Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d265fc25 by security tracker role at 2026-11-06T19:16:01+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,661 @@
+CVE-2026-97642 (The Wp Parsidate plugin for WordPress is vulnerable to Stored
Cross-Si ...)
+ TODO: check
+CVE-2026-92895 (The Live2DWebCanvas plugin for WordPress is vulnerable to
Arbitrary Fi ...)
+ TODO: check
+CVE-2026-92080 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
+ TODO: check
+CVE-2026-90975 (A vulnerability in Realtek's RtUsbA64.sys USB audio driver
allows a lo ...)
+ TODO: check
+CVE-2026-90436 (** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound
SOAP fau ...)
+ TODO: check
+CVE-2026-89101 (The Everest Forms \u2013 Contact Form, Payment Form, Quiz,
Survey & Cu ...)
+ TODO: check
+CVE-2026-89017 (Skyline DataMiner BrokerGateway contains an embedded API key
vulnerabi ...)
+ TODO: check
+CVE-2026-88801 (The MDJM Event Management and Mobile Events Manager WordPress
plugins ...)
+ TODO: check
+CVE-2026-88800 (The MDJM Event Management and Mobile Events Manager WordPress
plugins ...)
+ TODO: check
+CVE-2026-88799 (The MDJM Event Management and Mobile Events Manager WordPress
plugins ...)
+ TODO: check
+CVE-2026-87964 (The Product Feed Manager for WooCommerce \u2013 CTX Feed
\u2013 Suppor ...)
+ TODO: check
+CVE-2026-87045 (The HTTP/2 server in subsys/net/lib/http/http_server_http2.c
clears th ...)
+ TODO: check
+CVE-2026-85744 (FreeScout is a self-hosted help desk and shared mailbox. Prior
to 1.8. ...)
+ TODO: check
+CVE-2026-85743 (FreeScout is a self-hosted help desk and shared mailbox. Prior
to 1.8. ...)
+ TODO: check
+CVE-2026-85742 (FreeScout is a self-hosted help desk and shared mailbox. Prior
to 1.8. ...)
+ TODO: check
+CVE-2026-85111 (Allocation of Resources Without Limits or Throttling in Apache
James M ...)
+ TODO: check
+CVE-2026-85108 (Allocation of Resources Without Limits or Throttling in Apache
James M ...)
+ TODO: check
+CVE-2026-84473 (Authentication Bypass / Missing Brute-Force Protection in
remote.php/w ...)
+ TODO: check
+CVE-2026-84164 (The HTML report that plist-to-html, CodeChecker parse --export
html an ...)
+ TODO: check
+CVE-2026-84161 (When an operator enables store.analysis_statistics_dir, a
network clie ...)
+ TODO: check
+CVE-2026-84155 (CodeChecker's web server fails to fully invalidate a session
token on ...)
+ TODO: check
+CVE-2026-82308 (A pre-authentication heap-based buffer overflow vulnerability
has been ...)
+ TODO: check
+CVE-2026-80303 (An integer underflow vulnerability in the Avast Windows
Filtering Plat ...)
+ TODO: check
+CVE-2026-80302 (Insufficient isolation in the Avast sandbox file
virtualization layer ...)
+ TODO: check
+CVE-2026-80301 (Improper isolation in the Avast sandbox on Windows allows a
local, low ...)
+ TODO: check
+CVE-2026-76171 (In Apache James server prior version 3.9.1 improper validation
in JMAP ...)
+ TODO: check
+CVE-2026-76168 (In Apache James server prior version 3.9.1 relying on the
SieveFileRep ...)
+ TODO: check
+CVE-2026-75598 (The Gradle Shadow plugin creates fat or uber JARs and supports
file tr ...)
+ TODO: check
+CVE-2026-74756 (Some docker-compose shipped by the project exposes by default
Webadmin ...)
+ TODO: check
+CVE-2026-71495 (Wanderer is a self-hosted trail database for saving and
sharing advent ...)
+ TODO: check
+CVE-2026-66987 (HCL AION is affected by a vulnerability where the account
lockout mech ...)
+ TODO: check
+CVE-2026-66986 (HCL AION is affected by a vulnerability where user sessions
did not ex ...)
+ TODO: check
+CVE-2026-66984 (HCL AION is affected by a vulnerability where certain
application resp ...)
+ TODO: check
+CVE-2026-66982 (HCL AION is affected by a vulnerability where browser
autocomplete was ...)
+ TODO: check
+CVE-2026-66981 (HCL AION is affected by a vulnerability where the application
trusted ...)
+ TODO: check
+CVE-2026-66295 (Saxy's XML encoder writes the target and the content of a
processing i ...)
+ TODO: check
+CVE-2026-66294 (XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1
serializes ...)
+ TODO: check
+CVE-2026-66293 (XML injection in the encoder of Saxy. Saxy.Encoder does not
neutralize ...)
+ TODO: check
+CVE-2026-65022 (The MDM App Catalog / App Store preview does not properly
sanitize or ...)
+ TODO: check
+CVE-2026-64894 (Inclusion of functionality from untrusted control sphere
vulnerability ...)
+ TODO: check
+CVE-2026-62856 (FreeScout is a self-hosted help desk and shared mailbox
application. P ...)
+ TODO: check
+CVE-2026-62855 (FreeScout is a self-hosted help desk and shared mailbox. Prior
to 1.8. ...)
+ TODO: check
+CVE-2026-62854 (FreeScout is a self-hosted help desk and shared mailbox. Prior
to 1.8. ...)
+ TODO: check
+CVE-2026-62852 (FreeScout is a self-hosted help desk and shared mailbox. Prior
to 1.8. ...)
+ TODO: check
+CVE-2026-62851 (FreeScout is a self-hosted help desk and shared mailbox. Prior
to 1.8. ...)
+ TODO: check
+CVE-2026-62850 (FreeScout is a self-hosted help desk and shared mailbox. Prior
to 1.8. ...)
+ TODO: check
+CVE-2026-62346 (Wanderer is a self-hosted trail database for saving and
sharing advent ...)
+ TODO: check
+CVE-2026-62345 (Wanderer is a self-hosted trail database for saving and
sharing advent ...)
+ TODO: check
+CVE-2026-62344 (Wanderer is a self-hosted trail database for saving and
sharing advent ...)
+ TODO: check
+CVE-2026-5345 (HCL AION is affected by a missing encryption vulnerability in a
second ...)
+ TODO: check
+CVE-2026-59105 (Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL
Server ...)
