Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
fa1ac825 by security tracker role at 2026-08-25T19:15:32+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -113,103 +113,103 @@ CVE-2026-78684 (vLLM before 0.27.0 fails to properly
classify DeepStream as a GP
CVE-2026-78581 (Authorization Bypass Through User-Controlled Key (CWE-639) in
Kibana c ...)
TODO: check
CVE-2026-78576 (The Readabler plugin for WordPress is vulnerable to SQL
Injection in a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78572 (The Kalles Addons plugin for WordPress is vulnerable to PHP
Object Inj ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78570 (The Total Donations plugin for WordPress is vulnerable to
Privilege Es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78568 (The Total Donations plugin for WordPress is vulnerable to SQL
Injectio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78566 (The Shuffle theme for WordPress is vulnerable to Local File
Inclusion ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78563 (The NotificationX Pro plugin for WordPress is vulnerable to
Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78562 (The Verdure Core plugin for WordPress is vulnerable to Local
File Incl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78468 (The FluentCRM Pro \u2013 Email Newsletter, Automation, Email
Marketing ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78379 (Improper neutralization of input used for LLM prompting in the
python_ ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-78322 (A flaw was found in file-roller. When opening or extracting a
maliciou ...)
TODO: check
CVE-2026-77998 (Joomla Extension - miniorange.com - Unauthenticated
Authentication Byp ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-77997 (Joomla Extension - yootheme.com - Authenticated, privileged
informatio ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-77996 (Joomla Extension - yootheme.com - Authenticated, privileged
stored XSS ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-77824 (The Media Sweep \u2013 WordPress Media Cleaner plugin for
WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-77146 (The extension's invitation controller fails to stop processing
after r ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77145 (The permission check for the frontend management update flow
verified ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77144 (The frontend management plugin attributed a newly created
event to the ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77143 (The frontend topic editing flow does not verify on the server
side tha ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77142 (The frontend company self-service editing feature relies on a
template ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77141 (The extension resolves the targeted club record from a
user-supplied r ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77140 (The extension validates the HMAC of a frontend employee edit
link only ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77139 (The extension fails to validate a client-supplied template
element key ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77138 (The extension fails to safely process untrusted client input
of an att ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77137 (The extension fails to properly sanitize user input before
using it in ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77136 (The extension passes the raw value of a form field configured
as "This ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77135 (The extension's user detail view fails to verify that a
requested user ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77134 (The extension fails to require the dedicated admin
confirmation token ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77133 (The extension fails to restrict which frontend usergroups a
logged-in ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77131 (When OpenSSL is unavailable on the server, the extension
transmits TYP ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77130 (The extension fails to properly validate the expiration of a
client-su ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77129 (The extension passes an editor-configurable email subject
string direc ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77128 (The extension fails to enforce enable-field restrictions on a
reposito ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-77127 (The extension fails to restrict a backend AJAX endpoint for
inline edi ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-76198 (CAI Content Credentials is affected by an Improper Input
Validation vu ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-76197 (Adobe Campaign Classic (ACC) is affected by an Improper
Neutralization ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-76195 (Adobe Campaign Classic (ACC) is affected by an Improper
Neutralization ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-76193 (Adobe Campaign Classic (ACC) is affected by a Server-Side
Request Forg ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-76189 (CAI Content Credentials is affected by an Integer Underflow
(Wrap or W ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-76128 (The eCommerce Product Catalog plugin for WordPress is
vulnerable to St ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75971 (The ShopEngine Elementor WooCommerce Builder Addon \u2013 All
in One W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75908 (The Newsletters plugin for WordPress is vulnerable to
authorization by ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75770 (Substance3D - Painter is affected by an out-of-bounds write
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-75769 (Substance3D - Painter is affected by a Heap-based Buffer
Overflow vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-75768 (Substance3D - Painter is affected by an Untrusted Search Path
vulnerab ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-75767 (Substance3D - Painter is affected by a Heap-based Buffer
Overflow vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-75766 (Substance3D - Painter is affected by a Heap-based Buffer
Overflow vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-75752 (Substance3D - Painter is affected by an out-of-bounds read
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-75750 (Substance3D - Painter is affected by a Heap-based Buffer
Overflow vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-75749 (Substance3D - Painter is affected by an out-of-bounds write
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-75498 (Webkul QloApps does not validate request parameters before a
database ...)
TODO: check
CVE-2026-75497 (Webkul QloApps does not validate request parameters before a
database ...)
@@ -221,21 +221,21 @@ CVE-2026-75038 (UNIX symbolic link (symlink) following
vulnerability in ilya-zlo
CVE-2026-75037 (Polkit Authentication Based on UnixProcessSubject / Peer PID
in LACT o ...)
