Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ebe019cb by Salvatore Bonaccorso at 2026-08-05T22:42:48+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -227,7 +227,7 @@ CVE-2026-71204 (changedetection.io's /settings save handler
builds an update dic
CVE-2026-71203 (changedetection.io's REST API resources are protected by an
@auth.chec ...)
NOT-FOR-US: changedetection.io
CVE-2026-71202 (The raster Rust crate's crop() function (src/editor.rs) clamps
the cro ...)
- TODO: check
+ NOT-FOR-US: raster Rust crate
CVE-2026-70612 (Electron is a framework for writing cross-platform desktop
application ...)
- electron <itp> (bug #842420)
CVE-2026-70611 (Electron is a framework for writing cross-platform desktop
application ...)
@@ -311,11 +311,11 @@ CVE-2026-70427 (Jenkins 2.575 and earlier, LTS 2.568.1
and earlier does not safe
CVE-2026-70426 (In Remoting 3384.v60d89463d9e0 and earlier, except
3355.3357.v931d3c99 ...)
NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-70378 (imagecli's `carve <ratio>` pipeline operation (Carve::apply()
in src/i ...)
- TODO: check
+ NOT-FOR-US: imagecli
CVE-2026-70377 (imagecli's `scale <ratio>` pipeline operation (Scale::apply()
in src/i ...)
- TODO: check
+ NOT-FOR-US: imagecli
CVE-2026-70376 (Pluck CMS's admin panel relies solely on a Referer-header
comparison ( ...)
- TODO: check
+ NOT-FOR-US: Pluck CMS
CVE-2026-6972 (The SKT Skill Bar plugin for WordPress is vulnerable to Stored
Cross-S ...)
NOT-FOR-US: WordPress plugin
CVE-2026-6639 (The AI Chatbot & Workflow Automation by AIWU plugin for
WordPress is v ...)
@@ -329,21 +329,21 @@ CVE-2026-6079 (The Material Dashboard plugin for
WordPress is vulnerable to unau
CVE-2026-6020 (The ShopLentor plugin for WordPress is vulnerable to arbitrary
functio ...)
NOT-FOR-US: WordPress plugin
CVE-2026-67623 (Mistral Vibe before 2.23.3 contains a remote code execution
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Mistral Vibe
CVE-2026-66747 (Zbtlink router firmware ships an embedded remote-control
implant, ENDL ...)
- TODO: check
+ NOT-FOR-US: Zbtlink router firmware
CVE-2026-63457 (A potential denial of service vulnerability exists in HPE
Integrated L ...)
NOT-FOR-US: HPE
CVE-2026-61891 (In Eclipse Theia versions up to and including 1.73.1, the
`@theia/file ...)
NOT-FOR-US: Eclipse
CVE-2026-61486 (** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-61485 (** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with
Excessive Size ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-61484 (** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted
Data vuln ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-61483 (** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion
vulnerability i ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-60053 (Insufficient Session Expiration vulnerability in Apache
Answer. This ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-60023 (Exposure of Sensitive Information to an Unauthorized Actor
vulnerabili ...)
@@ -359,29 +359,29 @@ CVE-2026-5116 (The Contact Form 7 \u2013 Dynamic Text
Extension plugin for WordP
CVE-2026-5108 (The Super Progressive Web Apps plugin for WordPress is
vulnerable to S ...)
NOT-FOR-US: WordPress plugin
CVE-2026-59675 (When API audit logging is enabled, the middleware reads the
entire HTT ...)
- TODO: check
+ NOT-FOR-US: Rancher
CVE-2026-55998 (The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the
cluster ...)
- TODO: check
+ NOT-FOR-US: Rancher
CVE-2026-55997 (Rancher issues long-lived registration tokens to authenticate
nodes an ...)
NOT-FOR-US: SUSE
CVE-2026-55996 (A denial-of-service vulnerability was identified in multiple
TLS liste ...)
- TODO: check
+ NOT-FOR-US: Rancher
CVE-2026-55747 (The pocketflow-coding-agent cookbook example in
The-Pocket/PocketFlow ...)
- TODO: check
+ NOT-FOR-US: The-Pocket/PocketFlow
CVE-2026-55739 (Crater isolates data per company_id, and its
Invoice/Estimate/Payment/ ...)
