Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
747c5638 by security tracker role at 2026-11-07T19:14:22+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,47 +1,379 @@
-CVE-2026-99280 [ksmbd: drain session procfs readers before dropping table
references]
+CVE-2026-96565 (The WP-Members Membership Plugin plugin for WordPress is
vulnerable to ...)
+ TODO: check
+CVE-2026-95870 (The wpForo Forum plugin for WordPress is vulnerable to generic
SQL Inj ...)
+ TODO: check
+CVE-2026-93766 (The Happyforms Pro plugin for WordPress is vulnerable to
Stored Cross- ...)
+ TODO: check
+CVE-2026-93755 (The Happyforms plugin for WordPress is vulnerable to Stored
Cross-Site ...)
+ TODO: check
+CVE-2026-93429 (The VikBooking Hotel Booking Engine & PMS plugin for WordPress
is vuln ...)
+ TODO: check
+CVE-2026-66669 (Cross-Site Request Forgery (CSRF) vulnerability in Suplugins
Superb Ad ...)
+ TODO: check
+CVE-2026-61990 (Missing Authorization vulnerability in WC Lovers WCFM
Membership wc-mu ...)
+ TODO: check
+CVE-2026-52713 (Missing Authorization vulnerability in ThimPress LearnPress
learnpress ...)
+ TODO: check
+CVE-2026-39733 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-124318 (Treeio through 2.0 contains an insecure deserialization
vulnerability ...)
+ TODO: check
+CVE-2026-124317 (libexpat through 2.10.0 contains an out-of-bounds read
vulnerability i ...)
+ TODO: check
+CVE-2026-124316 (Frappe ERPNext before 15.121.4 and 16.x before 16.36.0
contains a miss ...)
+ TODO: check
+CVE-2026-124315 (Frappe ERPNext before 15.121.4 and 16.x before 16.36.0
contains a miss ...)
+ TODO: check
+CVE-2026-124314 (Frappe ERPNext before 15.121.4 and 16.x before 16.36.0
contains a miss ...)
+ TODO: check
+CVE-2026-124313 (Frappe ERPNext before 15.121.4 and 16.x before 16.36.0
contains a miss ...)
+ TODO: check
+CVE-2026-124312 (Fraunhofer HHI VVdeC through 3.2.1 contains a heap
out-of-bounds read ...)
+ TODO: check
+CVE-2026-124311 (Fraunhofer HHI VVdeC through 3.2.1 contains a NULL pointer
dereference ...)
+ TODO: check
+CVE-2026-124310 (Fraunhofer HHI VVdeC before 3.2.1 contains an out-of-bounds
read vulne ...)
+ TODO: check
+CVE-2026-124309 (Fraunhofer HHI VVdeC before 3.2.1 contains a heap
out-of-bounds read v ...)
+ TODO: check
+CVE-2026-124308 (Fraunhofer HHI VVdeC before 3.2.1 contains a heap
use-after-free vulne ...)
+ TODO: check
+CVE-2026-124307 (Fraunhofer HHI VVdeC before 3.2.1 contains a heap
use-after-free vulne ...)
+ TODO: check
+CVE-2026-124274 (Missing Authorization vulnerability in myCred myCred mycred
allows Exp ...)
+ TODO: check
+CVE-2026-124258 (Missing Authorization vulnerability in ThemeGrill User
Registration us ...)
+ TODO: check
+CVE-2026-124058 (A weakness has been identified in TOTOLINK CA300-PoE
6.2c.884. Affecte ...)
+ TODO: check
+CVE-2026-124057 (A security flaw has been discovered in TOTOLINK CA300-PoE
6.2c.884. Th ...)
+ TODO: check
+CVE-2026-123992 (A flaw has been found in DataEase up to 2.10.27. Affected by
this issu ...)
+ TODO: check
+CVE-2026-123991 (A vulnerability was detected in DataEase up to 2.10.27.
Affected by th ...)
+ TODO: check
+CVE-2026-123990 (A security vulnerability has been detected in DataEase up to
2.10.27/3 ...)
+ TODO: check
+CVE-2026-123989 (A vulnerability was found in ESEngine DeepSeek-Reasonix up to
1.33.0. ...)
+ TODO: check
+CVE-2026-123988 (A vulnerability has been found in SililaWijesinghe Food
Ordering Syste ...)
