security/vuxml: Document WeeChat 4.9.0 vulnerabilities

security/vuxml: Document WeeChat vulnerabilities

security/vuxml: document gitlab vulnerabilities

security/vuxml: add CVEs for xorg-server and xwayland

Sponsored by:	tipi.work

security/vuxml: Fix nginx entry

PR:		295797
Reported by:	tomas@ciernik.sk and others

security/vuxml: Document PowerDNS vulnerabilities

security/vuxml: Document Apache DoS vulnerability

security/vuxml: remove bogus <cvename/> references

ZDI-CAN-* references are not CVEs.  They are internal references from a
security company.  CVEs that don't exist upset the vuxmlbuild.

security/vuxml: add xwayland vulnerabilities

Sponsored by:	tipi.work

security/vuxml: add xorg-server vulnerabilities

security/vuxml: fix x11-servers/xorg-server's PORTEPOCH

% make -V PORTEPOCH -f /usr/ports/x11-servers/xorg-server/Makefile
1

Sponsored by:	tipi.work

security/vuxml: Fix nginx entry

The range seems wrong according to https://nginx.org/en/CHANGES:

Changes with nginx 1.31.1                                        22 May 2026

    *) Security: a heap memory buffer overflow might occur in a worker
       process when using a configuration with overlapping captures in
       ngx_http_rewrite_module, potentially resulting in arbitrary code
       execution (CVE-2026-9256).
       Thanks to Mufeed VH of Winfunc Research.

security/vuxml: add www/*chromium < 148.0.7778.215

Obtained
from:	https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html

security/vuxml: Add missing PORTEPOCH for many entries

fixes portepoch warnings from `make validate`
While here: fix some whitespace

security/vuxml: Only MariaDB Cluster vulnerable

security/vuxml: Add missing CVE for MariaDB

security/vuxml: Add www/gohugo vulnerabilities

 * CVE-2026-39826
 * CVE-2026-39823

security/vuxml: Document MariaDB vulnerabilities

security/vuxml: Report mailpit vulnerability

security/vuxml: Add OpenEXR vulnerabilities

PR:	295508
Sponsored by:	Netzkommune GmbH

security/vuxml: Document Erlang/OTP TLS/public_key vulnerabilities

security/vuxml: Add www/grafana vulnerabilities

- XSS in Grafana Explore stack trace (CVE-2025-41117)
- Public Dashboards time range restriction on annotations can be bypassed
(CVE-2026-21722)
- RCE on Grafana via sqlExpressions (CVE-2026-27876)
- Public dashboards discloses all direct mode datasources (CVE-2026-27877)
- Query resampling can cause unbounded memory allocations (CVE-2026-27879)
- OpenFeature evaluation API reads input data with no bounds (CVE-2026-27880)
- Grafana Testdata datasource can issue unbounded memory allocations
(CVE-2026-28375)
- Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS
(CVE-2026-33375)

PR:		294105
Reported by:	Boris Korzun <drtr0jan@yandex.ru>

security/vuxml: Add PORTEPOCH validation

This adds a check if portepoch has been forgotten
in affected version range specifications, which leads
to pkg audit not reporting a vulnerability.

Usage:

    make check-portepoch

This is also invoked when running `make validate`.

Approved by:	fernape (ports-secteam)
Differential Revision:	https://reviews.freebsd.org/D57193

security/vuxml: document jellyfin < 10.11.10 vulnerabilities

Three security advisories fixed in jellyfin 10.11.10:
- GHSA-f47c-m7gr-q92j
- GHSA-jg92-mrxq-vv75
- GHSA-wwwm-px48-fpvq

