security/vuxml: Document Roundcube vulnerabilities

security/vuxml: Fix package name typo

Fixes:	6911fd52c5d5 ("security/vuxml: Add OpenVPN vulnerability")
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Add OpenVPN vulnerability

 * CVE-2026-84732

security/vuxml: Remove duplicate entry for giflib CVE-2026-26740

Already added in 5b67b86dbc40c1e6f20bac05b3f7b8a25ba00730

security/vuxml: Document njs XML canonicalization vulnerability

CVE-2026-78689, fixed in njs 1.0.1.

Sponsored by:	Netzkommune GmbH

security/vuxml: Document electron42 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v42.11.1

security/vuxml: Document Jenkins Security Advisory 2026-09-02

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document py-strawberry-graphql vulnerability

security/vuxml: add www/*chromium < 152.0.7977.75

Obtained
from:	https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html

security/vuxml: Add entry for giflib CVE-2026-26740

security/vuxml: Add entries for expat2 CVE-2026-66046 and CVE-2026-76641

security/vuxml: Document remaining Erlang/OTP vulnerabilities

Upstream published 16 advisories alongside OTP 29.0.6, 28.5.0.6 and
27.3.4.17. CVE-2026-75538 already had an entry; add a combined one for
the other 15, which share the same affected packages and fixed versions.
Most are in the inets httpd and httpc implementations: HTTP request
smuggling, two mod_auth authentication bypasses and several denial of
service issues, plus unbounded integer conversion in stdlib, snmp and
eldap.

Also add the now-published GHSA reference to the CVE-2026-75538 entry.

security/vuxml: Document CVE-2026-75538 in Erlang/OTP

security/vuxml: Unbreak

Fixes:		820ac6c24c44 ("security/vuxml: add www/*chromium < 152.0.7977.64")

security/vuxml: add www/*chromium < 152.0.7977.64

Obtained
from:	https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html

security/vuxml: Document net/keycloak vulnerabilities

PR:		298077
Reported by:	Matthias Wolf <freebsd@rheinwolf.de>
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document sudo-rs < 0.2.15 vulnerability

PR:             298074
Reported by:    Valdemar Erk <valdemar@erk.dev> (author)
Approved by:    osa, vvd (Mentors, implicit)

security/vuxml: document net-p2p/c-lightning vulnerabilities

security/vuxml: Document phpBB vulnerabilities

Sponsored by:	Netzkommune GmbH

security/vuxml: Document Elixir vulnerabilities

Sponsored by:  SkunkWerks, GmbH

security/vuxml: Document dns/nsd vulnerabilities

PR:		297994
Reported by:	Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: document Gitlab vulnerabilities

security/vuxml: Document new php-composer vulnerabilities

security/vuxml: Document rsync vulnerability

security/vuxml: Document matrix-conduit vulnerability

security/vuxml: correct a tpyo

FreeBSD-SA-26:61.openssl not FreeBSD-SA-26:62.openssl.

Fixes:          6caee4041ace ("security/vuxml: reference
FreeBSD-SA-26:61.openssl")
Pointy hat to:  philip

security/vuxml: add FreeBSD SAs issued on 2026-08-25

FreeBSD-SA-26:56.hwpmc affects all supported releases
FreeBSD-SA-26:57.unix affects 15.0R and 15.1R
FreeBSD-SA-26:58.sound affects all supported releases
FreeBSD-SA-26:59.mac_do affects 15.0R and 15.1R
FreeBSD-SA-26:60.ppp affects all supported releases
FreeBSD-SA-26:62.tty affects all supported releases
FreeBSD-SA-26:63.posixshm affects all supported releases

security/vuxml: reference FreeBSD-SA-26:61.openssl

Add a reference to FreeBSD-SA-26:61.openssl (issued 2026-08-25) to the
vuxml entry for OpenSSL CVE-2026-14457, CVE-2026-18798, CVE-2026-54874,
CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075 and
CVE-2026-63076

FreeBSD-SA-26:61.openssl affects all supported versions of FreeBSD

security/vuxml: remove duplicate OpenSSL entry

Reference FreeBSD-SA-26:35.openssl in the existing entry for OpenSSL
CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181,
CVE-2026-34182, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766,
CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770,
CVE-2026-45445, CVE-2026-45446 and CVE-2026-45447 instead of duplicating
the entry.

