security/vuxml 1.1_6

security/vuxml: Document tailscale vulnerability

security/vuxml: Document qt6-webengine < 6.11.2

security/vuxml: add www/*chromium < 151.0.7922.169

Obtained from:	https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html

security/vuxml: Mark security/zeek < 8.0.10 as vulnerable as per:

https://github.com/zeek/zeek/releases/tag/v8.0.10

This release fixes the following vulnerabilities:

 - HIGH: SMB: Chains of AndX messages can crash Zeek

 - HIGH: DNP3: Memory exhaustion via file control (g70v1) fields

 - HIGH: SIP: Memory exhaustion from long request/response paths

 - HIGH: DHCP: Memory exhaustion from retained options after analyzer
   violation

 - HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path
   entries

 - HIGH: SMB: DCE/RPC memory exhaustion from fragment state

 - HIGH: Analyzer manager: Equivalent scheduled analyzers could
   exhaust memory

 - HIGH: ZIP: Unbounded decompression

 - HIGH: Redis: Parsed Redis traffic memory exhaustion

 - HIGH: Invalid IPv6 fragments can lead to unbounded state growth

 - HIGH: SSH: Quadratic KEX algorithm CPU exhaustion

 - HIGH: NVT: Oversized line recovery writes before heap buffer

 - HIGH: DHCP: Unbounded state growth via join_data

 - HIGH: FTP: Unbounded state growth via ftp_data_expected

 - HIGH: OCSP: Empty byName responder ID crashes Zeek

 - HIGH: ARP: Tunneled ARP traffic crashes Zeek

 - HIGH: LDAP: Unbounded per-connection script state

 - HIGH: IRC DCC SEND has unbounded state growth

 - HIGH: tunnel_changed event limit bypass on direct/tunneled toggles

 - HIGH: Recursive stack exhaustion from deep packet analyzer chains

 - MEDIUM: Telnet: AUTH STATUS options before a NAME is received
   results in event argument mismatch

 - MEDIUM: UDP: udp_contents events could trigger out-of-bounds
   reads

 - MEDIUM: NetBIOS: Memory exhaustion from declared session lengths

 - MEDIUM: IRC: Single DCC Send packet can result in scripting error

 - MEDIUM: IRC: Invalid DCC Send host/port fields can lead to
   unexpected parsing results

While here add missing URL to zeek 8.0.9 entry.

Reported by:	Tim Wojtulewicz

security/vuxml: document podman vulnerability

Sponsored by:	tipi.work

security/vuxml: document Gitlab vulnerabilities

security/vuxml: Document gitea < 1.27.0 vulnerabilities

Gitea 1.27.0 fixed 45 security issues, including privilege
escalation, remote denial of service, SSRF, authorization and
token scope bypasses, and information disclosure.

Sponsored by:	Netzkommune GmbH

security/vuxml: Add databases/postgreql??-* vulnerabilities

security/vuxml: update lang/python31{0,1} entries for new releases

security/vuxml: update lang/python315 poplib entry

Commit existed since 3.15.0.a6

security/vuxml: Document security/openexr < 3.4.14 multiple vulnerabilities

PR:		297486
Reported by:	mandree
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 151.0.7922.{108,137}

Obtained from:	https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html
Obtained from:	https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01815628406.html

security/vuxml: Add phpmyfaq vulnerabilities

security/vuxml: Add gitea vulnerabilities

* CVE-2026-59774
 * CVE-2026-60004

security/vuxml: Add Chromium vulnerabilities

* CVE-2026-19137
 * CVE-2026-19149
 * CVE-2026-19154
 * CVE-2026-19157
 * CVE-2026-19170
 * CVE-2026-19172

security/vuxml: Document OpenSSH vulnerabilities

security/vuxml: Document www/py-calibreweb vulnerabilities

PR:		297375
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document Roundcube vulnerabilities

security/vuxml: update lang/python312 entries

security/vuxml: update python poplib and imaplib entries

security/vuxml: Add gstreamer1* <= 1.28.6

security/vuxml: Document multiple security issues in libXfont2

PR:		297327
Approved by:	osa (mentor)

security/vuxml: Document dns/{dnsdist,powerdns,powerdns-recursor} vulnerability

PR:		297320, 297321, 297322
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Amend entry for py-mkdocs-material