References:
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-f47c-m7gr-q92j
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-jg92-mrxq-vv75
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wwwm-px48-fpvq
https://github.com/jellyfin/jellyfin/releases/tag/v10.11.10

security/vuxml: Document Roundcube Webmail vulnerabilities

security/vuxml: Document REST vulnerability in traefik

security/vuxml: Add entry for putty

PR:	295501
Sponsored by:	Netzkommune GmbH

security/vuxml: Add entry for NGINX

PR:	295498
Sponsored by:	Netzkommune GmbH

security/vuxml: Document GStreamer1 < 1.28.3

security/vuxml: Document GStreamer1 < 1.28.2

security/vuxml: Document www/qt6-webengine < 6.11.1

security/vuxml: Document net/rsync vulnerability

    - CVE-2026-29518
    - CVE-2026-43617
    - CVE-2026-43618
    - CVE-2026-43619
    - CVE-2026-43620
    - CVE-2026-45232

security/vuxml: add FreeBSD SAs issued on 2026-05-20

FreeBSD-SA-26:18.setcred affects all supported releases
FreeBSD-SA-26:19.file affects all supported releases
FreeBSD-SA-26:20.fusefs affects all supported releases
FreeBSD-SA-26:21.ptrace affects all supported releases
FreeBSD-SA-26:22.casper affects all supported releases
FreeBSD-SA-26:23.bsdinstall affects all supported releases
FreeBSD-SA-26:24.cap_net affects all supported releases

security/vuxml: Document Nginx vulnerabilities

add entry for www/nginx-devel

Sponsored by:	Netzkommune GmbH

security/vuxml: Document MySQL vulnerabilities

security/vuxml: Document MariaDB vulnerabilities

security/vuxml: Update affected packages for varnish vuln

security/vuxml: Document varnish/vinyl vulnerability

A deficiency in HTTP/2 request parsing can be exploited to launch a backend
request desync attack (request smuggling), which in turn can be used for cache
poisoning, authentication bypass or possibly even information disclosure and
manipulation.

security/vuxml: Fix nginx version in the latest entry

security/vuxml: Add postgreql??-* vulnerabilities

* CVE-2026-6472
* CVE-2026-6473
* CVE-2026-6474
* CVE-2026-6475
* CVE-2026-6476
* CVE-2026-6477
* CVE-2026-6478
* CVE-2026-6479
* CVE-2026-6575
* CVE-2026-6637
* CVE-2026-6638

security/vuxml: Document www/nginx DoS/RCE

PR:		295270
Security:	3414ac89-4f9f-11f1-a1c0-0050569f0b83

security/vuxml: Document new mail/mailpit vulnerabilities

security/vuxml: Update entry for (py-)setuptools CVE-2025-47273

Expand this to our ancient ports to according to upstream report.
Affects devel/py-setuptools44 and devel/py-setuptools58

security/vuxml: Add entry for (py-)setuptools CVE-2025-47273

This is almost a one year old CVE

security/vuxml: document Gitlab vulnerabilities

security/vuxml: Mark security/zeek < 8.0.8 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v8.0.8

This release fixes the following potential DoS vulnerability:

 - A specially-crafted series of MIME headers sent via SMTP or HTTP
   could cause Zeek to use large amounts of memory and potentially
   crash.

Reported by:	Tim Wojtulewicz

security/vuxml: Add dnsmasq vulnerabilities

 * CVE-2026-2291
 * CVE-2026-4890
 * CVE-2026-4891
 * CVE-2026-4892
 * CVE-2026-4893
 * CVE-2026-5172

PR:	295204

security/vuxml: Add prosody vulnerability

CNA:  MITRE
 * Base Score:	7.2 HIGH
 * Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

PR:	295226

security/vuxml: adding an entry for expat

See https://blog.hartwork.org/posts/expat-2-8-1-released/
and https://nvd.nist.gov/vuln/detail/CVE-2026-45186

Security:	CVE-2026-45186

security/vuxml: Remove warning

Reduce the size of the description in one case.
Nothing can be done for the other one.

security/vuxml: add CVEs for Prosody advisory 2026-04-29

ChangeLog: https://prosody.im/security/advisory_735dd9d3/

PR:		295127

security/vuxml: Document dash entry

security/vuxml: Adjust listing for OpenVPN 2.6.20 release

Fixes in 2.7.2 are backported to 2.6.20 release

PR:		294714
Security:	549313db-3e93-11f1-8d38-7fbbe0285610
		CVE-2026-35058
		CVE-2026-40215

security/vuxml: Add Mozilla vulnerabilities

 * CVE-2026-8090
 * CVE-2026-8091
 * CVE-2026-8092
 * CVE-2026-8093
 * CVE-2026-8094

security/vuxml: add www/*chromium < 148.0.7778.96

Obtained
from:	https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html

security/vuxml: Add mongodb vulnerabilities

CVE-2026-6914
	Base Score:	7.5 HIGH
	Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

