{"cves":[{"id":"CVE-2025-61634","published":"2026-02-03T00:16:00","updated_at":"2026-07-10T19:14:18.574777+00:00","description":"\nVulnerability in Wikimedia Foundation MediaWiki. This vulnerability is\nassociated with program files includes/Rest/Handler/PageHTMLHandler.Php.\nThis issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/RE:M/U:Green","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":0.0,"baseSeverity":"NONE"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-61634","https://phabricator.wikimedia.org/T387478","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1153370"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-1767","published":"2026-02-03T00:00:00","updated_at":"2026-06-25T15:33:31.583499+00:00","description":"\nA flaw was found in the GNOME localsearch (previously known as\ntracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote\nattacker could exploit this heap buffer overflow vulnerability by providing\na specially crafted MP3 file containing malformed ID3 tags. This incorrect\nlength calculation during the parsing of performer tags can lead to a read\nbeyond the allocated buffer, potentially causing a Denial of Service (DoS)\ndue to a crash or enabling information disclosure.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.6,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.6,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-1767","https://ubuntu.com/security/notices/USN-8019-1"],"bugs":["https://gitlab.gnome.org/GNOME/localsearch/-/issues/429"],"patches":{"localsearch":["upstream: https://gitlab.gnome.org/GNOME/localsearch/-/commit/2897ca48b7ae79db7dcfe7e66cdd5d75cb641466"],"tracker-miners":["upstream: https://gitlab.gnome.org/GNOME/localsearch/-/commit/2897ca48b7ae79db7dcfe7e66cdd5d75cb641466"]},"tags":{},"packages":[{"name":"localsearch","source":"https://ubuntu.com/security/cve?package=localsearch","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=localsearch","debian":"https://tracker.debian.org/pkg/localsearch","statuses":[{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.11","component":null,"pocket":"security"}]},{"name":"tracker-miners","source":"https://ubuntu.com/security/cve?package=tracker-miners","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tracker-miners","debian":"https://tracker.debian.org/pkg/tracker-miners","statuses":[{"release_codename":"upstream","status":"released","description":"3.11","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"3.3.3-0ubuntu0.20.04.4","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"3.7.1-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"3.8.2-4ubuntu2.1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]}],"notices_ids":["USN-8019-1"],"notices":[{"id":"USN-8019-1","title":"tracker-miners vulnerabilities","summary":"tracker-miners could be made to crash or run programs as your login if it\nopened a specially crafted file.","instructions":"After a standard system update you need to restart your session to make all\nthe necessary changes.","references":[],"published":"2026-02-05T14:47:57.232150","description":"Fatih Çelik discovered that tracker-miners incorrectly handled certain\nmalformed MP3 files. An attacker could use this issue to cause\ntracker-miners to crash, resulting in a denial of service, or possibly\nexecute arbitrary code.","is_hidden":false,"release_packages":{"jammy":[{"name":"tracker-miners","version":"3.3.3-0ubuntu0.20.04.4","description":"Metadata database, indexer and search tool","is_source":true},{"name":"tracker-extract","version":"3.3.3-0ubuntu0.20.04.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.3.3-0ubuntu0.20.04.4","pocket":"security"},{"name":"tracker-miner-fs","version":"3.3.3-0ubuntu0.20.04.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.3.3-0ubuntu0.20.04.4","pocket":"security"}],"noble":[{"name":"tracker-miners","version":"3.7.1-1ubuntu0.1","description":"Metadata database, indexer and search tool","is_source":true},{"name":"tracker-extract","version":"3.7.1-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.7.1-1ubuntu0.1","pocket":"security"},{"name":"tracker-miner-fs","version":"3.7.1-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.7.1-1ubuntu0.1","pocket":"security"}],"questing":[{"name":"tracker-miners","version":"3.8.2-4ubuntu2.1","description":"Metadata database, indexer and search tool","is_source":true},{"name":"tracker-extract","version":"3.8.2-4ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.8.2-4ubuntu2.1","pocket":"security"},{"name":"tracker-miner-fs","version":"3.8.2-4ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.8.2-4ubuntu2.1","pocket":"security"},{"name":"tracker-test-utils","version":"3.8.2-4ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.8.2-4ubuntu2.