TODO: check
CVE-2026-71564 (Substance3D - Designer is affected by an out-of-bounds write
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-71444 (CAI Content Credentials is affected by an Integer Underflow
(Wrap or W ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-71443 (CAI Content Credentials is affected by an Improper Input
Validation vu ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-71442 (CAI Content Credentials is affected by an Integer Underflow
(Wrap or W ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-71441 (Illustrator is affected by an out-of-bounds read vulnerability
that co ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-71399 (Adobe XD is affected by a Buffer Overflow vulnerability that
could res ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-71382 (Substance3D - Sampler is affected by an out-of-bounds write
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-71360 (CAI Content Credentials is affected by an Uncontrolled
Resource Consum ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-70551 (A user who can read an existing remote VCS repository can
replace its ...)
TODO: check
CVE-2026-70550 (An authorization weakness in JFrog Artifactory Composer
repository han ...)
@@ -253,13 +253,13 @@ CVE-2026-65979 (OpenEXR is the reference implementation
and specification for th
CVE-2026-65633 (Improper Authentication vulnerability in team-alembic
AshAuthenticatio ...)
TODO: check
CVE-2026-64204 (There is a memory corruption vulnerability recently discovered
in NI L ...)
- TODO: check
+ NOT-FOR-US: National Instruments
CVE-2026-64203 (There is a memory corruption vulnerability recently discovered
in NI L ...)
- TODO: check
+ NOT-FOR-US: National Instruments
CVE-2026-64202 (There is a memory corruption vulnerability recently discovered
in NI L ...)
- TODO: check
+ NOT-FOR-US: National Instruments
CVE-2026-64201 (There is a memory corruption vulnerability recently discovered
in NI L ...)
- TODO: check
+ NOT-FOR-US: National Instruments
CVE-2026-63587 (The SMS control function of IE-SR-2TX-WL-4G devices can
require a pass ...)
TODO: check
CVE-2026-63586 (The web-based management interface uses a modified uhttpd
server with ...)
@@ -289,23 +289,23 @@ CVE-2026-59186 (OpenEXR is the reference implementation
and specification for th
CVE-2026-59184 (OpenEXR is the reference implementation and specification for
the EXR ...)
TODO: check
CVE-2026-57910 (Improper authentication in the WatchGuard Agent allows an
unauthentica ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-57909 (A path traversal vulnerability in WatchGuard Agent allows a
remote, un ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-57863 (Crater Invoice through 6.0.6 contains a path traversal
vulnerability i ...)
TODO: check
CVE-2026-56096 (The extension passes the user-supplied search query parameter
to Apach ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-56095 (The extension's indexer passed every field value returned by
content o ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-56094 (The extension allows a request-provided additionalFilters
parameter to ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-56093 (The extension's frontend detail-view document lookup does not
apply th ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-56092 (The extension forces empty frontend-group and
subpage-inheritance rest ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-55976 (Server-Side Request Forgery (SSRF) in Avro SerDe schema
resolution in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-55663 (mediasoup is a WebRTC video conferencing system. From version
3.20.0 u ...)
TODO: check
CVE-2026-55640 (Nextcloud MCP Server is a production-ready MCP server that
connects AI ...)
@@ -377,55 +377,55 @@ CVE-2026-55525 (PraisonAI is a multi-agent teams system.
Prior to praisonaiagent
CVE-2026-55419 (Reachy Mini is an SDK for controlling Reachy Mini robots.
Prior to 1.8 ...)
TODO: check
CVE-2026-53561 (An improper authentication vulnerability in HiveServer2 SAML
bearer-to ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-49845 (SQL injection in Hive Metastore direct SQL partition-name
resolution i ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-48433 (Substance3D - Designer is affected by a Heap-based Buffer
Overflow vul ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48432 (Substance3D - Designer is affected by a Heap-based Buffer
Overflow vul ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48431 (Substance3D - Designer is affected by a Heap-based Buffer
Overflow vul ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48430 (Substance3D - Designer is affected by a Heap-based Buffer
Overflow vul ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48429 (Substance3D - Designer is affected by a NULL Pointer
Dereference vulne ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48428 (Substance3D - Designer is affected by a Heap-based Buffer
Overflow vul ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48427 (Substance3D - Designer is affected by an out-of-bounds write
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48426 (Substance3D - Designer is affected by an out-of-bounds write
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48425 (Substance3D - Sampler is affected by a Heap-based Buffer
Overflow vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48424 (Substance3D - Sampler is affected by a Heap-based Buffer
Overflow vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48423 (Substance3D - Sampler is affected by a Heap-based Buffer
Overflow vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48422 (Substance3D - Sampler is affected by a Heap-based Buffer
Overflow vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48421 (Substance3D - Sampler is affected by an out-of-bounds write
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48420 (Substance3D - Sampler is affected by an out-of-bounds write
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48419 (Substance3D - Sampler is affected by an out-of-bounds write
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48418 (Substance3D - Sampler is affected by an out-of-bounds write
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48417 (Substance3D - Sampler is affected by a Stack-based Buffer
Overflow vul ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-47626 (NVIDIA DGX Spark contains a vulnerability in the system
firmware, wher ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-47624 (NVIDIA DGX Spark contains a vulnerability in UEFI where a
Attacker may ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-26211 (Ekushey Project Manager CRM stores the
administrator-configured system ...)
