Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
2089f738 by Salvatore Bonaccorso at 2026-08-28T21:53:53+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -22,17 +22,17 @@ CVE-2026-82324 (A flaw was found in the file-iff (IFF/ILBM)
plugin in GIMP. When
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16584
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/gimp/-/commit/2fba61f28efaebdc170e951e499e42820fbf633a
CVE-2026-82261 (SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with
experime ...)
- TODO: check
+ NOT-FOR-US: SvelteKit
CVE-2026-82260 (SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with
experime ...)
- TODO: check
+ NOT-FOR-US: SvelteKit
CVE-2026-82259 (SvelteKit versions from 2.49.0 through 2.53.2 (fixed in
2.53.3) contai ...)
- TODO: check
+ NOT-FOR-US: SvelteKit
CVE-2026-82258 (SvelteKit versions from 2.38.0 before 2.60.1 contain a race
condition ...)
- TODO: check
+ NOT-FOR-US: SvelteKit
CVE-2026-82257 (SvelteKit versions before 2.69.1 contain a prototype pollution
vulnera ...)
- TODO: check
+ NOT-FOR-US: SvelteKit
CVE-2026-82256 (SvelteKit before 2.69.1 fails to properly validate remote form
functio ...)
- TODO: check
+ NOT-FOR-US: SvelteKit
CVE-2026-82255 (gitoxide versions from 0.25.4 contain an HTTP credential leak
vulnerab ...)
TODO: check
CVE-2026-82254 (gitoxide before 0.69.0 contains unchecked array indexing in
delta appl ...)
@@ -52,29 +52,29 @@ CVE-2026-82248 (gix-worktree-state before 0.33.0 (part of
gitoxide) allows writi
CVE-2026-82247 (gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a
hand-roll ...)
TODO: check
CVE-2026-82246 (Budibase Server before 3.41.3 contains a server-side request
forgery v ...)
- TODO: check
+ NOT-FOR-US: Budibase
CVE-2026-82245 (Budibase before 3.41.3 fails to enforce role-based
authorization on li ...)
- TODO: check
+ NOT-FOR-US: Budibase
CVE-2026-82244 (Budibase versions before 3.41.3 contain a remote code
execution vulner ...)
- TODO: check
+ NOT-FOR-US: Budibase
CVE-2026-82243 (Budibase Server before 3.41.3 contains a server-side request
forgery v ...)
- TODO: check
+ NOT-FOR-US: Budibase
CVE-2026-82242 (Budibase versions before 3.41.3 contain a missing
authorization vulner ...)
- TODO: check
+ NOT-FOR-US: Budibase
CVE-2026-82241 (Budibase backend-core (@budibase/backend-core, as used by
@budibase/se ...)
- TODO: check
+ NOT-FOR-US: Budibase
CVE-2026-82240 (Budibase before 3.41.3 fails to validate app-scoped builder
role assig ...)
- TODO: check
+ NOT-FOR-US: Budibase
CVE-2026-82239 (Budibase before 3.41.3 fails to enforce per-table role
restrictions on ...)
- TODO: check
+ NOT-FOR-US: Budibase
CVE-2026-82238 (filebrowser from version 2.24.0 contains a race condition in
the TUS u ...)
- TODO: check
+ NOT-FOR-US: filebrowser
CVE-2026-82237 (filebrowser through 2.63.23 does not remove share records when
a share ...)
- TODO: check
+ NOT-FOR-US: filebrowser
CVE-2026-82236 (File Browser versions from 2.63.6 through 2.63.23 fail to
clean up pub ...)
- TODO: check
+ NOT-FOR-US: filebrowser
CVE-2026-82235 (filebrowser through 2.63.23 fails to validate named pipes in
directory ...)
- TODO: check
+ NOT-FOR-US: filebrowser
CVE-2026-82234 (SiYuan versions before v3.8.1 contain a server-side request
forgery vu ...)
NOT-FOR-US: SiYuan
CVE-2026-82233 (SiYuan before v3.8.1 contains a path traversal vulnerability
in the as ...)
@@ -86,15 +86,15 @@ CVE-2026-82222 (Deserialization of Untrusted Data
vulnerability in Liquid Web /
CVE-2026-82220 (Unauthenticated Other Vulnerability Type in Forminator <=
1.57.1 versi ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-82181 (Medical Practice Management System developed by Le-yan has a
Sensitive ...)