+ TODO: check
+CVE-2026-58141 (Dify before 1.15.0 contains a server-side request forgery
vulnerabilit ...)
+ TODO: check
+CVE-2026-56717
+ REJECTED
+CVE-2026-53980 (Charmbracelet wish before 2.0.5 contains a path traversal
vulnerabilit ...)
+ TODO: check
+CVE-2026-49951 (RAGFlow before 0.27.0 contains a server-side request forgery
vulnerabi ...)
+ TODO: check
+CVE-2026-49939 (In Apache James server prior version 3.9.1 improper Access
Control Lis ...)
+ TODO: check
+CVE-2026-49126
+ REJECTED
+CVE-2026-49125
+ REJECTED
+CVE-2026-49124
+ REJECTED
+CVE-2026-49123
+ REJECTED
+CVE-2026-49122
+ REJECTED
+CVE-2026-47404
+ REJECTED
+CVE-2026-47403
+ REJECTED
+CVE-2026-47402
+ REJECTED
+CVE-2026-47401
+ REJECTED
+CVE-2026-47400
+ REJECTED
+CVE-2026-39744 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-35115 (HCL AION is affected by a vulnerability where the HTTP
Strict-Transpor ...)
+ TODO: check
+CVE-2026-35114 (HCL AION is affected by a vulnerability where the
X-Content-Type-Optio ...)
+ TODO: check
+CVE-2026-35113 (HCL AION is affected by a vulnerability where the
Cross-Origin-Opener- ...)
+ TODO: check
+CVE-2026-35112 (HCL AION is affected by a vulnerability where the
Cross-Origin-Embedde ...)
+ TODO: check
+CVE-2026-35111 (HCL AION is affected by a vulnerability where the
Cross-Origin-Resourc ...)
+ TODO: check
+CVE-2026-35110 (HCL AION is affected by a vulnerability where encrypted
(HTTPS) commun ...)
+ TODO: check
+CVE-2026-35109 (HCL AION is affected by a vulnerability where pages served
over HTTPS ...)
+ TODO: check
+CVE-2026-35107 (HCL AION is affected by an open redirect vulnerability in the
user men ...)
+ TODO: check
+CVE-2026-35106 (HCL AION is affected by an open redirect vulnerability in the
session- ...)
+ TODO: check
+CVE-2026-35105 (HCL AION is affected by an open redirect vulnerability in the
session- ...)
+ TODO: check
+CVE-2026-35104 (HCL AION is affected by an open redirect vulnerability on the
user reg ...)
+ TODO: check
+CVE-2026-35103 (HCL AION is affected by an open redirect vulnerability on the
role ass ...)
+ TODO: check
+CVE-2026-35102 (HCL AION is affected by an open redirect vulnerability in the
navigati ...)
+ TODO: check
+CVE-2026-33379 (A user with any role, including Viewer or a service account
with no pe ...)
+ TODO: check
+CVE-2026-21850 (HCL AION is affected by a vulnerability where user-controlled
input co ...)
+ TODO: check
+CVE-2026-21849 (HCL AION is affected by a missing encryption vulnerability in
the WebS ...)
+ TODO: check
+CVE-2026-21834 (HCL AION is affected by a vulnerability where the
Content-Security-Pol ...)
+ TODO: check
+CVE-2026-19877 (INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects
image-share ...)
+ TODO: check
+CVE-2026-19876 (A reflected cross-site scripting (XSS) vulnerability in the
login/SSO ...)
+ TODO: check
+CVE-2026-12067 (Missing exception handlers in AvastSvc native message
dispatcher (ashS ...)
+ TODO: check
+CVE-2026-123998 (Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains
an authent ...)
+ TODO: check
+CVE-2026-123997 (Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains
an unauthe ...)
+ TODO: check
+CVE-2026-123996 (Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains a
missing ...)
+ TODO: check
+CVE-2026-123995 (Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains
an input v ...)
+ TODO: check
+CVE-2026-123994 (Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains
an unauthe ...)
+ TODO: check
+CVE-2026-123993 (Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains
an unauthe ...)
+ TODO: check
+CVE-2026-123976 (EDFbrowser before 2.16 contains an out-of-bounds write
vulnerability i ...)
+ TODO: check
+CVE-2026-123973 (SharePoint Products CopyMove before 2026-11-06 allows
traversal. An au ...)
+ TODO: check
+CVE-2026-123876 (A flaw was found in the default seccomp profile used by
Podman via con ...)
+ TODO: check
+CVE-2026-123859 (When identifier escaping is disabled through a non-default
configurati ...)
+ TODO: check
+CVE-2026-123858 (In JetBrains PhpStorm before 2026.3 project files could be
automatical ...)
+ TODO: check
+CVE-2026-123857 (In JetBrains PhpStorm before 2026.3 xXE was possible in
untrusted proj ...)
+ TODO: check
+CVE-2026-123856 (In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure
was possibl ...)
+ TODO: check
+CVE-2026-123855 (In JetBrains Toolbox App before 3.6.1 command injection was
possible v ...)
+ TODO: check
+CVE-2026-123854 (In JetBrains PyCharm before 2026.3 code execution was
possible in Safe ...)
+ TODO: check
+CVE-2026-123853 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code
execution was ...)
+ TODO: check
+CVE-2026-123852 (In JetBrains Junie GitHub Action before 1.8.0 code execution
with work ...)
+ TODO: check
+CVE-2026-123851 (In JetBrains Junie GitHub Action before 1.6.4 prompt
injection protect ...)
+ TODO: check
+CVE-2026-123850 (In JetBrains YouTrack before 2026.2.19422 cSS injection was
possible i ...)
+ TODO: check
+CVE-2026-123849 (In JetBrains IntelliJ IDEA before 2026.3 code execution was
possible i ...)
+ TODO: check
+CVE-2026-123848 (In JetBrains IntelliJ IDEA before 2026.3 host name
verification was mi ...)
+ TODO: check
+CVE-2026-123847 (In JetBrains IntelliJ IDEA before 2026.3 command execution
was possibl ...)
+ TODO: check
+CVE-2026-123846 (In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was
possible via r ...)
+ TODO: check
+CVE-2026-123845 (In JetBrains IntelliJ IDEA before 2026.3 path traversal was
possible v ...)
+ TODO: check
+CVE-2026-123844 (In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible
via custom ...)
+ TODO: check
+CVE-2026-123843 (In JetBrains IntelliJ IDEA before 2026.3 untrusted projects
could trig ...)
+ TODO: check
+CVE-2026-123842 (In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write
was poss ...)
