security/vuxml 1.1_6

security/vuxml: Document Vaultwarden vulnerabilities

security/vuxml: Document unbound multiple vulnerabilities.

security/vuxml: Add gstreamer1* < 1.28.5

security/vuxml: Add entry for giflib CVE-2026-26740

security/vuxml: Add vulnerability records for CVEs fixed in www/srt

* CVE-2026-55869
* CVE-2026-55868

security/vuxml: Fix version in previous Weechat vuln

security/vuxml: Register Weechat vulnerabilities

security/vuxml: Document new mailpit vulnerability

security/vuxml: Document vulnerabilities in Tailscale

security/vuxml: Document multiple vulnerabilities in traefik

security/vuxml: Add phpmyfaq vulnerabilities

security/vuxml: Document nginx multiple vulnerabilities

PR:	296830

Sponsored by:	Netzkommune GmbH

security/vuxml: Document liboqs vulnerabilities

security/vuxml: fix warning for the ffmpeg record

security/vuxml: fix package name

Fixes:	25fdff6924a2ffc740d7102a0940c896cc8c35d0

security/vuxml: Document Poppler vulnerability

PR:		296769
Approved by:	osa (mentor)
Security:	CVE-2026-10118

security/vuxml: Add devel/ocaml-opam vulnerability

While here, fix whitespaces of two previous entries after the
feedback of `make validate`.

PR:		296642
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: fix the version of *-commons-httpclient

I learned that <eq> does not match portrevision, so <ge> works better.
And CVE-2020-13956 only mentions 3.1 and later and not earlier CPE versions.

security/vuxml: also mention the predecessor package name of apache-commons-httpclient

security/vuxml: add some CVEs for Apache HttpClient

security/vuxml: Report new mail/mailpit vulnerabilities

security/vuxml: document Gitlab vulnerabilities

security/vuxml: Document libXfont2 vulnerabilities

Sponsored by:	tipi.work

security/vuxml: Document xwayland vulnerabilities

security/vuxml: Document xorg-server vulnerabilities

security/vuxml: add net-mgmt/cacti vuln entries

security/vuxml: Document net/xrdp{,-devel} vulnerabilities

security/vuxml: Mark security/zeek < 8.0.9 as vulnerable as per:

https://github.com/zeek/zeek/releases/tag/v8.0.9

This release fixes the following potential DoS vulnerabilities:

 - The NVT, Rlogin, and RSH analyzers have received fixes to avoid
   unbounded state growth. Due to the fact that these packets can
   be received from remote hosts, these are considered DoS risks.

 - A specially crafted WebSocket payload can cause the Spicy WebSocket
   analyzer to use excessive memory when processing close, ping,
   and pong frames. Due to the fact that these packets can be
   received from remote hosts, these are considered a DoS risk.

 - A specially crafted series of Finger packets can cause the Spicy
   Finger analyzer to use excessive amounts of memory and potentially
   crash Zeek. Due to the fact that these packets can be received
   from remote hosts, this is considered a DoS risk.

 - A specially crafted Kerberos packet can cause the Kerberos
   analyzer to enter an invalid state and potentially crash Zeek.
   Due to the fact that these packets can be received from remote
   hosts, this is considered a DoS risk.

 - A specially crafted series of RDP packets can cause the RDP
   analyzer to use excessive amounts of memory and potentially crash
   Zeek. Due to the fact that these packets can be received from
   remote hosts, this is considered a DoS risk.

 - A specially crafted IP packet can cause the IP analyzer to read
   past the end of the contents of the packet when emitting the
   packet_contents event and possibly crash. Due to the fact that
   these packets can be received from remote hosts, this is considered
   a DoS risk.

 - A specially crafted IP packet can cause the packet discarding
   code to read off the end of the packet when looking for follow-on
   header data. This may potentially lead to a crash of Zeek. Due
   to the fact that these packets can be received from remote hosts,
   this is considered a DoS risk.

 - A specially crafted series of Gnutella packets may cause Zeek
   to continue accumulating memory and eventually crash. Due to the
   fact that these packets can be received from remote hosts, this
   is considered a DoS risk.

 - A specially crafted ICMPv6 packet can cause the ICMP analyzer
   to skip part of the packet and not report corresponding events
   and logs. Due to the fact that these packets can be received
   from remote hosts, this is considered an evasion risk.

