CVE and update status of the FreeBSD ports tree3,298 unaddressed CVEs in 671 portsAll times are CET
Port details

security/vuxml 1.1_6

Vulnerability and eXposure Markup Language DTD

0
unaddressed
0
VuXML only
0
fixed
5
open problem reports

Port info

Maintainer
ports-secteam@FreeBSD.org
Packages
latest: 1.1_6
Upstream
up to date
Last update
to 1.1_6 · 31d6cbe4eb
Quarterly
2026Q4: 1.1_6
WWW
https://vuxml.freebsd.org/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install vuxml
installs 1.1_6 from latest; from quarterly (2026Q4) 1.1_6
Port
# cd /usr/ports/security/vuxml && make install clean
Size
9.7 KiB download · 40 KiB installed
Depends on
lang/python312 3.12.15, textproc/libxslt 1.1.45, textproc/xhtml-basic 1.0.20001219_2, textproc/xhtml-modularization 1.0.20010410_1, textproc/xmlcatmgr 2.2_4
License
BSD2CLAUSE

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.1_61.1_6–
FreeBSD 151.1_61.1_6–
FreeBSD 141.1_61.1_61.1_6

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.1_61.1_6–
FreeBSD 141.1_61.1_61.1_6

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.1_6.

Fixed (0)

No VuXML entries for this package.

Problem reports (5) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
295797maintainer-feedback? security/vuxml: fix nginx ranges vulnerable to CVE-2026-9256In Progress2026-07-17
295836maintainer-feedback? security/vuxml: Multiple vulnerabilities in py-djangoNew2026-06-04
291717security/vuxml: add entry for uriparser < 1.0.0New2025-12-16
288090maintainer-feedback? security/vuxml: make validate warnings after update to new libxml2New2025-07-08
270795security maintainer-feedback? security/vuxml: taking port flavours into account in recent new entriesIn Progress2025-07-01

Commits (8,338)

Kai Knoblich (kai) · 1.1_6
security/vuxml: Document games/anki vulnerabilities

* External Control of Path in "aqt" leads to Arbitrary Code Execution.
* Imported note HTML may expose the internal Anki API API through image
  occlusion documents.
00f8ba0f4d
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Fix entry

Reported by:	dan@
Fixes:		db727c902a8fa37ce530139e6cfaf2cfe50188ec
96ad848daa
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Fix entry subject

Fixes:	85adc9fdc0e0535ead4b6b5368df074d96c17ae2
734fd65d42
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add devel/git-lfs entry

* CVE-2025-26625

PR:		298477
Reported by:	ivo.marino+freebsd@gmail.com
db727c902a
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add devel/cjose vulnerabilities

* CVE-2026-53938
 * CVE-2026-53939

PR:		298458
Reported by:	Ivo Marino <ivo.marino+freebsd@gmail.com>
85adc9fdc0
Yusuf Yaman (nxjoseph) · 1.1_6
security/vuxml: Document gitea < 1.27.3 vulnerabilities

Gitea 1.27.3 fixes 26 security issues, hardens issue searching
that an unfiltered query no longer enumerates every public
repository into the indexer filter and removes unsafe code
from the internal private endpoints.

PR:		298072
Approved by:	osa, vvd (Mentors, implicit)
d128625bc5
R. Christian McDonald (rcm) · 1.1_6
security/vuxml: Document multiple strongSwan vulnerabilities

PR:		298372
Sponsored by:	Rubicon Communications, LLC ("Netgate")
0a61592e67
Danilo G. Baio (dbaio) · 1.1_6
security/vuxml: document irc/znc vulnerabilities
817a69fb0d
Matthias Fechner (mfechner) · 1.1_6
security/vuxml: document Gitlab vulnerabilities
03e134b122
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Fix false negative due to missing

Quite old, but still worth the fix.