+ TODO: check
+CVE-2026-123966 (A vulnerability was determined in Tenda AC19 16.03.10.07.
Affected by ...)
+ TODO: check
+CVE-2026-123964 (A vulnerability was detected in OpenBMB Internet of Agents up
to 9d78e ...)
+ TODO: check
+CVE-2026-123963 (A security vulnerability has been detected in OpenBMB
Internet of Agen ...)
+ TODO: check
+CVE-2026-123961 (A security vulnerability has been detected in TOTOLINK
CA300-PoE 6.2c. ...)
+ TODO: check
+CVE-2026-123960 (A weakness has been identified in TOTOLINK CA300-PoE
6.2c.884. This af ...)
+ TODO: check
+CVE-2026-123959 (A security flaw has been discovered in TOTOLINK CA300-PoE
6.2c.884. Th ...)
+ TODO: check
+CVE-2026-123958 (A vulnerability was identified in TOTOLINK CA300-PoE
6.2c.884. The aff ...)
+ TODO: check
+CVE-2026-123957 (A vulnerability was determined in TOTOLINK CA300-PoE
6.2c.884. Impacte ...)
+ TODO: check
+CVE-2026-123881 (A vulnerability was found in OpenBMB Internet of Agents up to
9d78e88e ...)
+ TODO: check
+CVE-2026-123861 (Authorization Bypass Through User-Controlled Key
vulnerability in Croc ...)
+ TODO: check
+CVE-2026-123860 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-123776 (RRD::CGI::Image versions through 0.01 for Perl pass CGI query
paramete ...)
+ TODO: check
+CVE-2026-123483 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-123477 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-123474 (Missing Authorization vulnerability in LeapWorx Premium
Blocks \u2013 ...)
+ TODO: check
+CVE-2026-123472 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-123470 (Missing Authorization vulnerability in HivePress HivePress
hivepress a ...)
+ TODO: check
+CVE-2026-123469 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-123468 (Missing Authorization vulnerability in StylemixThemes Motors
motors-ca ...)
+ TODO: check
+CVE-2026-123467 (Missing Authorization vulnerability in StylemixThemes Motors
motors-ca ...)
+ TODO: check
+CVE-2026-123466 (Missing Authorization vulnerability in LeapWorx Premium
Blocks \u2013 ...)
+ TODO: check
+CVE-2026-123464 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-123462 (Missing Authorization vulnerability in myCred myCred mycred
allows Exp ...)
+ TODO: check
+CVE-2026-123461 (Missing Authorization vulnerability in PluginUs.Net FOX
woocommerce-cu ...)
+ TODO: check
+CVE-2026-123418 (The Church Admin plugin for WordPress is vulnerable to Stored
Cross-Si ...)
+ TODO: check
+CVE-2026-123183 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-123148 (Missing Authorization vulnerability in TMS IvyForms ivyforms
allows Ex ...)
+ TODO: check
+CVE-2026-122675 (Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp
Social wp- ...)
+ TODO: check
+CVE-2026-122669 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-122668 (Missing Authorization vulnerability in myCred myCred mycred
allows Exp ...)
+ TODO: check
+CVE-2026-122663 (Missing Authorization vulnerability in VillaTheme CURCY
woo-multi-curr ...)
+ TODO: check
+CVE-2026-122660 (Missing Authorization vulnerability in BAKKBONE Australia
FloristPress ...)
+ TODO: check
+CVE-2026-122659 (Missing Authorization vulnerability in WP ManageNinja LLC
Fluent Booki ...)
+ TODO: check
+CVE-2026-122231 (The WS Form LITE \u2013 Drag & Drop Contact Form Builder
plugin for Wo ...)
+ TODO: check
+CVE-2026-122059 (The WP ImageViewer plugin for WordPress is vulnerable to
Stored DOM-Ba ...)
+ TODO: check
+CVE-2026-122041 (The Checkout Field Editor for WooCommerce (Pro) plugin for
WordPress i ...)
+ TODO: check
+CVE-2026-121977 (The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin
for WordP ...)
+ TODO: check
+CVE-2026-121976 (The Modula plugin for WordPress is vulnerable to Stored
Cross-Site Scr ...)
+ TODO: check
+CVE-2026-121784 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-121783 (Cross-Site Request Forgery (CSRF) vulnerability in Passionate
Programm ...)