 - A specially crafted SSH packet can cause the SSH analyzer to
   throw BinPAC exceptions for extremely large packets and skip
   logging them otherwise. Due to the fact that these packets can
   be received from remote hosts, this is considered an evasion
   risk.

 - A number of issues with the HTTP analyzer were found involving
   unusual Content-Length, Transfer-Encoding and Expect header
   usage. Due to the fact that these packets can be received from
   remote hosts, this is considered an evasion risk.

 - A series of fixes were applied to the serialization code in Zeek
   to avoid buffer overreads with both Broker and ZeroMQ traffic.
   On debug builds, these hit various abort() conditions and cause
   Zeek to exit. Due to the fact that all of these states require
   direct access to the Broker/ZeroMQ ports (meaning access to the
   local network to some degree), this isn’t considered a DoS risk.

Reported by:	Tim Wojtulewicz

security/vuxml: Document Emacs vulnerability

PR:		296546
Security:	CVE-2026-6861
Sponsored by:	The FreeBSD Foundation

security/vuxml: Document Weechat vulnerability

security/roundcube: Document vulnerabilities

security/vuxml: Document multiple vulnerabilities in traefik

security/vuxml: add www/p5-CGI-Session security fixes

security/vuxml: add security/openvpn[-devel] vuln entries.

Aligned with Gert Doering for openvpn-devel.

PR:		296429
Security:	ffa897a0-756f-11f1-b291-a74de6bb0320
Security:       CVE-2026-11771
Security:       CVE-2026-12932
Security:       CVE-2026-12996
Security:       CVE-2026-13117
Security:       CVE-2026-13122
Security:       CVE-2026-13698

Pull Request:	https://github.com/freebsd/freebsd-ports/pull/550

security/vuxml: Fix invalid escape sequence in Python re

ports/security/vuxml/files/extra-validation.py:13:
  SyntaxWarning: invalid escape sequence '\|'
    re_invalid_package_name = re.compile('[@!#$%^&*()<>?/\|}{~:]')

This can be fixed by making the re.compile argument a raw R'...' string,
capital R avoids issues with some Microsoft IDEs.
(Alternative is doubling the backslash, but that's less readable.)

Pull Request:	https://github.com/freebsd/freebsd-ports/pull/550

security/vuxml: extend ffmpeg announcement to ffmpeg4 and ffmpeg6

Approved by:	0mp (mentor)
Reviewed by:	fernape
Security:	CVE-2026-8461

security/vuxml: add www/*chromium < 150.0.7871.46

Obtained from:	https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html

security/vuxml: add FreeBSD SAs issued on 2026-06-30

FreeBSD-SA-26:37.vm affects all supported releases
FreeBSD-SA-26:38.jail affects 15.0R and 15.1R
FreeBSD-SA-26:39.execve affects all supported releases
FreeBSD-SA-26:40.zfs affects all supported releases
FreeBSD-SA-26:41.libalias affects all supported releases
FreeBSD-SA-26:42.unlinkat affects all supported releases
FreeBSD-SA-26:43.tcp affects all supported releases
FreeBSD-SA-26:44.posixshm affects all supported releases
FreeBSD-SA-26:45.audit affects all supported releases
FreeBSD-SA-26:46.ktls affects all supported releases
FreeBSD-SA-26:47.linux affects 14.3R, 14.4R and 15.0R
FreeBSD-SA-26:48.compat32 affects 14.3R, 14.4R and 15.0R
FreeBSD-SA-26:49.iconv affects all supported releases

security/vuxml: Document net-mgmt/icinga2 vulnerabilities

security/vuxml: Document databases/postgresql-jdbc vulnerability

security/vuxml: add www/*chromium < 149.0.7827.200

Obtained from:	https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01245939337.html

security/vuxml: Document dns/nsd vulnerabilities

PR:		296375
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document net/rclone vulnerability

PR:		296192
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document dns/powerdns vulnerabilities

PR:		296312
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document dns/powerdns-recursor vulnerabilities

PR:		296313
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document dns/dnsdist vulnerabilities

PR:		296314
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Add gstreamer1* < 1.28.4

security/vuxml: document expat2 vulberabilities

Sponsored by:	tipi.work

security/vuxml: Document www/gitea vulnerabilities

PR:             296351
Approved by:    osa, vvd (Mentors, implicit)

security/vuxml: document ffmpeg vulnerability

Approved by:	0mp (mentor)
Approved by:	fernape
Security:	CVE-2026-8461
Differential Revision:	https://reviews.freebsd.org/D57843