpractical/rt/releases/tag/rt-5.0.11
TODO: check details from upstream and affected versions
@@ -1562,7 +2336,7 @@ CVE-2026-XXXX [GHSA-c968-33g3-wh7p: Package names in
vendor/composer/installed.j
CVE-2026-XXXX [GHSA-fm2w-xgf2-f9fh: Inline repository HTTP headers, such as
API tokens, are written into composer.lock]
- composer 2.11.0-1
NOTE:
https://github.com/composer/composer/security/advisories/GHSA-fm2w-xgf2-f9fh
-CVE-2026-115642 [OSSA-2026-050: keystonemiddleware access_rules bypass via
X-Service-Token]
+CVE-2026-115642 (In OpenStack keystonemiddleware before 13.0.2, by supplying a
custom X ...)
- python-keystonemiddleware 13.0.1-5 (bug #1152543)
NOTE: https://security.openstack.org/ossa/OSSA-2026-050.html
CVE-2026-XXXX [TROVE-2026-072]
@@ -4086,7 +4860,7 @@ CVE-2013-20008 (Linksys WAG200G through 1.01.06 contains
a weak password change
NOT-FOR-US: Linksys
CVE-2013-20007 (Linksys WAG200G through 1.01.06 contains an OS command
injection vulne ...)
NOT-FOR-US: Linksys
-CVE-2026-119193 [GHSA-9vw2-f4vp-x7gf: PHPUnit vulnerable to code execution by
other local users via shared temporary directory in PHPT code coverage handling]
+CVE-2026-119193 (PHPUnit is a testing framework for PHP. From 13.4.0 until
13.4.4, the ...)
- phpunit 13.4.5+ds-1
[trixie] - phpunit <not-affected> (Vulnerable code introduced later)
[bookworm] - phpunit <not-affected> (Vulnerable code introduced later)
@@ -8008,7 +8782,7 @@ CVE-2026-110928
- openssh <undetermined>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2553038
TODO: check, unclear if usptream is affected by the specific issue?
-CVE-2026-115683
+CVE-2026-115683 (A race condition in Epiphany allows a malicious website to
bypass the ...)
- epiphany-browser <unfixed>
NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978
CVE-2026-110522
@@ -23985,6 +24759,7 @@ CVE-2026-94200 (Improper Validation of Consistency
within Input vulnerability in
CVE-2026-94197 (An authentication and authorization bypass vulnerability
exists in F5 ...)
NOT-FOR-US: F5
CVE-2026-93683 (A flaw was found in the DPDK vhost library. When handling a
virtio ind ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2046
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
@@ -24073,54 +24848,66 @@ CVE-2026-88164 (Missing authorization in Microsoft
Office SharePoint allows an a
CVE-2026-87093 (Incorrect Permission Assignment for Critical Resource
vulnerability in ...)
NOT-FOR-US: Progress Software
CVE-2026-86856 (A flaw was found in the DPDK nfp vDPA driver. Stack and heap
buffers s ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2027
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86849 (A flaw was found in DPDK lib/vhost vhost-crypto. Integer
overflow in c ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2022
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86848 (A flaw was found in DPDK lib/vhost vhost-crypto. The
indirect-descript ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2001
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2026
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86847 (A flaw was found in DPDK lib/vhost vhost-crypto. Write-back
chain clea ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2023
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86846 (A flaw was found in DPDK lib/vhost vhost-crypto. A guest can
supply an ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2529846
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2001
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2026
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86845 (A flaw was found in DPDK lib/vhost vhost-crypto. Session
cleanup can l ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2028
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86567 (A flaw was found in DPDK lib/vhost. The VDUSE handler fails to
invalid ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2029
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86566 (A flaw was found in DPDK lib/vhost. A guest with runt RX
descriptors c ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2020
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86565 (A flaw was found in DPDK lib/vhost. A guest can desynchronize
virtqueu ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2008
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86563 (A flaw was found in DPDK lib/vhost. A double-offset bug in
vhost log m ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2004
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86562 (A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of
control-q ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2003
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2021
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
CVE-2026-86561 (A flaw was found in DPDK lib/vhost. Memory size is not
adequately vali ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2002
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
@@ -25174,6 +25961,7 @@ CVE-2026-100404 (Zulip is an open-source team
collaboration tool. In Zulip Serve
CVE-2026-100394 (Nezha Monitoring is a self-hostable, lightweight, servers and
websites ...)
NOT-FOR-US: Nezha Monitoring
CVE-2026-100236 (A flaw was found in the DPDK GSO library. When software GSO
copies pac ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2047
NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/7
@@ -35297,7 +36085,7 @@ CVE-2026-107660 (FFmpeg before 8.1.3 and 9.x before
9.0.2 contains an improper c
NOTE: Fixed by:
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29
(n9.0.2)
NOTE: Fixed by:
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f
(n8.1.3)
NOTE: mbedtls not enabled in Debian builds
-CVE-2026-118475 [EogMetadataReaderPng: Avoid buffer overflow with malformed
iCCP chunks]
+CVE-2026-118475 (A flaw was found in Eye of GNOME. When parsing a specially
crafted PNG ...)
