Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
e2d1a78b by Salvatore Bonaccorso at 2026-08-14T08:23:42+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -229,21 +229,21 @@ CVE-2026-73569 (fast-xml-parser allows users to process
XML from JS object witho
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f
(v5.10.1)
NOTE: node-webfont provides node-fast-xml-parser
CVE-2026-73568 (py-libp2p is the Python implementation of the libp2p
networking stack. ...)
- TODO: check
+ NOT-FOR-US: py-libp2p
CVE-2026-73567 (sm-crypto provides JavaScript implementations of the Chinese
cryptogra ...)
- TODO: check
+ NOT-FOR-US: sm-crypto
CVE-2026-73566 (node-tar is a tar archive manipulation library for Node.js.
Prior to 7 ...)
TODO: check
CVE-2026-73565 (@hono/node-server allows running the Hono application on
Node.js. From ...)
- TODO: check
+ NOT-FOR-US: Hono
CVE-2026-73564 (frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's
optional ...)
TODO: check
CVE-2026-73563 (Backstage is an open framework for building developer portals.
Prior t ...)
- TODO: check
+ NOT-FOR-US: Backstage
CVE-2026-73562 (Mongoose is a MongoDB object modeling tool designed to work in
an asyn ...)
TODO: check
CVE-2026-73561 (Hub is a Node.js WebSocket server and client with added
features. Prio ...)
- TODO: check
+ NOT-FOR-US: Hub Node.js WebSocket server and client
CVE-2026-73559 (vLLM is an inference and serving engine for large language
models. Fro ...)
TODO: check
CVE-2026-73558 (vLLM is an inference and serving engine for large language
models. Pri ...)
@@ -255,23 +255,23 @@ CVE-2026-73556 (vLLM is an inference and serving engine
for large language model
CVE-2026-73555 (vLLM is an inference and serving engine for large language
models. Pri ...)
TODO: check
CVE-2026-73533 (Ninja Tables Pro 5.2.11 contains an embedded malicious code
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Ninja Tables Pro
CVE-2026-73532 (Fluent Forms Pro 6.2.7 contains an embedded malicious code
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Fluent Forms Pro
CVE-2026-73515 (PostGIS before 3.7.0beta2 contains an out-of-bounds read
vulnerability ...)
TODO: check
CVE-2026-73514 (The address_standardizer extension for PostGIS through 3.7.0,
fixed in ...)
- TODO: check
+ NOT-FOR-US: address_standardizer extension for PostGIS
CVE-2026-73509 (OpenList a file list program that supports multiple storage.
Prior to ...)
- TODO: check
+ NOT-FOR-US: OpenList
CVE-2026-73508 (Netty is an asynchronous, event-driven network application
framework. ...)
TODO: check
CVE-2026-73507 (Netty is an asynchronous, event-driven network application
framework. ...)
TODO: check
CVE-2026-73506 (Oh My Posh is the most customisable and low-latency cross
platform/she ...)
- TODO: check
+ NOT-FOR-US: Oh My Posh
CVE-2026-73505 (Oh My Posh is the most customisable and low-latency cross
platform/she ...)
- TODO: check
+ NOT-FOR-US: Oh My Posh
CVE-2026-73488 (Flowise versions before 3.1.3 contain an insecure direct
object refere ...)
NOT-FOR-US: Flowise
CVE-2026-73487 (Flowise before 3.1.3 contains a regex-based Python code
validator bypa ...)
@@ -305,17 +305,17 @@ CVE-2026-73344 (Author Cross Site Scripting (XSS) in WP
Data Access <= 5.5.79 ve
CVE-2026-73340 (Contributor Cross Site Scripting (XSS) in Featured Image from
URL <= 5 ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-73266 (A flaw was found in the clusterclaims-controller component of
Multiclu ...)
- TODO: check
+ NOT-FOR-US: Red Hat Multicluster Engine for Kubernetes
CVE-2026-73188 (Unauthenticated Sensitive Data Exposure in KiviCare <= 4.5.1
versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-73038 (NodeBB before 4.15.0 contains a stored cross-site scripting
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: NodeBB
CVE-2026-73037 (Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected
cross-site s ...)
- TODO: check
+ NOT-FOR-US: Next AI Draw.io
CVE-2026-72777 (Next AI Draw.io through 0.4.16 contains a server-side request
forgery ...)
- TODO: check
+ NOT-FOR-US: Next AI Draw.io
CVE-2026-72741 (Rainbond through 6.9.7 contains a broken access control
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Rainbond
CVE-2026-6387 (A potential authentication bypass vulnerability was reported in
Lenovo ...)
NOT-FOR-US: Lenovo
CVE-2026-67991 (crmne/ruby_llm at commit
fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 cont ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e2d1a78b7b153ac713b1e04bf2253b2a9e08062e
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e2d1a78b7b153ac713b1e04bf2253b2a9e08062e
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
