Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
897350a0 by security tracker role at 2026-11-08T07:13:56+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,305 @@
+CVE-2026-97195 (The Secure Custom Fields WordPress plugin before 6.9.8 does
not saniti ...)
+ TODO: check
+CVE-2026-97194 (The Secure Custom Fields WordPress plugin before 6.9.8 does
not perfor ...)
+ TODO: check
+CVE-2026-97193 (The Secure Custom Fields WordPress plugin before 6.9.8 does
not verify ...)
+ TODO: check
+CVE-2026-97192 (The Secure Custom Fields WordPress plugin before 6.9.8 does
not re-app ...)
+ TODO: check
+CVE-2026-96963 (The Pie Register WordPress plugin through 3.8.4.15 does not
perform a ...)
+ TODO: check
+CVE-2026-96961 (The Pie Register WordPress plugin through 3.8.4.15 does not
perform a ...)
+ TODO: check
+CVE-2026-85344 (The FV Flowplayer Video Player WordPress plugin before
7.5.57.7212 doe ...)
+ TODO: check
+CVE-2026-124422 (SunEditor from 3.0.0 before 3.4.0 contains a stored
cross-site scripti ...)
+ TODO: check
+CVE-2026-124060 (A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884.
Affected ...)
+ TODO: check
+CVE-2026-124059 (A security vulnerability has been detected in TOTOLINK
CA300-PoE 6.2c. ...)
+ TODO: check
+CVE-2026-123616 (imgproxy from 3.3.0 before 4.0.16 contains an unbounded
memory allocat ...)
+ TODO: check
+CVE-2026-123615 (imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap
read and w ...)
+ TODO: check
+CVE-2026-123614 (imgproxy from 4.0.0 before 4.0.16 contains an integer
overflow in the ...)
+ TODO: check
+CVE-2026-123613 (Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake
messages ...)
+ TODO: check
+CVE-2026-123612 (rustls 0.23.44 and 0.23.45 contain an information disclosure
vulnerabi ...)
+ TODO: check
+CVE-2026-123611 (rustls before 0.23.46 contains a key exchange downgrade
vulnerability ...)
+ TODO: check
+CVE-2026-123610 (rustls before 0.23.46 contains an uncontrolled memory
allocation flaw ...)
+ TODO: check
+CVE-2026-123609 (Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2
contains an ...)
+ TODO: check
+CVE-2026-123608 (Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a
denial o ...)
+ TODO: check
+CVE-2026-123607 (Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and
hickory-ne ...)
+ TODO: check
+CVE-2026-123606 (The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3
through 0. ...)
+ TODO: check
+CVE-2026-123605 (Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and
hickory-net b ...)
+ TODO: check
+CVE-2026-123604 (Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2
contains an u ...)
+ TODO: check
+CVE-2026-123603 (hickory-proto and hickory-resolver 0.26.0 before 0.26.2,
hickory-serve ...)
+ TODO: check
+CVE-2026-123602 (The Hickory DNS recursor in all versions of hickory-recursor
and in hi ...)
+ TODO: check
+CVE-2026-123601 (Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and
hickory-ne ...)
+ TODO: check
+CVE-2026-123600 (Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and
hickory-ne ...)
+ TODO: check
+CVE-2026-123599 (Hickory DNS hickory-proto before 0.26.0-beta.1 and
hickory-net before ...)
+ TODO: check
+CVE-2026-123598 (The validating recursor in Hickory DNS hickory-recursor
0.25.0 through ...)
+ TODO: check
+CVE-2026-123597 (Hickory DNS hickory-proto 0.25.0-alpha.1 through
0.26.0-alpha.1 and hi ...)
+ TODO: check
+CVE-2026-123596 (Hickory DNS hickory-proto through 0.26.0-alpha.1 and
hickory-net 0.26. ...)
+ TODO: check
+CVE-2026-123595 (Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and
hickory-net ...)
+ TODO: check
+CVE-2026-123594 (Hickory DNS hickory-proto through 0.26.0-alpha.1 and
hickory-net 0.26. ...)
+ TODO: check
+CVE-2026-123593 (Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and
hickory-proto ...)
+ TODO: check
+CVE-2026-123592 (The hickory-net crate in Hickory DNS 0.26.0-beta.1 before
0.26.2 allow ...)
+ TODO: check
+CVE-2026-123591 (Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and
hickory-proto ...)
+ TODO: check
+CVE-2026-123590 (Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and
hickory-proto ...)
+ TODO: check
+CVE-2026-123589 (The DNS-over-QUIC (DoQ) server in hickory-server
(hickory-dns) before ...)
