Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
9c2afed2 by Moritz Muehlenhoff at 2026-05-08T10:31:39+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -168,17 +168,17 @@ CVE-2026-42501 (A malicious module proxy can exploit a
flaw in the go command's
CVE-2026-42499 (Pathological inputs could cause DoS through consumePhrase when
parsing ...)
TODO: check
CVE-2026-42449 (n8n-MCP is an MCP server that provides AI assistants access to
n8n nod ...)
- TODO: check
+ NOT-FOR-US: n8n-MCP
CVE-2026-42279 (solidtime is an open-source time-tracking app. In version
0.12.0, the ...)
- TODO: check
+ NOT-FOR-US: solidtime
CVE-2026-42278 (UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to
commit fb6e ...)
- TODO: check
+ NOT-FOR-US: UltraDAG
CVE-2026-42277 (Onyx is an open-source AI platform. Prior to versions 3.0.9,
3.1.6, an ...)
NOT-FOR-US: Onyx
CVE-2026-42276 (Onyx is an open-source AI platform. Prior to versions 3.0.9,
3.1.6, an ...)
NOT-FOR-US: Onyx
CVE-2026-42275 (zrok is software for sharing web services, files, and network
resource ...)
- TODO: check
+ NOT-FOR-US: zrok
CVE-2026-42274 (Heimdall is a cloud native Identity Aware Proxy and Access
Control Dec ...)
NOT-FOR-US: Heimdall
CVE-2026-42273 (Heimdall is a cloud native Identity Aware Proxy and Access
Control Dec ...)
@@ -194,11 +194,11 @@ CVE-2026-42264 (Axios is a promise based HTTP client for
the browser and Node.js
CVE-2026-42261 (PromptHub is an all-in-one AI toolbox for prompt, skill, and
agent man ...)
NOT-FOR-US: PromptHub
CVE-2026-42259 (Saltcorn is an extensible, open source, no-code database
application b ...)
- TODO: check
+ NOT-FOR-US: Saltcorn
CVE-2026-42241 (ParquetSharp is a .NET library for reading and writing Apache
Parquet ...)
- TODO: check
+ NOT-FOR-US: ParquetSharp
CVE-2026-42239 (Budibase is an open-source low-code platform. Prior to version
3.35.10 ...)
- TODO: check
+ NOT-FOR-US: Budibase
CVE-2026-42225 (PJSIP is a free and open source multimedia communication
library writt ...)
TODO: check
CVE-2026-42203 (LiteLLM is a proxy server (AI Gateway) to call LLM APIs in
OpenAI (or ...)
@@ -214,9 +214,9 @@ CVE-2026-41928 (Vvveb before 1.0.8.2 contains an
information disclosure vulnerab
CVE-2026-41900 (OpenLearnX is an open-source, decentralized learning and
assessment pl ...)
NOT-FOR-US: OpenLearnX
CVE-2026-41692 (i18nextify is a JavaScript library that adds website
internationalizat ...)
- TODO: check
+ NOT-FOR-US: Node i18nextify
CVE-2026-41691 (Copilot said: i18nextify is a JavaScript library that adds
i18nextify ...)
- TODO: check
+ NOT-FOR-US: Node i18nextify
CVE-2026-41646 (Nuclei is a vulnerability scanner built on a simple YAML-based
DSL. Fr ...)
NOT-FOR-US: Nuclei
CVE-2026-41645 (Nuclei is a vulnerability scanner built on a simple YAML-based
DSL. Fr ...)
@@ -284,11 +284,11 @@ CVE-2025-69599 (RayVentory Scan Engine through 12.6
Update 8 allows attackers to
CVE-2025-67888 (An issue was discovered in Control Web Panel (CWP) before
0.9.8.1209. ...)
TODO: check
CVE-2025-67887 (1C-Bitrix through 25.100.500 allows Remote Code Execution
because an a ...)
- TODO: check
+ NOT-FOR-US: 1C-Bitrix
CVE-2025-67886 (Bitrix24 through 25.100.300 allows Remote Code Execution
because an ac ...)
- TODO: check
+ NOT-FOR-US: Bitrix24
CVE-2025-55449 (AstrBotDevs AstrBot 3.5.15 has
Advanced_System_for_Text_Response_and_B ...)
- TODO: check
+ NOT-FOR-US: AstrBotDevs AstrBot
CVE-2024-53326 (LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe
Deserializa ...)
TODO: check
CVE-2024-51092 (LibreNMS before 24.10.0 allows a remote attacker to execute
arbitrary ...)
@@ -312,15 +312,15 @@ CVE-2024-27686 (Mikrotik RouterOS (x86) 6.40.5 through
6.49.10 (fixed in 7) allo
CVE-2023-47268 (In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer
through 2.6. ...)
TODO: check
CVE-2023-46453 (Certain GL.iNet devices with 4.x firmware allow authentication
bypass ...)
- TODO: check
+ NOT-FOR-US: GL.iNet devices
CVE-2023-42346 (Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE>
refers to an ...)
- TODO: check
+ NOT-FOR-US: Alkacon OpenCms
CVE-2023-42345 (A Cross Site Scripting vulnerability in Alkacon OpenCms before
16 exis ...)
- TODO: check
+ NOT-FOR-US: Alkacon OpenCms
CVE-2023-42344 (Alkacon OpenCms before 10.5.1 allows remote unauthenticated
attackers ...)
- TODO: check
+ NOT-FOR-US: Alkacon OpenCms
CVE-2023-42343 (A Cross Site Scripting vulnerability in Alkacon OpenCms before
10.5.1 ...)
- TODO: check
+ NOT-FOR-US: Alkacon OpenCms
CVE-2026-8094 (Other issue in the WebRTC component. This vulnerability was
fixed in F ...)
- firefox-esr 140.10.2esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-41/#CVE-2026-8094
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9c2afed268cd406b6a821af5a903f85be40d3e8c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9c2afed268cd406b6a821af5a903f85be40d3e8c
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
