Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
33748b5d by Salvatore Bonaccorso at 2026-08-19T07:41:13+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -110,67 +110,67 @@ CVE-2026-75874 (Sandbox escape in the Remote Settings
Client component. This vul
- firefox <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-74/#CVE-2026-75874
CVE-2026-75872 (HTML Injection in the public subscription form in maalfer
MailerUp bef ...)
- TODO: check
+ NOT-FOR-US: maalfer MailerUp
CVE-2026-75859 (CodeWhale versions before 0.8.64 fail to validate file paths
in the pr ...)
- TODO: check
+ NOT-FOR-US: CodeWhale
CVE-2026-75858 (CodeWhale (packages codewhale / codewhale-tui) versions >=
0.8.41 and ...)
- TODO: check
+ NOT-FOR-US: CodeWhale
CVE-2026-75857 (CodeWhale versions >= 0.8.41 and < 0.8.64 contain a
vulnerability in t ...)
- TODO: check
+ NOT-FOR-US: CodeWhale
CVE-2026-75856 (CodeWhale before 0.8.64 contains a server-side request forgery
bypass ...)
- TODO: check
+ NOT-FOR-US: CodeWhale
CVE-2026-75855 (ArcadeDB versions before 26.8.1 fail to sanitize database
names in the ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75854 (ArcadeDB versions before 26.8.1 contain a missing
authentication vulne ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75853 (ArcadeDB's Gremlin wire-protocol plugin
(com.arcadedb:arcadedb-gremlin ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75852 (ArcadeDB versions before 26.8.1 fail to enforce SASL
authentication on ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75851 (ArcadeDB server (com.arcadedb:arcadedb-server) in versions
26.7.3 and ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75850 (ArcadeDB before 26.8.1 fails to bind the authenticated
principal (setC ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75846 (ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains
a missin ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75845 (ArcadeDB versions 26.4.2 through 26.7.3 contain an
authorization bypas ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75844 (ArcadeDB versions before 26.8.1 contain a server-side request
forgery ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75843 (ArcadeDB before 26.8.1 fails to bind the authenticated
principal on th ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75842 (ArcadeDB versions before 26.8.1 contain an arbitrary file read
vulnera ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75841 (ArcadeDB before 26.8.1 contains a denial of service
vulnerability in t ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75840 (ArcadeDB before 26.8.1 contains an arbitrary file read
vulnerability i ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75839 (ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3
contain an ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-75838 (DOMPurify before 3.4.13 contains a cross-site scripting
vulnerability ...)
TODO: check
CVE-2026-75837 (Grav before 2.0.14 fails to guard the access field in the core
group b ...)
- TODO: check
+ NOT-FOR-US: Grav CMS
CVE-2026-75836 (The Grav API plugin (getgrav/grav-plugin-api, bundled with
Grav's admi ...)
- TODO: check
+ NOT-FOR-US: Grav plugin
CVE-2026-75835 (Grav API plugin (getgrav/grav-plugin-api) before 1.0.14
contains a mis ...)
- TODO: check
+ NOT-FOR-US: Grav plugin
CVE-2026-75834 (Grav before 2.0.14 contains a stored cross-site scripting
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Grav CMS
CVE-2026-75833 (The Grav API plugin (getgrav/grav-plugin-api, bundled with
Grav 2.0's ...)
- TODO: check
+ NOT-FOR-US: Grav plugin
CVE-2026-75832 (The Grav API plugin (getgrav/grav-plugin-api, bundled with
Grav 2.0) b ...)
- TODO: check
+ NOT-FOR-US: Grav plugin
CVE-2026-75831 (Grav before 2.0.15 contains a stored cross-site scripting
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Grav CMS
CVE-2026-75830 (grav-plugin-api (getgrav/grav-plugin-api) versions >=
1.0.0-beta.10 an ...)
- TODO: check
+ NOT-FOR-US: Grav plugin
CVE-2026-75829 (grav-plugin-api versions before 1.0.15 fail to validate Twig
content i ...)
- TODO: check
+ NOT-FOR-US: Grav plugin
CVE-2026-75828 (Grav before 2.0.15 contains a stored cross-site scripting
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Grav CMS
CVE-2026-75827 (Grav before 2.0.15 contains an arbitrary file write
vulnerability in t ...)
- TODO: check
+ NOT-FOR-US: Grav CMS
CVE-2026-75784 (A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01.