- eog 50.4-1
NOTE: https://gitlab.gnome.org/GNOME/eog/-/issues/342
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/eog/-/commit/04e4f313421eacb9fc529781542bb7fb81a3cd1a
(50.4)
@@ -36278,6 +37066,7 @@ CVE-2026-107227 (The AsyncHttpClient (AHC) library
allows Java applications to e
CVE-2026-107176 (A flaw was found in the cluster-samples-operator. The RBAC
Role coreos ...)
NOT-FOR-US: cluster-samples-operator
CVE-2026-107161 (A heap-based buffer overflow flaw was found in Cyrus SASL.
The add_to_ ...)
+ {DLA-4871-1}
- cyrus-sasl2 2.1.28+dfsg1-12 (bug #1150516)
[trixie] - cyrus-sasl2 <no-dsa> (Will be fixed via point release;
suggested patch taken for update)
NOTE: https://github.com/cyrusimap/cyrus-sasl/issues/889
@@ -77153,6 +77942,7 @@ CVE-2026-87050
CVE-2026-87049
NOT-FOR-US: operator-foundry
CVE-2026-86564 (A flaw was found in DPDK lib/vhost. Missing length validation
before r ...)
+ {DSA-6597-1}
- dpdk 25.11.4-1 (bug #1147518)
[bookworm] - dpdk <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2529682
@@ -109559,7 +110349,8 @@ CVE-2026-13197 (Nozomi Networks Labs identified a
CWE-362: Concurrent Execution
NOT-FOR-US: KUNBUS
CVE-2026-13196 (Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write
vulnera ...)
NOT-FOR-US: KUNBUS
-CVE-2026-13002 (A flow has been identified into dnssec.c library, causing an
infinite ...)
+CVE-2026-13002
+ REJECTED
- dnsmasq <unfixed> (bug #1144649)
[trixie] - dnsmasq <no-dsa> (Minor issue)
[bookworm] - dnsmasq <postponed> (Minor issue)
@@ -155069,7 +155860,7 @@ CVE-2026-11597 (The Surbma | Infusionsoft Shortcode
plugin for WordPress is vuln
NOT-FOR-US: WordPress plugin
CVE-2026-11364 (The Product Specifications for WooCommerce plugin for
WordPress is vul ...)
NOT-FOR-US: WordPress plugin
-CVE-2026-61626 [GHSA-5gf7-wjfm-vmvm: Out-of-bounds bit clears for negative
Matroska ReadOrder values]
+CVE-2026-61626 (libass is a portable subtitle renderer for the ASS/SSA
(Advanced Subst ...)
- libass 1:0.17.5-1
[trixie] - libass <not-affected> (Vulnerable code not present)
[bookworm] - libass <not-affected> (Vulnerable code not present)
@@ -155078,7 +155869,7 @@ CVE-2026-61626 [GHSA-5gf7-wjfm-vmvm: Out-of-bounds
bit clears for negative Matro
NOTE: Introduced with:
https://github.com/libass/libass/commit/dcc9eb722ebd485d2ed0e21c261b0a1b05497154
(0.17.4)
NOTE: Fixed with:
https://github.com/libass/libass/commit/23da65a130bb8c5b2cf0c7df0dd7d424607f98f1
(0.17.5)
NOTE: https://github.com/libass/libass/issues/937
-CVE-2026-61627 [GHSA-pjjp-65r7-ppgm: Out-of-bounds read and write in
wrap_lines_measure]
+CVE-2026-61627 (libass is a portable subtitle renderer for the `ASS`/SSA
(Advanced Sub ...)
{DLA-4769-1}
- libass 1:0.17.5-1
[trixie] - libass 1:0.17.3-1+deb13u1
@@ -170043,7 +170834,7 @@ CVE-2026-41448 (AdGuard Home, when started with the
--glinet flag, contains an a
NOT-FOR-US: AdGuard Home
CVE-2026-3011 (The Recipe Card Blocks Lite plugin for WordPress is vulnerable
to Stor ...)
NOT-FOR-US: WordPress plugin
-CVE-2026-39910 (STACKIT IaaS API contains a missing authorization check
vulnerability ...)
+CVE-2026-39910 (STACKIT IaaS API contains a missing authorization check in the
PUT ser ...)
NOT-FOR-US: STACKIT
CVE-2026-39908 (OpenBullet2 through version 0.3.2 on Windows contains a
credential dis ...)
