UBUNTU-CVE-2026-24480

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-24480
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-24480
Upstream
Published
2026-01-27T01:16:00Z
Modified
2026-10-17T12:59:56Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called "pre-commit checks" that, before commit 76a693cd91650f9b4e83edac525e5e4f90d954e9, was vulnerable to remote code execution and repository compromise because it used the pull_request_target trigger and then checked out and executed untrusted pull request code in a privileged context. Workflows triggered by pull_request_target ran with the base repository's credentials and access to secrets. If these workflows then checked out and executed code from the head of an external pull request (which could have been attacker controlled), the attacker could have executed arbitrary commands with elevated privileges. This insecure pattern has been documented as a security risk by GitHub and security researchers. Commit 76a693cd91650f9b4e83edac525e5e4f90d954e9 removed the vulnerable code.

References

Affected packages

Ubuntu:16.04:LTS
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.8.3+dfsg-1
2.8.3+dfsg-5
2.8.4+dfsg-1
2.8.6+dfsg-1~exp2
2.8.6+dfsg-1
2.8.6+dfsg-1build1
2.8.6+dfsg-1ubuntu1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-analysis2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgis-core2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgis-gui2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgis-networkanalysis2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgis-server2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgisgrass2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "libqgispython2.8.6",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "python-qgis",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "python-qgis-common",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-plugin-globe",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-plugin-globe-common",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "2.8.6+dfsg-1ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"
Ubuntu:18.04:LTS
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.14.18+dfsg-1
2.14.20+dfsg-1build2
2.14.21+dfsg-1
2.14.21+dfsg-1build1
2.14.22+dfsg-2
2.18.17+dfsg-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-analysis2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgis-app2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgis-core2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgis-gui2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgis-networkanalysis2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgis-server2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgisgrass7-2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "libqgispython2.18.17",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "python-qgis",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "python-qgis-common",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "2.18.17+dfsg-1"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "2.18.17+dfsg-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"
Ubuntu:20.04:LTS
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.4.10+dfsg-1build1
3.4.10+dfsg-1build2
3.4.14+dfsg-1
3.4.15+dfsg-1ubuntu2
3.10.3+dfsg-1ubuntu1
3.10.4+dfsg-1ubuntu2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-3d3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-analysis3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-app3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-core3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-gui3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-native3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgis-server3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgisgrass7-3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "libqgispython3.10.4",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "python3-qgis",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "python3-qgis-common",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "3.10.4+dfsg-1ubuntu2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"
Ubuntu:22.04:LTS
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.10.14+dfsg-1ubuntu2
3.16.14+dfsg-1build1
3.16.15+dfsg-1
3.22.4+dfsg-3
3.22.4+dfsg-3build1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-3d3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-analysis3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-app3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-core3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-gui3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-native3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-server3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgisgrass7-3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "libqgispython3.22.4",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "python3-qgis",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "python3-qgis-common",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-bin",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-common",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-dummy",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-landingpage",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wcs",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wfs",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wfs3",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wms",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wmts",
            "binary_version":  "3.22.4+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-sip",
            "binary_version":  "3.22.4+dfsg-3build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"
Ubuntu:24.04:LTS
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.28.10+dfsg-1
3.28.12+dfsg-1build1
3.28.13+dfsg-1
3.28.14+dfsg-1
3.28.15+dfsg-1
3.34.4+dfsg-1
3.34.4+dfsg-4
3.34.4+dfsg-4build1
3.34.4+dfsg-4build2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-3d3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-analysis3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-app3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-core3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-gui3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-native3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgis-server3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgisgrass8-3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "libqgispython3.34.4t64",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "python3-qgis",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "python3-qgis-common",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-bin",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-common",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-dummy",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-landingpage",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-wcs",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-wfs",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-wfs3",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-wms",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-server-wmts",
            "binary_version":  "3.34.4+dfsg-4build2"
        },
        {
            "binary_name":  "qgis-sip",
            "binary_version":  "3.34.4+dfsg-4build2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"
Ubuntu:25.10
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.40.5+dfsg-1
3.40.6+dfsg-1
3.40.6+dfsg-1build1
3.40.8+dfsg-1~exp1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-3d3.40.8",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "libqgis-analysis3.40.8",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "libqgis-app3.40.8",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "libqgis-core3.40.8",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "libqgis-gui3.40.8",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "libqgis-native3.40.8",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "libqgis-server3.40.8",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "libqgisgrass8-3.40.8",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "libqgispython3.40.8",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "python3-qgis",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "python3-qgis-common",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-server-bin",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-server-common",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-server-landingpage",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-server-wcs",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-server-wfs",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-server-wfs3",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-server-wms",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-server-wmts",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        },
        {
            "binary_name":  "qgis-sip",
            "binary_version":  "3.40.8+dfsg-1~exp1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"
Ubuntu:26.04:LTS
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.40.8+dfsg-1~exp1
3.40.12+dfsg-1build1
3.40.12+dfsg-1build2
3.40.13+dfsg-2build1
3.40.14+dfsg-1
3.40.14+dfsg-1build1
3.40.15+dfsg-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-3d3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-analysis3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-app3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-core3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-gui3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-native3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgis-server3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgisgrass8-3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "libqgispython3.40.15",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "python3-qgis",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "python3-qgis-common",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-bin",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-common",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-landingpage",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-wcs",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-wfs",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-wfs3",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-wms",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-server-wmts",
            "binary_version":  "3.40.15+dfsg-1"
        },
        {
            "binary_name":  "qgis-sip",
            "binary_version":  "3.40.15+dfsg-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"
Ubuntu:26.10
qgis

Package

Name
qgis
Purl
pkg:deb/ubuntu/qgis?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.40.15+dfsg-1
3.44.11+dfsg-1build1
3.44.12+dfsg-1
3.44.13+dfsg-1
3.44.13+dfsg-3
3.44.13+dfsg-3build1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libqgis-3d3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-analysis3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-app3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-core3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-customwidgets",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-gui3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-native3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgis-server3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgisgrass8-3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "libqgispython3.44.13",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "python3-qgis",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "python3-qgis-common",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-common",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-plugin-grass",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-plugin-grass-common",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-provider-grass",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-providers",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-providers-common",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-bin",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-common",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-landingpage",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wcs",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wfs",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wfs3",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wms",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-server-wmts",
            "binary_version":  "3.44.13+dfsg-3build1"
        },
        {
            "binary_name":  "qgis-sip",
            "binary_version":  "3.44.13+dfsg-3build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"