Affecte ...)
NOT-FOR-US: TRENDnet
CVE-2026-75783 (A security vulnerability has been detected in TRENDnet
TEW-WLC100P 12. ...)
@@ -178,21 +178,21 @@ CVE-2026-75783 (A security vulnerability has been
detected in TRENDnet TEW-WLC10
CVE-2026-75778 (A vulnerability was identified in code-projects Task
Management System ...)
NOT-FOR-US: code-projects
CVE-2026-75774 (A vulnerability was determined in karakeep-app karakeep up to
0.32.0. ...)
- TODO: check
+ NOT-FOR-US: karakeep-app karakeep
CVE-2026-75773 (A vulnerability was found in karakeep-app karakeep up to
0.32.0. The a ...)
- TODO: check
+ NOT-FOR-US: karakeep-app karakeep
CVE-2026-75627 (Bastillion fails to properly validate request URI paths in its
control ...)
- TODO: check
+ NOT-FOR-US: Bastillion
CVE-2026-75626 (SpiderFoot fails to HTML-escape correlation titles built from
external ...)
- TODO: check
+ NOT-FOR-US: SpiderFoot
CVE-2026-75625 (Kraken agents fail to verify peer-to-peer downloaded blobs
against the ...)
TODO: check
CVE-2026-75485 (A flaw was found in the must-gather component of Red Hat
Advanced Clus ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-75130 (Context7 through 2.1.2 contains a prompt injection
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: Context7
CVE-2026-75107 (Grav Form Plugin before 9.1.19 fails to escape
field-definition proper ...)
- TODO: check
+ NOT-FOR-US: Grav plugin
CVE-2026-75032 (A flaw was found in BlueZ. Insufficient validation of packet
length fi ...)
TODO: check
CVE-2026-74990 (Internally found bugs present in Thunderbird ESR 140.13,
Thunderbird E ...)
@@ -491,9 +491,9 @@ CVE-2026-74934 (Site isolation issue in the Graphics:
CanvasWebGL component. Thi
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-76/#CVE-2026-74934
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-79/#CVE-2026-74934
CVE-2026-74908 (Grav plugin-api before 1.0.15 contains a script injection
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Grav plugin
CVE-2026-74907 (Grav before 2.0.15 contains a path traversal vulnerability in
the stat ...)
- TODO: check
+ NOT-FOR-US: Grav CMS
CVE-2026-74906 (SiYuan before v3.7.4 contains an incorrect authorization
vulnerability ...)
NOT-FOR-US: SiYuan
CVE-2026-74905 (SiYuan before v3.7.4 contains a server-side request forgery
(SSRF) vul ...)
@@ -505,13 +505,13 @@ CVE-2026-74903 (SiYuan before v3.7.4 contains an
insufficient access control vul
CVE-2026-74902 (SiYuan before v3.7.4 contains a cross-site scripting
vulnerability in ...)
NOT-FOR-US: SiYuan
CVE-2026-74046 (Wazuh 4.4.0 before 4.14.7 contains a denial of service
vulnerability i ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74044 (Wazuh 4.0.0 before 4.14.6 contains a path traversal
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74039 (Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of
service ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74038 (Wazuh 4.0.0 before 4.14.6 contains a path traversal
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74015 (Unauthenticated SQL Injection in Readabler < 2.0.18 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-74012 (Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.)
@@ -537,13 +537,13 @@ CVE-2026-73995 (Subscriber Broken Authentication in User
Registration <= 5.2.6 v
CVE-2026-73994 (Unauthenticated Broken Access Control in Charitable <=
1.8.11.3 versio ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-73834 (A flaw was found in the must-gather component of Red Hat
Advanced Clus ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-73692
REJECTED
CVE-2026-73502 (kin-openapi is a Go project for handling OpenAPI files. From
0.2.0 unt ...)
TODO: check
CVE-2026-73426 (Trix is a what-you-see-is-what-you-get rich text editor for
everyday w ...)
- TODO: check
+ NOT-FOR-US: Trix
CVE-2026-73404 (Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41
versions ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-73400 (Unauthenticated Local File Inclusion in Restaurant Menu by
MotoPress < ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/33748b5d3edb456c028500d7f28bb6d91575f55e
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/33748b5d3edb456c028500d7f28bb6d91575f55e
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