* Python 3.10 is still in the ports tree, so add the related entry.

security/vuxml: Document py-djangorestframework vulnerabilities

security/vuxml: Document net/keycloak vulnerabilities

PR:		297306
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document SSH packet alignment issue in erlang

security/vuxml: Fix firefox-esr PORTEPOCH in two Mozilla entries

www/firefox-esr has PORTEPOCH=2, but the firefox-esr ranges in these
two do not have it so they cannot match any installed package.

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document Jenkins Security Advisory 2026-08-05

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document MySQL vulnerabilities from CPU Jul 2026

The Oracle Critical Patch Update of July 2026 fixes 54 issues in
Oracle MySQL. 31 of them affect the 8.4 series, 43 the 9.7 series,
including the MySQL Router shipped with the server ports.

Three issues require no credentials: one in the X Plugin and two in
MySQL Router, the latter of which allows unauthorized read and write
access. The remaining ones mostly need a privileged account and lead
to a denial of service.

Fixed in 8.4.11 and 9.7.2 respectively.

Sponsored by:	Netzkommune GmbH

security/vuxml: Document dns/powerdns-recursor vulnerabilities

PR:		296983

security/vuxml: Fix affected port version of mail/thunderbird by CVE-2026-6778

Although mail/thunderbird does not actually have PORTEPOCH, one is included in vuxml.
As a result, even fixed versions were still incorrectly reported as vulnerable.

The incorrect report was as follows:

===>  thunderbird-153.0.2 has known vulnerabilities:
thunderbird-153.0.2 is vulnerable:
  Mozilla -- Invalid pointer
  CVE: CVE-2026-6778
  WWW: https://vuxml.FreeBSD.org/freebsd/5124ce36-430a-11f1-a627-b42e991fc52e.html

security/vuxml: Fix giflib entry

The update to 6.1.3 already contains in files/ a patch for CVE-2026-26740 so use
lt instead of le to fix the version range.

PR:		296876

security/vuxml: Document www/angie vulnerabilities

PR:		297154
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Remove spurious file

security/vuxml: Document Weechat vulnerabilities

security/vuxml: Document ejabberd vulnerabilities

security/vuxml: Document py-mkdocs-material vulnerability

security/vuxml: Update existing tailscale vulnerability

security/vuxml: Document Weechat vulnerabilities

security/vuxml: Add security/netbird vulnerability

PR:		297167
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: add www/*chromium < 151.0.7922.71

Obtained from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html

security/vuxml: document gitlab vulnerabilities

security/vuxml: add FreeBSD SAs issued on 2026-07-29

FreeBSD-SA-26:50.kqueue affects 15.1R
FreeBSD-SA-26:51.ktimer affects 15.0R and 15.1R
FreeBSD-SA-26:52.if_wg affects all supported releases
FreeBSD-SA-26:53.ktrace affects 15.0R and 15.1R
FreeBSD-SA-26:54.sysvsem affects all supported releases
FreeBSD-SA-26:55.elf affects all supported releases

security/vuxml: add www/*chromium < 150.0.7871.{114,128,181,186}

Obtained from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html
Obtained from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html
Obtained from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html
Obtained from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0256605430.html
Obtained from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01320465736.html

security/vuxml: Add jetbrains-goland vulnerabilities

* CVE-2026-64800
 * CVE-2026-64802

security/vuxml: Add Mozilla vulnerabilities

* CVE-2026-16411
 * CVE-2026-16412
 * CVE-2026-16360

security/vuxml: Report new mailpit vulnerability

security/vuxml: Document Erlang/OTP vulnerabilities fixed in OTP 29.0.4, 28.5.0.4 and 27.3.4.15