TODO: check
CVE-2026-24263 (NVIDIA DGX Spark contains a vulnerability in the system
firmware, wher ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24262 (NVIDIA DGX Spark contains a vulnerability in the system
firmware, wher ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24225 (NVIDIA DGX Spark contains a vulnerability in the standalone MM
firmwar ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24170 (NVIDIA UFM Enterprise contains a vulnerability in the web
interface au ...)
TODO: check
CVE-2026-24169 (NVIDIA UFM Enterprise contains a vulnerability in the plugin
managemen ...)
@@ -437,59 +437,59 @@ CVE-2026-24167 (NVIDIA UFM Enterprise contains a
vulnerability in the user manag
CVE-2026-24166 (NVIDIA UFM Enterprise contains a vulnerability in the session
manageme ...)
TODO: check
CVE-2026-21758 (HCL Hive is affected by an information disclosure
vulnerability, which ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-21754 (HCL Hive is affected by multiple infrastructure and network
configurat ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-21753 (HCL Hive is affected by weak software supply chain governance,
which c ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-19949 (The All-in-One WP Migration and Backup plugin for WordPress is
vulnera ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19913 (The Kaltura HTML5 player (mwEmbed / html5lib) contains a local
file di ...)
TODO: check
CVE-2026-19912 (The Kaltura HTML5 player (mwEmbed / html5lib) contains an
unauthentica ...)
TODO: check
CVE-2026-19851 (A Use of Default Password vulnerability affecting Tuleap
Enterprise Ed ...)
- TODO: check
+ NOT-FOR-US: Dassault Systemes
CVE-2026-18547 (The Ultimate Member \u2013 User Profile, Registration, Login,
Member D ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18512 (The TranslatePress \u2013 Translate Multilingual sites with AI
Transla ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18445 (There is an integer overflow vulnerability resulting in an
out-of-boun ...)
- TODO: check
+ NOT-FOR-US: National Instruments
CVE-2026-18444 (There is an integer conversion vulnerability resulting in an
out-of-bo ...)
- TODO: check
+ NOT-FOR-US: National Instruments
CVE-2026-18328 (The Forminator Forms \u2013 Contact Form, Payment Form &
Custom Form B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18323 (The Forminator Forms \u2013 Contact Form, Payment Form &
Custom Form B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18100 (The MetForm \u2013 Contact Form, Survey, Quiz, & Custom Form
Builder f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-17587 (The My Agile Privacy\xae \u2013 CMP, Cookie Consent & Privacy
Tools pl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-17548 (Missing authorization in Checkmk <2.5.0p12, <2.4.0p36,
<2.3.0p50 and a ...)
TODO: check
CVE-2026-16601 (The CM Map Locations \u2013 Visualize and share your locations
in a fe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-16599 (GNU wget is vulnerable to denial of service in its FTP
OPIE/S-KEY auth ...)
TODO: check
CVE-2026-16286 (Unrestricted upload of file with dangerous type vulnerability
in TRtek ...)
TODO: check
CVE-2026-16234 (There is a memory corruption vulnerability recently discovered
in NI L ...)
- TODO: check
+ NOT-FOR-US: National Instruments
CVE-2026-16233 (There is a memory corruption vulnerability recently discovered
in NI L ...)
- TODO: check
+ NOT-FOR-US: National Instruments
CVE-2026-16231 (hbs is an Express view engine that wraps Handlebars. Its
registerAsync ...)
TODO: check
CVE-2026-15310 (When decompressing crafted zip files using the
bzip/LZMA/Zstandard c ...)
TODO: check
CVE-2026-13478 (The Zephyr ext2 filesystem driver validates the on-disk block
bitmap i ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-13217 (The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs
a sessi ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-13216 (The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a
device's ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-12878 (In affected versions of the Codefresh platform an
authenticated user c ...)
- TODO: check
+ NOT-FOR-US: Octopus Deploy
CVE-2026-12600 (Denial-of-service (DoS) vulnerability in the internal JPEG2000
(JPX) d ...)
TODO: check
CVE-2025-71407 (Nokogiri before 1.18.3 contains a stack buffer overflow
vulnerability ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fa1ac82553126e2d450b2f15237392659bebfb7d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fa1ac82553126e2d450b2f15237392659bebfb7d
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