+ TODO: check
+CVE-2026-121781 (Missing Authorization vulnerability in WP ManageNinja LLC
Fluent Booki ...)
+ TODO: check
+CVE-2026-121779 (Exposure of Sensitive System Information to an Unauthorized
Control Sp ...)
+ TODO: check
+CVE-2026-121778 (Missing Authorization vulnerability in WP Lab WP-Lister Lite
for Amazo ...)
+ TODO: check
+CVE-2026-121777 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-121775 (Missing Authorization vulnerability in VillaTheme CURCY
woo-multi-curr ...)
+ TODO: check
+CVE-2026-121768 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-121767 (Missing Authorization vulnerability in weDevs weDocs wedocs
allows Exp ...)
+ TODO: check
+CVE-2026-121766 (Missing Authorization vulnerability in Blubrry Podcasting
PowerPress P ...)
+ TODO: check
+CVE-2026-121765 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-121762 (Cross-Site Request Forgery (CSRF) vulnerability in Blubrry
Podcasting ...)
+ TODO: check
+CVE-2026-121761 (Missing Authorization vulnerability in Infomaniak Network VOD
Infomani ...)
+ TODO: check
+CVE-2026-121724 (Missing Authorization vulnerability in WebberZone Contextual
Related P ...)
+ TODO: check
+CVE-2026-121579 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-121575 (Missing Authorization vulnerability in WP User Manager WP
User Manager ...)
+ TODO: check
+CVE-2026-121571 (Missing Authorization vulnerability in WP Desk Autopay dla
WooCommerce ...)
+ TODO: check
+CVE-2026-121265 (SQL::Abstract versions before 2.000003 for Perl allow SQL
injection vi ...)
+ TODO: check
+CVE-2026-120984 (A flaw was found in the Keycloak server's client management
component. ...)
+ TODO: check
+CVE-2026-120857 (Missing Authorization vulnerability in VideoWhisper.com 2Way
VideoCall ...)
+ TODO: check
+CVE-2026-120853 (Missing Authorization vulnerability in Brainstorm Force
CartFlows cart ...)
+ TODO: check
+CVE-2026-120852 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-120850 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-120849 (Missing Authorization vulnerability in WC Lovers WCFM
Marketplace wc-m ...)
+ TODO: check
+CVE-2026-120848 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-120847 (Missing Authorization vulnerability in Wpmet Metform metform
allows Ex ...)
+ TODO: check
+CVE-2026-120842 (Missing Authorization vulnerability in Brainstorm Force
SureForms sure ...)
+ TODO: check
+CVE-2026-120841 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
+ TODO: check
+CVE-2026-120840 (Missing Authorization vulnerability in ThemeGrill User
Registration us ...)
+ TODO: check
+CVE-2026-120839 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
+ TODO: check
+CVE-2026-120837 (Missing Authorization vulnerability in Everest Forms Everest
Forms eve ...)
+ TODO: check
+CVE-2026-120836 (Missing Authorization vulnerability in eLightUp Meta Box
\u2013 WordPr ...)
+ TODO: check
+CVE-2026-120685 (The Real Testimonials \u2013 Testimonial Slider, Collect
Customer Revi ...)
+ TODO: check
+CVE-2026-120683 (The Real Testimonials \u2013 Testimonial Slider, Collect
Customer Revi ...)
+ TODO: check
+CVE-2026-120579 (The Active Woot Products Tables for WooCommerce. 100% FREE
plugin for ...)
+ TODO: check
+CVE-2026-120548 (The YML for Yandex Market plugin for WordPress is vulnerable
to Sensit ...)
+ TODO: check
+CVE-2026-120532 (The wpForo Forum plugin for WordPress is vulnerable to Stored
Cross-Si ...)
+ TODO: check
+CVE-2026-120514 (The Zephyr Project Manager plugin for WordPress is vulnerable
to Store ...)
+ TODO: check
+CVE-2026-120509 (The Real Testimonials \u2013 Testimonial Slider, Collect
Customer Revi ...)
+ TODO: check
+CVE-2026-120365 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-120364 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-119525 (Missing Authorization vulnerability in WP Desk Dropshipping
XML for Wo ...)
+ TODO: check
+CVE-2026-119523 (Missing Authorization vulnerability in Cozmoslabs Paid Member
Subscrip ...)