+ TODO: check
+CVE-2026-123841 (In JetBrains IntelliJ IDEA before 2026.3 code execution was
possible v ...)
+ TODO: check
+CVE-2026-123840 (In JetBrains IntelliJ IDEA before 2026.3 hTML injection was
possible i ...)
+ TODO: check
+CVE-2026-123839 (In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary
URLs withou ...)
+ TODO: check
+CVE-2026-123838 (In JetBrains IntelliJ IDEA before 2026.3 code execution was
possible i ...)
+ TODO: check
+CVE-2026-123837 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command
injection ...)
+ TODO: check
+CVE-2026-123836 (In JetBrains Datalore before 2026.4 workspace collaborators
could obta ...)
+ TODO: check
+CVE-2026-123835 (In JetBrains Datalore before 2026.4 code execution was
possible in ano ...)
+ TODO: check
+CVE-2026-123834 (In JetBrains Datalore before 2026.4 improper scope validation
in datab ...)
+ TODO: check
+CVE-2026-123833 (In JetBrains IntelliJ IDEA before 2026.3 database connections
could be ...)
+ TODO: check
+CVE-2026-123832 (In JetBrains CLion before 2026.2 code execution was possible
in Safe M ...)
+ TODO: check
+CVE-2026-123831 (In JetBrains CLion before 2026.2, 2026.1.4 code execution
was possibl ...)
+ TODO: check
+CVE-2026-123824 (The Symfony Config componentXmlUtils::parse()enables DTD
validation be ...)
+ TODO: check
+CVE-2026-123792 (The Symfony Yaml componentsInlineandParser, parse some YAML
documents ...)
+ TODO: check
+CVE-2026-123786 (Agenta before 0.122.5 contains a server-side request forgery
vulnerabi ...)
+ TODO: check
+CVE-2026-123785 (Fluxbox through 1.3.7 contains an infinite loop vulnerability
in Menu: ...)
+ TODO: check
+CVE-2026-123784 (Fluxbox through 1.3.7 contains an OS command injection
vulnerability i ...)
+ TODO: check
+CVE-2026-123783 (Skyvern through 1.0.56 contains a sandbox bypass
vulnerability that al ...)
+ TODO: check
+CVE-2026-123782 (ChatWiki before 2.10.0 contains an insecure direct object
reference vu ...)
+ TODO: check
+CVE-2026-123748 (A security flaw has been discovered in chenyme grok2api up to
3.1.6. A ...)
+ TODO: check
+CVE-2026-123746 (The Symfony Security HTTP
componentAuthenticatorManager::authenticateU ...)
+ TODO: check
+CVE-2026-123677 (A vulnerability was found in xxyopen/201206030 novel up to
3.5.0. Affe ...)
+ TODO: check
+CVE-2026-123676 (A vulnerability has been found in xxyopen/201206030 novel up
to 3.5.0. ...)
+ TODO: check
+CVE-2026-123675 (A flaw has been found in OpenBMB Internet of Agents up to
9d78e88e4716 ...)
+ TODO: check
+CVE-2026-123665 (A weakness has been identified in kubescape up to 4.0.15.
Impacted is ...)
+ TODO: check
+CVE-2026-123664 (A security flaw has been discovered in nasa-gcn gcn.nasa.gov
up to b29 ...)
+ TODO: check
+CVE-2026-123660 (In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1,
a signed- ...)
+ TODO: check
+CVE-2026-123655 (A flaw was found in Moodle. Insufficient access control
checks on H5P ...)
+ TODO: check
+CVE-2026-123653 (A security vulnerability has been detected in esengine
DeepSeek-Reason ...)
+ TODO: check
+CVE-2026-123624 (ChatWiki before 2.10.0 contains an insecure direct object
reference vu ...)
+ TODO: check
+CVE-2026-123623 (Grida through 0.0.24 contains a missing authorization
vulnerability in ...)
+ TODO: check
+CVE-2026-123622 (Usermin through 2.570 contains a cross-site scripting
vulnerability in ...)
+ TODO: check
+CVE-2026-123621 (Usermin through 2.570 contains a path traversal vulnerability
in mailb ...)
+ TODO: check
+CVE-2026-123620 (Usermin through 2.570 contains an OS command injection
vulnerability i ...)
+ TODO: check
+CVE-2026-123619 (Lektor through 3.3.14 and 3.4.0b15 contains an absolute path
traversal ...)
+ TODO: check
+CVE-2026-123618 (ABP Framework before 10.7.1 contains an authentication bypass
vulnerab ...)
+ TODO: check
+CVE-2026-123617 (Openwhyd before 1.65.1 contains a NoSQL injection
vulnerability that a ...)
+ TODO: check
+CVE-2026-123492 (SiYuan before 3.8.9 contains a nil pointer dereference
vulnerability i ...)
+ TODO: check
+CVE-2026-123491 (Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2
contains an SQL ...)
+ TODO: check
+CVE-2026-123490 (Craft CMS from 5.8.17 before 5.11.2 contains a privilege
escalation vu ...)
+ TODO: check
+CVE-2026-123489 (Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2
contains a blind ...)
+ TODO: check
+CVE-2026-123488 (Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2
contains an unau ...)
+ TODO: check
+CVE-2026-123487 (Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1
validates ...)
+ TODO: check
+CVE-2026-123486 (WWBN AVideo 29.0 through 29.4.0 contains a race condition
vulnerabilit ...)
+ TODO: check
+CVE-2026-123485 (Ground Station from 0.6.0 before 0.8.20 does not restrict the
get-orbi ...)
+ TODO: check
+CVE-2026-123357 (GROBID is machine learning software for extracting
information from sc ...)
+ TODO: check
+CVE-2026-123356 (GROBID is machine learning software for extracting
information from sc ...)
+ TODO: check
+CVE-2026-123339 (Improper trust of forwarded headers
inRouterListener::onKernelFinishRe ...)
+ TODO: check
+CVE-2026-123337 (In JetBrains YouTrack before 2026.2.19656 users without
update permiss ...)
+ TODO: check
+CVE-2026-123336 (In JetBrains YouTrack before 2026.2.19728 the attachment size
limit co ...)
+ TODO: check
+CVE-2026-123335 (In JetBrains YouTrack before 2026.2.19562, 2026.1.14137,
2025.3.1690 ...)
+ TODO: check
+CVE-2026-123334 (In JetBrains YouTrack before 2026.2.19562 project admins of a
related ...)
+ TODO: check
+CVE-2026-123333 (In JetBrains YouTrack before 2026.2.19562 sprint creation
allowed movi ...)