+ TODO: check
+CVE-2026-123588 (The recursive resolver in Hickory DNS (all versions of the
hickory-rec ...)
+ TODO: check
+CVE-2026-123587 (The DNSSEC validation in the Hickory DNS hickory-net crate
0.26.0 befo ...)
+ TODO: check
+CVE-2026-123586 (Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query
amplificati ...)
+ TODO: check
+CVE-2026-123585 (The hickory-resolver component of Hickory DNS 0.25.0 before
0.26.2 fol ...)
+ TODO: check
+CVE-2026-123584 (The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2
stops listen ...)
+ TODO: check
+CVE-2026-123583 (The recursive resolver in Hickory DNS hickory-recursor 0.25.0
through ...)
+ TODO: check
+CVE-2026-123582 (The validating recursive resolver and validating forwarder in
Hickory ...)
+ TODO: check
+CVE-2026-123581 (Hickory DNS hickory-proto through 0.26.0-alpha.1 and
hickory-net 0.26. ...)
+ TODO: check
+CVE-2026-123580 (Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and
hickory-proto ...)
+ TODO: check
+CVE-2026-123579 (DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1
before 0.26 ...)
+ TODO: check
+CVE-2026-123578 (Hickory DNS hickory-net 0.26.0 before 0.26.2 and
hickory-proto 0.25.0 ...)
+ TODO: check
+CVE-2026-123577 (Hickory DNS from 0.24.0 before 0.26.2 contains a resource
exhaustion v ...)
+ TODO: check
+CVE-2026-123576 (Hickory DNS 0.24.0 through 0.26.1 contains a memory
exhaustion vulnera ...)
+ TODO: check
+CVE-2026-123575 (Hickory DNS before 0.26.2 contains a resource exhaustion
vulnerability ...)
+ TODO: check
+CVE-2026-123574 (The zone file parser in the hickory-proto crate of Hickory
DNS 0.24.0 ...)
+ TODO: check
+CVE-2026-123573 (hickory-dns from 0.20.1 before 0.26.2 contains a denial of
service vul ...)
+ TODO: check
+CVE-2026-123572 (Hickory-dns from 0.20.1 before 0.26.2 contains a denial of
service vul ...)
+ TODO: check
+CVE-2026-123571 (Hickory DNS from 0.26.0 before 0.26.2 contains an integer
underflow vu ...)
+ TODO: check
+CVE-2026-123570 (The DNS wire-format message parser in hickory-proto (Hickory
DNS) 0.18 ...)
+ TODO: check
+CVE-2026-123569 (The devalue package for npm before 5.6.3 can consume
excessive CPU and ...)
+ TODO: check
+CVE-2026-123568 (Sveltejs devalue before 5.6.3 contains a prototype pollution
vulnerabi ...)
+ TODO: check
+CVE-2026-123567 (Sveltejs devalue before 5.6.4 contains a prototype injection
vulnerabi ...)
+ TODO: check
+CVE-2026-123566 (Sveltejs devalue before 5.9.3 contains a denial of service
vulnerabili ...)
+ TODO: check
+CVE-2026-123565 (Sveltejs devalue before 5.9.3 contains a resource exhaustion
vulnerabi ...)
+ TODO: check
+CVE-2026-123564 (Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory
exhaustion ...)
+ TODO: check
+CVE-2026-123563 (Devalue before 5.9.3 contains a validation bypass
vulnerability that a ...)
+ TODO: check
+CVE-2026-123562 (devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an
unhandled pr ...)
+ TODO: check
+CVE-2026-123561 (devalue before 5.9.3 allows malformed null-prototype object
keys to by ...)
+ TODO: check
+CVE-2026-123560 (Zebra before 7.0.0 contains an incomplete cleanup
vulnerability that a ...)
+ TODO: check
+CVE-2026-123559 (Zebra before 7.0.0 contains an inefficient algorithmic
complexity vuln ...)
+ TODO: check
+CVE-2026-123558 (Zebra zebrad before 7.0.0 contains a denial of service
vulnerability t ...)
+ TODO: check
+CVE-2026-123557 (ZcashFoundation Zebra zebrad before 7.0.0 contains a
reachable asserti ...)
+ TODO: check
+CVE-2026-123556 (ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a
protection me ...)
+ TODO: check
+CVE-2026-123555 (Zebra from 2.3.0 before 7.0.0 contains a denial of service
vulnerabili ...)
+ TODO: check
+CVE-2026-123554 (Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in
the mempool ...)