- TODO: check
+ NOT-FOR-US: Medical Practice Management System
CVE-2026-82123 (Improper neutralization of input during web page generation
('cross-si ...)
TODO: check
CVE-2026-82112 (A flaw has been found in houtini-ai houtini-lm up to 2.13.2.
The impac ...)
- TODO: check
+ NOT-FOR-US: houtini-ai houtini-lm
CVE-2026-82111 (A vulnerability was detected in iswalle getnote-mcp up to
1.5.0. The a ...)
- TODO: check
+ NOT-FOR-US: iswalle getnote-mcp
CVE-2026-82078 (An unsafe dynamic class loading vulnerability exists in the
database c ...)
- TODO: check
+ NOT-FOR-US: PaperCut
CVE-2026-81777 (Authentication Bypass by Spoofing vulnerability in WPDeveloper
Essenti ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-81767 (Unauthenticated Broken Access Control in Simple Payment <=
2.5.2 versi ...)
@@ -108,13 +108,13 @@ CVE-2026-81759 (Contributor Broken Access Control in
WpEvently <= 5.5.0 versions
CVE-2026-81757 (Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276
version ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-81733 (WWBN AVideo through 30.0 (and master up to commit 4cb576e)
contains a ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-81732 (WWBN AVideo through version 30.0 fails to enforce
authentication on th ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-81578 (An improper access control vulnerability exists in the web
management ...)
- TODO: check
+ NOT-FOR-US: PaperCut
CVE-2026-81341 (wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for
TLS 1.2 ...)
- TODO: check
+ NOT-FOR-US: wolfEngine
CVE-2026-81299 (Subscriber Insecure Direct Object References (IDOR) in WP Job
Portal < ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-81285 (Unauthenticated Denial of Service Attack in Smush Image
Compression an ...)
@@ -122,9 +122,9 @@ CVE-2026-81285 (Unauthenticated Denial of Service Attack in
Smush Image Compress
CVE-2026-81284 (Contributor Broken Access Control in ACF Extended <= 0.9.2.6
versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-81020 (wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM
nonce on ...)
- TODO: check
+ NOT-FOR-US: wolfEngine
CVE-2026-81019 (wolfProvider before 1.2.2 generates the 8-byte explicit
AES-GCM nonce ...)
- TODO: check
+ NOT-FOR-US: wolfProvider
CVE-2026-79996 (The User Registration & Membership WordPress plugin before
5.2.6 does ...)
NOT-FOR-US: WordPress plugin
CVE-2026-79995 (The User Registration & Membership WordPress plugin before
5.2.5 does ...)
@@ -134,7 +134,7 @@ CVE-2026-79706 (The Breeze Cache WordPress plugin before
2.5.13 does not sanitis
CVE-2026-79615 (The Quiz and Survey Master (QSM) WordPress plugin before
11.2.4 does ...)
NOT-FOR-US: WordPress plugin
CVE-2026-78238 (SOY Gallery contains a cross-site scripting vulnerability. An
arbitra ...)
- TODO: check
+ NOT-FOR-US: SOY Gallery
CVE-2026-78073 (Joomla Extension - mrvinoth.com - Reflected XSS in All Video
Share 1.0 ...)
NOT-FOR-US: Joomla
CVE-2026-78072 (Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in
Sexy Po ...)
@@ -144,9 +144,9 @@ CVE-2026-78071 (Joomla Extension - digital-peak.com -
Authenticated, privileged
CVE-2026-78070 (Joomla Extension - digital-peak.com - Authenticated,
privileged blind ...)
NOT-FOR-US: Joomla
CVE-2026-78032 (SOY CMS contains an issue with deserialization of untrusted
data. An ...)
- TODO: check
+ NOT-FOR-US: SOY CMS
CVE-2026-77838 (SOY Calendar contains a cross-site scripting vulnerability. An
arbitra ...)
- TODO: check
+ NOT-FOR-US: SOY
CVE-2026-77701 (The WCFM Marketplace WordPress plugin before 3.8.2 does not
correctly ...)
NOT-FOR-US: WordPress plugin
CVE-2026-76581 (The WPMU DEV Dashboard plugin for WordPress is vulnerable to
Authentic ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2089f738fbc8f7685e92bb3df2bcab608acb38a0
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2089f738fbc8f7685e92bb3df2bcab608acb38a0
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