PR:		298399
Reported by:	chris@chrullrich.net
a5752a1661
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add www/yt-dlp vulnerability

* CVE-2026-55404

PR:		297810
Reported by:	mce@
7dacfb9841
Jochen Neumeister (joneum) · 1.1_6
security/vuxml: Document two vulnerabilities in immich

Sponsored by:	Netzkommune GmbH
5446292c8d
Jimmy Olgeni (olgeni) · 1.1_6
security/vuxml: Document redpanda-connect vulnerability
387596fa7d
Jochen Neumeister (joneum) · 1.1_6
security/vuxml: Document multiple vulnerabilities in FreeIPA

Sponsored by:	Netzkommune GmbH
7b659d3916
Yusuf Yaman (nxjoseph) · 1.1_6
security/vuxml: Document security/crowdsec vulrenabilities

PR:		298349
Approved by:	osa, vvd (Mentors, implicit)
9b346b92bd
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document Roundcube vulnerabilities
567cbaa50b
Yusuf Yaman (nxjoseph) · 1.1_6
security/vuxml: Fix package name typo

Fixes:	6911fd52c5d5 ("security/vuxml: Add OpenVPN vulnerability")
Approved by:	osa, vvd (Mentors, implicit)
d07d5c0a2e
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add OpenVPN vulnerability

* CVE-2026-84732
6911fd52c5
Daniel Engberg (diizzy) · 1.1_6
security/vuxml: Remove duplicate entry for giflib CVE-2026-26740

Already added in 5b67b86dbc40c1e6f20bac05b3f7b8a25ba00730
03f748f2d8
Jochen Neumeister (joneum) · 1.1_6
security/vuxml: Document njs XML canonicalization vulnerability

CVE-2026-78689, fixed in njs 1.0.1.

Sponsored by:	Netzkommune GmbH
66081dd24f
Hiroki Tagato (tagattie) · 1.1_6
security/vuxml: Document electron42 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v42.11.1
33fb37f1e0
Li-Wen Hsu (lwhsu) · 1.1_6
security/vuxml: Document Jenkins Security Advisory 2026-09-02

Sponsored by:	The FreeBSD Foundation
a51897786a
Kai Knoblich (kai) · 1.1_6
security/vuxml: Document py-strawberry-graphql vulnerability
62f8cabf3c
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 152.0.7977.75

Obtained from:	https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html
0dce732235
Daniel Engberg (diizzy) · 1.1_6
security/vuxml: Add entry for giflib CVE-2026-26740
5ffc40cde5
Daniel Engberg (diizzy) · 1.1_6
security/vuxml: Add entries for expat2 CVE-2026-66046 and CVE-2026-76641
3dc4c03f91
Jimmy Olgeni (olgeni) · 1.1_6
security/vuxml: Document remaining Erlang/OTP vulnerabilities

Upstream published 16 advisories alongside OTP 29.0.6, 28.5.0.6 and
27.3.4.17. CVE-2026-75538 already had an entry; add a combined one for
the other 15, which share the same affected packages and fixed versions.
Most are in the inets httpd and httpc implementations: HTTP request
smuggling, two mod_auth authentication bypasses and several denial of
service issues, plus unbounded integer conversion in stdlib, snmp and
eldap.

Also add the now-published GHSA reference to the CVE-2026-75538 entry.
8d731c8d43
Jimmy Olgeni (olgeni) · 1.1_6
security/vuxml: Document CVE-2026-75538 in Erlang/OTP
5ff179de9e
Dag-Erling Smørgrav (des) · 1.1_6
security/vuxml: Unbreak

Fixes:		820ac6c24c44 ("security/vuxml: add www/*chromium < 152.0.7977.64")
16ddd305cf
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 152.0.7977.64

Obtained from:	https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html
820ac6c24c
Yusuf Yaman (nxjoseph) · 1.1_6
security/vuxml: Document net/keycloak vulnerabilities

PR:		298077
Reported by:	Matthias Wolf <freebsd@rheinwolf.de>
Approved by:	osa, vvd (Mentors, implicit)
c294323784
Yusuf Yaman (nxjoseph) · 1.1_6
security/vuxml: Document sudo-rs < 0.2.15 vulnerability

PR:             298074
Reported by:    Valdemar Erk <valdemar@erk.dev> (author)
Approved by:    osa, vvd (Mentors, implicit)
1309e4ecd1
Vasil Dimov (vd) · 1.1_6
security/vuxml: document net-p2p/c-lightning vulnerabilities
3fc992f3e9
Jochen Neumeister (joneum) · 1.1_6
security/vuxml: Document phpBB vulnerabilities

Sponsored by:	Netzkommune GmbH
4c4a7135d7
Dave Cottlehuber (dch) · 1.1_6
security/vuxml: Document Elixir vulnerabilities

Sponsored by:  SkunkWerks, GmbH
f3681399e9
Yusuf Yaman (nxjoseph) · 1.1_6
security/vuxml: Document dns/nsd vulnerabilities