+ TODO: check
+CVE-2026-123553 (OpenAM before 16.1.4 ships built-in identities in the Top
Level Realm ...)
+ TODO: check
+CVE-2026-123552 (OpenAM before 16.1.4 contains a server-side request forgery
vulnerabil ...)
+ TODO: check
+CVE-2026-123551 (OpenAM from 14.0.0 before 16.1.4 contains an information
disclosure vu ...)
+ TODO: check
+CVE-2026-123550 (OpenAM before 16.1.4 contains an authentication bypass
vulnerability i ...)
+ TODO: check
+CVE-2026-123549 (OpenAM before 16.1.4 fails to enforce the Valid Creation
Attributes li ...)
+ TODO: check
+CVE-2026-123548 (OpenIdentityPlatform OpenAM before 16.1.4 contains an open
redirect be ...)
+ TODO: check
+CVE-2026-123547 (OpenAM before 16.1.4 contains an open redirect vulnerability
that allo ...)
+ TODO: check
+CVE-2026-123546 (OpenAM before 16.1.4 contains an open redirect and cross-site
scriptin ...)
+ TODO: check
+CVE-2026-123545 (OpenAM from 14.5.1 before 16.1.4 contains a cross-site
request forgery ...)
+ TODO: check
+CVE-2026-123544 (OpenAM before 16.1.4 and its client SDK fail to sufficiently
validate ...)
+ TODO: check
+CVE-2026-123543 (OpenAM before 16.1.4 contains a denial of service
vulnerability that a ...)
+ TODO: check
+CVE-2026-123542 (OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0
device aut ...)
+ TODO: check
+CVE-2026-123541 (OpenAM before 16.1.4 contains an open redirect vulnerability
that allo ...)
+ TODO: check
+CVE-2026-123540 (OpenAM before 16.1.4 contains an incomplete output encoding
vulnerabil ...)
+ TODO: check
+CVE-2026-123539 (OpenAM before 16.1.4 contains a stored cross-site scripting
vulnerabil ...)
+ TODO: check
+CVE-2026-123538 (OpenAM before 16.1.4 does not verify that a signed SAML 1.x
assertion ...)
+ TODO: check
+CVE-2026-123537 (OpenAM before 16.1.4 contains a server-side request forgery
vulnerabil ...)
+ TODO: check
+CVE-2026-123536 (OpenAM before 16.1.4 contains a server-side request forgery
vulnerabil ...)
+ TODO: check
+CVE-2026-123535 (Tornado before 6.6 does not validate the max_age argument of
RequestHa ...)
+ TODO: check
+CVE-2026-123534 (Tornado before 6.6 contains a path traversal vulnerability in
RequestH ...)
+ TODO: check
+CVE-2026-123533 (gix-commitgraph before 0.42.0, as used in gitoxide before
0.61.0, cont ...)
+ TODO: check
+CVE-2026-123532 (gix-fs in gitoxide before 0.24.1 contains a credential
disclosure vuln ...)
+ TODO: check
+CVE-2026-123531 (Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled
resource cons ...)
+ TODO: check
+CVE-2026-123530 (Vikunja before 2.7.1 contains a missing authentication
vulnerability t ...)
+ TODO: check
+CVE-2026-123529 (Vikunja before 2.7.1 contains a stored CSS injection
vulnerability tha ...)
+ TODO: check
+CVE-2026-123528 (Vikunja before 2.7.1 contains an insufficient session
expiration vulne ...)
+ TODO: check
+CVE-2026-123527 (Vikunja from 2.4.0 before 2.7.1 contains an authorization
bypass vulne ...)
+ TODO: check
+CVE-2026-123526 (Vikunja before 2.7.1 contains a mass assignment vulnerability
that all ...)
+ TODO: check
+CVE-2026-123525 (Vikunja before 2.7.1 allocates memory without limits in its
Trello, To ...)
+ TODO: check
+CVE-2026-123524 (Vikunja from 0.23.0 before 2.7.1 contains an information
disclosure vu ...)
+ TODO: check
+CVE-2026-123523 (Vikunja before 2.7.1 contains an uncontrolled resource
consumption vul ...)
+ TODO: check
+CVE-2026-123522 (Vikunja before 2.7.1 contains an authorization bypass
vulnerability th ...)
+ TODO: check
+CVE-2026-123521 (Vikunja before 2.7.1 contains an improper restriction of
excessive aut ...)
+ TODO: check
+CVE-2026-123520 (Vikunja from 0.18.0 before 2.7.1 contains a privilege
escalation vulne ...)
