git: 91986e7a009a - main - security/vuxml: Document p5-ack vulnerabilities

From: Rodrigo Osorio <rodrigo_at_FreeBSD.org>
Date: Wed, 10 Jun 2026 12:42:50 UTC 
The branch main has been updated by rodrigo:

URL: https://cgit.FreeBSD.org/ports/commit/?id=91986e7a009aa64876926647b93595aa5e480dd3

commit 91986e7a009aa64876926647b93595aa5e480dd3
Author:     Rodrigo Osorio <rodrigo@FreeBSD.org>
AuthorDate: 2026-06-10 12:40:52 +0000
Commit:     Rodrigo Osorio <rodrigo@FreeBSD.org>
CommitDate: 2026-06-10 12:41:40 +0000

    security/vuxml: Document p5-ack vulnerabilities
---
 security/vuxml/vuln/2026.xml | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml
index d7b938bf5bae..c80fcc6a9aed 100644
--- a/security/vuxml/vuln/2026.xml
+++ b/security/vuxml/vuln/2026.xml
@@ -1,3 +1,35 @@
+  <vuln vid="7ce71561-64c7-11f1-99fc-40b034429ecf">
+    <topic>p5-ack -- Multiple issues</topic>
+    <affects>
+<package>
+<name>p5-ack</name>
+<range><lt>3.10.0</lt></range>
+</package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Ack project reports:</p>
+	<blockquote cite="https://metacpan.org/dist/ack/changes">
+	  <p>CVE-2026-49147: filename ANSI escape sequences</p>
+	  <p>CVE-2026-49146: project .ackrc -A -B -C memory exhaustion</p>
+	  <p>CVE-2026-49145: project .ackrc --follow / --files-from file exfiltration</p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2026-49147</cvename>
+      <url>https://www.suse.com/security/cve/CVE-2026-49147.html</url>
+      <cvename>CVE-2026-49146</cvename>
+      <url>https://www.suse.com/security/cve/CVE-2026-49146.html</url>
+      <cvename>CVE-2026-49145</cvename>
+      <url>https://www.suse.com/security/cve/CVE-2026-49145.html</url>
+    </references>
+    <dates>
+      <discovery>2026-06-07</discovery>
+      <entry>2026-06-10</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="36ec75da-633d-11f1-9dbc-28d2443e6cfa">
     <topic>tree-sitter-cli -- Always-Incorrect Control Flow Implementation in wasmtime crate</topic>
     <affects>