 CVE-2026-6915
	Base Score:	4.3 MEDIUM
	Vector:		CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

security/vuxml: Add devel/ocaml-opam (CVE-2026-41082)

Reviewed by:	osa, vvd (mentors)
Approved by:	vvd (co-mentor)
Differential Revision: https://reviews.freebsd.org/D56834

security/vuxml: Document Apache httpd vulnerabilities

security/vuxml: Add modsecurity3 vulnerabilities

Document CVE-2026-42268 and CVE-2026-30923 in modsecurity3
before 3.0.15.

PR:	294932
Sponsored by:	Netzkommune GmbH

security/vuxml: Add Mozilla vulnerability

CVE-2026-7323

NIST: NVD Base Score:	N/A

ADP:  CISA-ADP
Base Score:	7.3 HIGH
Vector:  	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

security/vuxml: add Prosody XMPP server advisory 2026-04-29

CVEs requested but not received yet.

PR:             294898
Reported by:    Thomas Morper <twm@pdp11.pw> (maintainer),
		Max Hearnden (security)
Approved by:    vvd (co-mentor, implicit)
URL:            https://prosody.im/security/advisory_735dd9d3/
Security:       a420f545-442c-11f1-b9b5-589cfc0dc9a2

security/vuxml: add textproc/p5-Text-CSV_XS

Reported by:	H.Merijn Brand - Tux <linux@tux.freedom.nl>
Security:	CVE-2026-7111
Reviewed by:	osa, vvd (mentors)
Approved by:	osa (mentor)
Differential Revision: https://reviews.freebsd.org/D56749

security/vuxml: Document openexr < 3.4.11 vulnerabilities

Multiple vulnerabilities

PR:		294882
Security:	787cde46-4424-11f1-943f-05b19d100dca
		CVE-2026-42217
		CVE-2026-42216
		CVE-2026-41142

security/vuxml: correct a typo in SA-26:12.dhclient entry

A trailing space crept into the <topic/> before m previous commit.

Fixes:		0821906582e8 security/vuxml: add FreeBSD SAs issued on 2026-04-29
Pointy hat to:	philip

security/vuxml: add FreeBSD SAs issued on 2026-04-29

FreeBSD-SA-26:12.dhclient affects all supported releases
FreeBSD-SA-26:13.exec affects all supported releases
FreeBSD-SA-26:14.pf affects all supported releases
FreeBSD-SA-26:15.dhclient affects all supported releases
FreeBSD-SA-26:16.libnv affects all supported releases
FreeBSD-SA-26:17.libnv affects all supported releases

security/vuxml: Add Mozilla vulnerabilities

 * CVE-2026-6786
 * CVE-2026-6785
 * CVE-2026-6784
 * CVE-2026-6783
 * CVE-2026-6782
 * CVE-2026-6781
 * CVE-2026-6780
 * CVE-2026-6779
 * CVE-2026-6778
 * CVE-2026-6777
 * CVE-2026-6776
 * CVE-2026-6775
 * CVE-2026-6774

security/vuxml: Add libXpm vulnerability

PR:		293154
Approved by:	osa (mentor)

security/vuxml: Add entry for (lib)expat CVE-2026-41080

(lib)expat before 2.8.0 uses insufficient entropy, and thus hash
flooding can occur via a crafted XML document

PR:		294769

security/vuxml: Add entry for lcms2 CVE-2026-41254

Integer overflow

security/vuxml: add OpenVPN < 2.7.2 vulns

Security:       549313db-3e93-11f1-8d38-7fbbe0285610
Security:       CVE-2026-35058
Security:       CVE-2026-40215
PR:		294714

security/vuxml: document gitlab vulnerabilities

security/vuxml: add FreeBSD SAs issued on 2026-04-21

FreeBSD-SA-26:10.vm affects all supported releases
FreeBSD-SA-26:11.amd64 affects all supported releases

security/vuxml: Add Mozilla vulnerability

 * Base Score:  9.8 CRITICAL
 * Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

security/vuxml: Document ejabberd vulnerability

security/vuxml: Mark security/zeek < 8.0.7 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v8.0.7

This release fixes the following potential DoS vulnerabilities:

 - A series of DNS messages containing long DNS compression chains
   can cause Zeek to spend a long time processing packets and
   potentially crash. Due to the fact that these packets can be
   received from remote hosts, this is a DoS risk.