+ TODO: check
+CVE-2026-123519 (Vikunja before 2.7.1 contains a denial of service
vulnerability that a ...)
+ TODO: check
+CVE-2026-123518 (Vikunja before 2.7.1 contains an incorrect authorization
vulnerability ...)
+ TODO: check
+CVE-2026-123517 (Vikunja before 2.7.1 contains an information disclosure
vulnerability ...)
+ TODO: check
+CVE-2026-123516 (Vikunja before 2.7.1 contains a resource exhaustion
vulnerability in t ...)
+ TODO: check
+CVE-2026-123515 (Vikunja before 2.7.1 contains a client-side request forgery
vulnerabil ...)
+ TODO: check
+CVE-2026-123514 (Vikunja before 2.7.1 contains an improper resource cleanup
vulnerabili ...)
+ TODO: check
+CVE-2026-123513 (Vikunja before 2.7.1 contains a credential exposure
vulnerability that ...)
+ TODO: check
+CVE-2026-123512 (Vikunja before 2.7.1 embeds live password-reset,
email-confirmation an ...)
+ TODO: check
+CVE-2026-123511 (Vikunja before 2.7.1 contains an uncontrolled resource
consumption vul ...)
+ TODO: check
+CVE-2026-123510 (Vikunja before 2.7.1 fails to re-anchor PluginsDir and
LogPath to serv ...)
+ TODO: check
+CVE-2026-123509 (Vikunja before 2.7.1 contains an uncontrolled resource
consumption vul ...)
+ TODO: check
+CVE-2026-123508 (Vikunja before 2.7.1 contains a supply chain vulnerability in
its mage ...)
+ TODO: check
+CVE-2026-123507 (Vikunja from 0.24.0 before 2.7.1 contains a nil pointer
dereference vu ...)
+ TODO: check
+CVE-2026-123506 (Vikunja from 2.2.0 before 2.7.1 contains an authorization
bypass vulne ...)
+ TODO: check
+CVE-2026-123505 (Vikunja before 2.7.1 contains an insecure file permissions
vulnerabili ...)
+ TODO: check
+CVE-2026-123504 (Vikunja from 0.22.0 before 2.7.1 contains an information
disclosure vu ...)
+ TODO: check
+CVE-2026-123503 (Vikunja before 2.7.1 contains an improper authorization
vulnerability ...)
+ TODO: check
+CVE-2026-123502 (Vikunja before 2.7.1 contains an information exposure
vulnerability th ...)
+ TODO: check
+CVE-2026-123501 (Vikunja before 2.7.1 contains an uncontrolled resource
consumption vul ...)
+ TODO: check
+CVE-2026-123500 (Vikunja before 2.7.1 contains an insecure file permissions
vulnerabili ...)
+ TODO: check
+CVE-2026-123499 (Vikunja veans before 2.7.1 contains a credential exposure
vulnerabilit ...)
+ TODO: check
+CVE-2026-123498 (Vikunja veans before 2.7.1 contains a prompt injection
vulnerability t ...)
+ TODO: check
+CVE-2026-123497 (Vikunja veans before 2.7.1 contains a protocol downgrade
vulnerability ...)
+ TODO: check
+CVE-2026-123496 (Vikunja veans before 2.7.1 contains a symlink following
vulnerability ...)
+ TODO: check
+CVE-2026-123495 (Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the
/api/v2 ...)
+ TODO: check
+CVE-2026-123494 (Vikunja before 2.7.1 contains a cross-site request forgery
vulnerabili ...)
+ TODO: check
+CVE-2026-123493 (Vikunja from 2.4.0 before 2.7.1 contains an authentication
bypass vuln ...)
+ TODO: check
+CVE-2026-122085 (The Event Tickets Manager for WooCommerce WordPress plugin
before 1.6. ...)
+ TODO: check
+CVE-2026-122062 (The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay
doneren ...)
+ TODO: check
+CVE-2026-122060 (The WP Recipe Maker WordPress plugin before 10.9.2 does not
check whet ...)
+ TODO: check
+CVE-2026-120531 (The Subscribe2 \u2013 Form, Email Subscribers & Newsletters
plugin for ...)
+ TODO: check
+CVE-2026-114713 (The labeled-response module in UnrealIRCd 6.0.0 before
6.2.7.1 does no ...)
+ TODO: check
+CVE-2026-114432 (The Contact Form 7 WordPress plugin before 6.2.4 does not
validate the ...)
+ TODO: check
+CVE-2026-110963 (The Userplace WordPress plugin through 1.2.0 does not
perform authori ...)
