Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
4b07bb57 by Salvatore Bonaccorso at 2026-09-15T21:44:08+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -42,45 +42,45 @@ CVE-2026-91990 (Tornado before 6.5.8 contains a memory
amplification vulnerabili
- python-tornado <unfixed>
NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
CVE-2026-91989 (atomic-agents-stack before 1.1.0 contains a path traversal
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: atomic-agents-stack
CVE-2026-91988 (atomic-agents-stack before 1.1.0 accepts cleartext HTTP
schemes in the ...)
- TODO: check
+ NOT-FOR-US: atomic-agents-stack
CVE-2026-91987 (atomic-agents-stack before 1.1.0 contains a cost-guardrail
bypass in t ...)
- TODO: check
+ NOT-FOR-US: atomic-agents-stack
CVE-2026-91986 (gitoxide gix-transport before 0.59.2 fails to filter control
character ...)
TODO: check
CVE-2026-91985 (Vikunja before 2.6.0 fails to properly restrict access to the
link-sha ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91984 (Vikunja before 2.6.0 fails to validate that user-supplied
project_view ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91983 (Vikunja before 2.6.0 contains an API token scope bypass
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91982 (Vikunja before 2.6.0 continues to expose the raw TOTP shared
secret af ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91981 (Vikunja versions before 2.6.0 fail to properly validate
link-share tok ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91980 (vikunja before 2.6.0 fails to validate team access when
attaching team ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91979 (Vikunja before 2.6.0 fails to limit archive expansion during
data impo ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91973 (Vikunja before 2.6.0 contains an authentication bypass
vulnerability i ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91972 (Vikunja versions before 2.6.0 fail to apply rate limiting to
/api/v2 p ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91971 (Vikunja before 2.6.0 fails to apply pixel decode limits to
avatar and ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91970 (Vikunja versions before 2.6.0 contain a resource exhaustion
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91969 (vikunja versions before 2.6.0 contain a resource exhaustion
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91968 (vikunja versions before 2.6.0 contain a resource exhaustion
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-91967 (AVideo through 29.0 contains a blind server-side request
forgery vulne ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-91966 (AVideo through 29.0 contains an unauthenticated server-side
request fo ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-91965 (WWBN AVideo through 29.0 fails to enforce user-group
restrictions in t ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-91964 (FreeRDP versions before 3.31.0 contain a heap-based buffer
overflow in ...)
TODO: check
CVE-2026-91963 (FreeRDP versions before 3.31.0 contain an uninitialized heap
memory di ...)
@@ -122,15 +122,15 @@ CVE-2026-91946 (FreeRDP versions before 3.31.0 contain an
information disclosure
CVE-2026-91945 (FreeRDP versions before 3.31.0 contain an out-of-bounds read
vulnerabi ...)
TODO: check
CVE-2026-91944 (crawl4ai versions before 0.9.3 contain a DOM-based cross-site
scriptin ...)
- TODO: check
+ NOT-FOR-US: crawl4ai
CVE-2026-91943 (Crawl4AI before 0.9.3 contains a server-side request forgery
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Crawl4AI
CVE-2026-91942 (crawl4ai before 0.9.3 contains a DOM-based cross-site
scripting vulner ...)
- TODO: check
+ NOT-FOR-US: crawl4ai
CVE-2026-91941 (Crawl4AI before 0.9.3 contains an uncontrolled resource
consumption vu ...)
- TODO: check
+ NOT-FOR-US: Crawl4AI
CVE-2026-91940 (crawl4ai before 0.9.3 contains an arbitrary file write
vulnerability i ...)
- TODO: check
+ NOT-FOR-US: crawl4ai
CVE-2026-91938 (Flowise versions before 3.1.4 contain a server-side request
forgery vu ...)
NOT-FOR-US: Flowise
CVE-2026-91937 (Flowise before 3.1.4 fails to sanitize the
overrideConfig.sessionId pa ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4b07bb57811d63f17acac2ec41e2c79cab7bf3c8
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4b07bb57811d63f17acac2ec41e2c79cab7bf3c8
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
