Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
9ca4abf7 by Salvatore Bonaccorso at 2026-08-27T23:01:45+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -183,45 +183,45 @@ CVE-2026-81099 (tiger-slack started its MCP HTTP
transport without enabling the
CVE-2026-81098 (The Telnyx MCP server exposed its HTTP transport on every
interface an ...)
NOT-FOR-US: Telnyx MCP server
CVE-2026-81097 (The execute_ruby tool is documented as a read-only Ruby
sandbox and is ...)
- TODO: check
+ NOT-FOR-US: rails-mcp-server
CVE-2026-81096 (ToolUniverse ran caller-supplied Python inside a sandbox that
could be ...)
- TODO: check
+ NOT-FOR-US: ToolUniverse
CVE-2026-81095 (pg-aiguide started its MCP HTTP transport without enabling the
host al ...)
- TODO: check
+ NOT-FOR-US: pg-aiguide
CVE-2026-81094 (The mcp-router CLI served its MCP aggregator on every
interface and en ...)
- TODO: check
+ NOT-FOR-US: mcp-router CLI
CVE-2026-81093 (The get-html-skeleton tool fetched a URL the caller supplied
after che ...)
- TODO: check
+ NOT-FOR-US: get-html-skeleton tool
CVE-2026-81092 (mcp-go accepted requests on its HTTP transports without
checking the H ...)
- TODO: check
+ NOT-FOR-US: mcp-go
CVE-2026-81091 (The proxy middleware in mcp-use's inspector forwards requests
to a des ...)
- TODO: check
+ NOT-FOR-US: mcp-use
CVE-2026-80433 (Subscriber Sensitive Data Exposure in SureFeedback Client Site
<= 1.2. ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-80213 (An issue was discovered in the resolv gem before 0.7.2 for
Ruby. Resol ...)
- TODO: check
+ NOT-FOR-US: resolv Ruby gem
CVE-2026-80212 (An issue was discovered in the resolv gem before 0.7.2 for
Ruby. Resol ...)
- TODO: check
+ NOT-FOR-US: resolv Ruby gem
CVE-2026-80211 (FrontAccounting through 2.4.20 stores and verifies user
passwords as u ...)
TODO: check
CVE-2026-80210 (FrontAccounting through 2.4.20 generates a CSRF token in
end_form() in ...)
TODO: check
CVE-2026-80209 (The updateWorkspace handler in
mods/identity/src/workspaces/createUpda ...)
- TODO: check
+ NOT-FOR-US: Fonoster
CVE-2026-80208 (APITable through 1.13.0-beta.1 annotates both getUserHistories
and clo ...)
- TODO: check
+ NOT-FOR-US: APITable
CVE-2026-80207 (APITable through 1.13.0-beta.1 annotates the create handler of
Interna ...)
- TODO: check
+ NOT-FOR-US: APITable
CVE-2026-79988 (The Twig sandbox mechanism in Craft CMS is configured to allow
dangero ...)
NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-79720 (Reflected XSS in Netron versions <=9.1.2 on desktop
application throug ...)
- TODO: check
+ NOT-FOR-US: Netron
CVE-2026-79719 (Reflected XSS in Netron versions <=9.1.2 on desktop
application throug ...)
- TODO: check
+ NOT-FOR-US: Netron
CVE-2026-79718 (Reflected XSS in Netron versions <=9.1.2 on desktop
application throug ...)
- TODO: check
+ NOT-FOR-US: Netron
CVE-2026-79653 (In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0,
20.1.0, if t ...)
- TODO: check
+ NOT-FOR-US: Eclipse SW360
CVE-2026-78293 (Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB
<= 3.0.6 ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-78292 (Unauthenticated PHP Object Injection in Hash Form <= 1.4.1
versions.)
@@ -263,7 +263,7 @@ CVE-2026-75871 (GitLab has remediated a vulnerability in
the GitLab AI Gateway c
CVE-2026-75573 (In MongoDB Connector for BI, mongodrdl may write a TLS
private-key pas ...)
TODO: check
CVE-2026-75357 (An issue in Bilibili Desktop v.1.17.9 allows a remote attacker
to exec ...)
- TODO: check
+ NOT-FOR-US: Bilibili Desktop
CVE-2026-75159 (An unauthenticated client that can reach a MongoDB Connector
for BI de ...)
TODO: check
CVE-2026-75020 (Improper Neutralization of Special Elements used in an LDAP
Query ('LD ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ca4abf726e73e7ff1a8945ba423207c8af3d77c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ca4abf726e73e7ff1a8945ba423207c8af3d77c
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
