Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
413cbc79 by Salvatore Bonaccorso at 2026-08-24T22:46:41+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -220,17 +220,17 @@ CVE-2026-76844 (webpack-dev-middleware resolves a request
to a local file in get
CVE-2026-76843 (The official Flair wheels for 0.15.0 and 0.15.1 still contain
flair/mo ...)
TODO: check
CVE-2026-76842 (The Mercado Pago Node.js SDK interpolates caller-supplied
identifiers ...)
- TODO: check
+ NOT-FOR-US: Mercado Pago Node.js SDK
CVE-2026-76841 (Xinference loads models with Hugging Face remote code
execution uncond ...)
- TODO: check
+ NOT-FOR-US: Xinference
CVE-2026-76840 (RustDesk's Windows clipboard redirection copies a
peer-supplied length ...)
TODO: check
CVE-2026-76838 (Hi.Events validates a webhook destination only when it is
registered, ...)
- TODO: check
+ NOT-FOR-US: Hi.Events
CVE-2026-76837 (Baserow interpolates a user's display name into the rich-text
mention ...)
- TODO: check
+ NOT-FOR-US: Baserow
CVE-2026-76836 (AzuraCast exposes the Liquidsoap custom configuration fields
through a ...)
- TODO: check
+ NOT-FOR-US: AzuraCast
CVE-2026-76835 (OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header
when dec ...)
TODO: check
CVE-2026-76831
@@ -242,13 +242,13 @@ CVE-2026-76829
CVE-2026-76172 (fast-uri is a URI parser for Node.js. During parsing it runs a
legacy ...)
TODO: check
CVE-2026-76073 (Label Studio does not scope the annotation detail endpoint to
the requ ...)
- TODO: check
+ NOT-FOR-US: Label Studio
CVE-2026-76072 (The Continue CLI applies an incomplete denylist as its only
barrier to ...)
- TODO: check
+ NOT-FOR-US: Continue CLI
CVE-2026-76071 (Netis NC63 firmware through V3.0.0.3327 contains a stack-based
buffer ...)
- TODO: check
+ NOT-FOR-US: Netis NC63 firmware
CVE-2026-76070 (Netis NC63 firmware through V3.0.0.3327 contains a stack-based
buffer ...)
- TODO: check
+ NOT-FOR-US: Netis NC63 firmware
CVE-2026-76055 (Improper Neutralization of Special Elements used in an OS
Command in t ...)
NOT-FOR-US: Black Duck
CVE-2026-76054 (Invocation of Process Using Visible Sensitive Information in
Black Duc ...)
@@ -260,9 +260,9 @@ CVE-2026-75931 (fast-uri is a URI parser for Node.js. It
canonicalizes a host to
CVE-2026-75899 (fast-uri is a URI parser for Node.js. It decodes percent
escapes in a ...)
TODO: check
CVE-2026-75371 (An integer handling flaw in the cobs_decode function of
SpaceDot Acube ...)
- TODO: check
+ NOT-FOR-US: SpaceDot AcubeSAT OBC software
CVE-2026-75370 (An out-of-bounds read/write vulnerability in the
MessageParser::parseE ...)
- TODO: check
+ NOT-FOR-US: SpaceDot AcubeSAT OBC software
CVE-2026-75099 (Unauthenticated REST disclosureof certain content items in
Apache Allu ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71982
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/413cbc79e4dccba0e3b445552805b1ad21e07980
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/413cbc79e4dccba0e3b445552805b1ad21e07980
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
