Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
1f7b7ef8 by security tracker role at 2026-06-26T19:13:48+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,6 +1,448 @@
-CVE-2026-11702
+CVE-2026-9699 (Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0
fail to sa ...)
+ TODO: check
+CVE-2026-9640 (A privilege escalation vulnerability exists in LXD from 6.0
before 6.9 ...)
+ TODO: check
+CVE-2026-9639 (Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD
up to v ...)
+ TODO: check
+CVE-2026-6658 (A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows
for Cro ...)
+ TODO: check
+CVE-2026-5757 (Unauthenticated remote information disclosure vulnerability in
Ollama' ...)
+ TODO: check
+CVE-2026-57940 (HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF)
vulnerabilit ...)
+ TODO: check
+CVE-2026-57926 (In JetBrains YouTrack before 2026.2.16593 the websandbox
bridge was vu ...)
+ TODO: check
+CVE-2026-57925 (In JetBrains YouTrack before 2026.2.16593 improper access
control allo ...)
+ TODO: check
+CVE-2026-57924 (In JetBrains YouTrack before 2026.2.16593 default role
configuration e ...)
+ TODO: check
+CVE-2026-57923 (In JetBrains YouTrack before 2026.2.16593 improper
authorisation in th ...)
+ TODO: check
+CVE-2026-57922 (In JetBrains YouTrack before 2026.2.16593 project settings
disclosure ...)
+ TODO: check
+CVE-2026-57921 (In JetBrains YouTrack before 2026.2.16593 improper access
control allo ...)
+ TODO: check
+CVE-2026-57920 (Peplink InControl 2 through 2.14.2 before 2026-06-03 allows
use of a s ...)
+ TODO: check
+CVE-2026-57918 (libnfs through 6.0.2 before 935b8db has an xid integer
underflow in RE ...)
+ TODO: check
+CVE-2026-57915 (It is possible to bypass the Kerberos pre-authentication check
in Apac ...)
+ TODO: check
+CVE-2026-57914 (By sending a deeply nested ASN1 structure to a Apache Kerby
client or ...)
+ TODO: check
+CVE-2026-57913 (Johnson & Johnson Audit Tracking Management System (ATMS)
before 2026- ...)
+ TODO: check
+CVE-2026-57912 (Johnson & Johnson Campus Recruiting before 2025-10-31 allows
viewing o ...)
+ TODO: check
+CVE-2026-57881 (An unauthenticated stack-based buffer overflow vulnerability
exists in ...)
+ TODO: check
+CVE-2026-57880 (An unauthenticated stack-based buffer overflow vulnerability
exists in ...)
+ TODO: check
+CVE-2026-57879 (An unauthenticated stack-based buffer overflow vulnerability
exists in ...)
+ TODO: check
+CVE-2026-57878 (An unauthenticated stack-based buffer overflow vulnerability
exists in ...)
+ TODO: check
+CVE-2026-57877 (An unauthenticated format string vulnerability exists in vlsvr
in GeoV ...)
+ TODO: check
+CVE-2026-57876 (An unauthenticated out-of-bounds write vulnerability exists in
onvif.c ...)
+ TODO: check
+CVE-2026-57875 (An unauthenticated NULL pointer dereference vulnerability
exists in th ...)
+ TODO: check
+CVE-2026-57874 (An unauthenticated buffer overflow vulnerability exists in
IEEE8021x_u ...)
+ TODO: check
+CVE-2026-57873 (An unauthenticated NULL pointer dereference vulnerability
exists in IE ...)
+ TODO: check
+CVE-2026-57872 (An unauthenticated directory traversal vulnerability exists in
get_fco ...)
+ TODO: check
+CVE-2026-57667 (Sales Representative SQL Injection in Groundhogg <= 4.5
versions.)
+ TODO: check
+CVE-2026-57665 (Unauthenticated Insecure Direct Object References (IDOR) in
GravityVie ...)
+ TODO: check
+CVE-2026-57664 (Unauthenticated Sensitive Data Exposure in Bopo \u2013
WooCommerce Pro ...)
+ TODO: check
+CVE-2026-57663 (Contributor SQL Injection in Recipe Maker For Your Food Blog
from Zip ...)
+ TODO: check
+CVE-2026-57662 (Contributor SQL Injection in Contest Gallery <= 30.0.0
versions.)
