Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
aa341e3f by Moritz Muehlenhoff at 2026-11-06T23:45:00+01:00
bugnums
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -864,7 +864,7 @@ CVE-2026-77463 (Remark42 is a self-hosted comment engine
for blogs, articles, or
CVE-2026-77439 (Immich is a self-hosted photo and video management solution.
Prior to ...)
NOT-FOR-US: Immich
CVE-2026-77299 (Regexp2 is a feature-rich RegExp engine for Go. Prior to
version 2.3.0 ...)
- - golang-github-dlclark-regexp2 <unfixed>
+ - golang-github-dlclark-regexp2 <unfixed> (bug #1153279)
NOTE:
https://github.com/dlclark/regexp2/security/advisories/GHSA-wq9v-j77v-qr26
NOTE: Fixed by:
https://github.com/dlclark/regexp2/commit/6e446cb3a57a0f20112bc24353604fd00bdb309a
(v2.3.0)
CVE-2026-76580 (Improper neutralization of input during web page generation
('cross-si ...)
@@ -1008,7 +1008,7 @@ CVE-2026-61648 (SuiteCRM is an open-source,
enterprise-ready Customer Relationsh
CVE-2026-58273 (Rucio is a scientific data management framework. From 1.16.1
until 35. ...)
NOT-FOR-US: Rucio
CVE-2026-55458 (Caddy is an extensible server platform that uses TLS by
default. Prior ...)
- - caddy <unfixed>
+ - caddy <unfixed> (bug #1153276)
NOTE:
https://github.com/caddyserver/caddy/security/advisories/GHSA-8qx7-j2v2-x6q5
NOTE: Fixed by:
https://github.com/caddyserver/caddy/commit/25b3eab6dbd8d2d2670711f26b774e0fd43e1179
(v2.11.5)
CVE-2026-54914 (WebAssembly Micro Runtime (WAMR) is a lightweight standalone
WebAssemb ...)
@@ -1040,7 +1040,7 @@ CVE-2026-49405 (OpenHuman is an open-source agent harness
available as a desktop
CVE-2026-49393 (OpenHuman is an open-source agent harness available as a
desktop appli ...)
NOT-FOR-US: OpenHuman
CVE-2026-49272 (OAuthLib is an implementation of the OAuth request-signing
logic for P ...)
- - python-oauthlib <unfixed>
+ - python-oauthlib <unfixed> (bug #1153277)
NOTE:
https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc
NOTE: https://github.com/oauthlib/oauthlib/pull/954
NOTE: Fixed by:
https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114
(v4.0.1)
@@ -1076,15 +1076,13 @@ CVE-2026-123272 (Mark3labs mcp-go before v1.2.1
contains an improper validation
CVE-2026-123271 (ChatCLI before v1.215.2 contains an improper validation
vulnerability ...)
NOT-FOR-US: ChatCLI
CVE-2026-123269 (A vulnerability was detected in libyal libvmdk. Affected by
this vulne ...)
- - libvmdk <undetermined>
+ - libvmdk <unfixed>
NOTE: https://github.com/libyal/libvmdk/issues/41
NOTE: Fixed by:
https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b
- TODO: check details
CVE-2026-123268 (A security vulnerability has been detected in libyal libvmdk
up to 3fd ...)
- - libvmdk <undetermined>
+ - libvmdk <unfixed>
NOTE: https://github.com/libyal/libvmdk/issues/39
NOTE: Fixed by:
https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b
- TODO: check details
CVE-2026-123208 (noname Electron desktop build v1.11.2 through v1.11.6.1
contains an un ...)
NOT-FOR-US: noname Electron desktop
CVE-2026-123207 (LibreTV before v2.21.2 contains a server-side request forgery
vulnerab ...)
@@ -1098,7 +1096,7 @@ CVE-2026-123204 (Posta before v0.18.0 contains a
server-side request forgery vul
CVE-2026-123203 (NEURON (CoreNEURON) through 9.0.2 contains a stack buffer
overflow vul ...)
NOT-FOR-US: NEURON (CoreNEURON)
CVE-2026-123202 (libnxml before 0.18.6 contains a stack-based buffer overflow
vulnerabi ...)