PR:		297994
Reported by:	Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
Approved by:	osa, vvd (Mentors, implicit)
90a89d8dac
Matthias Fechner (mfechner) · 1.1_6
security/vuxml: document Gitlab vulnerabilities
c08043fb99
Guido Falsi (madpilot) · 1.1_6
security/vuxml: Document new php-composer vulnerabilities
d6aed87d22
Rodrigo Osorio (rodrigo) · 1.1_6
security/vuxml: Document rsync vulnerability
2a0abdcc38
Ashish SHUKLA (ashish) · 1.1_6
security/vuxml: Document matrix-conduit vulnerability
f1f75ad23b
Philip Paeps (philip) · 1.1_6
security/vuxml: correct a tpyo

FreeBSD-SA-26:61.openssl not FreeBSD-SA-26:62.openssl.

Fixes:          6caee4041ace ("security/vuxml: reference FreeBSD-SA-26:61.openssl")
Pointy hat to:  philip
f62c942371
Philip Paeps (philip) · 1.1_6
security/vuxml: add FreeBSD SAs issued on 2026-08-25

FreeBSD-SA-26:56.hwpmc affects all supported releases
FreeBSD-SA-26:57.unix affects 15.0R and 15.1R
FreeBSD-SA-26:58.sound affects all supported releases
FreeBSD-SA-26:59.mac_do affects 15.0R and 15.1R
FreeBSD-SA-26:60.ppp affects all supported releases
FreeBSD-SA-26:62.tty affects all supported releases
FreeBSD-SA-26:63.posixshm affects all supported releases
d4032cabc0
Philip Paeps (philip) · 1.1_6
security/vuxml: reference FreeBSD-SA-26:61.openssl

Add a reference to FreeBSD-SA-26:61.openssl (issued 2026-08-25) to the
vuxml entry for OpenSSL CVE-2026-14457, CVE-2026-18798, CVE-2026-54874,
CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075 and
CVE-2026-63076

FreeBSD-SA-26:61.openssl affects all supported versions of FreeBSD
6caee4041a
Philip Paeps (philip) · 1.1_6
security/vuxml: remove duplicate OpenSSL entry

Reference FreeBSD-SA-26:35.openssl in the existing entry for OpenSSL
CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181,
CVE-2026-34182, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766,
CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770,
CVE-2026-45445, CVE-2026-45446 and CVE-2026-45447 instead of duplicating
the entry.

FreeBSD-SA-26:35.openssl affected all supported versions of FreeBSD.
efb5ff9b62
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document OpenSSL vulnerabilities
ca988e46ee
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document MariaDB vulnerabilities
a3126621b6
Jochen Neumeister (joneum) · 1.1_6
security/vuxml: Document mod_gnutls -- multiple vulnerabilities

CVE-2026-33307 is an out-of-bounds write when mod_gnutls receives a client
certificate chain longer than its buffer, CVE-2026-33308 a missing Key
Purpose check during client certificate verification.  Upstream fixed both
on 2026-03-20; in the tree the fix arrives with www/mod_gnutls 0.13.0.

Sponsored by:	Netzkommune GmbH
830607dc70
Jochen Neumeister (joneum) · 1.1_6
security/vuxml: Document jackson vulnerabilities

jackson-databind before 2.22.2 by-passes @JsonView and @JsonIgnore in
several ways and validates polymorphic types incompletely, jackson-core
before 2.22.2 can be driven past StreamReadConstraints.

Security:	0cb401f9-9f19-11f1-a655-3497f65b111b
Security:	0cb42b4a-9f19-11f1-a655-3497f65b111b
Sponsored by:	Netzkommune GmbH
220761e542
Thomas Zander (riggs) · 1.1_6
security/vuxml: Document multiple vulnerabilities in traefik
903c15a884
Jochen Neumeister (joneum) · 1.1_6
security/vuxml: Document terraform exclusion bypass

go-slug before v0.18.3, bundled in terraform, does not consistently
match .terraformignore rules against canonically equivalent Unicode
filenames, so files meant to be excluded can end up in uploads to
HCP Terraform or Terraform Enterprise.  Fixed in terraform 1.15.9.

Security:	CVE-2026-14978
Sponsored by:	Netzkommune GmbH
2fb0b54e43
« newest← newerpage 3 of 167older →oldest »