FreeBSD-SA-26:35.openssl affected all supported versions of FreeBSD.

security/vuxml: Document OpenSSL vulnerabilities

security/vuxml: Document MariaDB vulnerabilities

security/vuxml: Document mod_gnutls -- multiple vulnerabilities

CVE-2026-33307 is an out-of-bounds write when mod_gnutls receives a client
certificate chain longer than its buffer, CVE-2026-33308 a missing Key
Purpose check during client certificate verification.  Upstream fixed both
on 2026-03-20; in the tree the fix arrives with www/mod_gnutls 0.13.0.

Sponsored by:	Netzkommune GmbH

security/vuxml: Document jackson vulnerabilities

jackson-databind before 2.22.2 by-passes @JsonView and @JsonIgnore in
several ways and validates polymorphic types incompletely, jackson-core
before 2.22.2 can be driven past StreamReadConstraints.

Security:	0cb401f9-9f19-11f1-a655-3497f65b111b
Security:	0cb42b4a-9f19-11f1-a655-3497f65b111b
Sponsored by:	Netzkommune GmbH

security/vuxml: Document multiple vulnerabilities in traefik

security/vuxml: Document terraform exclusion bypass

go-slug before v0.18.3, bundled in terraform, does not consistently
match .terraformignore rules against canonically equivalent Unicode
filenames, so files meant to be excluded can end up in uploads to
HCP Terraform or Terraform Enterprise.  Fixed in terraform 1.15.9.

Security:	CVE-2026-14978
Sponsored by:	Netzkommune GmbH

security/vuxml: Document tailscale vulnerability

security/vuxml: Document qt6-webengine < 6.11.2

security/vuxml: add www/*chromium < 151.0.7922.169

Obtained
from:	https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html

security/vuxml: Mark security/zeek < 8.0.10 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v8.0.10

This release fixes the following vulnerabilities:

 - HIGH: SMB: Chains of AndX messages can crash Zeek

 - HIGH: DNP3: Memory exhaustion via file control (g70v1) fields

 - HIGH: SIP: Memory exhaustion from long request/response paths

 - HIGH: DHCP: Memory exhaustion from retained options after analyzer
   violation

security/vuxml: document podman vulnerability

Sponsored by:	tipi.work

security/vuxml: document Gitlab vulnerabilities

security/vuxml: Document gitea < 1.27.0 vulnerabilities

Gitea 1.27.0 fixed 45 security issues, including privilege
escalation, remote denial of service, SSRF, authorization and
token scope bypasses, and information disclosure.

Sponsored by:	Netzkommune GmbH

security/vuxml: Add databases/postgreql??-* vulnerabilities

security/vuxml: update lang/python31{0,1} entries for new releases

security/vuxml: update lang/python315 poplib entry

Commit existed since 3.15.0.a6

security/vuxml: Document security/openexr < 3.4.14 multiple vulnerabilities

PR:		297486
Reported by:	mandree
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 151.0.7922.{108,137}

Obtained
from:	https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html
Obtained
from:	https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01815628406.html

security/vuxml: Add phpmyfaq vulnerabilities

security/vuxml: Add gitea vulnerabilities

 * CVE-2026-59774
 * CVE-2026-60004

security/vuxml: Add Chromium vulnerabilities

 * CVE-2026-19137
 * CVE-2026-19149
 * CVE-2026-19154
 * CVE-2026-19157
 * CVE-2026-19170
 * CVE-2026-19172

security/vuxml: Document OpenSSH vulnerabilities

security/vuxml: Document www/py-calibreweb vulnerabilities

PR:		297375
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document Roundcube vulnerabilities

security/vuxml: update lang/python312 entries

security/vuxml: update python poplib and imaplib entries

security/vuxml: Add gstreamer1* <= 1.28.6

security/vuxml: Document multiple security issues in libXfont2

PR:		297327
Approved by:	osa (mentor)

security/vuxml: Document dns/{dnsdist,powerdns,powerdns-recursor} vulnerability

PR:		297320, 297321, 297322
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Amend entry for py-mkdocs-material

* Python 3.10 is still in the ports tree, so add the related entry.

security/vuxml: Document py-djangorestframework vulnerabilities

security/vuxml: Document net/keycloak vulnerabilities

PR:		297306
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document SSH packet alignment issue in erlang

security/vuxml: Fix firefox-esr PORTEPOCH in two Mozilla entries

www/firefox-esr has PORTEPOCH=2, but the firefox-esr ranges in these
two do not have it so they cannot match any installed package.

