Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
3b68d96b by Salvatore Bonaccorso at 2026-10-31T11:21:53+01:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -45,7 +45,7 @@ CVE-2026-63414 (Shopify App is a Rails engine for building
Shopify applications.
CVE-2026-63410 (secp256k1-native is a native C secp256k1 implementation for
Ruby. In a ...)
NOT-FOR-US: secp256k1-native Ruby gem
CVE-2026-63402 (i18next is an internationalization framework for JavaScript.
Prior to ...)
- - node-i18next <unfixed>
+ - node-i18next <unfixed> (bug #1152688)
NOTE:
https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx
NOTE: Fixed by:
https://github.com/i18next/i18next/commit/642137b7786d83661ec3ee53027798dc4b81d30a
(v26.3.4)
CVE-2026-63401 (Coop is an open source review and moderation tool from ROOST.
Prior to ...)
@@ -364,7 +364,7 @@ CVE-2026-9239 (The Meow Gallery plugin for WordPress is
vulnerable to Stored Cro
CVE-2026-97638 (The Forminator Forms \u2013 Contact Form, Payment Form &
Custom Form B ...)
NOT-FOR-US: WordPress plugin
CVE-2026-97209 (Insecure Temporary File vulnerability in Mix deps.partition in
Elixir ...)
- - elixir-lang <unfixed>
+ - elixir-lang <unfixed> (bug #1152683)
[trixie] - elixir-lang <not-affected> (Vulnerable code introduced later)
[bookworm] - elixir-lang <not-affected> (Vulnerable code introduced
later)
NOTE:
https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q
@@ -433,7 +433,7 @@ CVE-2026-64860
CVE-2026-64618 (Improper Neutralization of Special Elements used in an SQL
Command ("S ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-62303 (Pistache is a high-performance REST toolkit written in C++.
From 0.0.5 ...)
- - pistache <unfixed>
+ - pistache <unfixed> (bug #152687)
NOTE:
https://github.com/pistacheio/pistache/security/advisories/GHSA-q474-pqcp-gqm5
NOTE:
https://github.com/pistacheio/pistache/commit/935461352403696f3ca0dbb9a7de7d2609e7ce91
CVE-2026-62298 (mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN
TYPE` dec ...)
@@ -1364,43 +1364,43 @@ CVE-2026-119210 (MariaDB Connector/J is used to connect
applications developed i
NOTE: https://jira.mariadb.org/browse/CONJ-1387
NOTE: Fixed by:
https://github.com/mariadb-corporation/mariadb-connector-j/commit/a4891f877f1c885a573194771c1ed0aacec0ce1d
(3.5.11)
CVE-2026-119209 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.21 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1152684)
- pypdf2 <removed>
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-x3rh-gjgm-fmqc
NOTE: https://github.com/py-pdf/pypdf/pull/4269
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/a93fe3a901fd00af38f0a105c3ba7175fa72dcb4
(6.21.3)
CVE-2026-119208 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.21 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1152684)
- pypdf2 <removed>
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-62m5-6wh8-28x7
NOTE: https://github.com/py-pdf/pypdf/pull/4270
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/82b91951dc74496bb3efe6465434f041bb6a5e6b
(6.21.3)
CVE-2026-119207 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.21 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1152684)
- pypdf2 <removed>
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vqv-7265-gm2w
NOTE: https://github.com/py-pdf/pypdf/pull/4265
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/64270258c0eced720f7960aecf8cef31afd39f8d
(6.21.3)
CVE-2026-119206 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.21 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1152684)
- pypdf2 <removed>
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw
NOTE: https://github.com/py-pdf/pypdf/pull/4251
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/b891fef37000cd86baa6e9848a3387d080b3b03e
(6.21.3)
CVE-2026-119205 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.21 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1152684)
- pypdf2 <removed>
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-mfr5-77xh-9j7h
NOTE: https://github.com/py-pdf/pypdf/pull/4288
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/f176db1a1f7f9af3e472e69a843ef1175653b044
(6.21.4)
CVE-2026-119204 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.21 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1152684)
- pypdf2 <removed>
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-cggf-277g-3q54
NOTE: https://github.com/py-pdf/pypdf/pull/4290
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/ea4ac663133f1b3de1d7a8f2e6fa239802fde79e
(6.21.4)
CVE-2026-119203 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.21 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1152684)
- pypdf2 <removed>
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-5849-834g-hvw5
NOTE: https://github.com/py-pdf/pypdf/pull/4289
@@ -2355,7 +2355,7 @@ CVE-2026-118766 (Botan is a C++ cryptography library.
Prior to 3.13.0, Botan's o
CVE-2026-118765 (Botan is a C++ cryptography library. From 3.7.0 until 3.13.0,
an appli ...)
TODO: check
CVE-2026-118764 (minimatch is a minimal matching utility for converting glob
expression ...)
- - node-minimatch <unfixed>
+ - node-minimatch <unfixed> (bug #1152691)
NOTE:
https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249
NOTE: Fixed by:
https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8
(v11.0.1)
CVE-2026-118763 (sigstore-js provides JavaScript libraries for interacting
with Sigstor ...)
@@ -2942,7 +2942,7 @@ CVE-2026-118803 (Bricks Theme 2.4.3 and before contains
an unauthenticated dynam
CVE-2026-118757 (PiWeb Disable payment method / Partial payment for
WooCommerce before ...)