+ TODO: check
+CVE-2026-119522 (Missing Authorization vulnerability in ThemeGrill User
Registration us ...)
+ TODO: check
+CVE-2026-119520 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-119513 (Missing Authorization vulnerability in Ahmad JS Help Desk
js-support-t ...)
+ TODO: check
+CVE-2026-119511 (Missing Authorization vulnerability in Saeed MC Woocommerce
Wishlist s ...)
+ TODO: check
+CVE-2026-119510 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-119508 (Missing Authorization vulnerability in Mamunur Rashid Radius
Booking \ ...)
+ TODO: check
+CVE-2026-119507 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-119502 (Missing Authorization vulnerability in BdThemes Ultimate
Store Kit Ele ...)
+ TODO: check
+CVE-2026-119501 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-119500 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-119498 (Authentication Bypass Using an Alternate Path or Channel
vulnerability ...)
+ TODO: check
+CVE-2026-119496 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-119494 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-119493 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-119492 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-119491 (Missing Authorization vulnerability in David Lingren Media
LIbrary Ass ...)
+ TODO: check
+CVE-2026-119490 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-119489 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-119486 (Missing Authorization vulnerability in WP ManageNinja LLC
FluentBoards ...)
+ TODO: check
+CVE-2026-119484 (Cross-Site Request Forgery (CSRF) vulnerability in Supsystic
Photo Gal ...)
+ TODO: check
+CVE-2026-119478 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-119473 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
+ TODO: check
+CVE-2026-119467 (Missing Authorization vulnerability in WPVibes AnyWhere
Elementor anyw ...)
+ TODO: check
+CVE-2026-119465 (Insertion of Sensitive Information Into Sent Data
vulnerability in WPV ...)
+ TODO: check
+CVE-2026-119183 (The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin
for WordP ...)
+ TODO: check
+CVE-2026-119164 (The wpForo Forum plugin for WordPress is vulnerable to
Privilege Escal ...)
+ TODO: check
+CVE-2026-119156 (The Download Manager plugin for WordPress is vulnerable to
Stored Cros ...)
+ TODO: check
+CVE-2026-119155 (The wpForo Forum plugin for WordPress is vulnerable to
time-based SQL ...)
+ TODO: check
+CVE-2026-119075 (The Registration Form for WooCommerce plugin for WordPress is
vulnerab ...)
+ TODO: check
+CVE-2026-118784 (The WPSpeed plugin for WordPress is vulnerable to Stored
Cross-Site Sc ...)
+ TODO: check
+CVE-2026-118267 (The WP Data Access \u2013 App Builder for Tables, Forms,
Dashboards, C ...)
+ TODO: check
+CVE-2026-118066 (The Appointment Booking Plugin \u2013 LatePoint | Calendar &
Schedulin ...)
+ TODO: check
+CVE-2026-118056 (The Image Hover Effects Ultimate ( Image Gallery, Effects,
Lightbox, C ...)
+ TODO: check
+CVE-2026-118050 (The Football Pool plugin for WordPress is vulnerable to
Stored Cross-S ...)
+ TODO: check
+CVE-2026-118047 (The Falang multilanguage for WordPress plugin for WordPress
is vulnera ...)
+ TODO: check
+CVE-2026-116751 (The Booking for Appointments and Events Calendar \u2013
Amelia Pro plu ...)
+ TODO: check
+CVE-2026-116537 (The Link Library plugin for WordPress is vulnerable to Stored
Cross-Si ...)
+ TODO: check
+CVE-2026-115548 (The Quttera ThreatSign \u2013 Web Malware Scanner for
WordPress plugin ...)
+ TODO: check
+CVE-2026-111370 (The WP Visitor Statistics (Real Time Traffic) plugin for
WordPress is ...)
+ TODO: check
+CVE-2026-111317 (The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin
for WordP ...)
+ TODO: check
+CVE-2026-110004 (The wpForo Forum plugin for WordPress is vulnerable to
arbitrary file ...)
+ TODO: check
+CVE-2026-109991 (The FunnelKit Payment Gateway for Stripe WooCommerce plugin
for WordPr ...)
+ TODO: check
+CVE-2026-109973 (The Image Hover Effects Ultimate Visual Composer (Flipbox -
Awesomes F ...)