- - libnxml <unfixed>
+ - libnxml <unfixed> (bug #1153280)
NOTE: Fixed by:
https://github.com/bakulf/libnxml/commit/fbac242374883edf2ec14127ca6d2accf4704b6a
(0.18.6)
CVE-2026-123201 (Buku (bukuserver) through 5.1.1 contains an unauthenticated
server-sid ...)
NOT-FOR-US: Buku (bukuserver)
@@ -1889,7 +1887,7 @@ CVE-2026-122302 (Kyverno before 1.19.2 contains a
privilege escalation vulnerabi
CVE-2026-122301 (Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6
returns fi ...)
NOT-FOR-US: Parse Server
CVE-2026-122299 (Dulwich before 1.2.20 contains a commit object parsing
vulnerability w ...)
- - dulwich <unfixed>
+ - dulwich <unfixed> (bug #1153281)
NOTE: Fixed by:
https://github.com/jelmer/dulwich/commit/b77f385b4b0d2d2c7f5ac39dae628948f7ad3a96
(dulwich-1.2.20)
CVE-2026-122266 (Improper isolation of shared resources in
aws-network-policy-agent in ...)
NOT-FOR-US: Amazon
@@ -1948,7 +1946,7 @@ CVE-2026-122134 (Mistral Vibe before 2.25.7 contains a
remote code execution vul
CVE-2026-122133 (Mistral Vibe before 2.25.5 on Windows contains an untrusted
search pat ...)
NOT-FOR-US: Mistral Vibe
CVE-2026-122132 (go-chi chi 5.2.2 through 5.5.0 contains an open redirect
vulnerability ...)
- - golang-github-go-chi-chi <unfixed>
+ - golang-github-go-chi-chi <unfixed> (bug #1153282)
[trixie] - golang-github-go-chi-chi <not-affected> (Incomplete
mitigation for CVE-2025-71405 not applied)
[bookworm] - golang-github-go-chi-chi <not-affected> (Incomplete
mitigation for CVE-2025-71405 not applied)
NOTE:
https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8
@@ -2156,7 +2154,7 @@ CVE-2026-118514 (In Symfony http-foundation prior to
versions 5.4.56, 6.4.50, 7.
CVE-2026-116498
NOT-FOR-US: Kiali
CVE-2026-115697
- - iwd <unfixed>
+ - iwd <unfixed> (bug #1153284)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2560193
CVE-2026-97705 (Moleculer is a progressive microservices framework for
Node.js. Prior ...)
NOT-FOR-US: Moleculer
@@ -2280,15 +2278,17 @@ CVE-2026-121946 (zbateson mail-mime-parser before 3.0.9
and 4.x before 4.0.6 con
CVE-2026-121945 (CoopCycle coopcycle-web before 6.20.1 contains a broken
access control ...)
NOT-FOR-US: coopcycle-web
CVE-2026-121944 (sngrep through 1.9.0 contains an infinite loop vulnerability
in captur ...)
- - sngrep <unfixed>
+ - sngrep <unfixed> (unimportant)
NOTE: https://github.com/irontec/sngrep/issues/589
NOTE: https://github.com/irontec/sngrep/pull/592
NOTE: Fixed by:
https://github.com/irontec/sngrep/commit/07a063c37c17d7b051300935cde5952345975135
+ NOTE: Hang in CLI tool, no security impact
CVE-2026-121943 (Irontec sngrep through 1.9.0 contains an out-of-bounds stack
read vuln ...)
- - sngrep <unfixed>
+ - sngrep <unfixed> (unimportant)
NOTE: https://github.com/irontec/sngrep/issues/589
NOTE: https://github.com/irontec/sngrep/pull/591
NOTE: Fixed by:
https://github.com/irontec/sngrep/commit/d49c96c99bfff47b41c547113cb3a39dfb9b8717
+ NOTE: Crash in CLI tool, no security impact
CVE-2026-121942 (ZBar through 0.23.95 contains an out-of-bounds read
vulnerability in _ ...)
- zbar <unfixed> (bug #1153258)
[trixie] - zbar <no-dsa> (Minor issue)
@@ -2349,11 +2349,11 @@ CVE-2026-120554 (The Import and export users and
customers plugin for WordPress
CVE-2026-120422 (Sogou Input Method for Windows contains a vulnerability in
the configu ...)