+ TODO: check
+CVE-2026-123332 (In JetBrains YouTrack before 2026.2.19562 missing
authorization allowe ...)
+ TODO: check
+CVE-2026-123331 (In JetBrains YouTrack before 2026.2.19197 article editors
could change ...)
+ TODO: check
+CVE-2026-123330 (In JetBrains YouTrack before 2026.2.19562 missing
authorization allowe ...)
+ TODO: check
+CVE-2026-123329 (In JetBrains YouTrack before 2026.2.19562 missing
authorization in Tea ...)
+ TODO: check
+CVE-2026-123328 (In JetBrains YouTrack before 2026.2.19656 app permission
bypass allowe ...)
+ TODO: check
+CVE-2026-123327 (In JetBrains YouTrack before 2026.2.19562 missing
authorization in the ...)
+ TODO: check
+CVE-2026-123326 (In JetBrains YouTrack before 2026.2.19197 incorrect
authorisation in t ...)
+ TODO: check
+CVE-2026-123325 (In JetBrains YouTrack before 2025.3.170763, 2026.1.14150,
2026.2.196 ...)
+ TODO: check
+CVE-2026-123324 (In JetBrains YouTrack before 2026.2.19562 information
disclosure via s ...)
+ TODO: check
+CVE-2026-123323 (In JetBrains YouTrack before 2025.3.170763, 2026.1.14150,
2026.2.196 ...)
+ TODO: check
+CVE-2026-123322 (In JetBrains WebStorm before 2026.3, 2026.2.4 code execution
was poss ...)
+ TODO: check
+CVE-2026-123321 (In JetBrains WebStorm before 2026.3, 2026.2.3 code execution
via Grun ...)
+ TODO: check
+CVE-2026-123320 (In JetBrains Toolbox App before 3.9 insufficient warning in
the login ...)
+ TODO: check
+CVE-2026-123319 (In JetBrains Ktor before 3.6.1 missing Domain attribute
validation in ...)
+ TODO: check
+CVE-2026-123318 (In JetBrains Ktor before 3.6.1 hTTP request smuggling was
possible in ...)
+ TODO: check
+CVE-2026-123317 (In JetBrains Ktor before 3.6.1 session forgery was possible
via tamper ...)
+ TODO: check
+CVE-2026-123316 (In JetBrains Junie CLI before 26.6.29 sensitive environment
variables ...)
+ TODO: check
+CVE-2026-123315 (In JetBrains Junie CLI before 26.8.24 command execution was
possible v ...)
+ TODO: check
+CVE-2026-123314 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE
attack was pos ...)
+ TODO: check
+CVE-2026-123313 (In JetBrains IntelliJ IDEA before 2026.3 improper checks
could enable ...)
+ TODO: check
+CVE-2026-123312 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was
possible ...)
+ TODO: check
+CVE-2026-123311 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command
execution ...)
+ TODO: check
+CVE-2026-123310 (In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could
trigger ...)
+ TODO: check
+CVE-2026-123309 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored
XSS was pos ...)
+ TODO: check
+CVE-2026-123308 (In JetBrains IntelliJ IDEA before 2026.3 code execution via
the docume ...)
+ TODO: check
+CVE-2026-123307 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4
unauthenticated co ...)
+ TODO: check
+CVE-2026-123306 (In JetBrains IntelliJ IDEA before 2026.3 improper checks
allowed serve ...)
+ TODO: check
+CVE-2026-123305 (In JetBrains IntelliJ IDEA before 2026.3 path traversal was
possible v ...)
+ TODO: check
+CVE-2026-123304 (In JetBrains IntelliJ IDEA before 2026.3 code execution in
untrusted p ...)
+ TODO: check
+CVE-2026-123302 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4,
2026.1.5.1, 202 ...)
+ TODO: check
+CVE-2026-123301 (In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the
OpenAPI ...)
+ TODO: check
+CVE-2026-123300 (In JetBrains Hub before 2026.2.52519 missing authorisation
allowed use ...)
+ TODO: check
+CVE-2026-123299 (In JetBrains Hub before 2026.2.52519 information disclosure
via user s ...)
+ TODO: check
+CVE-2026-123298 (In JetBrains Hub before 2026.2.52556 sMTP command injection
via email ...)
+ TODO: check
+CVE-2026-123297 (In JetBrains Hub before 2026.2.52519 two-factor
authentication bypass ...)
+ TODO: check
+CVE-2026-123296 (In JetBrains Hub before 2026.2.52519 privilege escalation via
forged e ...)
+ TODO: check
+CVE-2026-123295 (In JetBrains Hub before 2026.2.52519 enforced two-factor
authenticatio ...)
+ TODO: check
+CVE-2026-123294 (In JetBrains Hub before 2026.2.52556 privilege escalation was
possible ...)
+ TODO: check
+CVE-2026-123293 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code
execution was ...)
+ TODO: check
+CVE-2026-123292 (In JetBrains Datalore before 2026.4 aPI tokens and sessions
of removed ...)
+ TODO: check
+CVE-2026-123291 (In JetBrains Datalore before 2026.4 improper owner validation
allowed ...)
+ TODO: check
+CVE-2026-123290 (In JetBrains Datalore before 2026.4 hidden notebook code was
exposed t ...)
+ TODO: check
+CVE-2026-123289 (In JetBrains Datalore before 2026.4 improper authorisation
allowed not ...)
+ TODO: check
+CVE-2026-123288 (In JetBrains Datalore before 2026.4 stored XSS in notebook
charts was ...)
+ TODO: check
+CVE-2026-123287 (In JetBrains Datalore before 2026.4 private notebook files
could be do ...)
+ TODO: check
+CVE-2026-123286 (In JetBrains Datalore before 2026.4 improper authorisation
allowed rea ...)
+ TODO: check
+CVE-2026-123285 (In JetBrains Datalore before 2026.3 command execution was
possible in ...)
+ TODO: check
+CVE-2026-123284 (In JetBrains Datalore before 2026.4 improper authorisation on
workspac ...)
+ TODO: check
+CVE-2026-123283 (In JetBrains Datalore before 2026.4 account takeover was
possible via ...)
+ TODO: check
+CVE-2026-123282 (In JetBrains Datalore before 2026.4 missing expiration
validation of a ...)
+ TODO: check
+CVE-2026-123281 (In JetBrains Datalore before 2026.4 notebook code could
execute comman ...)
+ TODO: check
+CVE-2026-123280 (In JetBrains Datalore before 2026.2.4 unauthenticated users
could exec ...)