+ TODO: check
+CVE-2026-109230 (The WP Visitor Statistics (Real Time Traffic) plugin for
WordPress is ...)
+ TODO: check
+CVE-2026-109214 (The User Frontend \u2013 Membership, User Registration, User
Profile, ...)
+ TODO: check
+CVE-2026-107616 (The Amelia plugin for WordPress is vulnerable to unauthorized
access o ...)
+ TODO: check
+CVE-2026-104992 (The Booking for Appointments and Events Calendar \u2013
Amelia plugin ...)
+ TODO: check
+CVE-2026-104768 (The AutomatorWP \u2013 No-Code Workflow Automation,
Integration & Webh ...)
+ TODO: check
+CVE-2026-104760 (The weDocs: AI Powered Knowledge Base, Docs, Documentation,
Wiki & AI ...)
+ TODO: check
+CVE-2026-104746 (The Motors \u2013 Car Dealership & Classified Listings Plugin
plugin f ...)
+ TODO: check
+CVE-2026-104738 (The Advanced Form Integration \u2014 Connect Forms to 300+
Apps plugin ...)
+ TODO: check
+CVE-2026-104014 (The Naimur Email OTP Verification for WooCommerce plugin for
WordPress ...)
+ TODO: check
+CVE-2026-103914 (The Dynific Addons for Elementor plugin for WordPress is
vulnerable to ...)
+ TODO: check
+CVE-2026-103900 (The WPJAM Basic plugin for WordPress is vulnerable to
Privilege Escala ...)
+ TODO: check
+CVE-2026-102564 (The The Dynific Addons for Elementor (formerly Anywhere
Elementor) plu ...)
+ TODO: check
+CVE-2026-99280 (In the Linux kernel, the following vulnerability has been
resolved: k ...)
- linux 7.3.3-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/1c087cf7d5386c708d8984b263280b42b3daada0 (7.4-rc1)
-CVE-2026-99279 [ksmbd: reclaim ended sessions on logoff and expiration]
+CVE-2026-99279 (In the Linux kernel, the following vulnerability has been
resolved: k ...)
- linux 7.3.3-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/26534ef335e92b028eb58e44d98d46a0e26af0ec (7.4-rc1)
-CVE-2026-99278 [ksmbd: limit sessions on each connection]
+CVE-2026-99278 (In the Linux kernel, the following vulnerability has been
resolved: k ...)
- linux 7.3.3-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68 (7.4-rc1)
-CVE-2026-99277 [ksmbd: hold a connection reference for each session channel]
+CVE-2026-99277 (In the Linux kernel, the following vulnerability has been
resolved: k ...)
- linux 7.3.3-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/add8d7fb04efe564193df73581889c62fc0016f1 (7.4-rc1)
-CVE-2026-99276 [ksmbd: defer connection scavenging while session locks are
busy]
+CVE-2026-99276 (In the Linux kernel, the following vulnerability has been
resolved: k ...)
- linux 7.3.3-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/b4bae7af1154089be87c7475218264fcbfd16d10 (7.4-rc1)
-CVE-2026-99282 [net/sched: sch_teql: fix use-after-free on lower qdisc drop]
+CVE-2026-99282 (In the Linux kernel, the following vulnerability has been
resolved: n ...)
- linux 7.3.3-1
NOTE:
https://git.kernel.org/linus/782d6bb8f9b8e9d8591181662222bf74cd3ecf79 (7.4-rc1)
-CVE-2026-99281 [tun: Require CAP_NET_ADMIN to attach to an ownerless device]
+CVE-2026-99281 (In the Linux kernel, the following vulnerability has been
resolved: t ...)
- linux 7.3.3-1
NOTE:
https://git.kernel.org/linus/ffdf678dd16610e3f006dac904bd37c09684673c (7.4-rc1)
-CVE-2026-99275 [smb: client: reject short SESSION_SETUP responses]
+CVE-2026-99275 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux 7.3.3-1
NOTE:
https://git.kernel.org/linus/4d8930afa3446041358a7db33e7b23a0bb9459b5 (7.4-rc1)
-CVE-2026-99274 [smb: client: fix fiemap wild read on empty truncated response]
+CVE-2026-99274 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux 7.3.3-1
NOTE:
https://git.kernel.org/linus/f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc (7.4-rc1)
-CVE-2026-99273 [ksmbd: reserve space for the UTF-16 terminator in stream info]
+CVE-2026-99273 (In the Linux kernel, the following vulnerability has been
resolved: k ...)