NOT-FOR-US: Sogou Input Method for Windows
CVE-2026-120421 (In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0
through 4.1.19 ...)
- - mojarra <unfixed>
+ - mojarra <unfixed> (bug #1153275)
NOTE:
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/536
NOTE:
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1332
CVE-2026-119776 (In all prior released versions of FRRouting, the OSPFv3 (for
IPv6) imp ...)
- - frr <unfixed>
+ - frr <unfixed> (bug #1153274)
NOTE: https://github.com/FRRouting/frr/pull/24183
NOTE: https://github.com/FRRouting/frr/pull/23935
CVE-2026-119749 (The GetPaid plugin for WordPress before 2.8.63 contains an
improper in ...)
@@ -2392,7 +2392,7 @@ CVE-2026-115498 (The Slim Jetpack plugin for WordPress is
vulnerable to Stored C
CVE-2026-115474 (Zulip is an open-source team collaboration tool. From 8.0
until 12.2, ...)
- zulip-server <itp> (bug #800052)
CVE-2026-115448 (Uncontrolled recursion in Apache ZooKeeper. The server
serializes its ...)
- - zookeeper <unfixed>
+ - zookeeper <unfixed> (bug #1153272)
NOTE: https://www.openwall.com/lists/oss-security/2026/11/03/13
CVE-2026-114456 (Multiple Snowflake client drivers implementing the
`authenticator=exte ...)
TODO: check
@@ -2460,16 +2460,16 @@ CVE-2026-100408 (Git for Windows is the Windows port of
Git. From 2.43.0.windows
CVE-2026-100407 (Git for Windows is the Windows port of Git. From
2.44.0.windows.1 unti ...)
NOT-FOR-US: Git for Windows
CVE-2026-100302 (Allocation of Resources Without Limits or Throttling in the
multiRead ...)
- - zookeeper <unfixed>
+ - zookeeper <unfixed> (bug #1153272)
NOTE: https://www.openwall.com/lists/oss-security/2026/11/03/12
CVE-2026-100300 (Improper handling of exceptional conditions in the quota
subsystem of ...)
- - zookeeper <unfixed>
+ - zookeeper <unfixed> (bug #1153272)
NOTE: https://www.openwall.com/lists/oss-security/2026/11/03/11
CVE-2026-100252 (Improper Authorization vulnerability in Apache ZooKeeper.
When SASL a ...)
- - zookeeper <unfixed>
+ - zookeeper <unfixed> (bug #1153272)
NOTE: https://www.openwall.com/lists/oss-security/2026/11/03/10
CVE-2026-100235 (Incorrect authorization due to a time-of-check to time-of-use
(TOCTOU) ...)
- - zookeeper <unfixed>
+ - zookeeper <unfixed> (bug #1153272)
NOTE: https://www.openwall.com/lists/oss-security/2026/11/03/9
CVE-2026-121009 (SQL::Abstract versions from 1.90_01 before 2.000001_04 for
Perl skip t ...)
- libsql-abstract-perl <unfixed> (bug #1153058)
@@ -2553,7 +2553,7 @@ CVE-2026-XXXX [GHSA-gmj8-hvj3-49mw]
- rails <unfixed>
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw
CVE-2026-115696
- - iwd <unfixed>
+ - iwd <unfixed> (bug #1153286)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2560194
CVE-2026-109518 (On Debian, Ubuntu, and derivative Linux distributions, an
on-path atta ...)
{DSA-6607-1 DLA-4880-1}
@@ -4777,16 +4777,16 @@ CVE-2026-16305 (Local privilege escalation in
`SmartUpdate.exe` and `SmartExecut
CVE-2026-120987 (Whale Browser before 5.39.412.57 allows an attacker to bypass
the ifra ...)
NOT-FOR-US: Whale Browser
CVE-2026-120971 (A flaw was found in RESTEasy's default exception mapper. When
an unhan ...)
- - resteasy <unfixed>
- - resteasy3.0 <unfixed>
+ - resteasy <unfixed> (bug #1153287)
+ - resteasy3.0 <unfixed> (bug #1153288)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2565584
CVE-2026-120833 (labbench before 0.46.1 contains a deserialization of
untrusted data vu ...)