 - A specially-crafted LDAP search request can cause Zeek to spend
   a long time processing the packet, resulting in Zeek silently
   dropping the LDAP analyzer for the connection. Due to the fact
   that these packets can be received from remote hosts, this is
   an evasion risk.

 - A specially-crafted series of ASN.1 messages in LDAP packets can
   cause Zeek to spend a long time processing the packets, resulting
   in Zeek silently dropping the LDAP analyzer for the connection.
   Due to the fact that these packets can be received from remote
   hosts, this is an evasion risk.

Reported by:	Tim Wojtulewicz

security/vuxml: Add entry for OpenEXR vulnerabilities < 3.4.10

Multiple integer overflow issues

Obtained from:	GitHub repo
Security:	CVE-2026-39886
		CVE-2026-40244
		CVE-2026-40250

security/vuxml: Document multiple xrdp vulnerability

security/vuxml: Document py-strawberry-graphql security issues

* CVE-2026-35523 - 7.5
* CVE-2026-35526 - 7.5

security/vuxml: Add Mozilla vulnerability

CVE-2026-5731
	Base Score:	9.8 CRITICAL
	Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

security/vuxml: Add entry for Python CVE-2026-4786

Incomplete mitigation of CVE-2026-4519,
%action expansion for command injection to webbrowser.open()

Obtained from:	GitHub repo
Security:	CVE-2026-4786
		cf75f572-378a-11f1-a119-e36228bfe7d4

security/vuxml: Add entry for Python CVE-2026-6100

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor
and gzip.GzipFile

Obtained from:	GitHub repo
Security:	b8e9f33c-375d-11f1-a119-e36228bfe7d4
		CVE-2026-6100

security/vuxml: Add go-ethereum vulnerabilities

PR:		293829
Approved by:	vvd (co-mentor)

security/vuxml: add www/*chromium < 147.0.7727.101

Obtained
from:	https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html

security/vuxml: fix php composer declaration to respect the DTD

security/vuxml: Document php-composer vulnerabilities

Reference: https://github.com/composer/composer/releases/tag/2.9.6

PR:		294528

security/vuxml: document xwayland vulnerabilities

Sponsored by:	tipi.work

security/vuxml: document xorg-server vulnerabilities

Sponsored by:	tipi.work

security/vuxml: Document Vaultwarden vulnerabilities

security/vuxml: Add entries for Python CVE-2026-1502 and gh-146333

PR:		294324
Security:	CVE-2026-1502
		/ 30bda1c3-369b-11f1-b51c-6dd25bec137b

Security:	5ec4dcf6-3588-11f1-b51c-6dd25bec137b

security/vuxml: Update entry for Python CVE-2026-4519

Fixed in 3.14.4

PR:		294324
Security:	9fdad262-2e0f-11f1-88c7-00a098b42aeb
		/ CVE-2026-4519

security/vuxml: Add py-ormar vulnerabilities

PR:		294382
Approved by:	osa (mentor)

security/vuxml: Document (lib)tiff vulnerability

Document CVE-2026-4775

security/vuxml: Add DNSdist vulnerabilities

PR:		294225
Approved by:	osa (mentor)

security/vuxml: Add MbedTLS vulnerabilities

Reviewed by:	osa, vvd (mentors)
Approved by:	osa (mentor)
Differential Revision: https://reviews.freebsd.org/D56344

security/vuxml: add www/*chromium < 147.0.7727.55

Obtained
from:	https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html

security/vuxml: Add Mozilla vulnerabilities

 * CVE-2026-5732:	NVD assessment not yet provided
 * CVE-2026-5733:	NVD assessment not yet provided
 * CVE-2026-5734:	Base Score:  9.8 CRITICAL
			Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 * CVE-2026-5734:	Base Score:  9.8 CRITICAL
			Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

security/vuxml: Update URL in latest OpenSSL vulns

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document OpenSSL vulnerabilities

security/vuxml: Add {lib}nghttp2 vulneability

CVE-2026-27135

Base Score:	7.5 HIGH
Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H