- linux 7.3.3-1
NOTE:
https://git.kernel.org/linus/a025c4991a7d83edc4dd339e3ea86d8ff6226eca (7.4-rc1)
-CVE-2026-99272 [smb: client: validate the data area in SMB2_read()]
+CVE-2026-99272 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux 7.3.3-1
NOTE:
https://git.kernel.org/linus/2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1 (7.4-rc1)
-CVE-2026-99271 [ALSA: line6: Clear prev_fbuf on capture buffer release]
+CVE-2026-99271 (In the Linux kernel, the following vulnerability has been
resolved: A ...)
- linux 7.3.3-1
NOTE:
https://git.kernel.org/linus/aa118c8f61d59387961d58ffae831c5259a9f222 (7.4-rc1)
CVE-2026-9601 (The Stackable \u2013 Page Builder Gutenberg Blocks plugin for
WordPres ...)
@@ -20543,6 +20875,7 @@ CVE-2026-110353 (HAProxy 3.2 before 3.4.6 allows a
remote unauthenticated attack
NOTE:
https://git.haproxy.org/?p=haproxy-3.0.git;a=commit;h=e1672c9ca04c81b544a60e316eb2bb4af02381e1
(v3.0.30)
NOTE:
https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=f07a3dbd514ac585177792cca1ff0e5008f28b60
(v2.6.35)
CVE-2026-110264 (An issue has been discovered in GitLab CE/EE affecting all
versions fr ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1152513)
- ruby3.1 <removed>
NOTE: https://github.com/ruby/ruby/pull/16801
@@ -39540,6 +39873,7 @@ CVE-2026-9268 (GitLab has remediated an issue in GitLab
EE affecting all version
CVE-2026-97691 (Convex is an open-source reactive database for application
developers. ...)
NOT-FOR-US: Convex
CVE-2026-97229 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1152513)
- ruby3.1 <removed>
NOTE: https://github.com/ruby/ruby/pull/19020
@@ -42089,7 +42423,7 @@ CVE-2026-62034 (Unauthenticated Cross Site Scripting
(XSS) in Before After Image
NOT-FOR-US: WordPress plugin or theme
CVE-2026-62033 (Subscriber Settings Change in uListing <= 2.2.0 versions.)
NOT-FOR-US: WordPress plugin or theme
-CVE-2026-62032 (Unauthenticated Local File Inclusion in DirectoryPress <=
3.6.27 versi ...)
+CVE-2026-62032 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-62031 (Unauthenticated SQL Injection in uListing <= 2.2.0 versions.)
NOT-FOR-US: WordPress plugin or theme
@@ -63595,6 +63929,7 @@ CVE-2026-93620 (Unauthenticated Broken Access Control
in PayPlus Payment Gateway
CVE-2026-93618 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-93577 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1152513)
- ruby3.1 <removed>
NOTE: https://github.com/ruby/ruby/pull/19020
@@ -63738,6 +64073,7 @@ CVE-2026-90900 (Joomla Extension - joomshaper.com -
Missing CSRF Token Verificat
CVE-2026-90899 (Joomla Extension - joomshaper.com - Unauthenticated PII
Exposure via I ...)
NOT-FOR-US: Joomla
CVE-2026-89078 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1152513)
- ruby3.1 <removed>
NOTE: https://github.com/ruby/ruby/pull/13332
@@ -85978,12 +86314,12 @@ CVE-2026-6485 (UEFI BIOS embedded Shell could be used
to bypass Secure Boot via
CVE-2026-55250 (Maravel, a PHP framework oriented towards dependency
injection, prior ...)
NOT-FOR-US: Maravel
CVE-2026-53939 (OpenIDC/cjose is a C library implementing the Javascript
Object Signin ...)
- {DSA-6499-1}
+ {DSA-6499-1 DLA-4887-1}
- cjose 0.6.2.7-1
NOTE:
https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq
NOTE: Fixed by:
https://github.com/OpenIDC/cjose/commit/2a6e5bd969fa20059fb00913fb9f57d77ea6a4d9
(v0.6.2.6)
CVE-2026-53938 (OpenIDC/cjose is a C library implementing the Javascript
Object Signin ...)
