Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
07ea588a by Salvatore Bonaccorso at 2026-07-12T09:06:31+02:00
Process some NFUs
- - - - -
aa723d58 by Salvatore Bonaccorso at 2026-07-12T09:10:02+02:00
Add CVE-2026-49844/apache-log4j2
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -208,14 +208,14 @@ CVE-2026-55377 (Logto is the modern, open-source auth
infrastructure for SaaS an
CVE-2026-55370 (Logto is the modern, open-source auth infrastructure for SaaS
and AI a ...)
NOT-FOR-US: Logto
CVE-2026-55233 (OpenResty is a high performance web platform. From 1.29.2.1 to
before ...)
- TODO: check
+ NOT-FOR-US: OpenResty
CVE-2026-55229 (Gotenberg is a Docker-powered stateless API for PDF files.
Prior to 8. ...)
NOT-FOR-US: Gotenberg
CVE-2026-55213 (h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and
HTTP/3. Pr ...)
- h2o <removed>
NOTE: https://github.com/h2o/h2o/security/advisories/GHSA-432c-8xmj-frmq
CVE-2026-55187 (Mailpit is an email testing tool and API for developers. Prior
to 1.30 ...)
- TODO: check
+ NOT-FOR-US: Mailpit
CVE-2026-55175 (Spinnaker is an open source, multi-cloud continuous delivery
platform. ...)
NOT-FOR-US: Spinnaker
CVE-2026-54736 (Phalcon is a high-performance, full-stack PHP framework. Prior
to 5.14 ...)
@@ -234,31 +234,34 @@ CVE-2026-52747 (ModSecurity is an open source, cross
platform web application fi
CVE-2026-4661 (The WP CTA \u2013 Sticky CTA Builder, Generate Leads, Promote
Sales pl ...)
NOT-FOR-US: WordPress plugin
CVE-2026-49844 (Improper encoding of non-finite floating-point values during
MapMessag ...)
- TODO: check
+ - apache-log4j2 <unfixed>
+ NOTE: https://logging.apache.org/security.html#CVE-2026-49844
+ NOTE: https://github.com/apache/logging-log4j2/pull/4163
+ NOTE: Fixed by:
https://github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300
(2.x branch)
CVE-2026-49394 (Frappe is a full-stack web application framework. Prior to
16.19.0, au ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-49213 (TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's
shared S ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-48127 (Frappe is a full-stack web application framework. Prior to
16.20.0 and ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-47422 (Frappe is a full-stack web application framework. Prior to
15.107.5 an ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-47199 (Frappe is a full-stack web application framework. Prior to
16.18.3 and ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-45203 (Kernel software installed and running inside a Host VM may
post improp ...)
NOT-FOR-US: Imagination Technologies
CVE-2026-45196 (Kernel software installed and running inside a Host VM may
post improp ...)
NOT-FOR-US: Imagination Technologies
CVE-2026-44795 (Spinnaker is an open source, multi-cloud continuous delivery
platform. ...)
- TODO: check
+ NOT-FOR-US: Spinnaker
CVE-2026-44383 (Multiple connections to the backend using the same charging
station ID ...)
TODO: check
CVE-2026-42952 (Previously, there was no throttling on repeated authentication
attempt ...)
TODO: check
CVE-2026-42219 (Frappe is a full-stack web application framework. Prior to
16.19.0 and ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-41482 (Frappe is a full-stack web application framework. Prior to
16.18.3, po ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-41154 (Software installed and run as a non-privileged user may cause
OOB kern ...)
NOT-FOR-US: Imagination Technologies
CVE-2026-3576 (The Planyo Online Reservation System plugin for WordPress is
vulnerabl ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/7e467275625a13af895355a14c31a3ccc4f71406...aa723d58bc6f7e40d614f9ecc30844f4e0cedb59
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/7e467275625a13af895355a14c31a3ccc4f71406...aa723d58bc6f7e40d614f9ecc30844f4e0cedb59
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
