CVE and update status of the FreeBSD ports tree3,310 unaddressed CVEs in 678 portsAll times are CET
Port details

security/vuxml 1.1_6

Vulnerability and eXposure Markup Language DTD

0
unaddressed
0
VuXML only
0
fixed
5
open problem reports

Port info

Maintainer
ports-secteam@FreeBSD.org
Packages
latest: 1.1_6
Upstream
up to date
Last update
to 1.1_6 · 7b95a2eac4
Quarterly
2026Q4: 1.1_6
WWW
https://vuxml.freebsd.org/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install vuxml
installs 1.1_6 from latest; from quarterly (2026Q4) 1.1_6
Port
# cd /usr/ports/security/vuxml && make install clean
Size
9.7 KiB download · 40 KiB installed
Depends on
lang/python312 3.12.15, textproc/libxslt 1.1.45, textproc/xhtml-basic 1.0.20001219_2, textproc/xhtml-modularization 1.0.20010410_1, textproc/xmlcatmgr 2.2_4
License
BSD2CLAUSE

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.1_61.1_6–
FreeBSD 151.1_61.1_6–
FreeBSD 141.1_61.1_61.1_6

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.1_61.1_6–
FreeBSD 141.1_61.1_61.1_6

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.1_6.

Fixed (0)

No VuXML entries for this package.

Problem reports (5) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
295797maintainer-feedback? security/vuxml: fix nginx ranges vulnerable to CVE-2026-9256In Progress2026-07-17
295836maintainer-feedback? security/vuxml: Multiple vulnerabilities in py-djangoNew2026-06-04
291717security/vuxml: add entry for uriparser < 1.0.0New2025-12-16
288090maintainer-feedback? security/vuxml: make validate warnings after update to new libxml2New2025-07-08
270795security maintainer-feedback? security/vuxml: taking port flavours into account in recent new entriesIn Progress2025-07-01

Commits (8,339)

Bernard Spil (brnrd) · 1.1_6
security/vuxml: Only MariaDB Cluster vulnerable
7d214142b1
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Add missing CVE for MariaDB
83f9333eeb
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add www/gohugo vulnerabilities

* CVE-2026-39826
 * CVE-2026-39823
0a0abf3f77
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document MariaDB vulnerabilities
ca95ba2993
Guido Falsi (madpilot) · 1.1_6
security/vuxml: Report mailpit vulnerability
892d517aca
Jochen Neumeister (joneum) · 1.1_6
security/vuxml: Add OpenEXR vulnerabilities

PR:	295508
Sponsored by:	Netzkommune GmbH
22b501f599
Jimmy Olgeni (olgeni) · 1.1_6
security/vuxml: Document Erlang/OTP TLS/public_key vulnerabilities
64794e9743
Yusuf Yaman (nxjoseph) · 1.1_6
security/vuxml: Add www/grafana vulnerabilities

- XSS in Grafana Explore stack trace (CVE-2025-41117)
- Public Dashboards time range restriction on annotations can be bypassed (CVE-2026-21722)
- RCE on Grafana via sqlExpressions (CVE-2026-27876)
- Public dashboards discloses all direct mode datasources (CVE-2026-27877)
- Query resampling can cause unbounded memory allocations (CVE-2026-27879)
- OpenFeature evaluation API reads input data with no bounds (CVE-2026-27880)
- Grafana Testdata datasource can issue unbounded memory allocations (CVE-2026-28375)
- Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS (CVE-2026-33375)

PR:		294105
Reported by:	Boris Korzun <drtr0jan@yandex.ru>
9bfe0d3977
Michael Gmelin (grembo) · 1.1_6
security/vuxml: Add PORTEPOCH validation

This adds a check if portepoch has been forgotten
in affected version range specifications, which leads
to pkg audit not reporting a vulnerability.

Usage:

    make check-portepoch

This is also invoked when running `make validate`.

