security/vuxml: Document security/openexr < 3.4.14 multiple vulnerabilities

PR:		297486
Reported by:	mandree
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 151.0.7922.{108,137}

Obtained
from:	https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html
Obtained
from:	https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01815628406.html

security/vuxml: Add phpmyfaq vulnerabilities

security/vuxml: Add gitea vulnerabilities

 * CVE-2026-59774
 * CVE-2026-60004

security/vuxml: Add Chromium vulnerabilities

 * CVE-2026-19137
 * CVE-2026-19149
 * CVE-2026-19154
 * CVE-2026-19157
 * CVE-2026-19170
 * CVE-2026-19172

security/vuxml: Document OpenSSH vulnerabilities

security/vuxml: Document www/py-calibreweb vulnerabilities

PR:		297375
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document Roundcube vulnerabilities

security/vuxml: update lang/python312 entries

security/vuxml: update python poplib and imaplib entries

security/vuxml: Add gstreamer1* <= 1.28.6

security/vuxml: Document multiple security issues in libXfont2

PR:		297327
Approved by:	osa (mentor)

security/vuxml: Document dns/{dnsdist,powerdns,powerdns-recursor} vulnerability

PR:		297320, 297321, 297322
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Amend entry for py-mkdocs-material

* Python 3.10 is still in the ports tree, so add the related entry.

security/vuxml: Document py-djangorestframework vulnerabilities

security/vuxml: Document net/keycloak vulnerabilities

PR:		297306
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document SSH packet alignment issue in erlang

security/vuxml: Fix firefox-esr PORTEPOCH in two Mozilla entries

www/firefox-esr has PORTEPOCH=2, but the firefox-esr ranges in these
two do not have it so they cannot match any installed package.

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document Jenkins Security Advisory 2026-08-05

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document MySQL vulnerabilities from CPU Jul 2026

The Oracle Critical Patch Update of July 2026 fixes 54 issues in
Oracle MySQL. 31 of them affect the 8.4 series, 43 the 9.7 series,
including the MySQL Router shipped with the server ports.

Three issues require no credentials: one in the X Plugin and two in
MySQL Router, the latter of which allows unauthorized read and write
access. The remaining ones mostly need a privileged account and lead
to a denial of service.

Fixed in 8.4.11 and 9.7.2 respectively.

Sponsored by:	Netzkommune GmbH

security/vuxml: Document dns/powerdns-recursor vulnerabilities

PR:		296983

security/vuxml: Fix affected port version of mail/thunderbird by CVE-2026-6778

Although mail/thunderbird does not actually have PORTEPOCH, one is included in
vuxml.
As a result, even fixed versions were still incorrectly reported as vulnerable.

The incorrect report was as follows:

===>  thunderbird-153.0.2 has known vulnerabilities:
thunderbird-153.0.2 is vulnerable:
  Mozilla -- Invalid pointer
  CVE: CVE-2026-6778
  WWW:
https://vuxml.FreeBSD.org/freebsd/5124ce36-430a-11f1-a627-b42e991fc52e.html

security/vuxml: Fix giflib entry

The update to 6.1.3 already contains in files/ a patch for CVE-2026-26740 so use
lt instead of le to fix the version range.

PR:		296876

security/vuxml: Document www/angie vulnerabilities

PR:		297154
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Remove spurious file

security/vuxml: Document Weechat vulnerabilities

security/vuxml: Document ejabberd vulnerabilities

security/vuxml: Document py-mkdocs-material vulnerability

security/vuxml: Update existing tailscale vulnerability

security/vuxml: Document Weechat vulnerabilities

security/vuxml: Add security/netbird vulnerability

PR:		297167
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: add www/*chromium < 151.0.7922.71

