Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
60fc5cb5 by Salvatore Bonaccorso at 2026-09-18T22:08:11+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -9,9 +9,9 @@ CVE-2026-93765 (Mongoid contains an unsafe reflection weakness
in the document p
CVE-2026-93764 (Mongoid may omit encryption rules for fields declared on
embedded mode ...)
NOT-FOR-US: Mongoid
CVE-2026-93763 (A protection mechanism failure in the object-document mapper's
encrypt ...)
- TODO: check
+ NOT-FOR-US: Mongoid
CVE-2026-93762 (Mongoid contains an unsafe reflection weakness in the query
path used ...)
- TODO: check
+ NOT-FOR-US: Mongoid
CVE-2026-93761 (An inefficient regular expression complexity issue in the
in-memory qu ...)
NOT-FOR-US: Mongoid
CVE-2026-93760 (Mongoid does not restrict which query operators may come from
caller-s ...)
@@ -24,7 +24,7 @@ CVE-2026-93753 (deepmerge through 4.3.1 contains a prototype
poisoning vulnerabi
- node-deepmerge <unfixed>
NOTE: https://github.com/TehShrike/deepmerge/issues/273
CVE-2026-93752 (CSSOM through 0.5.0 contains a denial of service vulnerability
in CSSS ...)
- TODO: check
+ NOT-FOR-US: CSSOM
CVE-2026-93751 (uri-js through 4.4.1 contains an improper UTF-8 decoding
vulnerability ...)
- node-uri-js <unfixed>
NOTE: https://github.com/garycourt/uri-js/issues/106
@@ -35,19 +35,19 @@ CVE-2026-93749 (source-map-js through 1.2.1 fails to
validate the per-section of
CVE-2026-93748 (http-cache-semantics through 4.2.0 fails to properly validate
security ...)
TODO: check
CVE-2026-93737 (Azkaban through 4.0.0 omits project permission checks in the
ScheduleS ...)
- TODO: check
+ NOT-FOR-US: Azkaban
CVE-2026-93736 (Mealie before 3.21.0 fails to validate user ownership in the
ratings a ...)
- TODO: check
+ NOT-FOR-US: Mealie
CVE-2026-93690 (uri-js through 4.4.1 contains a denial of service
vulnerability in the ...)
TODO: check
CVE-2026-93689 (WinFsp through 2.2.26215 contains a null pointer dereference
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: WinFsp
CVE-2026-93688 (SGLang through 0.5.19 in prefill/decode disaggregation mode
with Moonc ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-93687 (braces through 3.0.3 contains a stack overflow vulnerability
in the re ...)
TODO: check
CVE-2026-93685 (A flaw was found in the multicluster-observability-addon. A
remote att ...)
- TODO: check
+ NOT-FOR-US: multicluster-observability-addon (Red Hat Advanced Cluster
Management for Kubernetes 2)
CVE-2026-93676 (xdg-dbus-proxy incorrectly filters D-Bus broadcast messages,
bypassing ...)
TODO: check
CVE-2026-93660 (SQLBot through 1.10.1 fails to verify dashboard ownership in
update_re ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/60fc5cb57924ad80da5e7e22bdc11da8868eda05
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/60fc5cb57924ad80da5e7e22bdc11da8868eda05
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