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document Jenkins Security Advisory 2026-08-05

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document MySQL vulnerabilities from CPU Jul 2026

The Oracle Critical Patch Update of July 2026 fixes 54 issues in
Oracle MySQL. 31 of them affect the 8.4 series, 43 the 9.7 series,
including the MySQL Router shipped with the server ports.

Three issues require no credentials: one in the X Plugin and two in
MySQL Router, the latter of which allows unauthorized read and write
access. The remaining ones mostly need a privileged account and lead
to a denial of service.

Fixed in 8.4.11 and 9.7.2 respectively.

Sponsored by:	Netzkommune GmbH

security/vuxml: Document dns/powerdns-recursor vulnerabilities

PR:		296983

security/vuxml: Fix affected port version of mail/thunderbird by CVE-2026-6778

Although mail/thunderbird does not actually have PORTEPOCH, one is included in
vuxml.
As a result, even fixed versions were still incorrectly reported as vulnerable.

The incorrect report was as follows:

===>  thunderbird-153.0.2 has known vulnerabilities:
thunderbird-153.0.2 is vulnerable:
  Mozilla -- Invalid pointer
  CVE: CVE-2026-6778
  WWW:
https://vuxml.FreeBSD.org/freebsd/5124ce36-430a-11f1-a627-b42e991fc52e.html

security/vuxml: Fix giflib entry

The update to 6.1.3 already contains in files/ a patch for CVE-2026-26740 so use
lt instead of le to fix the version range.

PR:		296876

security/vuxml: Document www/angie vulnerabilities

PR:		297154
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Remove spurious file

security/vuxml: Document Weechat vulnerabilities

security/vuxml: Document ejabberd vulnerabilities

security/vuxml: Document py-mkdocs-material vulnerability

security/vuxml: Update existing tailscale vulnerability

security/vuxml: Document Weechat vulnerabilities

security/vuxml: Add security/netbird vulnerability

PR:		297167
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: add www/*chromium < 151.0.7922.71

Obtained
from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html

security/vuxml: document gitlab vulnerabilities

security/vuxml: add FreeBSD SAs issued on 2026-07-29

FreeBSD-SA-26:50.kqueue affects 15.1R
FreeBSD-SA-26:51.ktimer affects 15.0R and 15.1R
FreeBSD-SA-26:52.if_wg affects all supported releases
FreeBSD-SA-26:53.ktrace affects 15.0R and 15.1R
FreeBSD-SA-26:54.sysvsem affects all supported releases
FreeBSD-SA-26:55.elf affects all supported releases

security/vuxml: add www/*chromium < 150.0.7871.{114,128,181,186}

Obtained
from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html
Obtained
from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html
Obtained
from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html
Obtained
from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0256605430.html
Obtained
from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01320465736.html

security/vuxml: Add jetbrains-goland vulnerabilities

 * CVE-2026-64800
 * CVE-2026-64802

security/vuxml: Add Mozilla vulnerabilities

 * CVE-2026-16411
 * CVE-2026-16412
 * CVE-2026-16360

security/vuxml: Report new mailpit vulnerability

security/vuxml: Document Erlang/OTP vulnerabilities fixed in OTP 29.0.4,
28.5.0.4 and 27.3.4.15

security/vuxml: Document Vaultwarden vulnerabilities

security/vuxml: Document unbound multiple vulnerabilities.

security/vuxml: Add gstreamer1* < 1.28.5

security/vuxml: Add entry for giflib CVE-2026-26740

security/vuxml: Add vulnerability records for CVEs fixed in www/srt

* CVE-2026-55869
* CVE-2026-55868

security/vuxml: Fix version in previous Weechat vuln

security/vuxml: Register Weechat vulnerabilities

security/vuxml: Document new mailpit vulnerability

security/vuxml: Document vulnerabilities in Tailscale

security/vuxml: Document multiple vulnerabilities in traefik

security/vuxml: Add phpmyfaq vulnerabilities

security/vuxml: Document nginx multiple vulnerabilities

PR:	296830

Sponsored by:	Netzkommune GmbH

security/vuxml: Document liboqs vulnerabilities

security/vuxml: fix warning for the ffmpeg record

security/vuxml: fix package name

Fixes:	25fdff6924a2ffc740d7102a0940c896cc8c35d0