+ TODO: check
+CVE-2026-110132 (The Sync Post With Other Site WordPress plugin before 1.9.4
does not p ...)
+ TODO: check
+CVE-2026-109925 (The Productive Commerce WordPress plugin before 1.1.54 does
not sanit ...)
+ TODO: check
+CVE-2026-106015 (The Ecommerce Affiliate WordPress plugin through 1.0.0 does
not restri ...)
+ TODO: check
+CVE-2026-105970 (The Thanh To\xe1n Qu\xe9t M\xe3 QR Code T\u1ef1
\u0110\u1ed9ng WordPr ...)
+ TODO: check
+CVE-2026-104639 (The Razorpay for WooCommerce WordPress plugin before 4.8.9
does not sa ...)
+ TODO: check
+CVE-2026-104338 (The Razorpay for WooCommerce WordPress plugin before 4.8.9
does not pe ...)
+ TODO: check
+CVE-2026-104337 (The Razorpay for WooCommerce WordPress plugin before 4.8.9
does not ve ...)
+ TODO: check
+CVE-2026-104307 (The BackUpWordPress plugin before 3.15 does not perform a
capability o ...)
+ TODO: check
+CVE-2026-103375 (The Antom Payments WordPress plugin through 2.0.11 does not
perform an ...)
+ TODO: check
+CVE-2026-103303 (The Turisbook Booking System WordPress plugin through 1.3.8
does not h ...)
+ TODO: check
CVE-2026-XXXX [RUSTSEC-2026-0393]
- rust-zstd <not-affected> (Fixed before initial upload to the archive)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0393.html
@@ -54,11 +356,11 @@ CVE-2026-XXXX [GHSA-499w-x7r4-fw7p: TLS certificate
verification disabled by def
- ruby-amq-protocol 2.10.0-1
NOTE:
https://github.com/ruby-amqp/amq-protocol/security/advisories/GHSA-499w-x7r4-fw7p
NOTE: Fixed by:
https://github.com/ruby-amqp/amq-protocol/commit/307f55a1299fb6fbde9ef2bd187bcbe23b7cba22
(v2.10.0)
-CVE-2026-99284 [net: skbuff: propagate shared-frag marker in skb_zerocopy()]
+CVE-2026-99284 (In the Linux kernel, the following vulnerability has been
resolved: n ...)
- linux 7.2.14-1
[trixie] - linux 6.12.115-1
NOTE:
https://git.kernel.org/linus/79dc34beb1fdb3da79753e51e15c68591a2561fe (7.4-rc1)
-CVE-2026-99283 [netfilter: conntrack: tcp: use UNACK timeout for non-closing
RST packets]
+CVE-2026-99283 (In the Linux kernel, the following vulnerability has been
resolved: n ...)
- linux 7.3.3-1
NOTE:
https://git.kernel.org/linus/bf80e6802273a900311b44e47c9b1a59c6d2473c (7.3-rc1)
CVE-2026-XXXX [root-run logrotate postrotate follows symlinks, allows _gvm to
chown arbitrary files]
@@ -2117,6 +2419,7 @@ CVE-2026-76580 (Improper neutralization of input during
web page generation ('cr
CVE-2026-76563 (Improper neutralization of Script-Related HTML tags in a web
page (bas ...)
NOT-FOR-US: Fileorbis
CVE-2026-76181 (LibreOffice includes a dBASE database driver, which reads
dBASE tables ...)
+ {DSA-6615-1}
- libreoffice 4:26.8.1.1-2
NOTE: https://www.libreoffice.org/security/#cve-2026-76181
CVE-2026-76152 (Path traversal and missing authorization check in the
imageCrop and im ...)
@@ -4802,6 +5105,7 @@ CVE-2026-115878 (Stanza is a Stanford NLP Python library
for tokenization, sente
CVE-2026-115779 (Effect is a TypeScript framework that consists of several
packages tha ...)
TODO: check
CVE-2026-115732 (Incorrect authorization in the certificate-name matching of
trapperkee ...)
+ {DSA-6609-1 DLA-4885-1}
- trapperkeeper-authorization-clojure 2.5.0-1
NOTE: https://www.openwall.com/lists/oss-security/2026/11/03/14
NOTE:
https://github.com/OpenVoxProject/trapperkeeper-authorization/security/advisories/GHSA-q4hm-33rc-572g
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/897350a06f25a8390aff9c7a78be568621d7bf03
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/897350a06f25a8390aff9c7a78be568621d7bf03
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