+ TODO: check
+CVE-2026-57661 (Subscriber Broken Access Control in WPComplete <= 2.9.5.5
versions.)
+ TODO: check
+CVE-2026-57660 (Unauthenticated Broken Access Control in Booking and Rental
Manager <= ...)
+ TODO: check
+CVE-2026-57659 (Unauthenticated Cross Site Request Forgery (CSRF) in Paid
Memberships ...)
+ TODO: check
+CVE-2026-57658 (Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0
versions ...)
+ TODO: check
+CVE-2026-57657 (Unauthenticated Cross Site Request Forgery (CSRF) in Gmail
SMTP <= 1.2 ...)
+ TODO: check
+CVE-2026-57656 (Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8
versions.)
+ TODO: check
+CVE-2026-57655 (Unauthenticated Cross Site Request Forgery (CSRF) in Child
Theme Wizar ...)
+ TODO: check
+CVE-2026-57654 (Affiliate Broken Access Control in Affiliates Manager <=
2.9.49 versio ...)
+ TODO: check
+CVE-2026-57653 (Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.)
+ TODO: check
+CVE-2026-57652 (Unauthenticated Insecure Direct Object References (IDOR) in JS
Help De ...)
+ TODO: check
+CVE-2026-57651 (Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0
versions.)
+ TODO: check
+CVE-2026-57650 (Contributor Cross Site Scripting (XSS) in Magazine Blocks <=
1.8.3 ver ...)
+ TODO: check
+CVE-2026-57649 (Subscriber Broken Access Control in Shoppable Images Lite <=
1.3 versi ...)
+ TODO: check
+CVE-2026-57648 (Contributor Broken Access Control in Nelio Content <= 4.3.4
versions.)
+ TODO: check
+CVE-2026-57647 (Contributor Local File Inclusion in Panorama Viewer \u2013 360
Degree ...)
+ TODO: check
+CVE-2026-57646 (Subscriber Insecure Direct Object References (IDOR) in
Majestic Suppor ...)
+ TODO: check
+CVE-2026-57645 (newsletters_subscribers Broken Access Control in Newsletters
<= 4.13 v ...)
+ TODO: check
+CVE-2026-57644 (Contributor SQL Injection in Restaurant Menu by MotoPress <=
2.4.10 ve ...)
+ TODO: check
+CVE-2026-57643 (Contributor SQL Injection in WP Post Author <= 3.9.1 versions.)
+ TODO: check
+CVE-2026-57642 (Contributor SQL Injection in Gallery <= 4.7.8 versions.)
+ TODO: check
+CVE-2026-57641 (Unauthenticated Cross Site Request Forgery (CSRF) in Real
Estate 7 <= ...)
+ TODO: check
+CVE-2026-57640 (Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30
versions ...)
+ TODO: check
+CVE-2026-57638 (Contributor Cross Site Scripting (XSS) in Fluent Booking <=
2.1.0 vers ...)
+ TODO: check
+CVE-2026-57637 (Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned
Cart Li ...)
+ TODO: check
+CVE-2026-57636 (Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.)
+ TODO: check
+CVE-2026-57635 (Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit
Payment ...)
+ TODO: check
+CVE-2026-57634 (Contributor Insecure Direct Object References (IDOR) in PPWP
<= 1.9.19 ...)
+ TODO: check
+CVE-2026-57633 (Unauthenticated Sensitive Data Exposure in WCBoost –
Products Co ...)
+ TODO: check
+CVE-2026-57632 (Subscriber Broken Access Control in Email Marketing for
WooCommerce by ...)
+ TODO: check
+CVE-2026-57631 (Administrator SQL Injection in Popup box <= 6.0.1 versions.)
+ TODO: check
+CVE-2026-57630 (Unauthenticated Insecure Direct Object References (IDOR) in
Blocksy Co ...)
+ TODO: check
+CVE-2026-57629 (Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1
version ...)
+ TODO: check
+CVE-2026-57628 (Administrator SQL Injection in WP All Import <= 4.0.1
versions.)
+ TODO: check
+CVE-2026-57627 (Subscriber Server Side Request Forgery (SSRF) in Kirki <=
6.0.11 versi ...)
+ TODO: check
+CVE-2026-57622 (Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.)
+ TODO: check
+CVE-2026-57620 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2026-57618 (Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2
versions.)