- TODO: check
+ NOT-FOR-US: Crater
CVE-2026-54418 (Leantime through 3.6.2 exposes the JSON-RPC methods
leantime.rpc.TwoFA ...)
- TODO: check
+ NOT-FOR-US: Leantime
CVE-2026-54416 (Pluck CMS through 4.7.21 restricts dangerous file uploads in
its admin ...)
- TODO: check
+ NOT-FOR-US: Pluck CMS
CVE-2026-53992 (ProjectSend r2029 contains a reflected cross-site scripting
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: ProjectSend
CVE-2026-50749 (Improper Authorization vulnerability in Apache Answer. This
issue aff ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-4431 (The Easy Post Submission plugin for WordPress is vulnerable to
unautho ...)
NOT-FOR-US: WordPress plugin
CVE-2026-49331 (A flaw was found in openshift/oauth-proxy. On paths configured
to bypa ...)
- TODO: check
+ NOT-FOR-US: openshift/oauth-proxy
CVE-2026-48912 (Improper Input Validation vulnerability in Apache Answer.
This issue ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-48911 (Insufficient Verification of Data Authenticity vulnerability
in Apache ...)
@@ -389,41 +389,41 @@ CVE-2026-48911 (Insufficient Verification of Data
Authenticity vulnerability in
CVE-2026-48834 (Improper Handling of Length Parameter Inconsistency
vulnerability in A ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-48168 (PraisonAI is a multi-agent teams system. In versions prior to
4.6.40, ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-46581 (In Eclipse Mojarra versions 2.3 and following, URL handing in
`Default ...)
TODO: check
CVE-2026-44945 (A privilege escalation vulnerability exists in Rancher's
impersonation ...)
- TODO: check
+ NOT-FOR-US: Rancher
CVE-2026-39924 (Flarum before 1.8.16 contains an improper session invalidation
vulnera ...)
- TODO: check
+ NOT-FOR-US: Flarum
CVE-2026-39923 (Flarum before 1.8.16 contains a password reset token expiry
bypass vul ...)
- TODO: check
+ NOT-FOR-US: Flarum
CVE-2026-32835
REJECTED
CVE-2026-25703 (NeuVector through 5.4.9 is can potentially leak information
from manag ...)
- TODO: check
+ NOT-FOR-US: NeuVector
CVE-2026-20313 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20312 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20311 (A vulnerability in the web-based management interface of Cisco
IOS XE ...)
NOT-FOR-US: Cisco
CVE-2026-20310 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20308 (A vulnerability in the web-based management interface of Cisco
IOS XE ...)
NOT-FOR-US: Cisco
CVE-2026-20304 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20303 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20301 (A vulnerability in the Extensible Messaging Client Protocol
(XMCP), al ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20294 (A vulnerability in the web-based management interface of Cisco
Catalys ...)
NOT-FOR-US: Cisco
CVE-2026-20289 (A vulnerability in the logging subsystem of Cisco RoomOS could
allow a ...)
NOT-FOR-US: Cisco
CVE-2026-20288 (A vulnerability in the web-based management interface of Cisco
IMC cou ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20273 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
NOT-FOR-US: Cisco
CVE-2026-20272 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
@@ -441,17 +441,17 @@ CVE-2026-20267 (As part of Cisco's ongoing commitment to
proactive security and
CVE-2026-20263 (A vulnerability in the Blocks Extensible Exchange Protocol
(BEEP) feat ...)
NOT-FOR-US: Cisco
CVE-2026-20200 (A vulnerability in the web-based management interface of Cisco
IMC cou ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20198 (A vulnerability in the web-based management interface of Cisco
Integra ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20124 (A vulnerability in the Simple Network Management Protocol
(SNMP) subsy ...)
NOT-FOR-US: Cisco
CVE-2026-20028 (A vulnerability in the network driver of Cisco Terminal
Service (TS) A ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-18933 (The wp-downloadmanager WordPress plugin, in version 1.68.11
(also affe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18927 (A vulnerability was determined in imranrisal-dev
Student-Management-Sy ...)
- TODO: check
+ NOT-FOR-US: imranrisal-dev Student-Management-System
CVE-2026-18881 (The TableOn \u2013 WordPress Posts Table Filterable plugin for
WordPre ...)
