Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
e145a7ef by Moritz Muehlenhoff at 2026-09-16T15:11:02+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -818,7 +818,7 @@ CVE-2026-54689 (mcp-searxng is a Model Context Protocol
server that gives AI ass
CVE-2026-54688 (mcp-searxng is a Model Context Protocol server that gives AI
assistant ...)
NOT-FOR-US: mcp-searxng
CVE-2026-54637 (Dragonfly is an open source P2P-based file distribution and
image acce ...)
- TODO: check
+ NOT-FOR-US: Dragonfly
CVE-2026-54561 (MCP Memory Keeper is an MCP server for persistent context
management i ...)
TODO: check
CVE-2026-54549 (Meta Ads MCP is a Model Context Protocol (MCP) server that
lets AI ass ...)
@@ -880,21 +880,21 @@ CVE-2026-52819 (Kimai is an open-source time tracking
application. Prior to 2.57
CVE-2026-52724 (Kuma is a modern Envoy-based service mesh that can run on
every cloud ...)
NOT-FOR-US: Kimai
CVE-2026-52484 (An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3
allows a ...)
- TODO: check
+ NOT-FOR-US: MitraStar
CVE-2026-50166 (Kuma is a modern Envoy-based service mesh that can run on
every cloud ...)
- TODO: check
+ NOT-FOR-US: Kuma
CVE-2026-50024 (GitHacker is a tool that restores Git repositories from
exposed .git d ...)
- TODO: check
+ NOT-FOR-US: GitHacker
CVE-2026-49446 (Cosmos provides users the ability self-host a home server by
acting as ...)
- TODO: check
+ NOT-FOR-US: Cosmos
CVE-2026-49254 (Dragonfly is an open source P2P-based file distribution and
image acce ...)
- TODO: check
+ NOT-FOR-US: Dragonfly
CVE-2026-48987 (pyLoad is a free and open-source download manager written in
Python. P ...)
- pyload <itp> (bug #1001980)
CVE-2026-48737 (pyLoad is a free and open-source download manager written in
Python. P ...)
- pyload <itp> (bug #1001980)
CVE-2026-48722 (Nextflow is a DSL for data-driven computational pipelines.
From 25.09. ...)
- TODO: check
+ NOT-FOR-US: Nextflow
CVE-2026-48717 (Open Access Management (OpenAM) is an access management
solution. Prio ...)
NOT-FOR-US: OpenAM
CVE-2026-47780 (free5GC is an open-source implementation of the 5G core
network. In 4. ...)
@@ -926,17 +926,17 @@ CVE-2026-45048 (Open Access Management (OpenAM) is an
access management solution
CVE-2026-44793 (Open Access Management (OpenAM) is an access management
solution. Prio ...)
NOT-FOR-US: OpenAM
CVE-2026-44778 (Inspektor Gadget is a set of tools and framework for data
collection a ...)
- TODO: check
+ NOT-FOR-US: Inspektor Gadget
CVE-2026-44300 (OpenCost provides cost monitoring for Kubernetes workloads and
cloud c ...)
- TODO: check
+ NOT-FOR-US: OpenCost
CVE-2026-44282 (Decidim is a participatory democracy framework. Prior to
0.32.0, a low ...)
- TODO: check
+ NOT-FOR-US: Decidim
CVE-2026-44203 (Open Access Management (OpenAM) is an access management
solution. Prio ...)
NOT-FOR-US: OpenAM
CVE-2026-44202 (Open Access Management (OpenAM) is an access management
solution. Prio ...)
NOT-FOR-US: OpenAM
CVE-2026-44163 (fluent-plugin-opentelemetry is a Fluentd input and output
plugin for f ...)
- TODO: check
+ NOT-FOR-US: fluent-plugin-opentelemetry
CVE-2026-41573 (Open Access Management (OpenAM) is an access management
solution. Prio ...)
NOT-FOR-US: OpenAM
CVE-2026-40058 (CrowdStrike released a security update to address a
vulnerability in t ...)
@@ -944,19 +944,19 @@ CVE-2026-40058 (CrowdStrike released a security update to
address a vulnerabilit
CVE-2026-39919 (Ghostscript before 10.08.0 contains a heap-based buffer
overflow vulne ...)
TODO: check
CVE-2026-39040 (BharatMLStack up to and including 1.3.0 is vulnerable to Cross
Site Sc ...)
- TODO: check
+ NOT-FOR-US: BharatMLStack
CVE-2026-39039 (In BharatMLStack up to and including v1.3.0, Trufflebox UI
stores the ...)
- TODO: check
+ NOT-FOR-US: BharatMLStack
CVE-2026-39038 (BharatMLStack up to and including v1.3.0 is vulnerable to
Cross Site S ...)
- TODO: check
+ NOT-FOR-US: BharatMLStack
CVE-2026-37152 (TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to
contain a ha ...)
NOT-FOR-US: TOTOLINK
CVE-2026-25827 (An issue was discovered in Keyfactor SignServer before 7.6.0.
A number ...)
- TODO: check
+ NOT-FOR-US: Keyfactor SignServer
CVE-2026-25826 (An issue was discovered in Keyfactor SignServer before 7.6.0.
The attr ...)
- TODO: check
+ NOT-FOR-US: Keyfactor SignServer
CVE-2026-25825 (An issue was discovered in Keyfactor SignServer before 7.6.0.
The outp ...)