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2026-1764","CVE-2026-1767","CVE-2026-1766","CVE-2026-1765"]}]},{"id":"CVE-2026-1766","published":"2026-02-03T00:00:00","updated_at":"2026-06-25T15:23:46.249453+00:00","description":"\nA flaw was found in GNOME localsearch (previously known as tracker-miners)\nMP3 Extractor, specifically within the tracker-extract-mp3 component. This\nheap buffer overflow vulnerability occurs when processing specially crafted\nMP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker\ncould exploit this by providing a malicious MP3 file, leading to a denial\nof service (DoS), which causes an application crash, and potentially\ndisclosing sensitive information from the heap memory.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.6,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.6,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-1766","https://ubuntu.com/security/notices/USN-8019-1"],"bugs":["https://gitlab.gnome.org/GNOME/localsearch/-/issues/428"],"patches":{"localsearch":["upstream: https://gitlab.gnome.org/GNOME/localsearch/-/commit/efb4aa19ec8e4ec172457deea10ebb9a1a3147f1","upstream: https://gitlab.gnome.org/GNOME/localsearch/-/commit/9cc562cc126c408efb2a8220fcd67f006902412c"],"tracker-miners":[]},"tags":{},"packages":[{"name":"localsearch","source":"https://ubuntu.com/security/cve?package=localsearch","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=localsearch","debian":"https://tracker.debian.org/pkg/localsearch","statuses":[{"release_codename":"resolute","status":"not-affected","description":"3.8.2-12","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.11","component":null,"pocket":"security"}]},{"name":"tracker-miners","source":"https://ubuntu.com/security/cve?package=tracker-miners","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tracker-miners","debian":"https://tracker.debian.org/pkg/tracker-miners","statuses":[{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"3.3.3-0ubuntu0.20.04.4","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"3.7.1-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.11","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"3.8.2-4ubuntu2.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-8019-1"],"notices":[{"id":"USN-8019-1","title":"tracker-miners vulnerabilities","summary":"tracker-miners could be made to crash or run programs as your login if it\nopened a specially crafted file.","instructions":"After a standard system update you need to restart your session to make all\nthe necessary changes.","references":[],"published":"2026-02-05T14:47:57.232150","description":"Fatih Çelik discovered that tracker-miners incorrectly handled certain\nmalformed MP3 files. An attacker could use this issue to cause\ntracker-miners to crash, resulting in a denial of service, or possibly\nexecute arbitrary code.","is_hidden":false,"release_packages":{"jammy":[{"name":"tracker-miners","version":"3.3.3-0ubuntu0.20.04.4","description":"Metadata database, indexer and search tool","is_source":true},{"name":"tracker-extract","version":"3.3.3-0ubuntu0.20.04.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.3.3-0ubuntu0.20.04.4","pocket":"security"},{"name":"tracker-miner-fs","version":"3.3.3-0ubuntu0.20.04.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.3.3-0ubuntu0.20.04.4","pocket":"security"}],"noble":[{"name":"tracker-miners","version":"3.7.1-1ubuntu0.1","description":"Metadata database, indexer and search tool","is_source":true},{"name":"tracker-extract","version":"3.7.1-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.7.1-1ubuntu0.1","pocket":"security"},{"name":"tracker-miner-fs","version":"3.7.1-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.7.1-1ubuntu0.1","pocket":"security"}],"questing":[{"name":"tracker-miners","version":"3.8.2-4ubuntu2.1","description":"Metadata database, indexer and search tool","is_source":true},{"name":"tracker-extract","version":"3.8.2-4ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.8.2-4ubuntu2.1","pocket":"security"},{"name":"tracker-miner-fs","version":"3.8.2-4ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.8.2-4ubuntu2.1","pocket":"security"},{"name":"tracker-test-utils","version":"3.8.2-4ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.8.2-4ubuntu2.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2026-1764","CVE-2026-1767","CVE-2026-1766","CVE-2026-1765"]}]},{"id":"CVE-2026-1765","published":"2026-02-03T00:00:00","updated_at":"2026-06-26T07:31:11.857586+00:00","description":"\nA flaw was found in the `tracker-extract-mp3` component of GNOME\nlocalsearch (previously known as tracker-miners). This vulnerability, a\nheap buffer overflow, occurs when processing specially crafted MP3 files. A\nremote attacker could exploit this by providing a malicious MP3 file,\nleading to a Denial of Service (DoS) where the application crashes. It may\nalso potentially expose sensitive information from the system's memory.