+ TODO: check
+CVE-2026-57617 (Contributor Cross Site Scripting (XSS) in SeedProd Pro <
6.19.5 versio ...)
+ TODO: check
+CVE-2026-57527 (Zed Attack Proxy (ZAP) ViewState add-on before version 4
contains an i ...)
+ TODO: check
+CVE-2026-57518 (Pagekit CMS 1.0.18 contains a privilege escalation
vulnerability that ...)
+ TODO: check
+CVE-2026-57473 (A vulnerability exists in the netclient and factory services
of Reolin ...)
+ TODO: check
+CVE-2026-57431 (Author Cross Site Scripting (XSS) in Featured Image <= 2.1
versions.)
+ TODO: check
+CVE-2026-57430 (Contributor Broken Access Control in SEOPress PRO <= 9.1.1
versions.)
+ TODO: check
+CVE-2026-57325 (Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8
versions.)
+ TODO: check
+CVE-2026-57324 (Unauthenticated Broken Access Control in GIFT4U <= 1.0.10
versions.)
+ TODO: check
+CVE-2026-57323 (Unauthenticated Broken Access Control in Flash & HTML5 Video
<= 2.11.0 ...)
+ TODO: check
+CVE-2026-57322 (Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2
versions ...)
+ TODO: check
+CVE-2026-57321 (Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.)
+ TODO: check
+CVE-2026-57319 (Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8
versions.)
+ TODO: check
+CVE-2026-57318 (Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11
versions.)
+ TODO: check
+CVE-2026-57317 (Unauthenticated Cross Site Scripting (XSS) in Simply Schedule
Appointm ...)
+ TODO: check
+CVE-2026-57316 (Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2
versions.)
+ TODO: check
+CVE-2026-57315 (Contributor Remote Code Execution (RCE) in Blocksy Companion
Pro <= 2. ...)
+ TODO: check
+CVE-2026-57314 (Unauthenticated Cross Site Scripting (XSS) in SureCart <=
4.3.2 versio ...)
+ TODO: check
+CVE-2026-57313 (Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2
versions.)
+ TODO: check
+CVE-2026-57312 (Unauthenticated Cross Site Scripting (XSS) in Everest Forms <=
3.4.8 v ...)
+ TODO: check
+CVE-2026-57231 (Podman is a tool for managing OCI containers and pods. From
1.8.1 unti ...)
+ TODO: check
+CVE-2026-56876 (extract-zip does not validate symlink targets when extracting
zip arch ...)
+ TODO: check
+CVE-2026-56823 (AutoGPT is a workflow automation platform for creating,
deploying, and ...)
+ TODO: check
+CVE-2026-56773 (Teable's v2 REST API controller lacks @Permissions metadata on
ORPC en ...)
+ TODO: check
+CVE-2026-56663 (AutoGPT is a workflow automation platform for creating,
deploying, and ...)
+ TODO: check
+CVE-2026-56072 (Unauthenticated Cross Site Scripting (XSS) in WoodMart <=
8.5.3 versio ...)
+ TODO: check
+CVE-2026-56070 (Unauthenticated SQL Injection in Advance Product Search <=
1.4.4 versi ...)
+ TODO: check
+CVE-2026-56069 (Unauthenticated Insecure Direct Object References (IDOR) in
Toolset Fo ...)
+ TODO: check
+CVE-2026-56068 (Unauthenticated SQL Injection in JetEngine <= 3.8.10.2
versions.)
+ TODO: check
+CVE-2026-56067 (Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3
versions.)
+ TODO: check
+CVE-2026-56066 (Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive
Images ...)
+ TODO: check
+CVE-2026-56064 (Subscriber SQL Injection in Tourfic <= 2.22.5 versions.)
+ TODO: check
+CVE-2026-56063 (Unauthenticated Broken Access Control in MailChimp Block <=
1.1.15 ver ...)
+ TODO: check
+CVE-2026-56062 (Unauthenticated SQL Injection in Quotes llama <= 3.1.5
versions.)
+ TODO: check
+CVE-2026-56061 (Unauthenticated Broken Access Control in Subscriptions for
WooCommerce ...)
+ TODO: check
+CVE-2026-56060 (Unauthenticated Sensitive Data Exposure in Print Invoice &
Delivery No ...)
+ TODO: check
+CVE-2026-56059 (Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5
versions.)
+ TODO: check
+CVE-2026-56058 (Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.)