NOT-FOR-US: WordPress plugin
CVE-2026-18531 (IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a
remote at ...)
@@ -475,9 +475,9 @@ CVE-2026-17623 (IBM Langflow OSS 1.0.0 through 1.10.3 could
allow a remote authe
CVE-2026-17617 (IBM Application Gateway Operator 22.2 through 26.06 is
vulnerable to S ...)
NOT-FOR-US: IBM
CVE-2026-17613 (Penpot\u2019s ::import-binfile RPC command lacks authorization
on the ...)
- TODO: check
+ NOT-FOR-US: Penpot
CVE-2026-17578 (Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do
not enfor ...)
- TODO: check
+ NOT-FOR-US: Kong Event Gateway
CVE-2026-17532 (The Seraphinite Accelerator plugin for WordPress is vulnerable
to Refl ...)
NOT-FOR-US: WordPress plugin
CVE-2026-17506 (The Independent Analytics plugin for WordPress is vulnerable
to Stored ...)
@@ -495,13 +495,13 @@ CVE-2026-16100 (A flaw was found in the user-event
metrics recording of Keycloak
CVE-2026-16071 (A flaw was found in the LDAP storage provider of Keycloak,
which is us ...)
TODO: check
CVE-2026-16022 (@oblique/cli 15.4.0 contains an OS command injection
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: oblique/cli
CVE-2026-15979 (The Content Egg \u2013 Affiliate Product Importer & Price
Comparison p ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15656 (IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set
the secure ...)
NOT-FOR-US: IBM
CVE-2026-15587 (Improper Privilege Management in Google SecOps (Chronicle
SOAR) versio ...)
- TODO: check
+ NOT-FOR-US: Google SecOps (Chronicle SOAR)
CVE-2026-15573 (A flaw was found in Keycloak's Authorization Services. The
component r ...)
TODO: check
CVE-2026-15572 (A flaw was found in Keycloak's Dynamic Client Registration
(DCR) secur ...)
@@ -525,7 +525,7 @@ CVE-2026-12730 (IBM Business Automation Workflow containers
and traditional 26.0
CVE-2026-12609 (In Eclipse Theia versions 1.66.0 and up until including
1.73.1, the `@ ...)
NOT-FOR-US: Eclipse
CVE-2026-12410 (Link following vulnerability in the Uninstaller component in
CCleaner ...)
- TODO: check
+ NOT-FOR-US: CCleaner
CVE-2026-12000 (The Page and Post Restriction plugin for WordPress is
vulnerable to Se ...)
NOT-FOR-US: WordPress plugin
CVE-2026-11977 (The WP Post Author \u2013 Author Box, Multiple Authors, Guest
Authors ...)
@@ -543,9 +543,9 @@ CVE-2026-10547 (IBM Langflow OSS 1.0.0 through 1.10.3 does
not properly validate
CVE-2026-10128 (IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated
users can e ...)
NOT-FOR-US: IBM
CVE-2026-10090 (A flaw was found in the Application Subscription controller
(multiclus ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes (ACM)
CVE-2026-10059 (A flaw was found in the Multicluster Engine for Kubernetes
ClusterCura ...)
- TODO: check
+ NOT-FOR-US: ulticluster Engine for Kubernetes ClusterCurator controller
(Red Hat)
CVE-2026-10025 (IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP
15 Inte ...)
NOT-FOR-US: IBM
CVE-2026-0931 (Denial-of-service vulnerability in M-Files Server versions
before26.5. ...)
@@ -553,7 +553,7 @@ CVE-2026-0931 (Denial-of-service vulnerability in M-Files
Server versions before
CVE-2026-0516 (A improper neutralization of HTTP Headers for Scripting Syntax
vulnera ...)
NOT-FOR-US: SonicWall
CVE-2025-70962 (Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect
Access Contro ...)
- TODO: check
+ NOT-FOR-US: Zosi C519M
CVE-2026-54876 (Issue summary: A malicious TLS server can cause a memory leak
in a TLS ...)
- openssl <unfixed>
[trixie] - openssl <not-affected> (Vulnerable code not present)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ebe019cb247ab256a3ae62182e97337789bd49ff
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ebe019cb247ab256a3ae62182e97337789bd49ff
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
