security/vuxml: add FreeBSD SAs issued on 2026-06-30

FreeBSD-SA-26:37.vm affects all supported releases
FreeBSD-SA-26:38.jail affects 15.0R and 15.1R
FreeBSD-SA-26:39.execve affects all supported releases
FreeBSD-SA-26:40.zfs affects all supported releases
FreeBSD-SA-26:41.libalias affects all supported releases
FreeBSD-SA-26:42.unlinkat affects all supported releases
FreeBSD-SA-26:43.tcp affects all supported releases
FreeBSD-SA-26:44.posixshm affects all supported releases
FreeBSD-SA-26:45.audit affects all supported releases
FreeBSD-SA-26:46.ktls affects all supported releases
FreeBSD-SA-26:47.linux affects 14.3R, 14.4R and 15.0R
FreeBSD-SA-26:48.compat32 affects 14.3R, 14.4R and 15.0R
FreeBSD-SA-26:49.iconv affects all supported releases

security/vuxml: Document net-mgmt/icinga2 vulnerabilities

security/vuxml: Document databases/postgresql-jdbc vulnerability

security/vuxml: add www/*chromium < 149.0.7827.200

Obtained
from:	https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01245939337.html

security/vuxml: Document dns/nsd vulnerabilities

PR:		296375
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document net/rclone vulnerability

PR:		296192
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document dns/powerdns vulnerabilities

PR:		296312
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document dns/powerdns-recursor vulnerabilities

PR:		296313
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document dns/dnsdist vulnerabilities

PR:		296314
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Add gstreamer1* < 1.28.4

security/vuxml: document expat2 vulberabilities

Sponsored by:	tipi.work

security/vuxml: Document www/gitea vulnerabilities

PR:             296351
Approved by:    osa, vvd (Mentors, implicit)

security/vuxml: document ffmpeg vulnerability

Approved by:	0mp (mentor)
Approved by:	fernape
Security:	CVE-2026-8461
Differential Revision:	https://reviews.freebsd.org/D57843

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document go-git vulnerability

security/vuxml: Document dns/{ldns,py-ldns} vulnerability

PR:		296232
Approved by:	osa, vvd (Mentors, implicit)
Security:	CVE-2026-10846

security/vuxml: Document podman vulnerability

Reviewed by:	dfr
Sponsored by:  SkunkWerks, GmbH
Differential Revision:	https://reviews.freebsd.org/D57736

security/vuxml: Fix month error on latest MariaDB entry

security/vuxml: Unbreak 'validate' target

73ebb85ec34a introduced basic CVE ID checking, which is fantastic. It
kind of broke the 'validate' target for a sane VuXML DB, though.

This fixes the 'validate' target keeping to the orginal idea and with
pretty-print as an added bonus.

security/vuxml: refuse non CVE vuln IDs in validate target

PR:		295994
Approved by:	0mp (mentor)
Reviewed by:	0mp, fernape, philip
Differential Revision:	https://reviews.freebsd.org/D57539

security/vuxml: fix lang/python311 version typo

Event: BSDCan 2026

security/vuxml: update python entries with upstream commits

Event: BSDCan 2026

security/vuxml: Add entry for NGINX

Add entry for NGINX

Sponsored by:	Netzkommune GmbH

security/vuxml: fix NGINX entry again

That's what happens when you're not focused.
Edit the entry again, since it's for nginx-devel

Sponsored by:	Netzkommune GmbH

security/vuxml: fix NGINX entry

Fix NGINX entry

Sponsored by:	Netzkommune GmbH

security/vuxml: add entry for NGINX

Add entry for NGINX

Sponsored by:	Netzkommune GmbH

security/vuxml: Document Jenkins Security Advisory 2026-06-10

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document net/routinator vulnerabilities

PR:		295979
Security:       CVE-2026-49232
Security:       CVE-2026-49233
Security:       CVE-2026-49234
Security:       CVE-2026-49235
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: add www/*chromium < 149.0.7827.155 + fix prev version

Obtained
from:	https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html

security/vuxml: Report mailpit vulnerability

security/vuxml: add www/*chromium < 149.0.7827.114

Obtained
from:	https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html

security/vuxml: improve recent change

Fixes:	a90e0c311e44e5916df1d0b26f288bac063d1688

security/vuxml: Add libsmi 0.4.8 vulnerability

PR:		295866
Approved by:	osa (mentor)

security/vuxml: Document multiple vulnerabilities in net/traefik

security/vuxml: Add caddy < 2.11.4

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document h2o vulnerabilities

Sponsored by:  SkunkWerks, GmbH

security/vuxml: remove bogus <cvename/s> tags

Unbreak the vuxml build (again).