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.6,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.6,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-1765","https://ubuntu.com/security/notices/USN-8019-1"],"bugs":["https://gitlab.gnome.org/GNOME/localsearch/-/issues/427"],"patches":{"localsearch":["upstream: https://gitlab.gnome.org/GNOME/localsearch/-/commit/79f47309bad068ff0c19c1431abab6766edc687f"],"tracker-miners":[]},"tags":{},"packages":[{"name":"localsearch","source":"https://ubuntu.com/security/cve?package=localsearch","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=localsearch","debian":"https://tracker.debian.org/pkg/localsearch","statuses":[{"release_codename":"resolute","status":"not-affected","description":"3.8.2-12","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.11","component":null,"pocket":"security"}]},{"name":"tracker-miners","source":"https://ubuntu.com/security/cve?package=tracker-miners","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tracker-miners","debian":"https://tracker.debian.org/pkg/tracker-miners","statuses":[{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"3.3.3-0ubuntu0.20.04.4","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"3.7.1-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"3.8.2-4ubuntu2.1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.11","component":null,"pocket":"security"}]}],"notices_ids":["USN-8019-1"],"notices":[{"id":"USN-8019-1","title":"tracker-miners vulnerabilities","summary":"tracker-miners could be made to crash or run programs as your login if it\nopened a specially crafted file.","instructions":"After a standard system update you need to restart your session to make all\nthe necessary changes.","references":[],"published":"2026-02-05T14:47:57.232150","description":"Fatih Çelik discovered that tracker-miners incorrectly handled certain\nmalformed MP3 files. An attacker could use this issue to cause\ntracker-miners to crash, resulting in a denial of service, or possibly\nexecute arbitrary code.","is_hidden":false,"release_packages":{"jammy":[{"name":"tracker-miners","version":"3.3.3-0ubuntu0.20.04.4","description":"Metadata database, indexer and search tool","is_source":true},{"name":"tracker-extract","version":"3.3.3-0ubuntu0.20.04.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.3.3-0ubuntu0.20.04.4","pocket":"security"},{"name":"tracker-miner-fs","version":"3.3.3-0ubuntu0.20.04.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.3.3-0ubuntu0.20.04.4","pocket":"security"}],"noble":[{"name":"tracker-miners","version":"3.7.1-1ubuntu0.1","description":"Metadata database, indexer and search tool","is_source":true},{"name":"tracker-extract","version":"3.7.1-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.7.1-1ubuntu0.1","pocket":"security"},{"name":"tracker-miner-fs","version":"3.7.1-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.7.1-1ubuntu0.1","pocket":"security"}],"questing":[{"name":"tracker-miners","version":"3.8.2-4ubuntu2.1","description":"Metadata database, indexer and search tool","is_source":true},{"name":"tracker-extract","version":"3.8.2-4ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.8.2-4ubuntu2.1","pocket":"security"},{"name":"tracker-miner-fs","version":"3.8.2-4ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.8.2-4ubuntu2.1","pocket":"security"},{"name":"tracker-test-utils","version":"3.8.2-4ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.8.2-4ubuntu2.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2026-1764","CVE-2026-1767","CVE-2026-1766","CVE-2026-1765"]}]},{"id":"CVE-2026-1764","published":"2026-02-03T00:00:00","updated_at":"2026-06-26T07:31:11.857586+00:00","description":"\nA flaw was found in GNOME localsearch (previously known as tracker-miners)\nMP3 Extractor. When processing specially crafted MP3 files containing\nID3v2.4 tags, a missing bounds check in the `extract_performers_tags`\nfunction can lead to a heap buffer overflow. This vulnerability allows a\nremote attacker to cause a Denial of Service (DoS) by triggering a read of\nunmapped memory. In some cases, it could also lead to information\ndisclosure by reading visible heap data.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"There is another commit that didn't get a CVE but should be\nadded to updates:\nhttps://gitlab.gnome.org/GNOME/localsearch/-/issues/426\nhttps://gitlab.gnome.org/GNOME/localsearch/-/commit/2da6a9442f09b2d83e5c508a4161a6aa586c5598"}],"codename":null,"priority":"medium","cvss3":5.6,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.6,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-1764","https://ubuntu.com/security/notices/USN-8019-1"],"bugs":["https://gitlab.gnome.org/GNOME/localsearch/-/issues/425"],"patches":{"localsearch":["upstream: https://gitlab.gnome.org/GNOME/localsearch/-/commit/5337e2977f159c29e2b8af575e56866862af241b"],"tracker-miners":["upstream: https://gitlab.gnome.org/GNOME/localsearch/-/commit/5337e2977f159c29e2b8af575e56866862af241b"]},"tags":{},"packages":[{"name":"localsearch","source":"https://ubuntu.com/security/cve?package=localsearch","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=localsearch","debian":"https://tracker.debian.org/pkg/localsearch","statuses":[{"release_codename":"resolute","status":"not-affected","description":"3.8.2-12","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.11","component":null,"pocket":"security"}]},{"name":"tracker-miners","source":"https://ubuntu.com/security/cve?package=tracker-miners","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tracker-miners","debian":"https://tracker.debian.org/pkg/tracker-miners","statuses":[{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.11","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"3.3.3-0ubuntu0.20.04.4","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"3.7.1-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"3.8.2-4ubuntu2.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-8019-1"],"notices":[{"id":"USN-8019-1","title":"tracker-miners vulnerabilities","summary":"tracker-miners could be made to crash or run programs as your login if it\nopened a specially crafted file.","instructions":"After a standard system update you need to restart your session to make all\nthe necessary changes.","references":[],"published":"2026-02-05T14:47:57.232150","description":"Fatih Çelik discovered that tracker-miners incorrectly handled certain\nmalformed MP3 files. An attacker could use this issue to cause\ntracker-miners to crash, resulting in a denial of service, or possibly\nexecute arbitrary code.","is_hidden":false,"release_packages":{"jammy":[{"name":"tracker-miners","version":"3.3.3-0ubuntu0.20.04.4","description":"Metadata database, indexer and search tool","is_source":true},{"name":"tracker-extract","version":"3.3.3-0ubuntu0.20.04.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.3.3-0ubuntu0.20.04.4","pocket":"security"},{"name":"tracker-miner-fs","version":"3.3.3-0ubuntu0.20.04.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.3.3-0ubuntu0.20.04.4","pocket":"security"}],"noble":[{"name":"tracker-miners","version":"3.7.1-1ubuntu0.1","description":"Metadata database, indexer and search tool","is_source":true},{"name":"tracker-extract","version":"3.7.1-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.7.1-1ubuntu0.1","pocket":"security"},{"name":"tracker-miner-fs","version":"3.7.1-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.7.1-1ubuntu0.1","pocket":"security"}],"questing":[{"name":"tracker-miners","version":"3.8.2-4ubuntu2.1","description":"Metadata database, indexer and search tool","is_source":true},{"name":"tracker-extract","version":"3.8.2-4ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.8.2-4ubuntu2.1","pocket":"security"},{"name":"tracker-miner-fs","version":"3.8.2-4ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.8.2-4ubuntu2.1","pocket":"security"},{"name":"tracker-test-utils","version":"3.8.2-4ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tracker-miners","version_link":"https://launchpad.net/ubuntu/+source/tracker-miners/3.8.2-4ubuntu2.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2026-1764","CVE-2026-1767","CVE-2026-1766","CVE-2026-1765"]}]},{"id":"CVE-2025-61644","published":"2026-02-03T00:00:00","updated_at":"2026-07-10T19:14:18.574777+00:00","description":"\nImproper Neutralization of Input During Web Page Generation (XSS or\n'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.\nThis vulnerability is associated with program files\nresources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js.\nThis issue affects MediaWiki: from * before >\nfb856ce9cf121e046305116852cca4899ecb48ca.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":{"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":0.0,"baseSeverity":"NONE"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-61644","https://phabricator.wikimedia.org/T403411"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-24051","published":"2026-02-02T23:16:00","updated_at":"2026-02-04T13:25:00.590112+00:00","description":"\nOpenTelemetry-Go is the Go implementation of OpenTelemetry. The\nOpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path\nHijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource\ndetection code in sdk/resource/host_id.go executes the ioreg system command\nusing a search path. An attacker with the ability to locally modify the\nPATH environment variable can achieve Arbitrary Code Execution (ACE) within\nthe context of the application. A fix was released with v1.40.0.","ubuntu_description":"","notes":[{"author":"","note":"Priority reason:\nallenpthuang> affects only macOS."