Approved by:	fernape (ports-secteam)
Differential Revision:	https://reviews.freebsd.org/D57193
bcfad8754e
Baptiste Daroussin (bapt) · 1.1_6
security/vuxml: document jellyfin < 10.11.10 vulnerabilities

Three security advisories fixed in jellyfin 10.11.10:
- GHSA-f47c-m7gr-q92j
- GHSA-jg92-mrxq-vv75
- GHSA-wwwm-px48-fpvq

References:
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-f47c-m7gr-q92j
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-jg92-mrxq-vv75
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wwwm-px48-fpvq
https://github.com/jellyfin/jellyfin/releases/tag/v10.11.10
399058bca8
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document Roundcube Webmail vulnerabilities
04fedb284c
Thomas Zander (riggs) · 1.1_6
security/vuxml: Document REST vulnerability in traefik
68648bc818
Jochen Neumeister (joneum) · 1.1_6
security/vuxml: Add entry for putty

PR:	295501
Sponsored by:	Netzkommune GmbH
17bd36f844
Jochen Neumeister (joneum) · 1.1_6
security/vuxml: Add entry for NGINX

PR:	295498
Sponsored by:	Netzkommune GmbH
ce3f4f3927
Jason E. Hale (jhale) · 1.1_6
security/vuxml: Document GStreamer1 < 1.28.3
2e4f790b42
Jason E. Hale (jhale) · 1.1_6
security/vuxml: Document GStreamer1 < 1.28.2
e992d60d35
Jason E. Hale (jhale) · 1.1_6
security/vuxml: Document www/qt6-webengine < 6.11.1
751fe24538
Rodrigo Osorio (rodrigo) · 1.1_6
security/vuxml: Document net/rsync vulnerability

- CVE-2026-29518
    - CVE-2026-43617
    - CVE-2026-43618
    - CVE-2026-43619
    - CVE-2026-43620
    - CVE-2026-45232
94d9b1f01c
Philip Paeps (philip) · 1.1_6
security/vuxml: add FreeBSD SAs issued on 2026-05-20

FreeBSD-SA-26:18.setcred affects all supported releases
FreeBSD-SA-26:19.file affects all supported releases
FreeBSD-SA-26:20.fusefs affects all supported releases
FreeBSD-SA-26:21.ptrace affects all supported releases
FreeBSD-SA-26:22.casper affects all supported releases
FreeBSD-SA-26:23.bsdinstall affects all supported releases
FreeBSD-SA-26:24.cap_net affects all supported releases
b6498d9e93
Jochen Neumeister (joneum) · 1.1_6
security/vuxml: Document Nginx vulnerabilities

add entry for www/nginx-devel

Sponsored by:	Netzkommune GmbH
8b69d71a5a
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document MySQL vulnerabilities
c82c148a03
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document MariaDB vulnerabilities
53bd09fab9
Ryan Steinmetz (zi) · 1.1_6
security/vuxml: Update affected packages for varnish vuln
a051aa67a6
Ryan Steinmetz (zi) · 1.1_6
security/vuxml: Document varnish/vinyl vulnerability

A deficiency in HTTP/2 request parsing can be exploited to launch a backend
request desync attack (request smuggling), which in turn can be used for cache
poisoning, authentication bypass or possibly even information disclosure and
manipulation.
7b63db13ec
Danilo G. Baio (dbaio) · 1.1_6
security/vuxml: Fix nginx version in the latest entry
c758ae56e7
Palle Girgensohn (girgen) · 1.1_6
security/vuxml: Add postgreql??-* vulnerabilities

* CVE-2026-6472
* CVE-2026-6473
* CVE-2026-6474
* CVE-2026-6475
* CVE-2026-6476
* CVE-2026-6477
* CVE-2026-6478
* CVE-2026-6479
* CVE-2026-6575
* CVE-2026-6637
* CVE-2026-6638
c46096fe37
Ryan Steinmetz (zi) · 1.1_6
security/vuxml: Document www/nginx DoS/RCE

PR:		295270
Security:	3414ac89-4f9f-11f1-a1c0-0050569f0b83
78c6cd4184
Guido Falsi (madpilot) · 1.1_6
security/vuxml: Document new mail/mailpit vulnerabilities
c0b7767176
Daniel Engberg (diizzy) · 1.1_6
security/vuxml: Update entry for (py-)setuptools CVE-2025-47273

Expand this to our ancient ports to according to upstream report.
Affects devel/py-setuptools44 and devel/py-setuptools58
cc12f45012
Daniel Engberg (diizzy) · 1.1_6
security/vuxml: Add entry for (py-)setuptools CVE-2025-47273

This is almost a one year old CVE
680508df7b
Matthias Fechner (mfechner) · 1.1_6
security/vuxml: document Gitlab vulnerabilities
ffbe9430c9
Craig Leres (leres) · 1.1_6
security/vuxml: Mark security/zeek < 8.0.8 as vulnerable as per:

https://github.com/zeek/zeek/releases/tag/v8.0.8

This release fixes the following potential DoS vulnerability:

 - A specially-crafted series of MIME headers sent via SMTP or HTTP
   could cause Zeek to use large amounts of memory and potentially
   crash.