- {DSA-6499-1}
+ {DSA-6499-1 DLA-4887-1}
- cjose 0.6.2.7-1
NOTE:
https://github.com/OpenIDC/cjose/security/advisories/GHSA-75r7-f5cv-g3wj
NOTE: Fixed by:
https://github.com/OpenIDC/cjose/commit/8c51d245273583a658f24ef7b08ba22f848a34a5
(v0.6.2.5)
@@ -92273,6 +92609,7 @@ CVE-2026-85093 (Cheshire Cat AI's GET
/memory/collections/{collection_id}/points
CVE-2026-85092 (LiME through 1.12.0 fails to validate the disk acquisition
output path ...)
NOT-FOR-US: LiME
CVE-2026-85091 (zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer
overflow vul ...)
+ {DSA-6613-1}
- zlib 1:1.3.dfsg+really1.3.2-4 (bug #1146895)
NOTE:
https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
NOTE: https://github.com/madler/zlib/issues/1310
@@ -99182,10 +99519,12 @@ CVE-2026-81091 (The proxy middleware in mcp-use's
inspector forwards requests to
CVE-2026-80433 (Subscriber Sensitive Data Exposure in SureFeedback Client Site
<= 1.2. ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-80213 (An issue was discovered in the resolv gem before 0.7.2 for
Ruby. Resol ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed>
- ruby3.1 <removed>
- ruby2.7 <removed>
CVE-2026-80212 (An issue was discovered in the resolv gem before 0.7.2 for
Ruby. Resol ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed>
- ruby3.1 <removed>
- ruby2.7 <removed>
@@ -104150,6 +104489,7 @@ CVE-2026-76847 (act starts an HTTP Artifacts V4
backend whenever a workflow uses
CVE-2026-76845 (adm-zip 0.5.9 through 0.6.0 follows symbolic links at the
extraction d ...)
NOT-FOR-US: adm-zip
CVE-2026-76844 (zlib 1.2.11 through 1.3.2 contains a heap buffer overflow:
after an un ...)
+ {DSA-6613-1}
- zlib 1:1.3.dfsg+really1.3.2-4 (bug #1153063)
NOTE: Fixed by:
https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148
(v1.4)
NOTE: Same fixing change as for CVE-2026-85091
@@ -170104,16 +170444,19 @@ CVE-2026-48109 (MessagePack for C# is a MessagePack
serializer for C#. Prior to
CVE-2026-48067 (Filament is a collection of full-stack components for
accelerated Lara ...)
NOT-FOR-US: Filament
CVE-2026-47242 (Net::IMAP implements Internet Message Access Protocol (IMAP)
client fu ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1141319)
- ruby3.1 <removed>
- ruby2.7 <removed>
NOTE:
https://github.com/ruby/net-imap/security/advisories/GHSA-46q3-7gv7-qmgg
CVE-2026-47241 (Net::IMAP implements Internet Message Access Protocol (IMAP)
client fu ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1141319)
- ruby3.1 <removed>
- ruby2.7 <removed>
NOTE:
https://github.com/ruby/net-imap/security/advisories/GHSA-c4fp-cxrr-mj66
CVE-2026-47240 (Net::IMAP implements Internet Message Access Protocol (IMAP)
client fu ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1141319)
- ruby3.1 <removed>
- ruby2.7 <removed>
@@ -200250,30 +200593,35 @@ CVE-2026-42562 (Plainpad is a self hosted note
taking app. Prior to version 1.1.
CVE-2026-42333 (Quarkus OpenAPI Generator is Quarkus' extensions for
generation of Res ...)