}],"codename":null,"priority":"negligible","cvss3":7.0,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-24051","https://github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-9h8m-3fm2-qjrq"],"bugs":[""],"patches":{"golang-opentelemetry-otel":[]},"tags":{},"packages":[{"name":"golang-opentelemetry-otel","source":"https://ubuntu.com/security/cve?package=golang-opentelemetry-otel","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=golang-opentelemetry-otel","debian":"https://tracker.debian.org/pkg/golang-opentelemetry-otel","statuses":[{"release_codename":"jammy","status":"not-affected","description":"macOS only","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"macOS only","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"macOS only","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2025-6927","published":"2026-02-02T23:16:00","updated_at":"2026-07-10T19:24:56.204695+00:00","description":"\nVulnerability in Wikimedia Foundation MediaWiki. This vulnerability is\nassociated with program files includes/specials/pagers/BlockListPager.Php,\nincludes/api/ApiQueryBlocks.Php.\nThis issue affects MediaWiki: from >= 1.42.0 before 1.39.13, 1.42.7 1.43.2,\n1.44.0.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":{"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":2.3,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-6927","https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/TT45WDZ7MDTXXBEFLBMLAJI532O2PN2U/","https://phabricator.wikimedia.org/T397595","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165118 (master)","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165119 (master)"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:1.43.3+dfsg-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2025-6597","published":"2026-02-02T23:16:00","updated_at":"2026-07-10T19:17:22.433959+00:00","description":"\nVulnerability in Wikimedia Foundation MediaWiki. This vulnerability is\nassociated with program files includes/auth/AuthManager.Php.\nThis issue affects MediaWiki: from * before 1.39.13, 1.42.7, 1.43.2,\n1.44.0.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":{"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":0.0,"baseSeverity":"NONE"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-6597","https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/TT45WDZ7MDTXXBEFLBMLAJI532O2PN2U/","https://phabricator.wikimedia.org/T389009","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165116 (master)","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165088 (REL1_39)"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:1.43.3+dfsg-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2025-6596","published":"2026-02-02T23:16:00","updated_at":"2026-07-10T19:17:22.433959+00:00","description":"\nImproper Neutralization of Input During Web Page Generation (XSS or\n'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This\nvulnerability is associated with program files\nresources/skins.Vector.Js/portlets.Js,\nresources/skins.Vector.Legacy.Js/portlets.Js.\nThis issue affects Vector: from >= 1.40.0 before 1.42.7, 1.43.2, 1.44.0.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":{"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":0.0,"baseSeverity":"NONE"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-6596","https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/TT45WDZ7MDTXXBEFLBMLAJI532O2PN2U/","https://phabricator.wikimedia.org/T396685","https://gerrit.wikimedia.org/r/c/mediawiki/skins/Vector/+/1165107 (master)"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:1.43.3+dfsg-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2025-6595","published":"2026-02-02T23:16:00","updated_at":"2026-07-10T19:17:57.714583+00:00","description":"\nImproper Neutralization of Input During Web Page Generation (XSS or\n'Cross-site Scripting') vulnerability in Wikimedia Foundation\nMultimediaViewer.This issue affects MultimediaViewer: from * before\n1.39.13, 1.42.7, 1.43.2, 1.44.0.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":4.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":0.0,"baseSeverity":"NONE"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-6595","https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/TT45WDZ7MDTXXBEFLBMLAJI532O2PN2U/","https://phabricator.wikimedia.org/T394863","https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MultimediaViewer/+/1165106 (master)","https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MultimediaViewer/+/1165144 (REL1_39)"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:1.43.3+dfsg-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2025-6594","published":"2026-02-02T23:16:00","updated_at":"2026-07-10T19:18:25.251728+00:00","description":"\nImproper Neutralization of Input During Web Page Generation (XSS or\n'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.\nThis vulnerability is associated with program files\nresources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js.\nThis issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2,\n1.44.0.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":4.