+ TODO: check
+CVE-2026-56057 (Subscriber PHP Object Injection in Uncanny Automator Pro <=
7.3.0.6 ve ...)
+ TODO: check
+CVE-2026-56055 (Subscriber PHP Object Injection in RealHomes <= 4.5.3
versions.)
+ TODO: check
+CVE-2026-56048 (Unauthenticated Insecure Direct Object References (IDOR) in
Payment Ga ...)
+ TODO: check
+CVE-2026-56047 (Unauthenticated Cross Site Scripting (XSS) in perfmatters <=
2.6.3 ver ...)
+ TODO: check
+CVE-2026-56046 (Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11
versions ...)
+ TODO: check
+CVE-2026-56045 (Unauthenticated Cross Site Scripting (XSS) in Automatic <
3.135.1 vers ...)
+ TODO: check
+CVE-2026-56044 (Unauthenticated Cross Site Scripting (XSS) in Blog2Social <=
8.9.2 ver ...)
+ TODO: check
+CVE-2026-56043 (Unauthenticated Cross Site Scripting (XSS) in Customer Reviews
for Woo ...)
+ TODO: check
+CVE-2026-56041 (Unauthenticated Cross Site Scripting (XSS) in Responsive
Lightbox <= 2 ...)
+ TODO: check
+CVE-2026-56040 (Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form
<= 2.4.7 ...)
+ TODO: check
+CVE-2026-56039 (Unauthenticated Cross Site Scripting (XSS) in Quick Interest
Slider <= ...)
+ TODO: check
+CVE-2026-56038 (Contributor Privilege Escalation in Frisbii Pay <= 1.8.2
versions.)
+ TODO: check
+CVE-2026-56036 (Unauthenticated SQL Injection in
\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0 ...)
+ TODO: check
+CVE-2026-56035 (Unauthenticated Multiple Vulnerabilities in BitFire Security
<= 5.0.3 ...)
+ TODO: check
+CVE-2026-56034 (Unauthenticated SQL Injection in Library Management System <=
3.5.7 ve ...)
+ TODO: check
+CVE-2026-56033 (Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4
versions.)
+ TODO: check
+CVE-2026-56032 (Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4
version ...)
+ TODO: check
+CVE-2026-56031 (Unauthenticated PHP Object Injection in Uncanny Automator <=
7.3.1.2 v ...)
+ TODO: check
+CVE-2026-56030 (Unauthenticated Privilege Escalation in Paytium <= 5.0.2
versions.)
+ TODO: check
+CVE-2026-56029 (Unauthenticated Broken Authentication in CorvusPay WooCommerce
Payment ...)
+ TODO: check
+CVE-2026-56028 (Unauthenticated Privilege Escalation in Easy Elements for
Elementor &# ...)
+ TODO: check
+CVE-2026-56027 (Customer Arbitrary File Upload in Booster for WooCommerce <=
8.0.1 ver ...)
+ TODO: check
+CVE-2026-56026 (Subscriber Server Side Request Forgery (SSRF) in utm.codes <=
1.9.0 ve ...)
+ TODO: check
+CVE-2026-56025 (Unauthenticated Broken Access Control in Paymob for
WooCommerce <= 4.1 ...)
+ TODO: check
+CVE-2026-56011 (Unauthenticated Cross Site Scripting (XSS) in MapPress Maps
for WordPr ...)
+ TODO: check
+CVE-2026-56010 (Subscriber Privilege Escalation in Abandoned Cart Pro for
WooCommerce ...)
+ TODO: check
+CVE-2026-56008 (Contributor Privilege Escalation in Fusion Builder <= 3.15.4
versions.)
+ TODO: check
+CVE-2026-55686 (Podman is a tool for managing OCI containers and pods. From
3.0.0 unti ...)
+ TODO: check
+CVE-2026-55677 (Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's
router a ...)
+ TODO: check
+CVE-2026-55448 (mise manages dev tools like node, python, cmake, and
terraform. From 2 ...)
+ TODO: check
+CVE-2026-55441 (mise manages dev tools like node, python, cmake, and
terraform. Prior ...)
+ TODO: check
+CVE-2026-54847 (Unauthenticated Broken Access Control in Stylish Cost
Calculator <= 8. ...)
+ TODO: check
+CVE-2026-54846 (Unauthenticated Broken Access Control in Syncee Premium
Dropshipping & ...)