- TODO: check
+ NOT-FOR-US: Keyfactor SignServer
CVE-2026-21588 (This High severity DoS (Denial of Service) vulnerability was
introduce ...)
NOT-FOR-US: Atlassian
CVE-2026-21587 (This High severity Improper Authorization vulnerability was
introduced ...)
@@ -968,13 +968,13 @@ CVE-2026-1759 (Improper handling of insufficient
permissions or privileges vulne
CVE-2026-1758 (Session fixation vulnerability in Secomea GateManager
(webserver modul ...)
TODO: check
CVE-2026-19886 (OriginLab Origin Viewer OGM File Parsing Memory Corruption
Remote Code ...)
- TODO: check
+ NOT-FOR-US: Origin Viewer
CVE-2026-19885 (OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write
Remote C ...)
- TODO: check
+ NOT-FOR-US: Origin Viewer
CVE-2026-19781 (Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer
Overflow Remote ...)
- TODO: check
+ NOT-FOR-US: Ashlar-Vellum Cobalt
CVE-2026-19780 (Koha Eval Code Injection Remote Code Execution Vulnerability.
This vul ...)
- TODO: check
+ - koha <itp> (bug #702134)
CVE-2026-19774 (BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution
Vulnerabi ...)
- bluez 5.87-1
NOTE: https://github.com/bluez/bluez/pull/2251
@@ -988,7 +988,7 @@ CVE-2026-19515 (The WSO2 Integrator MI VS Code extension
fails to properly sanit
CVE-2026-19504 (Fabric.js loadFromJSON Server-Side Request Forgery
Vulnerability. This ...)
TODO: check
CVE-2026-19407 (Bucket Squatting in Google Cloud Gemini Enterprise Agent
Platform SDK ...)
- TODO: check
+ NOT-FOR-US: Google Cloud Gemini Enterprise Agent Platform SDK
CVE-2026-18115 (Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field
edit_user_proper ...)
NOT-FOR-US: Concrete CMS
CVE-2026-18113 (In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did
not HTM ...)
@@ -998,9 +998,9 @@ CVE-2026-18111 (Concrete CMS 9 before 9.5.3 was vulnerable
to stored cross-site
CVE-2026-18110 (Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an
authorization ...)
NOT-FOR-US: Concrete CMS
CVE-2026-16141 (OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a
logic fl ...)
- TODO: check
+ NOT-FOR-US: OpenBMC
CVE-2026-16140 (OpenBMC's IPMI implementation, phosphor-net-ipmid, is
vulnerable to a ...)
- TODO: check
+ NOT-FOR-US: OpenBMC
CVE-2026-15609 (The Bridge - Creative Multipurpose WordPress Theme theme for
WordPress ...)
NOT-FOR-US: WordPress plugin
CVE-2026-14805 (The Consulting theme for WordPress is vulnerable to Privilege
Escalati ...)
@@ -1086,13 +1086,13 @@ CVE-2026-0170 (In Vp9DecodeFrameTag of
vp9hwd_headers.cc, there is a possible ou
CVE-2026-0159 (In Cellular Modem, there is a possible out-of-bounds write due
to a mi ...)
NOT-FOR-US: Google devices
CVE-2025-66974 (An issue in Prolink 13A Smart Plug Model Version:
DS-3202M-UKv3 Wi-Fi ...)
- TODO: check
+ NOT-FOR-US: Prolink
CVE-2025-5802 (The self-registration flow accepts user-supplied input for
usernames w ...)
NOT-FOR-US: WSO2
CVE-2025-13166 (The SMS OTP flow fails to adequately handle error messages,
allowing a ...)
NOT-FOR-US: WSO2
CVE-2024-58385 (Yonyou U8 CRM contains an unauthenticated SQL injection
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Yonyou
CVE-2024-58384 (Tornado before 6.4.1 contains a CRLF injection vulnerability
in CurlAs ...)
- python-tornado 6.4.1-1
NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-w235-7p84-xx57
@@ -1100,7 +1100,7 @@ CVE-2024-14029 (Tornado before 6.4.1 ignores duplicate
Transfer-Encoding: chunke
- python-tornado 6.4.1-1
NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g
CVE-2023-54398 (Yonyou U8 Cloud contains an unauthenticated Java
deserialization vulne ...)
- TODO: check
+ NOT-FOR-US: Yonyou
CVE-2023-54397 (Tornado before 6.3.3 contains an HTTP request smuggling
vulnerability ...)
TODO: check
CVE-2026-92079 (Mitigation bypass in the Widget: Win32 component. This
vulnerability w ...)
@@ -1844,9 +1844,9 @@ CVE-2026-84489 (A buffer overflow was addressed with
improved bounds checking. T
CVE-2026-84487 (An integer overflow was addressed with improved input
validation. This ...)
NOT-FOR-US: Apple
CVE-2026-82519 (Really Simple Security plugin for WordPress before 9.8.2
contains a mi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82028 (Magistrala before 1.0.0 contains a SQL injection vulnerability
in the ...)
- TODO: check
+ NOT-FOR-US: Magistrala
CVE-2026-81903 (Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container
icon va ...)
NOT-FOR-US: Concrete CMS
CVE-2026-81902 (Concrete CMS 9 through 9.5.2 did not validate a CSRF token in
the orph ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e145a7effa6b6a9a79793859cf7c7bdb5ca82564
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e145a7effa6b6a9a79793859cf7c7bdb5ca82564
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