+ TODO: check
+CVE-2026-123279 (In JetBrains Datalore before 2026.4 code execution was
possible in a n ...)
+ TODO: check
+CVE-2026-123278 (In JetBrains IntelliJ IDEA before 2026.3 code execution was
possible v ...)
+ TODO: check
+CVE-2026-123277 (In JetBrains CLion before 2026.3, 2026.2.4.1 missing
authentication a ...)
+ TODO: check
+CVE-2026-123276 (In JetBrains CLion before 2026.3, 2026.2.4.1 code execution
was possi ...)
+ TODO: check
+CVE-2026-123087 (SQL injection vulnerability in Atmira\u2019s SIREC. The
server retriev ...)
+ TODO: check
+CVE-2026-122222 (The Permalink Manager Lite plugin for WordPress is vulnerable
to Store ...)
+ TODO: check
+CVE-2026-122193 (OS command injection in the example SSM document provisioning
script i ...)
+ TODO: check
+CVE-2026-122113 (A vulnerability in Realtek's RtUsbA64.sys USB audio driver
allows a ph ...)
+ TODO: check
+CVE-2026-122053 (The Symfony Serializer componentObjectNormalizertreats any
attribute n ...)
+ TODO: check
+CVE-2026-121881 (SQL injection vulnerability in the get_last_seen code-server
session-s ...)
+ TODO: check
+CVE-2026-121880 (Authorization bypass through user-controlled key in the
localhost port ...)
+ TODO: check
+CVE-2026-121824 (A vulnerability has been identified in armeria versions prior
to 1.43. ...)
+ TODO: check
+CVE-2026-121823 (A vulnerability has been identified in armeria versions prior
to 1.43. ...)
+ TODO: check
+CVE-2026-121822 (A vulnerability has been identified in armeria versions
0.80.0 through ...)
+ TODO: check
+CVE-2026-121821 (A vulnerability has been identified in armeria versions
0.84.0 through ...)
+ TODO: check
+CVE-2026-121820 (A vulnerability has been identified in armeria-saml versions
prior to ...)
+ TODO: check
+CVE-2026-121819 (A vulnerability has been identified in armeria-xds versions
1.40.0 thr ...)
+ TODO: check
+CVE-2026-121794 (The Travelly \u2013 Tour & Travel Booking Manager for
WooCommerce plug ...)
+ TODO: check
+CVE-2026-121636 (The Quick Event Manager WordPress plugin before 9.19 does not
verify t ...)
+ TODO: check
+CVE-2026-121633 (The Order Tracking WordPress plugin before 3.6.0 does not
verify that ...)
+ TODO: check
+CVE-2026-121623 (The Symfony Serializer component
DataUriNormalizer::denormalize() matc ...)
+ TODO: check
+CVE-2026-120844 (Incorrect Privilege Assignment vulnerability in miniOrange
OAuth Singl ...)
+ TODO: check
+CVE-2026-120671 (The UsersWP \u2013 Front-end login form, User Registration,
User Profi ...)
+ TODO: check
+CVE-2026-120659 (The Redirection for Contact Form 7 plugin for WordPress is
vulnerable ...)
+ TODO: check
+CVE-2026-120550 (The WP User Manager \u2013 Registration Form, Login Form,
User Profile ...)
+ TODO: check
+CVE-2026-120474 (undici is an HTTP client for Node.js. In versions 7.0.0
through 7.30.1 ...)
+ TODO: check
+CVE-2026-120423 (undici is an HTTP client for Node.js. In versions 7.15.0
through 7.30. ...)
+ TODO: check
+CVE-2026-120415 (undici is an HTTP client for Node.js. In versions 7.0.0
through 7.30.1 ...)
+ TODO: check
+CVE-2026-120222 (undici is an HTTP client for Node.js. In versions 7.0.0
through 7.30.1 ...)
+ TODO: check
+CVE-2026-120035 (The RSS Aggregator by Feedzy \u2013 Feed to Post,
Autoblogging, News & ...)
+ TODO: check
+CVE-2026-119924 (An out-of-bounds read in the TDS RPC procedure-name parser in
the Babe ...)
+ TODO: check
+CVE-2026-119923 (A heap-based buffer overflow in the TDS prelogin parser in
the Babelfi ...)
+ TODO: check
+CVE-2026-119758 (ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a
missing au ...)
+ TODO: check
+CVE-2026-119516 (Deserialization of Untrusted Data vulnerability in Mamunur
Rashid Radi ...)
+ TODO: check
+CVE-2026-119499 (Insertion of Sensitive Information Into Sent Data
vulnerability in BAK ...)
+ TODO: check
+CVE-2026-119488 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-119472 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-119211 (The AAA Autoload Optimizer plugin for WordPress is vulnerable
to Store ...)
+ TODO: check
+CVE-2026-119178 (The Smart Cookie Kit plugin for WordPress is vulnerable to
Stored Cros ...)
+ TODO: check
+CVE-2026-119170 (There was a regression in how FIPS algorithms were enforced
for the ha ...)
+ TODO: check
+CVE-2026-118670 (OHIF Viewers is a zero-footprint DICOM viewer with shared
extension pa ...)
+ TODO: check
+CVE-2026-118423 (The WP Libre Form WordPress plugin 1.5.0.1 does not validate
the type ...)
+ TODO: check
+CVE-2026-118189 (The Posts Table with Search & Sort plugin for WordPress is
vulnerable ...)
+ TODO: check
+CVE-2026-118166 (The MC4WP: Mailchimp for WordPress WordPress plugin before
4.15.0 does ...)
+ TODO: check
+CVE-2026-116630 (undici is an HTTP client for Node.js. In versions 7.0.0
through 7.30.1 ...)
+ TODO: check
+CVE-2026-116624 (The Advanced Members for ACF plugin for WordPress is
vulnerable to Pri ...)
+ TODO: check
+CVE-2026-116592 (undici is an HTTP client for Node.js. In versions 7.30.1 and
8.12.2 th ...)
+ TODO: check
+CVE-2026-116551 (The WP Customer Area plugin for WordPress is vulnerable to
Stored Cros ...)
+ TODO: check
+CVE-2026-116545 (The All-in-One Video Gallery \u2013 Video Player & Galleries
for YouTu ...)
+ TODO: check
+CVE-2026-115952 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-115831 (The VOD Infomaniak plugin for WordPress is vulnerable to
authorization ...)
+ TODO: check
+CVE-2026-115701 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-115431 (Missing Authorization vulnerability in WP Swings Upsell Order
Bump Off ...)