+ TODO: check
+CVE-2026-54840 (Unauthenticated Broken Access Control in Newsletters <= 4.13
versions.)
+ TODO: check
+CVE-2026-54839 (Unauthenticated Sensitive Data Exposure in Trinity Backup
– Back ...)
+ TODO: check
+CVE-2026-54837 (Unauthenticated Broken Access Control in Intranet &
Private Site & ...)
+ TODO: check
+CVE-2026-54835 (Unauthenticated Broken Access Control in Five Star Restaurant
Menu <= ...)
+ TODO: check
+CVE-2026-54834 (Unauthenticated Sensitive Data Exposure in Object Cache 4
everyone <= ...)
+ TODO: check
+CVE-2026-54833 (Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions.)
+ TODO: check
+CVE-2026-54832 (Unauthenticated Broken Access Control in Gutenverse Companion
<= 2.5.0 ...)
+ TODO: check
+CVE-2026-54831 (Unauthenticated SQL Injection in GeoDirectory <= 2.8.162
versions.)
+ TODO: check
+CVE-2026-54827 (Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9
versions.)
+ TODO: check
+CVE-2026-54826 (Subscriber Insecure Direct Object References (IDOR) in
SupportCandy <= ...)
+ TODO: check
+CVE-2026-54825 (Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.)
+ TODO: check
+CVE-2026-54824 (Unauthenticated Sensitive Data Exposure in Ads by WPQuads <=
3.0.3 ver ...)
+ TODO: check
+CVE-2026-54820 (Unauthenticated SQL Injection in JetBooking <= 4.0.4.1
versions.)
+ TODO: check
+CVE-2026-54753 (Nx is a monorepo solution for TypeScript and polyglot
codebases. From ...)
+ TODO: check
+CVE-2026-54636 (Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron
plugin utili ...)
+ TODO: check
+CVE-2026-54557 (mise manages dev tools like node, python, cmake, and
terraform. Prior ...)
+ TODO: check
+CVE-2026-54341 (Dragonfly is an in-memory data store built for modern
application work ...)
+ TODO: check
+CVE-2026-53914 (In JetBrains Kotlin before 2.4.20 code execution was possible
via unsa ...)
+ TODO: check
+CVE-2026-52701 (Unauthenticated Broken Access Control in User Registration <=
5.2.2 ve ...)
+ TODO: check
+CVE-2026-4339 (Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3,
11.5.x <= 1 ...)
+ TODO: check
+CVE-2026-49486 (The Apache Airflow FTP provider's `FTPSHook.get_conn()`
created an `ft ...)
+ TODO: check
+CVE-2026-48743 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-48706 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-48529 (GitHub MCP Server is GitHub's official MCP Server. From 0.22.0
until 1 ...)
+ TODO: check
+CVE-2026-48497 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-48090 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-48044 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-48042 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-47778 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-47775 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-47692 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-47221 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-47220 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-47214 (Docling simplifies document processing by parsing diverse
formats and ...)
+ TODO: check
+CVE-2026-47207 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-47206 (Dragonfly is an in-memory data store built for modern
application work ...)
+ TODO: check
+CVE-2026-47205 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-47204 (Envoy is an open source edge and service proxy designed for
cloud-nati ...)
+ TODO: check
+CVE-2026-45408 (Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name
validati ...)
+ TODO: check
+CVE-2026-45407 (Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth
command ...)
+ TODO: check
+CVE-2026-45406 (Dokku is a docker-powered PaaS. Prior to 0.38.2, the
openresty-vhosts ...)
+ TODO: check
+CVE-2026-45405 (Dokku is a docker-powered PaaS. Prior to 0.38.2, the
git:from-archive ...)
+ TODO: check
+CVE-2026-45257 (The KTLS receive path decrypted each record in place, assuming
that th ...)
+ TODO: check
+CVE-2026-45256 (When used to deliver a signal to a specific thread,
thr_kill2(2) calle ...)
+ TODO: check
+CVE-2026-45195 (Kernel software installed and running inside a Host VM may
post improp ...)
+ TODO: check
+CVE-2026-44018 (Docling simplifies document processing by parsing diverse
formats and ...)
+ TODO: check
+CVE-2026-40711 (Dell Dell Container Storage Modules, version(s) csi-powerstore
v2.16.0 ...)