NOT-FOR-US: WooCommerce
CVE-2026-118756 (gopass before 1.17.0 contains a path traversal vulnerability
in the fi ...)
- - golang-github-gopasspw-gopass <unfixed>
+ - golang-github-gopasspw-gopass <unfixed> (bug #1152690)
NOTE:
https://github.com/gopasspw/gopass/security/advisories/GHSA-rw43-4vhf-hcvj
NOTE: Fixed by:
https://github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2
(v1.17.0-rc.3)
CVE-2026-118755 (Volmarg Personal Management System through 2.1.0 contains an
OS comman ...)
@@ -2970,7 +2970,7 @@ CVE-2026-118689 (OvenMediaEngine through 0.21.0 contains
a denial of service vul
CVE-2026-118682 (KaringX ClashMi through 1.0.32.1801 disables TLS certificate
validatio ...)
NOT-FOR-US: KaringX ClashMi
CVE-2026-118669 (OAuthLib is an implementation of the OAuth request-signing
logic for P ...)
- - python-oauthlib <unfixed>
+ - python-oauthlib <unfixed> (bug #1152689)
NOTE:
https://github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c
NOTE: https://github.com/oauthlib/oauthlib/pull/920
NOTE: Fixed by:
https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d
(v4.0.0)
@@ -3926,7 +3926,7 @@ CVE-2026-116796 (Highcharts JS is a JavaScript charting
library based on SVG. Fr
CVE-2026-116795 (RE2JS is the JavaScript port of RE2, a regular expression
engine that ...)
NOT-FOR-US: RE2JS
CVE-2026-116794 (russh is a Rust SSH client and server library that includes
an SSH age ...)
- - rust-russh <unfixed>
+ - rust-russh <unfixed> (bug #1152685)
NOTE:
https://github.com/Eugeny/russh/security/advisories/GHSA-vp5q-ff62-jwqv
NOTE: Fixed by:
https://github.com/Eugeny/russh/commit/62db6e7defd6d244159da962ccccb029e785ce0f
(v0.65.0)
CVE-2026-116778 (FOG is a free open-source cloning/imaging/rescue
suite/inventory manag ...)
@@ -5023,11 +5023,11 @@ CVE-2026-117605 (nopCommerce before 5.00.0 contains a
missing authorization vuln
CVE-2026-116775 (pageant provides a PageantStream type that implements
AsyncRead and As ...)
NOT-FOR-US: pageant
CVE-2026-116774 (russh is a Rust SSH client and server library that includes
an SSH age ...)
- - rust-russh <unfixed>
+ - rust-russh <unfixed> (bug #1152685)
NOTE:
https://github.com/Eugeny/russh/security/advisories/GHSA-fw5c-8223-6h42
NOTE: Fixed by:
https://github.com/Eugeny/russh/commit/39cb9dbaa37caf555d34c6c22efa3bbbff9e186c
(v0.65.0)
CVE-2026-116773 (russh is a Rust SSH client and server library that includes
an SSH age ...)
- - rust-russh <unfixed>
+ - rust-russh <unfixed> (bug #1152685)
NOTE:
https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg
NOTE: Fixed by:
https://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75
(v0.65.0)
CVE-2026-116761 (The CMB2 plugin for WordPress is vulnerable to Stored
Cross-Site Scrip ...)
@@ -5037,7 +5037,7 @@ CVE-2026-116750 (The VikRentCar Car Rental Management
System plugin for WordPres
CVE-2026-116749 (The VikRentCar Car Rental Management System plugin for
WordPress is vu ...)
NOT-FOR-US: WordPress plugin
CVE-2026-116696 (russh is a Rust SSH client and server library that includes
an SSH age ...)
- - rust-russh <unfixed>
+ - rust-russh <unfixed> (bug #1152685)
NOTE:
https://github.com/Eugeny/russh/security/advisories/GHSA-9wfm-jcj8-jfv9
NOTE: Fixed by:
https://github.com/Eugeny/russh/commit/23aa5d28fe9601c5bdfe9e60b7ec5d4f882c3de6
(v0.65.0)
CVE-2026-116695 (Crass is a Ruby CSS parser that is compliant with the CSS
Syntax Level ...)
@@ -10098,21 +10098,21 @@ CVE-2026-115586 (virtualenv is a tool for creating
isolated virtual python envir
NOTE: https://github.com/pypa/virtualenv/pull/3466
NOTE: Fixed by:
https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4
(21.14.13)
CVE-2026-115585 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.21 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1152684)
[trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4
NOTE: https://github.com/py-pdf/pypdf/pull/4240
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b
(6.21.2)
CVE-2026-115580 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.21 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1152684)
[trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5
NOTE: https://github.com/py-pdf/pypdf/pull/4239
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2
(6.21.2)
CVE-2026-115572 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.21 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1152684)
[trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw
@@ -25521,7 +25521,7 @@ CVE-2026-60010 (Gitea's repository-side team-link API
allows a repository admini
CVE-2026-60008 (Gitea's Jupyter notebook renderer inserts the notebook's
language_info ...)
NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-59951 (The MCP Python SDK, called mcp on PyPI, is a Python
implementation of ...)
- - python-mcp <unfixed>
+ - python-mcp <unfixed> (bug #1152686)
NOTE:
https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv
NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/3395
NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/3426
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3b68d96bcbdc3822f63b235a7d37e42a0e1ddaeb
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3b68d96bcbdc3822f63b235a7d37e42a0e1ddaeb
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