Obtained
from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html

security/vuxml: document gitlab vulnerabilities

security/vuxml: add FreeBSD SAs issued on 2026-07-29

FreeBSD-SA-26:50.kqueue affects 15.1R
FreeBSD-SA-26:51.ktimer affects 15.0R and 15.1R
FreeBSD-SA-26:52.if_wg affects all supported releases
FreeBSD-SA-26:53.ktrace affects 15.0R and 15.1R
FreeBSD-SA-26:54.sysvsem affects all supported releases
FreeBSD-SA-26:55.elf affects all supported releases

security/vuxml: add www/*chromium < 150.0.7871.{114,128,181,186}

Obtained
from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html
Obtained
from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html
Obtained
from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_049796704.html
Obtained
from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0256605430.html
Obtained
from:	https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01320465736.html

security/vuxml: Add jetbrains-goland vulnerabilities

 * CVE-2026-64800
 * CVE-2026-64802

security/vuxml: Add Mozilla vulnerabilities

 * CVE-2026-16411
 * CVE-2026-16412
 * CVE-2026-16360

security/vuxml: Report new mailpit vulnerability

security/vuxml: Document Erlang/OTP vulnerabilities fixed in OTP 29.0.4,
28.5.0.4 and 27.3.4.15

security/vuxml: Document Vaultwarden vulnerabilities

security/vuxml: Document unbound multiple vulnerabilities.

security/vuxml: Add gstreamer1* < 1.28.5

security/vuxml: Add entry for giflib CVE-2026-26740

security/vuxml: Add vulnerability records for CVEs fixed in www/srt

* CVE-2026-55869
* CVE-2026-55868

security/vuxml: Fix version in previous Weechat vuln

security/vuxml: Register Weechat vulnerabilities

security/vuxml: Document new mailpit vulnerability

security/vuxml: Document vulnerabilities in Tailscale

security/vuxml: Document multiple vulnerabilities in traefik

security/vuxml: Add phpmyfaq vulnerabilities

security/vuxml: Document nginx multiple vulnerabilities

PR:	296830

Sponsored by:	Netzkommune GmbH

security/vuxml: Document liboqs vulnerabilities

security/vuxml: fix warning for the ffmpeg record

security/vuxml: fix package name

Fixes:	25fdff6924a2ffc740d7102a0940c896cc8c35d0

security/vuxml: Document Poppler vulnerability

PR:		296769
Approved by:	osa (mentor)
Security:	CVE-2026-10118

security/vuxml: Add devel/ocaml-opam vulnerability

While here, fix whitespaces of two previous entries after the
feedback of `make validate`.

PR:		296642
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: fix the version of *-commons-httpclient

I learned that <eq> does not match portrevision, so <ge> works better.
And CVE-2020-13956 only mentions 3.1 and later and not earlier CPE versions.

security/vuxml: also mention the predecessor package name of
apache-commons-httpclient

security/vuxml: add some CVEs for Apache HttpClient

security/vuxml: Report new mail/mailpit vulnerabilities

security/vuxml: document Gitlab vulnerabilities

security/vuxml: Document libXfont2 vulnerabilities

Sponsored by:	tipi.work

security/vuxml: Document xwayland vulnerabilities

security/vuxml: Document xorg-server vulnerabilities

security/vuxml: add net-mgmt/cacti vuln entries

security/vuxml: Document net/xrdp{,-devel} vulnerabilities

security/vuxml: Mark security/zeek < 8.0.9 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v8.0.9

This release fixes the following potential DoS vulnerabilities:

 - The NVT, Rlogin, and RSH analyzers have received fixes to avoid
   unbounded state growth. Due to the fact that these packets can
   be received from remote hosts, these are considered DoS risks.

 - A specially crafted WebSocket payload can cause the Spicy WebSocket
   analyzer to use excessive memory when processing close, ping,
   and pong frames. Due to the fact that these packets can be
   received from remote hosts, these are considered a DoS risk.

security/vuxml: Document Emacs vulnerability

PR:		296546
Security:	CVE-2026-6861
Sponsored by:	The FreeBSD Foundation

security/vuxml: Document Weechat vulnerability

security/roundcube: Document vulnerabilities

security/vuxml: Document multiple vulnerabilities in traefik

security/vuxml: add www/p5-CGI-Session security fixes

security/vuxml: add security/openvpn[-devel] vuln entries.

Aligned with Gert Doering for openvpn-devel.