+ TODO: check
+CVE-2026-3472 (Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3,
11.5.x <= 1 ...)
+ TODO: check
+CVE-2026-33646 (mise manages dev tools like node, python, cmake, and
terraform. Prior ...)
+ TODO: check
+CVE-2026-30041 (An integer overflow in the PSD parser compnent of FastStone
Image View ...)
+ TODO: check
+CVE-2026-30040 (A heap overflow in the FSViewer.exe process of FastStone Image
Viewer ...)
+ TODO: check
+CVE-2026-2053 (The WSO2 API Manager's message flow component, when processing
WS-Addr ...)
+ TODO: check
+CVE-2026-28385 (In Canonical LXD versions 4.12 through 6.9, a Server-Side
Request Forg ...)
+ TODO: check
+CVE-2026-24547 (Unauthenticated Broken Access Control in SiteGround Email
Marketing <= ...)
+ TODO: check
+CVE-2026-21734 (A web page that contains unusual GPU shader code is loaded
into the GP ...)
+ TODO: check
+CVE-2026-1869 (The User Registration & Membership \u2013 Free & Paid
Memberships, Sub ...)
+ TODO: check
+CVE-2026-13434 (A flaw was found in KubeVirt's network annotation generator.
When a te ...)
+ TODO: check
+CVE-2026-13426 (The Mattermost Go module
github.com/mattermost/mattermost/server/publi ...)
+ TODO: check
+CVE-2026-13372 (Incorrect link resolution by display name in the custom
PowerShell VPN ...)
+ TODO: check
+CVE-2026-13325 (A flaw was found in KubeVirt's migration proxy. When
spec.configuratio ...)
+ TODO: check
+CVE-2026-12411 (Broken Access Control in the devLXDInstancePatchHandler
component of C ...)
+ TODO: check
+CVE-2026-11779 (An Improper Authorization vulnerability exists in PayloadCMS
version 3 ...)
+ TODO: check
+CVE-2026-0828 (Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint
client x ...)
+ TODO: check
+CVE-2026-0685 (Server side template inject (SSTI) in the expression evaluation
compon ...)
+ TODO: check
+CVE-2025-7958 (A Code Injection vulnerability existed in Trellix Network
Security CM ...)
+ TODO: check
+CVE-2025-68075 (Contributor Cross Site Scripting (XSS) in BNE Testimonials <=
2.0.8 ve ...)
+ TODO: check
+CVE-2025-68074 (Contributor Cross Site Scripting (XSS) in Image Carousel <=
1.0.0.41 v ...)
+ TODO: check
+CVE-2025-68064 (Contributor Local File Inclusion in Goya Core < 1.0.9.4
versions.)
+ TODO: check
+CVE-2025-68063 (Contributor Local File Inclusion in Splash - Sport Club
WordPress Them ...)
+ TODO: check
+CVE-2025-68052 (Unauthenticated Cross Site Request Forgery (CSRF) in Eagle
Booking <= ...)
+ TODO: check
+CVE-2025-66123 (Unauthenticated Insecure Direct Object References (IDOR) in
BookPro <= ...)
+ TODO: check
+CVE-2025-64637 (Unauthenticated Content Injection in Auros Core <= 5.3.1
versions.)
+ TODO: check
+CVE-2025-64636 (Unauthenticated Broken Access Control in Donation Thermometer
<= 2.2.7 ...)
+ TODO: check
+CVE-2025-64152 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
+ TODO: check
+CVE-2025-63079 (Contributor Broken Access Control in Live Copy Paste for
Elementor <= ...)
+ TODO: check
+CVE-2025-63078 (Subscriber Broken Access Control in Restaurant Menu by
MotoPress <= 2. ...)
+ TODO: check
+CVE-2025-63041 (Contributor Broken Access Control in Forget About Shortcode
Buttons <= ...)
+ TODO: check
+CVE-2025-55017 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
+ TODO: check
+CVE-2025-32423 (AutoGPT is a workflow automation platform for creating,
deploying, and ...)
+ TODO: check
+CVE-2025-32394 (AutoGPT is a workflow automation platform for creating,
deploying, and ...)
+ TODO: check
+CVE-2025-11919 (The default JVM can access files and directories under `/tmp/`
includi ...)