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":0.0,"baseSeverity":"NONE"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-6594","https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/TT45WDZ7MDTXXBEFLBMLAJI532O2PN2U/","https://phabricator.wikimedia.org/T395063","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165115 (master)","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165087 (REL1_39)"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:1.43.3+dfsg-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2025-6593","published":"2026-02-02T23:16:00","updated_at":"2026-07-10T19:16:54.214322+00:00","description":"\nVulnerability in Wikimedia Foundation MediaWiki. This vulnerability is\nassociated with program files includes/user/User.Php.\nThis issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2,\n1.44.0.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":{"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":2.1,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-6593","https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/TT45WDZ7MDTXXBEFLBMLAJI532O2PN2U/","https://phabricator.wikimedia.org/T396230","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165114 (master)","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165086 (REL1_39)"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:1.43.3+dfsg-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2025-6592","published":"2026-02-02T23:16:00","updated_at":"2026-07-10T19:18:25.251728+00:00","description":"\nVulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is\nassociated with program files includes/auth/AuthManager.Php.\nThis issue affects AbuseFilter: from\nfe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":{"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":2.1,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-6592","https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/TT45WDZ7MDTXXBEFLBMLAJI532O2PN2U/","https://phabricator.wikimedia.org/T391218","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1143146 (master)"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:1.43.3+dfsg-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2025-6591","published":"2026-02-02T23:16:00","updated_at":"2026-07-10T19:16:54.214322+00:00","description":"\nVulnerability in Wikimedia Foundation MediaWiki. This vulnerability is\nassociated with program files includes/api/ApiFeedContributions.Php.\nThis issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":4.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"ACTIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":0.0,"baseSeverity":"NONE"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-6591","https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/TT45WDZ7MDTXXBEFLBMLAJI532O2PN2U/","https://phabricator.wikimedia.org/T392276","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165113 (master)","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165085 (REL1_39)"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:1.43.3+dfsg-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2025-6590","published":"2026-02-02T23:16:00","updated_at":"2026-07-10T19:17:22.433959+00:00","description":"\nExposure of Sensitive Information to an Unauthorized Actor vulnerability in\nWikimedia Foundation MediaWiki. This vulnerability is associated with\nprogram files includes/htmlform/fields/HTMLUserTextField.Php.\nThis issue affects MediaWiki: from * through 1.39.12, 1.42.76 1.43.1,\n1.44.0.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":{"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":4.6,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-6590","https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/TT45WDZ7MDTXXBEFLBMLAJI532O2PN2U/","https://phabricator.wikimedia.org/T392746","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165112 (master)","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165084 (REL1_39)"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:1.43.3+dfsg-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2025-6589","published":"2026-02-02T23:16:00","updated_at":"2026-07-10T19:17:57.714583+00:00","description":"\nVulnerability in Wikimedia Foundation MediaWiki. This vulnerability is\nassociated with program files includes/specials/pagers/BlockListPager.Php.\nThis issue affects MediaWiki: >= 1.42.0.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":{"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":2.1,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-6589","https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/TT45WDZ7MDTXXBEFLBMLAJI532O2PN2U/","https://phabricator.wikimedia.org/T391343","https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165111 (master)"],"bugs":[""],"patches":{"mediawiki":[]},"tags":{},"packages":[{"name":"mediawiki","source":"https://ubuntu.com/security/cve?package=mediawiki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mediawiki","debian":"https://tracker.debian.org/pkg/mediawiki","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:1.43.3+dfsg-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-1703","published":"2026-02-02T15:16:00","updated_at":"2026-07-10T19:29:10.444716+00:00","description":"\nWhen pip is installing and extracting a maliciously crafted wheel archive,\nfiles may be extracted outside the installation directory. The path\ntraversal is limited to prefixes of the installation directory, thus isn't\nable to inject or overwrite executable files in typical situations.","ubuntu_description":"","notes":[{"author":"","note":"Priority reason:\nLimited scope and requires a user to extract a maliciously crafted wheel. Normal users are not vulnerable."