PR:		296429
Security:	ffa897a0-756f-11f1-b291-a74de6bb0320
Security:       CVE-2026-11771
Security:       CVE-2026-12932
Security:       CVE-2026-12996
Security:       CVE-2026-13117
Security:       CVE-2026-13122
Security:       CVE-2026-13698

Pull Request:	https://github.com/freebsd/freebsd-ports/pull/550

security/vuxml: Fix invalid escape sequence in Python re

ports/security/vuxml/files/extra-validation.py:13:
  SyntaxWarning: invalid escape sequence '\|'
    re_invalid_package_name = re.compile('[@!#$%^&*()<>?/\|}{~:]')

This can be fixed by making the re.compile argument a raw R'...' string,
capital R avoids issues with some Microsoft IDEs.
(Alternative is doubling the backslash, but that's less readable.)

Pull Request:	https://github.com/freebsd/freebsd-ports/pull/550

security/vuxml: extend ffmpeg announcement to ffmpeg4 and ffmpeg6

Approved by:	0mp (mentor)
Reviewed by:	fernape
Security:	CVE-2026-8461

security/vuxml: add www/*chromium < 150.0.7871.46

Obtained
from:	https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html

security/vuxml: add FreeBSD SAs issued on 2026-06-30

FreeBSD-SA-26:37.vm affects all supported releases
FreeBSD-SA-26:38.jail affects 15.0R and 15.1R
FreeBSD-SA-26:39.execve affects all supported releases
FreeBSD-SA-26:40.zfs affects all supported releases
FreeBSD-SA-26:41.libalias affects all supported releases
FreeBSD-SA-26:42.unlinkat affects all supported releases
FreeBSD-SA-26:43.tcp affects all supported releases
FreeBSD-SA-26:44.posixshm affects all supported releases
FreeBSD-SA-26:45.audit affects all supported releases
FreeBSD-SA-26:46.ktls affects all supported releases
FreeBSD-SA-26:47.linux affects 14.3R, 14.4R and 15.0R
FreeBSD-SA-26:48.compat32 affects 14.3R, 14.4R and 15.0R
FreeBSD-SA-26:49.iconv affects all supported releases

security/vuxml: Document net-mgmt/icinga2 vulnerabilities

security/vuxml: Document databases/postgresql-jdbc vulnerability

security/vuxml: add www/*chromium < 149.0.7827.200

Obtained
from:	https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01245939337.html

security/vuxml: Document dns/nsd vulnerabilities

PR:		296375
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document net/rclone vulnerability

PR:		296192
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document dns/powerdns vulnerabilities

PR:		296312
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document dns/powerdns-recursor vulnerabilities

PR:		296313
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Document dns/dnsdist vulnerabilities

PR:		296314
Approved by:	osa, vvd (Mentors, implicit)

security/vuxml: Add gstreamer1* < 1.28.4

security/vuxml: document expat2 vulberabilities

Sponsored by:	tipi.work

security/vuxml: Document www/gitea vulnerabilities

PR:             296351
Approved by:    osa, vvd (Mentors, implicit)

security/vuxml: document ffmpeg vulnerability

Approved by:	0mp (mentor)
Approved by:	fernape
Security:	CVE-2026-8461
Differential Revision:	https://reviews.freebsd.org/D57843

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document go-git vulnerability

security/vuxml: Document dns/{ldns,py-ldns} vulnerability

PR:		296232
Approved by:	osa, vvd (Mentors, implicit)
Security:	CVE-2026-10846

security/vuxml: Document podman vulnerability

Reviewed by:	dfr
Sponsored by:  SkunkWerks, GmbH
Differential Revision:	https://reviews.freebsd.org/D57736

security/vuxml: Fix month error on latest MariaDB entry

security/vuxml: Unbreak 'validate' target

73ebb85ec34a introduced basic CVE ID checking, which is fantastic. It
kind of broke the 'validate' target for a sane VuXML DB, though.

This fixes the 'validate' target keeping to the orginal idea and with
pretty-print as an added bonus.

security/vuxml: refuse non CVE vuln IDs in validate target

PR:		295994
Approved by:	0mp (mentor)
Reviewed by:	0mp, fernape, philip
Differential Revision:	https://reviews.freebsd.org/D57539

security/vuxml: fix lang/python311 version typo

Event: BSDCan 2026

security/vuxml: update python entries with upstream commits

Event: BSDCan 2026

security/vuxml: Add entry for NGINX

Add entry for NGINX

Sponsored by:	Netzkommune GmbH