+ TODO: check
+CVE-2026-114630 (The ELEX WordPress HelpDesk & Customer Ticketing System
plugin for Wor ...)
+ TODO: check
+CVE-2026-113618 (The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable
to imprope ...)
+ TODO: check
+CVE-2026-113431 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2026-112341 (Wazuh versions from 4.0.0 before 4.14.9 contain a sql
injection vulner ...)
+ TODO: check
+CVE-2026-112340 (Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an
authorizat ...)
+ TODO: check
+CVE-2026-112339 (Wazuh from 3.9.0 before 4.14.9 contains a missing TLS
hostname verific ...)
+ TODO: check
+CVE-2026-112338 (Wazuh from 4.3.0 before 4.14.9 contains a server-side request
forgery ...)
+ TODO: check
+CVE-2026-112337 (Wazuh from 3.7.0 before 4.14.9 contains a server-side request
forgery ...)
+ TODO: check
+CVE-2026-112336 (Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak
vulnerab ...)
+ TODO: check
+CVE-2026-112335 (Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based
buffer ove ...)
+ TODO: check
+CVE-2026-112334 (Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds
write vulnera ...)
+ TODO: check
+CVE-2026-111573 (Incorrect permissions on the Checkmk Windows agent's data
directory, c ...)
+ TODO: check
+CVE-2026-110776 (The MDTF \u2013 Meta Data and Taxonomies Filter plugin for
WordPress i ...)
+ TODO: check
+CVE-2026-110291 (The Graphina \u2013 Charts and Graphs For Elementor plugin
for WordPre ...)
+ TODO: check
+CVE-2026-10147
+ REJECTED
+CVE-2026-10146
+ REJECTED
+CVE-2026-109994 (The Eventin \u2013 Events Calendar, Tickets, Registration,
Booking & W ...)
+ TODO: check
+CVE-2026-109977 (The YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking &
Reports pl ...)
+ TODO: check
+CVE-2026-109884 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-109883 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-108262 (DDEV is an open-source tool for running local web development
environm ...)
+ TODO: check
+CVE-2026-108018 (The BigFix MCM admin portal is directly accessible from the
internet w ...)
+ TODO: check
+CVE-2026-107658 (The BuddyForms plugin for WordPress is vulnerable to Stored
Cross-Site ...)
+ TODO: check
+CVE-2026-107622 (The BuddyForms plugin for WordPress is vulnerable to
Privilege Escalat ...)
+ TODO: check
+CVE-2026-107155 (A permissive cross-domain policy vulnerability has been
identified in ...)
+ TODO: check
+CVE-2026-107154 (A session validation vulnerability has been identified in the
SonicOS ...)
+ TODO: check
+CVE-2026-106144 (Prototype Pollution in the Scheduler component
(@progress/kendo-angula ...)
+ TODO: check
+CVE-2026-106143 (Cross-Site Scripting (XSS) in the Editor component
(@progress/kendo-vu ...)
+ TODO: check
+CVE-2026-106142 (Cross-Site Scripting (XSS) in the Editor component
(@progress/kendo-re ...)
+ TODO: check
+CVE-2026-106141 (Cross-Site Scripting (XSS) in the Editor component
(@progress/kendo-an ...)
+ TODO: check
+CVE-2026-106136 (Cross-Site Scripting (XSS) in the Chat component
(@progress/kendo-reac ...)
+ TODO: check
+CVE-2026-106135 (Cross-Site Scripting (XSS) in the Chat component
(@progress/kendo-angu ...)
+ TODO: check
+CVE-2026-106134 (Cross-Site Scripting (XSS) in the Menu component
(@progress/kendo-reac ...)
+ TODO: check
+CVE-2026-106128 (Prototype Pollution in @progress/kendo-vue-common in Progress
Software ...)
+ TODO: check
+CVE-2026-106127 (Prototype Pollution in the setter utility
(@progress/kendo-react-commo ...)
+ TODO: check
+CVE-2026-106022 (Cleartext storage of sensitive information in memory
vulnerability in ...)
+ TODO: check
+CVE-2026-106020 (Improper neutralization of input used for LLM prompting
vulnerability ...)
+ TODO: check
+CVE-2026-106019 (Insertion of sensitive information into log file
vulnerability in John ...)
+ TODO: check
+CVE-2026-105422 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
+ TODO: check
+CVE-2026-104657 (Missing integrity verification in the Progress Software
Fiddler Downlo ...)
+ TODO: check
+CVE-2026-104656 (Improper neutralization of input in the sessions grid in
Progress Tele ...)
+ TODO: check
+CVE-2026-104010 (The WPSyncSheets For Contact Form 7 \u2013 CF7 Google Sheets
Connector ...)
+ TODO: check
+CVE-2026-103985 (FreeScout is a self-hosted help desk and shared mailbox.
Prior to 1.8. ...)
+ TODO: check
+CVE-2026-103984 (FreeScout is a self-hosted help desk and shared mailbox.
Prior to 1.8. ...)
+ TODO: check
+CVE-2026-103908 (The The AMP for WP \u2013 Accelerated Mobile Pages plugin for
WordPres ...)
+ TODO: check
+CVE-2026-103682 (Invocation of the Jolokia special agent with the login
password in the ...)
+ TODO: check
+CVE-2026-103674 (Invocation of the NetApp ONTAP special agent with the login
password i ...)
+ TODO: check
+CVE-2026-103479 (The Pubjet | \u067e\u0627\u0628\u062c\u062a plugin for
WordPress is vu ...)
+ TODO: check
+CVE-2026-102650 (Nuxt Content is the file-based CMS for Nuxt applications,
powered by M ...)
+ TODO: check
+CVE-2026-102359 (Kroki creates diagrams from textual descriptions. Prior to
0.31.2, the ...)
+ TODO: check
+CVE-2026-102356 (Kroki creates diagrams from textual descriptions. From 0.26.0
until 0. ...)
+ TODO: check
+CVE-2026-100082 (In the Linux kernel, the following vulnerability has been
resolved: x ...)
+ TODO: check
+CVE-2026-100081 (In the Linux kernel, the following vulnerability has been
resolved: x ...)
+ TODO: check
+CVE-2026-100080 (In the Linux kernel, the following vulnerability has been
resolved: x ...)
+ TODO: check
+CVE-2025-66621 (Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1
fails to va ...)
+ TODO: check
+CVE-2025-64798
+ REJECTED
+CVE-2025-46896
+ REJECTED
+CVE-2024-36240
+ REJECTED
CVE-2026-XXXX [GHSA-cpgf-5mjf-73p7: PermitScrubber took quadratic time
matching a long SVG href.]