Fixes:	        81a6669e034d07e3db13eff0688b32365ceff302

security/vuxml: Document Erlang/OTP June 2026 vulnerabilities

security/vuxml: Document p5-ack vulnerabilities

security/vuxml: document devel/tree-sitter-cli vulnerabilities

PR:		294982
Approved by:	0mp
Differential Revision:	https://reviews.freebsd.org/D57502

security/vuxml: Document OpenSSL vulnerabilities

security/vuxml: add www/*chromium < 149.0.7827.102

Obtained
from:	https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html

security/vuxml: add FreeBSD SAs issued on 2026-06-09

FreeBSD-SA-26:25.thr affects all supported releases
FreeBSD-SA-26:26.ktls affects all supported releases
FreeBSD-SA-26:27.sound affects all supported releases
FreeBSD-SA-26:28.capsicum affects all supported releases
FreeBSD-SA-26:29.ip6_multicast affects all supported releases
FreeBSD-SA-26:30.linux affects all supported releases
FreeBSD-SA-26:31.arm64 affects all supported releases
FreeBSD-SA-26:32.elf affects all supported releases
FreeBSD-SA-26:33.unbound affects all supported releases
FreeBSD-SA-26:34.vt affects all supported releases
FreeBSD-SA-26:35.openssl affects all supported releases
FreeBSD-SA-26:36.ldns affects all supported releases

security/vuxml: Document Elixir vulnerabilities

- CVE-2026-49762, GHSA-w2h8-8x3g-278p

References:
https://github.com/elixir-lang/elixir/releases/tag/v1.20.1

Sponsored by:    SkunkWerks, GmbH

security/vuxml: Document Apache httpd 2.4.67 vulnerabilities

security/vuxml: Document multiple Unbound vulnerabilities

* CVE-2026-32792
* CVE-2026-33278
* CVE-2026-40622
* CVE-2026-41292
* CVE-2026-42534
* CVE-2026-42923
* CVE-2026-42944
* CVE-2026-42959
* CVE-2026-42960
* CVE-2026-44390
* CVE-2026-44608

References:
https://www.nlnetlabs.nl/projects/unbound/security-advisories/

PR:		295442
Sponsored by:	Rubicon Communications, LLC ("Netgate")

security/vuxml: Add entry for strongSwan CVE-2026-47895

PR:		295936
Sponsored by:	Rubicon Communications, LLC ("Netgate")

security/vuxml: Document WeeChat 4.9.0 vulnerabilities

security/vuxml: Document WeeChat vulnerabilities

security/vuxml: document gitlab vulnerabilities

security/vuxml: add CVEs for xorg-server and xwayland

Sponsored by:	tipi.work

security/vuxml: Fix nginx entry

PR:		295797
Reported by:	tomas@ciernik.sk and others

security/vuxml: Document PowerDNS vulnerabilities

security/vuxml: Document Apache DoS vulnerability

security/vuxml: remove bogus <cvename/> references

ZDI-CAN-* references are not CVEs.  They are internal references from a
security company.  CVEs that don't exist upset the vuxmlbuild.

security/vuxml: add xwayland vulnerabilities

Sponsored by:	tipi.work

security/vuxml: add xorg-server vulnerabilities

security/vuxml: fix x11-servers/xorg-server's PORTEPOCH

% make -V PORTEPOCH -f /usr/ports/x11-servers/xorg-server/Makefile
1

Sponsored by:	tipi.work

security/vuxml: Fix nginx entry

The range seems wrong according to https://nginx.org/en/CHANGES:

Changes with nginx 1.31.1                                        22 May 2026

    *) Security: a heap memory buffer overflow might occur in a worker
       process when using a configuration with overlapping captures in
       ngx_http_rewrite_module, potentially resulting in arbitrary code
       execution (CVE-2026-9256).
       Thanks to Mufeed VH of Winfunc Research.

security/vuxml: add www/*chromium < 148.0.7778.215

Obtained
from:	https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html

security/vuxml: Add missing PORTEPOCH for many entries

fixes portepoch warnings from `make validate`
While here: fix some whitespace

security/vuxml: Only MariaDB Cluster vulnerable

security/vuxml: Add missing CVE for MariaDB

security/vuxml: Add www/gohugo vulnerabilities

 * CVE-2026-39826
 * CVE-2026-39823

security/vuxml: Document MariaDB vulnerabilities

security/vuxml: Report mailpit vulnerability

security/vuxml: Add OpenEXR vulnerabilities

PR:	295508
Sponsored by:	Netzkommune GmbH

security/vuxml: Document Erlang/OTP TLS/public_key vulnerabilities

security/vuxml: Add www/grafana vulnerabilities

- XSS in Grafana Explore stack trace (CVE-2025-41117)
- Public Dashboards time range restriction on annotations can be bypassed
(CVE-2026-21722)
- RCE on Grafana via sqlExpressions (CVE-2026-27876)
- Public dashboards discloses all direct mode datasources (CVE-2026-27877)
- Query resampling can cause unbounded memory allocations (CVE-2026-27879)
- OpenFeature evaluation API reads input data with no bounds (CVE-2026-27880)
- Grafana Testdata datasource can issue unbounded memory allocations
(CVE-2026-28375)
- Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS
(CVE-2026-33375)

PR:		294105
Reported by:	Boris Korzun <drtr0jan@yandex.ru>

security/vuxml: Add PORTEPOCH validation

This adds a check if portepoch has been forgotten
in affected version range specifications, which leads
to pkg audit not reporting a vulnerability.

