UBUNTU-CVE-2026-104140

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-104140
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-104140
Upstream
Published
2026-10-12T22:17:00Z
Modified
2026-10-17T12:58:42Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.

References

Affected packages

Ubuntu:16.04:LTS
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.8.3+dfsg-1
2.8.3+dfsg-5
2.8.4+dfsg-1
2.8.6+dfsg-1~exp2
2.8.6+dfsg-1
2.8.6+dfsg-1build1
2.8.6+dfsg-1ubuntu1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-analysis2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgis-core2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgis-gui2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgis-networkanalysis2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgis-server2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgisgrass2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgispython2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "python-qgis",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "python-qgis-common",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-plugin-globe",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-plugin-globe-common",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"
Ubuntu:18.04:LTS
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.14.18+dfsg-1
2.14.20+dfsg-1build2
2.14.21+dfsg-1
2.14.21+dfsg-1build1
2.14.22+dfsg-2
2.18.17+dfsg-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-analysis2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgis-app2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgis-core2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgis-gui2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgis-networkanalysis2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgis-server2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgisgrass7-2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgispython2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "python-qgis",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "python-qgis-common",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "2.18.17+dfsg-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"
Ubuntu:20.04:LTS
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.4.10+dfsg-1build1
3.4.10+dfsg-1build2
3.4.14+dfsg-1
3.4.15+dfsg-1ubuntu2
3.10.3+dfsg-1ubuntu1
3.10.4+dfsg-1ubuntu2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-3d3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-analysis3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-app3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-core3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-gui3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-native3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-server3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgisgrass7-3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgispython3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "python3-qgis",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "python3-qgis-common",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"
Ubuntu:22.04:LTS
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.10.14+dfsg-1ubuntu2
3.16.14+dfsg-1build1
3.16.15+dfsg-1
3.22.4+dfsg-3
3.22.4+dfsg-3build1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-3d3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-analysis3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-app3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-core3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-gui3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-native3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-server3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgisgrass7-3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgispython3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "python3-qgis",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "python3-qgis-common",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-bin",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-common",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-dummy",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-landingpage",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wcs",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wfs",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wfs3",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wms",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wmts",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-sip",
            "binary_version":  "3.22.4+dfsg-3build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"
Ubuntu:24.04:LTS
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.28.10+dfsg-1
3.28.12+dfsg-1build1
3.28.13+dfsg-1
3.28.14+dfsg-1
3.28.15+dfsg-1
3.34.4+dfsg-1
3.34.4+dfsg-4
3.34.4+dfsg-4build1
3.34.4+dfsg-4build2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-3d3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-analysis3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-app3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-core3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-gui3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-native3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-server3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgisgrass8-3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgispython3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "python3-qgis",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "python3-qgis-common",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-bin",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-common",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-dummy",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-landingpage",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-wcs",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-wfs",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-wfs3",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-wms",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-wmts",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-sip",
            "binary_version":  "3.34.4+dfsg-4build2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"
Ubuntu:26.04:LTS
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.40.8+dfsg-1~exp1
3.40.12+dfsg-1build1
3.40.12+dfsg-1build2
3.40.13+dfsg-2build1
3.40.14+dfsg-1
3.40.14+dfsg-1build1
3.40.15+dfsg-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-3d3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-analysis3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-app3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-core3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-gui3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-native3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-server3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgisgrass8-3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgispython3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "python3-qgis",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "python3-qgis-common",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-bin",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-common",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-landingpage",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-wcs",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-wfs",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-wfs3",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-wms",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-wmts",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-sip",
            "binary_version":  "3.40.15+dfsg-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"
Ubuntu:26.10
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.40.15+dfsg-1
3.44.11+dfsg-1build1
3.44.12+dfsg-1
3.44.13+dfsg-1
3.44.13+dfsg-3
3.44.13+dfsg-3build1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-3d3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-analysis3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-app3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-core3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-gui3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-native3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-server3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgisgrass8-3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgispython3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "python3-qgis",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "python3-qgis-common",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-bin",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-common",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-landingpage",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wcs",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wfs",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wfs3",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wms",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wmts",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-sip",
            "binary_version":  "3.44.13+dfsg-3build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"