- ruby-rails-html-sanitizer 1.7.2-1
NOTE:
https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cpgf-5mjf-73p7
@@ -6,7 +664,7 @@ CVE-2026-XXXX [GHSA-h7wh-q2qr-458c: Concurrent sanitize calls
could share anothe
- ruby-rails-html-sanitizer 1.7.2-1
NOTE:
https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-h7wh-q2qr-458c
NOTE: Fixed by:
https://github.com/rails/rails-html-sanitizer/commit/15f764c3563d5dd9b97ad32eaa7454577ccec4b9
(v1.7.2)
-CVE-2026-121006
+CVE-2026-121006 (HTTP::Body versions before 1.24_02 for Perl parse the trailer
in quadr ...)
- libhttp-body-perl 1.25-1 (bug #1153153)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44934345/
NOTE: Fixed by:
https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3b863ab513240b02c91c3114fb299389
(v1.25)
@@ -1449,9 +2107,9 @@ CVE-2025-15701 (The Easy Social Icons WordPress plugin
before 4.0.3 does not san
NOT-FOR-US: WordPress plugin
CVE-2026-118517 (The Symfony HtmlSanitizer component UrlSanitizerparses URLs
differentl ...)
- symfony 7.4.23+dfsg-1
-CVE-2026-118515
+CVE-2026-118515 (The Symfony Serializer componentDataUriNormalizerhandles only
the exac ...)
- symfony 7.4.23+dfsg-1
-CVE-2026-118514
+CVE-2026-118514 (In Symfony http-foundation prior to versions 5.4.56, 6.4.50,
7.4.23, a ...)
- symfony 7.4.23+dfsg-1
CVE-2026-116498
NOT-FOR-US: Kiali
@@ -2599,8 +3257,10 @@ CVE-2026-120953 (A URI redirection weakness exists in
the authentication compone
CVE-2026-120952 (An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver
may be tri ...)
TODO: check
CVE-2026-120931 (Out of bounds write in WebGL in Google Chrome on on Android
prior to 1 ...)
+ {DSA-6577-1 DLA-4853-1}
- chromium 156.0.8078.47-1
CVE-2026-120930 (Incorrect authorization in Blink in Google Chrome prior to
156.0.8078. ...)
+ {DSA-6577-1 DLA-4853-1}
- chromium 156.0.8078.47-1
CVE-2026-120846 (Missing Authorization vulnerability in Uncanny Owl Uncanny
Automator u ...)
NOT-FOR-US: WordPress plugin or theme
@@ -2809,6 +3469,7 @@ CVE-2026-115779 (Effect is a TypeScript framework that
consists of several packa
CVE-2026-115732 (Incorrect authorization in the certificate-name matching of
trapperkee ...)
TODO: check
CVE-2026-115731 (Deserialization of untrusted data in the report-processing
code of Pup ...)
+ {DSA-6608-1 DLA-4884-1}
- puppet-agent <removed>
NOTE:
https://portal.perforce.com/s/cve/a91Qi000003IaHpIAK/report-deserialization-code-execution
CVE-2026-115716 (Allocation of Resources Without Limits or Throttling
(CWE-770) in APM ...)
@@ -4497,7 +5158,7 @@ CVE-2024-12141 (The product fails to sufficiently
validate callback URLs, allowi
NOT-FOR-US: WSO2
CVE-2024-12139 (The error handling implementation fails to properly sanitize
or valida ...)
NOT-FOR-US: WSO2
-CVE-2026-123962 [ssh: Read/write authorized keys file using user account
privileges]
+CVE-2026-123962 (In FreedomBox before 26.15, unprivileged user accounts can
read/write ...)
- freedombox 26.15
NOTE:
https://alioth-lists.debian.net/pipermail/freedombox-discuss/2026-November/010041.html
NOTE: Requisite:
https://salsa.debian.org/freedombox-team/freedombox/-/commit/0120ea0e558364c98e51abcb6191d1f3e64abd01
(debian/26.15)
@@ -7431,7 +8092,6 @@ CVE-2026-93010 (A flaw was found in dnsmasq. When DHCP
leasequery is enabled wit
TODO: check upstream details
CVE-2026-93009 (A flaw was found in dnsmasq. The DHCPv6 client hostname parser
can rea ...)
- dnsmasq <unfixed> (bug #1153241)
- - dnsmasq <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2536083
TODO: check upstream details
CVE-2026-93008 (A flaw was found in dnsmasq. When following a CNAME in a DNS
response, ...)
@@ -12600,9 +13260,10 @@ CVE-2026-117503 (A vulnerability was determined in
a2aproject a2a-go up to 2.4.0
NOT-FOR-US: a2aproject a2a-go
CVE-2026-117499 (@fastify/session is a session plugin for Fastify. In all
releases befo ...)
NOT-FOR-US: fastify/session
-CVE-2026-117494 (Cross-Site Scripting (XSS) in the processing of SVG images
submitted t ...)
+CVE-2026-117494
+ REJECTED
NOT-FOR-US: Sisense
-CVE-2026-117493 (Stored cross-site scripting (XSS) in BloX widgets. The
/api/dashboards ...)
+CVE-2026-117493 (Stored Cross-Site Scripting (XSS) in Sisense BloX widgets, in
all vers ...)
NOT-FOR-US: Sisense
CVE-2026-117466 (In affected versions of Octopus Server, a user holding the
System Mana ...)
NOT-FOR-US: Octopus Deploy
@@ -30103,11 +30764,13 @@ CVE-2026-111233 (Netgate pfSense CE 2.7.1 through
2.9.0 contains a reflected cro
NOT-FOR-US: pfSense
CVE-2026-111232 (Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored
cross-site sc ...)
NOT-FOR-US: pfSense
-CVE-2026-111231 (Netgate pfSense CE through 2.9.0 contains an authorization
bypass vuln ...)
+CVE-2026-111231
+ REJECTED
NOT-FOR-US: pfSense
CVE-2026-111230 (Netgate pfSense CE through 2.9.0 contains a local file read
vulnerabil ...)
NOT-FOR-US: pfSense
-CVE-2026-111229 (pfSense CE 2.7.0 through 2.9.0 contains a command injection
vulnerabil ...)
+CVE-2026-111229
+ REJECTED
NOT-FOR-US: pfSense
CVE-2026-111228 (Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF
injection ...)