Usage:

    make check-portepoch

This is also invoked when running `make validate`.

Approved by:	fernape (ports-secteam)
Differential Revision:	https://reviews.freebsd.org/D57193

security/vuxml: document jellyfin < 10.11.10 vulnerabilities

Three security advisories fixed in jellyfin 10.11.10:
- GHSA-f47c-m7gr-q92j
- GHSA-jg92-mrxq-vv75
- GHSA-wwwm-px48-fpvq

References:
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-f47c-m7gr-q92j
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-jg92-mrxq-vv75
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wwwm-px48-fpvq
https://github.com/jellyfin/jellyfin/releases/tag/v10.11.10

security/vuxml: Document Roundcube Webmail vulnerabilities

security/vuxml: Document REST vulnerability in traefik

security/vuxml: Add entry for putty

PR:	295501
Sponsored by:	Netzkommune GmbH

security/vuxml: Add entry for NGINX

PR:	295498
Sponsored by:	Netzkommune GmbH

security/vuxml: Document GStreamer1 < 1.28.3

security/vuxml: Document GStreamer1 < 1.28.2

security/vuxml: Document www/qt6-webengine < 6.11.1

security/vuxml: Document net/rsync vulnerability

    - CVE-2026-29518
    - CVE-2026-43617
    - CVE-2026-43618
    - CVE-2026-43619
    - CVE-2026-43620
    - CVE-2026-45232

security/vuxml: add FreeBSD SAs issued on 2026-05-20

FreeBSD-SA-26:18.setcred affects all supported releases
FreeBSD-SA-26:19.file affects all supported releases
FreeBSD-SA-26:20.fusefs affects all supported releases
FreeBSD-SA-26:21.ptrace affects all supported releases
FreeBSD-SA-26:22.casper affects all supported releases
FreeBSD-SA-26:23.bsdinstall affects all supported releases
FreeBSD-SA-26:24.cap_net affects all supported releases

security/vuxml: Document Nginx vulnerabilities

add entry for www/nginx-devel

Sponsored by:	Netzkommune GmbH

security/vuxml: Document MySQL vulnerabilities

security/vuxml: Document MariaDB vulnerabilities

security/vuxml: Update affected packages for varnish vuln

security/vuxml: Document varnish/vinyl vulnerability

A deficiency in HTTP/2 request parsing can be exploited to launch a backend
request desync attack (request smuggling), which in turn can be used for cache
poisoning, authentication bypass or possibly even information disclosure and
manipulation.

security/vuxml: Fix nginx version in the latest entry

security/vuxml: Add postgreql??-* vulnerabilities

* CVE-2026-6472
* CVE-2026-6473
* CVE-2026-6474
* CVE-2026-6475
* CVE-2026-6476
* CVE-2026-6477
* CVE-2026-6478
* CVE-2026-6479
* CVE-2026-6575
* CVE-2026-6637
* CVE-2026-6638

security/vuxml: Document www/nginx DoS/RCE

PR:		295270
Security:	3414ac89-4f9f-11f1-a1c0-0050569f0b83

security/vuxml: Document new mail/mailpit vulnerabilities

security/vuxml: Update entry for (py-)setuptools CVE-2025-47273

Expand this to our ancient ports to according to upstream report.
Affects devel/py-setuptools44 and devel/py-setuptools58

security/vuxml: Add entry for (py-)setuptools CVE-2025-47273

This is almost a one year old CVE

security/vuxml: document Gitlab vulnerabilities

security/vuxml: Mark security/zeek < 8.0.8 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v8.0.8

This release fixes the following potential DoS vulnerability:

 - A specially-crafted series of MIME headers sent via SMTP or HTTP
   could cause Zeek to use large amounts of memory and potentially
   crash.

Reported by:	Tim Wojtulewicz

security/vuxml: Add dnsmasq vulnerabilities

 * CVE-2026-2291
 * CVE-2026-4890
 * CVE-2026-4891
 * CVE-2026-4892
 * CVE-2026-4893
 * CVE-2026-5172

PR:	295204

security/vuxml: Add prosody vulnerability

CNA:  MITRE
 * Base Score:	7.2 HIGH
 * Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

PR:	295226

security/vuxml: adding an entry for expat

See https://blog.hartwork.org/posts/expat-2-8-1-released/
and https://nvd.nist.gov/vuln/detail/CVE-2026-45186

Security:	CVE-2026-45186

security/vuxml: Remove warning

Reduce the size of the description in one case.
Nothing can be done for the other one.

security/vuxml: add CVEs for Prosody advisory 2026-04-29

ChangeLog: https://prosody.im/security/advisory_735dd9d3/

PR:		295127

security/vuxml: Document dash entry