NOT-FOR-US: Quarkus OpenAPI Generator
CVE-2026-42258 (Net::IMAP implements Internet Message Access Protocol (IMAP)
client fu ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1136823)
- ruby3.1 <removed>
- ruby2.7 <removed>
NOTE:
https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px
NOTE: Net::IMAP embedded in src:ruby* source package
CVE-2026-42257 (Net::IMAP implements Internet Message Access Protocol (IMAP)
client fu ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1136823)
- ruby3.1 <removed>
- ruby2.7 <removed>
NOTE:
https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg
NOTE: Net::IMAP embedded in src:ruby* source package
CVE-2026-42256 (Net::IMAP implements Internet Message Access Protocol (IMAP)
client fu ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1136823)
- ruby3.1 <removed>
- ruby2.7 <removed>
NOTE:
https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7
NOTE: Net::IMAP embedded in src:ruby* source package
CVE-2026-42246 (Net::IMAP implements Internet Message Access Protocol (IMAP)
client fu ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1136823)
- ruby3.1 <removed>
- ruby2.7 <removed>
NOTE:
https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp
NOTE: Net::IMAP embedded in src:ruby* source package
CVE-2026-42245 (Net::IMAP implements Internet Message Access Protocol (IMAP)
client fu ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1136823)
- ruby3.1 <removed>
- ruby2.7 <removed>
@@ -211030,7 +211378,7 @@ CVE-2026-41318 (AnythingLLM is an application that
turns pieces of content into
CVE-2026-41317 (Press, a Frappe custom app that runs Frappe Cloud, manages
infrastruct ...)
NOT-FOR-US: Press (Frapp app)
CVE-2026-41316 (ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB
2.2.0 was ...)
- {DLA-4716-1}
+ {DSA-6614-1 DLA-4716-1}
- ruby3.3 <unfixed> (bug #1134920)
- ruby3.1 <removed>
- ruby2.7 <removed>
@@ -215478,7 +215826,7 @@ CVE-2026-2336 (A privilege escalation vulnerability
in Microchip IStaX allows an
CVE-2026-28741 (Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0,
11.4.x <= 1 ...)
- mattermost-server <itp> (bug #823556)
CVE-2026-27820 (zlib is a Ruby interface for the zlib
compression/decompression librar ...)
- {DLA-4716-1}
+ {DSA-6614-1 DLA-4716-1}
- ruby3.3 <unfixed> (bug #1134341)
- ruby3.1 <removed>
- ruby2.7 <removed>
@@ -245952,6 +246300,7 @@ CVE-2026-2023 (The WP Plugin Info Card plugin for
WordPress is vulnerable to Cro
CVE-2026-2019 (The Cart All In One For WooCommerce plugin for WordPress is
vulnerable ...)
NOT-FOR-US: WordPress plugin
CVE-2026-27171 (zlib before 1.3.2 allows CPU consumption via crc32_combine64
and crc32 ...)
+ {DSA-6613-1}
- zlib 1:1.3.dfsg+really1.3.2-1 (bug #1128336)
[bookworm] - zlib <no-dsa> (Minor issue)
[bullseye] - zlib <not-affected> (Affected code implemented later)
@@ -265389,7 +265738,7 @@ CVE-2025-66723 (inMusic Brands Engine DJ before 4.3.4
suffers from Insecure Perm
CVE-2025-62753 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-61594 (URI is a module providing classes to handle Uniform Resource
Identifie ...)
- {DLA-4716-1}
+ {DSA-6614-1 DLA-4716-1}
- ruby3.3 <unfixed> (bug #1124379)
- ruby3.1 <removed>
[bookworm] - ruby3.1 <no-dsa> (Minor issue)
@@ -304510,6 +304859,7 @@ CVE-2025-59339 (The Bastion provides authentication,
authorization, traceability
CVE-2025-59304 (A directory traversal issue in Swetrix Web Analytics API 3.1.1
before ...)
NOT-FOR-US: Swetrix Web Analytics API
CVE-2025-58767 (REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to
3.4.1 h ...)
+ {DSA-6614-1}
- ruby3.3 <unfixed> (bug #1115655)
- ruby3.1 <not-affected> (Vulnerable code not present)
[bookworm] - ruby3.1 <no-dsa> (Minor issue)
@@ -326326,7 +326676,7 @@ CVE-2025-53871
CVE-2025-53636 (Open OnDemand is an open-source HPC portal. Users can flood
logs by in ...)
NOT-FOR-US: Open OnDemand
CVE-2025-24294 (The attack vector is a potential Denial of Service (DoS). The
vulnerab ...)
- {DLA-4716-1}
+ {DSA-6614-1 DLA-4716-1}
- ruby3.3 <unfixed> (bug #1109337)
- ruby3.1 <removed>
[bookworm] - ruby3.1 <no-dsa> (Minor issue)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/747c56389a4f134c19a860900c271fecd1bda139
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/747c56389a4f134c19a860900c271fecd1bda139
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