NOT-FOR-US: labbench
CVE-2026-120831 (A flaw was found in libslirp in if_output(). When moving a
session fro ...)
- - libslirp <unfixed>
+ - libslirp <unfixed> (bug #1153290)
NOTE: Fixed by:
https://gitlab.freedesktop.org/slirp/libslirp/-/commit/bad35bd3b529dc47aa109980a69a36da7848ab76
CVE-2026-120830 (A flaw was found in libslirp in icmp_forward_error(). When
building an ...)
- - libslirp <unfixed>
+ - libslirp <unfixed> (bug #1153290)
NOTE: Fixed by:
https://gitlab.freedesktop.org/slirp/libslirp/-/commit/21b33a6c5588af9f58d15e528fdc1019452708e4
CVE-2026-120752 (PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer
overflow vulne ...)
- pymupdf <unfixed>
@@ -4794,7 +4794,7 @@ CVE-2026-120752 (PyMuPDF 1.25.3 before 2.0 contains a
stack-based buffer overflo
NOTE: https://github.com/pymupdf/PyMuPDF/issues/5173
NOTE: Fixed by:
https://github.com/pymupdf/PyMuPDF/commit/d4298ead84ceeae1c9065c81cd9a275a1b092f5e
(2.0)
CVE-2026-120740 (A flaw was found in hivex. By supplying a specially crafted
Windows re ...)
- - hivex <unfixed>
+ - hivex <unfixed> (bug #1153289)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2565405
CVE-2026-120689 (HDF5 through 2.2.0 contains an uncontrolled recursion
vulnerability in ...)
- hdf5 <unfixed> (unimportant)
@@ -5327,7 +5327,7 @@ CVE-2026-119843 (A flaw was found in GStreamer's
gst-plugins-good package. The F
[bookworm] - gst-plugins-good1.0 <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2564182
CVE-2026-115698
- - iwd <unfixed>
+ - iwd <unfixed> (bug #1153283)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2560212
CVE-2026-95863 (Improper neutralization of input during web page generation in
Apache ...)
NOT-FOR-US: Apache software not packaged in Debian
@@ -9002,7 +9002,7 @@ CVE-2026-XXXX [TROVE-2026-072]
CVE-2026-116470
- keycloak <itp> (bug #1088287)
CVE-2026-XXXX [GHSA-p8g6-qw5j-8cgc: Local users can run code as root when
Tigris audits a running system]
- - tiger <unfixed>
+ - tiger <unfixed> (bug #1152995)
NOTE:
https://github.com/creativeheadz/tigris/security/advisories/GHSA-p8g6-qw5j-8cgc
CVE-2026-7180
- qemu 1:11.1.3+ds-1
@@ -67167,8 +67167,8 @@ CVE-2026-90981 (The Newsletter \u2013 Send awesome
emails from WordPress plugin
CVE-2026-90884 (The WP Recipe Maker plugin for WordPress is vulnerable to
Stored Cross ...)
NOT-FOR-US: WordPress plugin
CVE-2026-89059 (A flaw was found in RESTEasy's IIOImageProvider, which decodes
attacke ...)
- - resteasy <unfixed>
- - resteasy3.0 <unfixed>
+ - resteasy <unfixed> (bug #1153295)
+ - resteasy3.0 <unfixed> (bug #1153293)
[trixie] - resteasy3.0 <no-dsa> (Minor issue)
[bookworm] - resteasy3.0 <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2519756
@@ -67176,8 +67176,8 @@ CVE-2026-89059 (A flaw was found in RESTEasy's
IIOImageProvider, which decodes a
NOTE: https://redhat.atlassian.net/browse/RESTEASY-3793
NOTE: Fixed by:
https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb
(v7.0.5.Final)
CVE-2026-89058 (A flaw was found in RESTEasy's CorsFilter, which, when
configured to a ...)
- - resteasy <unfixed>
- - resteasy3.0 <unfixed>
+ - resteasy <unfixed> (bug #1153289)
+ - resteasy3.0 <unfixed> (bug #1153292)
[trixie] - resteasy3.0 <no-dsa> (Minor issue)
[bookworm] - resteasy3.0 <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2519775
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/aa341e3f24def1b54022404527ff57b1a439e85d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/aa341e3f24def1b54022404527ff57b1a439e85d
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