Reported by:	Tim Wojtulewicz
894f968898
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add dnsmasq vulnerabilities

* CVE-2026-2291
 * CVE-2026-4890
 * CVE-2026-4891
 * CVE-2026-4892
 * CVE-2026-4893
 * CVE-2026-5172

PR:	295204
6d0e297d83
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add prosody vulnerability

CNA:  MITRE
 * Base Score:	7.2 HIGH
 * Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

PR:	295226
70439fe032
Thierry Thomas (thierry) · 1.1_6
security/vuxml: adding an entry for expat

See https://blog.hartwork.org/posts/expat-2-8-1-released/
and https://nvd.nist.gov/vuln/detail/CVE-2026-45186

Security:	CVE-2026-45186
9f22d11e50
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Remove warning

Reduce the size of the description in one case.
Nothing can be done for the other one.
260dc0d24d
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: add CVEs for Prosody advisory 2026-04-29

ChangeLog: https://prosody.im/security/advisory_735dd9d3/

PR:		295127
0dc651fe04
Bryan Drewery (bdrewery) · 1.1_6
security/vuxml: Document dash entry
24c9096b86
Daniel Engberg (diizzy) · 1.1_6
security/vuxml: Adjust listing for OpenVPN 2.6.20 release

Fixes in 2.7.2 are backported to 2.6.20 release

PR:		294714
Security:	549313db-3e93-11f1-8d38-7fbbe0285610
		CVE-2026-35058
		CVE-2026-40215
de7ba06b0e
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add Mozilla vulnerabilities

* CVE-2026-8090
 * CVE-2026-8091
 * CVE-2026-8092
 * CVE-2026-8093
 * CVE-2026-8094
c7efe81fa9
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 148.0.7778.96

Obtained from:	https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html
2adcf0ad8a
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add mongodb vulnerabilities

CVE-2026-6914
	Base Score:	7.5 HIGH
	Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

 CVE-2026-6915
	Base Score:	4.3 MEDIUM
	Vector:		CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
646e75df22
Yusuf Yaman (nxjoseph) · 1.1_6
security/vuxml: Add devel/ocaml-opam (CVE-2026-41082)

Reviewed by:	osa, vvd (mentors)
Approved by:	vvd (co-mentor)
Differential Revision: https://reviews.freebsd.org/D56834
8a08f2af94
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document Apache httpd vulnerabilities
4b66c3976a
Jochen Neumeister (joneum) · 1.1_6
security/vuxml: Add modsecurity3 vulnerabilities

Document CVE-2026-42268 and CVE-2026-30923 in modsecurity3
before 3.0.15.

PR:	294932
Sponsored by:	Netzkommune GmbH
957b9a9920
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add Mozilla vulnerability

CVE-2026-7323

NIST: NVD Base Score:	N/A

ADP:  CISA-ADP
Base Score:	7.3 HIGH
Vector:  	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
7807b4a986
Yusuf Yaman (nxjoseph) · 1.1_6
security/vuxml: add Prosody XMPP server advisory 2026-04-29

CVEs requested but not received yet.

PR:             294898
Reported by:    Thomas Morper <twm@pdp11.pw> (maintainer),
		Max Hearnden (security)
Approved by:    vvd (co-mentor, implicit)
URL:            https://prosody.im/security/advisory_735dd9d3/
Security:       a420f545-442c-11f1-b9b5-589cfc0dc9a2
cac0111256
Yusuf Yaman (nxjoseph) · 1.1_6
security/vuxml: add textproc/p5-Text-CSV_XS

Reported by:	H.Merijn Brand - Tux <linux@tux.freedom.nl>
Security:	CVE-2026-7111
Reviewed by:	osa, vvd (mentors)
Approved by:	osa (mentor)
Differential Revision: https://reviews.freebsd.org/D56749
bdc7494345
Daniel Engberg (diizzy) · 1.1_6
security/vuxml: Document openexr < 3.4.11 vulnerabilities

Multiple vulnerabilities

PR:		294882
Security:	787cde46-4424-11f1-943f-05b19d100dca
		CVE-2026-42217
		CVE-2026-42216
		CVE-2026-41142
72fbe0877e
Philip Paeps (philip) · 1.1_6
security/vuxml: correct a typo in SA-26:12.dhclient entry

A trailing space crept into the <topic/> before m previous commit.

Fixes:		0821906582e8 security/vuxml: add FreeBSD SAs issued on 2026-04-29
Pointy hat to:	philip
c75e227a2e
« newest← newerpage 7 of 167older →oldest »