+ TODO: check
+CVE-2026-11702 (Bytes::Random::Secure::Tiny versions through 1.011 for Perl
share inte ...)
NOT-FOR-US: Bytes::Random::Secure::Tiny Perl module
-CVE-2026-11625
+CVE-2026-11625 (Bytes::Random::Secure versions through 0.29 for Perl share
internal st ...)
- libbytes-random-secure-perl 0.29-4
[trixie] - libbytes-random-secure-perl <no-dsa> (Minor issue; will be
fixed via point release)
[bookworm] - libbytes-random-secure-perl <no-dsa> (Minor issue; will be
fixed via point release)
@@ -196,7 +638,7 @@ CVE-2026-10512 (The X25519 x86_64 assembly implementation
fails to clear the mos
TODO: check
CVE-2026-10098 (OCSP CertID serial-number length-confusion in
wolfSSL_OCSP_resp_find_s ...)
TODO: check
-CVE-2026-10097 (ML-KEM-1024 x64 AVX2 implicit rejection failure in the
Fujisaki-Okamot ...)
+CVE-2026-10097 (wolfSSL's AVX2-optimized ML-KEM implementation
(mlkem_cmp_avx2) compar ...)
TODO: check
CVE-2025-71340 (picklescan through 0.0.26 fails to detect malicious pickle
files that ...)
TODO: check
@@ -29420,7 +29862,7 @@ CVE-2026-44432 (urllib3 is an HTTP client library for
Python. From 2.6.0 to befo
NOTE:
https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j
NOTE: Fixed by:
https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a
(2.7.0)
CVE-2026-44431 (urllib3 is an HTTP client library for Python. From 1.23 to
before 2.7. ...)
- {DSA-6363-1}
+ {DSA-6363-1 DLA-4651-1}
- python-urllib3 <unfixed> (bug #1136653)
NOTE:
https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc
NOTE: Fixed by:
https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc
(2.7.0)
@@ -30663,7 +31105,7 @@ CVE-2026-44411 (A vulnerability has been identified in
Solid Edge SE2026 (All ve
NOT-FOR-US: Siemens
CVE-2026-44343 (WGDashboard is a dashboard for WireGuard VPN. Prior to 4.3.2,
there ar ...)
NOT-FOR-US: WGDashboard
-CVE-2026-44279 (A improper export of android application components
vulnerability in F ...)
+CVE-2026-44279 (An improper export of android application components
vulnerability in ...)
NOT-FOR-US: Fortinet
CVE-2026-44278 (A use of hard-coded cryptographic key vulnerability in
Fortinet FortiC ...)
NOT-FOR-US: Fortinet
@@ -46914,7 +47356,7 @@ CVE-2026-23776 (Dell PowerProtect Data Domain with Data
Domain Operating System
NOT-FOR-US: Dell / EMC
CVE-2026-23775 (Dell PowerProtect Data Domain appliances with Data Domain
Operating Sy ...)
NOT-FOR-US: Dell / EMC
-CVE-2026-21733 (Vulnerability in Imagination Technologies Graphics DDK on
Linux, Andro ...)
+CVE-2026-21733 (Software installed and run as a non-privileged user may
conduct improp ...)
NOT-FOR-US: Imagination Technologies
CVE-2026-21709 (A vulnerability allowing a local attacker with administrator
privilege ...)
NOT-FOR-US: Veeam
@@ -402610,8 +403052,7 @@ CVE-2023-20574
RESERVED
CVE-2023-20573 (A privileged attacker can prevent delivery of debug exceptions
to SEV- ...)
NOT-FOR-US: AMD
-CVE-2023-20572
- RESERVED
+CVE-2023-20572 (An observable timing discrepancy in the ASP could allow a
privileged a ...)
NOT-FOR-US: AMD
CVE-2023-20571 (A race condition in System Management Mode (SMM) code may
allow an att ...)
NOT-FOR-US: AMD
@@ -402695,8 +403136,7 @@ CVE-2023-20542
RESERVED
CVE-2023-20541
RESERVED
-CVE-2023-20540
- RESERVED
+CVE-2023-20540 (An observable timing discrepancy in the ASP could allow a
privileged a ...)
NOT-FOR-US: AMD
CVE-2023-20539
RESERVED
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1f7b7ef8fd7688272960f3d1839381f40fca9482
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1f7b7ef8fd7688272960f3d1839381f40fca9482
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