}],"codename":null,"priority":"low","cvss3":null,"impact":{"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":2.0,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-1703","https://github.com/pypa/pip/pull/13777","https://mail.python.org/archives/list/security-announce@python.org/thread/WIEA34D4TABF2UNQJAOMXKCICSPBE2DJ/","https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126875"],"patches":{"python-pip":["upstream: https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735"]},"tags":{},"packages":[{"name":"python-pip","source":"https://ubuntu.com/security/cve?package=python-pip","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-pip","debian":"https://tracker.debian.org/pkg/python-pip","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"26.0","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-1761","published":"2026-02-02T14:16:00","updated_at":"2026-03-11T18:01:10.097761+00:00","description":"\nA flaw was found in libsoup. This stack-based buffer overflow vulnerability\noccurs during the parsing of multipart HTTP responses due to an incorrect\nlength calculation. A remote attacker can exploit this by sending a\nspecially crafted multipart HTTP response, which can lead to memory\ncorruption. This issue may result in application crashes or arbitrary code\nexecution in applications that process untrusted server responses, and it\ndoes not require authentication or user interaction.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.6,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW","baseScore":8.6,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-1761","https://access.redhat.com/security/cve/CVE-2026-1761"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126877","https://gitlab.gnome.org/GNOME/libsoup/-/issues/493","https://bugzilla.redhat.com/show_bug.cgi?id=2435961"],"patches":{"libsoup2.4":[],"libsoup3":["upstream: https://gitlab.gnome.org/GNOME/libsoup/-/commit/cfa9d90d1a5c274233554a264c56551c13d6a6f0"]},"tags":{},"packages":[{"name":"libsoup2.4","source":"https://ubuntu.com/security/cve?package=libsoup2.4","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libsoup2.4","debian":"https://tracker.debian.org/pkg/libsoup2.4","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"libsoup3","source":"https://ubuntu.com/security/cve?package=libsoup3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libsoup3","debian":"https://tracker.debian.org/pkg/libsoup3","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"3.6.6-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.6.5-8","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-1760","published":"2026-02-02T14:16:00","updated_at":"2026-03-11T18:01:10.097761+00:00","description":"\nA flaw was found in SoupServer. This HTTP request smuggling vulnerability\noccurs because SoupServer improperly handles requests that combine\nTransfer-Encoding: chunked and Connection: keep-alive headers. A remote,\nunauthenticated client can exploit this by sending specially crafted\nrequests, causing SoupServer to fail to close the connection as required by\nRFC 9112. This allows the attacker to smuggle additional requests over the\npersistent connection, leading to unintended request processing and\npotential denial-of-service (DoS) conditions.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-1760","https://access.redhat.com/security/cve/CVE-2026-1760"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126876","https://gitlab.gnome.org/GNOME/libsoup/-/issues/475","https://bugzilla.redhat.com/show_bug.cgi?id=2435951"],"patches":{"libsoup2.4":[],"libsoup3":["upstream: https://gitlab.gnome.org/GNOME/libsoup/-/commit/6224df5a471e9040a99dd3dc2e91817a701b1bf6"]},"tags":{},"packages":[{"name":"libsoup2.4","source":"https://ubuntu.com/security/cve?package=libsoup2.4","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libsoup2.4","debian":"https://tracker.debian.org/pkg/libsoup2.4","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"libsoup3","source":"https://ubuntu.com/security/cve?package=libsoup3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libsoup3","debian":"https://tracker.debian.org/pkg/libsoup3","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"3.6.6-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.6.5-8","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":15740,"limit":20,"total_results":79316}