NOT-FOR-US: OpenBullet2
@@ -1040122,7 +1040913,7 @@ CVE-2013-2058 (The host_start function in
drivers/usb/chipidea/host.c in the Lin
NOTE: https://www.openwall.com/lists/oss-security/2013/05/03/2
CVE-2013-2057 (YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File
Includ ...)
NOT-FOR-US: YaBB
-CVE-2013-2056 (The Inter-Satellite Sync (ISS) operation in Red Hat Network
(RHN) Sate ...)
+CVE-2013-2056 (A flaw was found in Red Hat Network Satellite. The
Inter-Satellite Syn ...)
NOT-FOR-US: RHN Satellite
CVE-2013-2055 (Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23,
1.5.x ...)
NOT-FOR-US: Apache Wicket
@@ -1040849,7 +1041640,7 @@ CVE-2013-1841 (Net-Server, when the reverse-lookups
option is enabled, does not
NOTE: 2.011 upstream adds 'double_reverse_lookups' configuration and
code as fix
NOTE: for the issue, but does not enable the checks by default. They
need to be
NOTE: enabled by consumers by setting 'reverse_lookups=double' or
double_reverse_lookups=1'.
-CVE-2013-1840 (The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2),
and Gr ...)
+CVE-2013-1840 (A flaw was found in OpenStack Glance. Remote authenticated
users can e ...)
- glance 2012.1.1-5 (bug #703063)
CVE-2013-1839 (The strHdrAcptLangGetItem function in errorpage.cc in Squid
3.2.x befo ...)
- squid3 <not-affected> (the errors were introduced in trunk rev.11496
in 3.2.0.9)
@@ -1048395,7 +1049186,7 @@ CVE-2012-5606 (Multiple cross-site scripting (XSS)
vulnerabilities in ownCloud b
- owncloud 4.0.8debian-1.1 (bug #693990)
[wheezy] - owncloud 4.0.4debian2-3.1
NOTE: https://www.openwall.com/lists/oss-security/2012/11/30/2
-CVE-2012-5605 (Grinder in Red Hat CloudForms before 1.1 uses world-writable
permissio ...)
+CVE-2012-5605 (A flaw was found in Grinder, a component of Red Hat CloudForms.
This v ...)
NOT-FOR-US: Red Hat CloudForms
CVE-2012-5604 (The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1,
when u ...)
NOT-FOR-US: Red Hat CloudForms
@@ -1051254,7 +1052045,7 @@ CVE-2012-4576 (FreeBSD: Input Validation Flaw
allows local users to gain elevate
CVE-2012-4575 (The add_database function in objects.c in the pgbouncer pooler
1.5.2 f ...)
- pgbouncer 1.5.2-4
[squeeze] - pgbouncer <no-dsa> (Minor issue)
-CVE-2012-4574 (Pulp in Red Hat CloudForms before 1.1 uses world-readable
permissions ...)
+CVE-2012-4574 (A flaw was found in Pulp, as used in Red Hat CloudForms. This
vulnerab ...)
NOT-FOR-US: Red Hat CloudForms
CVE-2012-4573 (The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and
Essex (20 ...)
- glance 2012.1.1-2 (bug #692641)
@@ -1054271,7 +1055062,7 @@ CVE-2012-3429 (The dns_to_ldap_dn_escape function
in src/ldap_convert.c in bind-
NOTE:
https://pagure.io/bind-dyndb-ldap/c/f345805c73c294db42452ae966c48fbc36c48006
(v2.0)
CVE-2012-3428 (The IronJacamar container before 1.0.12.Final for JBoss
Application Se ...)
- jbossas4 <not-affected> (Only builds a few libraries, not the full
application server)
-CVE-2012-3427 (EC2 Amazon Machine Image (AMI) in JBoss Enterprise Application
Platfor ...)
+CVE-2012-3427 (A flaw was found in JBoss Enterprise Application Platform (EAP)
and EC ...)
- jbossas4 <not-affected> (Only builds a few libraries, not the full
application server)
CVE-2012-3426 (OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom
before ...)
- keystone 2012.1.1-1
@@ -1144254,7 +1145045,7 @@ CVE-2006-4340 (Mozilla Network Security Service
(NSS) library before 3.11.3, as
- firefox 1.5.dfsg+1.5.0.7-1 (high)
- thunderbird 1.5.0.7-1 (high)
- xulrunner 1.8.0.7-1 (high)
-CVE-2006-4339 (OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before
0.9.8c, wh ...)
+CVE-2006-4339 (A flaw was found in OpenSSL. When configured to use an RSA key
with ex ...)
{DSA-1174-1 DSA-1173-1}
- openssl 0.9.8b-3 (medium)
- openssl097 0.9.7i-2 (medium)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/812babbbc1c97c76ce177c6a289c6fad702663a8
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/812babbbc1c97c76ce177c6a289c6fad702663a8
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