NOT-FOR-US: pfSense
@@ -30123,7 +30786,8 @@ CVE-2026-111223 (Netgate pfSense CE 2.7.0 through 2.9.0
contains a configuration
NOT-FOR-US: pfSense
CVE-2026-111222 (Netgate pfSense CE through 2.9.0 contains a php.ini injection
vulnerab ...)
NOT-FOR-US: pfSense
-CVE-2026-111221 (Netgate pfSense CE through 2.9.0 contains a configuration
injection vu ...)
+CVE-2026-111221
+ REJECTED
NOT-FOR-US: pfSense
CVE-2026-111220 (pfSense CE through 2.9.0 contains a crontab injection
vulnerability in ...)
NOT-FOR-US: pfSense
@@ -40581,7 +41245,7 @@ CVE-2026-40805 (Subscriber Arbitrary File Deletion in
PeepSo <= 9.0.5.4 versions
NOT-FOR-US: WordPress plugin or theme
CVE-2026-40803 (Unauthenticated Cross Site Scripting (XSS) in Jotform –
AI Chatb ...)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-40802 (Subscriber Settings Change in Pubjet |
\u067e\u0627\u0628\u062c\u062a ...)
+CVE-2026-40802 (Missing Authorization vulnerability in pubjet Pubjet |
\u067e\u0627\u0 ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-40801 (Subscriber Broken Access Control in Wordable <= 8.2.10
versions.)
NOT-FOR-US: WordPress plugin or theme
@@ -41122,7 +41786,7 @@ CVE-2026-94421 (The Church Admin plugin for WordPress
is vulnerable to Stored Cr
NOT-FOR-US: WordPress plugin
CVE-2026-94375 (The Order Export & Order Import for WooCommerce plugin for
WordPress i ...)
NOT-FOR-US: WordPress plugin
-CVE-2026-94257 (The SMS Alert WordPress plugin before 4.0.1 does not bind the
account ...)
+CVE-2026-94257 (The SMS Alert WordPress plugin before 4.0.3 does not bind the
account ...)
NOT-FOR-US: WordPress plugin
CVE-2026-94256 (The SMS Alert WordPress plugin before 4.0.1 does not verify
that the ...)
NOT-FOR-US: WordPress plugin
@@ -47484,7 +48148,8 @@ CVE-2026-104041 (A flaw was found in SSSD. An
unprivileged local user can repeat
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478864
NOTE: Fixed by [1/2]:
https://github.com/SSSD/sssd/commit/55b35d47caf9526e911f049f7644f848fb5661ac
(2.14.0-beta2)
NOTE: Fixed by [2/2]:
https://github.com/SSSD/sssd/commit/5b54a9cb3118ec648d29ada8a8701a1db9ad2805
(2.14.0-beta2)
-CVE-2026-104040 (A flaw was found in SSSD. When configured with the Entra ID
identity p ...)
+CVE-2026-104040
+ REJECTED
- sssd <unfixed> (bug #1150238)
[trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478915
@@ -50405,7 +51070,8 @@ CVE-2026-100179 (The Calculated Fields Form \u2013 AI
Form Builder for WordPress
NOT-FOR-US: WordPress plugin
CVE-2025-31980 (HCL BigFix Service Management is affected by an Improper Input
Validat ...)
NOT-FOR-US: HCL
-CVE-2024-58388 (Sharp (and Toshiba Tec rebranded) multifunction printers
contain an un ...)
+CVE-2024-58388
+ REJECTED
NOT-FOR-US: Sharp printers
CVE-2023-54404
REJECTED
@@ -119488,7 +120154,7 @@ CVE-2026-70468 (A authentication bypass using an
alternate path or channel vulne
NOT-FOR-US: Fortinet
CVE-2026-70467 (A server-side request forgery (ssrf) vulnerability in Fortinet
FortiSI ...)
NOT-FOR-US: Fortinet
-CVE-2026-70466 (A incomplete list of disallowed inputs vulnerability in
Fortinet Forti ...)
+CVE-2026-70466 (A incomplete list of disallowed inputs vulnerability [CWE-184]
vulnera ...)
NOT-FOR-US: Fortinet
CVE-2026-70465 (A buffer copy without checking size of input ('classic buffer
overflow ...)
NOT-FOR-US: Fortinet
@@ -316547,7 +317213,7 @@ CVE-2025-53132 (Concurrent execution using shared
resource with improper synchro
NOT-FOR-US: Microsoft
CVE-2025-53131 (Heap-based buffer overflow in Windows Media allows an
unauthorized att ...)
NOT-FOR-US: Microsoft
-CVE-2025-52970 (A improper handling of parameters in Fortinet FortiWeb
versions 7.6.3 ...)
+CVE-2025-52970 (A improper handling of parameters vulnerability in Fortinet
FortiWeb 7 ...)
NOT-FOR-US: Fortinet
CVE-2025-50177 (Use after free in Windows Message Queuing allows an
unauthorized attac ...)
NOT-FOR-US: Microsoft
@@ -765048,8 +765714,8 @@ CVE-2020-9711 (Acrobat Reader versions
2020.009.20074, 2020.001.30002, 2017.011.
NOT-FOR-US: Adobe
CVE-2020-9710 (Adobe Acrobat and Reader versions 2020.009.20074 and earlier,
2020.001 ...)
NOT-FOR-US: Adobe
-CVE-2020-9709
- REJECTED
+CVE-2020-9709 (Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020
have a ...)
+ TODO: check
CVE-2020-9708 (The resolveRepositoryPath function doesn't properly validate
user inpu ...)
NOT-FOR-US: Adobe
CVE-2020-9707 (Adobe Acrobat and Reader versions 2020.009.20074 and earlier,
2020.001 ...)
@@ -798185,8 +798851,8 @@ CVE-2019-16449 (Adobe Acrobat and Reader versions ,
2019.021.20056 and earlier,
NOT-FOR-US: Adobe
CVE-2019-16448 (Adobe Acrobat and Reader versions , 2019.021.20056 and
earlier, 2017.0 ...)
NOT-FOR-US: Adobe
-CVE-2019-16447
- REJECTED
+CVE-2019-16447 (Adobe Illustrator CC versions 23.1 and earlier have a binary
planting ...)
+ TODO: check
CVE-2019-16446 (Adobe Acrobat and Reader versions , 2019.021.20056 and
earlier, 2017.0 ...)
NOT-FOR-US: Adobe
CVE-2019-16445 (Adobe Acrobat and Reader versions , 2019.021.20056 and
earlier, 2017.0 ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d265fc25714c3609ac874e1880217806e4b2fc3c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d265fc25714c3609ac874e1880217806e4b2fc3c
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
