Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
83d60f73 by security tracker role at 2026-09-22T07:15:05+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -29,7 +29,7 @@ CVE-2026-94533 (lamp-cloud through 5.10.0 contains an
authorization bypass vulne
CVE-2026-94532 (lamp-cloud through 5.10.0 contains an authorization bypass
vulnerabili ...)
TODO: check
CVE-2026-94504 (Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value
and rend ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94501 (jshERP through 3.6 contains an authorization bypass
vulnerability in t ...)
TODO: check
CVE-2026-94497 (jshERP through 3.6 fails to validate object ownership in by-id
info, u ...)
@@ -115,7 +115,7 @@ CVE-2026-94148 (A vulnerability was determined in ScadaBR
up to 1.1. Impacted is
CVE-2026-93884
REJECTED
CVE-2026-93655 (The Booking Calendar plugin for WordPress is vulnerable to
Reflected C ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93340 (Gladys Assistant before 5.1.0 contains a password reset link
poisoning ...)
TODO: check
CVE-2026-93339 (Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70
contains a ...)
@@ -123,23 +123,23 @@ CVE-2026-93339 (Metaphor Creations Ditty
(ditty-news-ticker) before 3.1.70 conta
CVE-2026-92612 (In Eclipse iceoryx2 versions greater than v0.8.0, the
StaticString exp ...)
TODO: check
CVE-2026-92438 (The Ninja Forms WordPress plugin 3.15.3 does not escape
submitted form ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92400 (The Payment Gateway for PayPal on WooCommerce WordPress plugin
before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91921 (Cross-Site Scripting (XSS) vulnerability due to inadequate
input sanit ...)
TODO: check
CVE-2026-91867 (When Neethi fetches a remote policy reference, it only limits
the time ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-91866 (A specially crafted pair of WS-Policy documents can force
Neethi's pol ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-91865 (A small WS-Policy document using repeated policy references
can force ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-91864 (A specially crafted WS-Policy document can pack unlimited
content insi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-91863 (A specially crafted WS-Policy document with deeply nested
policy eleme ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-91827 (The Ninja Forms WordPress plugin 3.15.3 does not prevent
user-submitte ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91167 (Warpgate is an open source SSH, HTTPS and MySQL bastion host
for Linux ...)
TODO: check
CVE-2026-91166 (Warpgate is an open source SSH, HTTPS and MySQL bastion host
for Linux ...)
@@ -149,7 +149,7 @@ CVE-2026-91165 (Warpgate is an open source SSH, HTTPS and
MySQL bastion host for
CVE-2026-91164 (Warpgate is an open source SSH, HTTPS and MySQL bastion host
for Linux ...)
TODO: check
CVE-2026-89412 (The TranslatePress \u2013 Translate Multilingual sites with AI
Transla ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89139 (Temporal Server compiles a Worker Controller Instance module
into its ...)
TODO: check
CVE-2026-88978 (Hatchet is a platform for orchestrating background tasks, AI
agents, a ...)
@@ -159,7 +159,7 @@ CVE-2026-88807 (A heap overflow in libXrender before 0.9.13
inRenderQueryPictFor
CVE-2026-88806 (A malicious X server could exploit a buffer overflow in libX11
before ...)
TODO: check
CVE-2026-88788 (The Text Styler WordPress plugin through 1.1.1 does not
sanitise and e ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88756 (Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to
perform SQ ...)
TODO: check
CVE-2026-88746 (idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in
/admin/mak ...)
@@ -195,27 +195,27 @@ CVE-2026-88402 (A SQL injection vulnerability in the
checkSQL function of nocoba
CVE-2026-87858 (Temporal Server decided whether a Workflow completion callback
was int ...)
TODO: check
CVE-2026-86802 (The To Do List Member WordPress plugin through 1.6 does not
have autho ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86473 (Apache Airflow: the Core API logout endpoint revokes only a
session to ...)
TODO: check
CVE-2026-85751 (Mailu is a mail server distributed as a set of Docker images.
From Mai ...)
TODO: check
CVE-2026-85653 (The Contextual Related Posts plugin for WordPress is
vulnerable to Sto ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85220 (A vulnerability in the Thinkst Canary honeypot Redis service
allows an ...)
TODO: check
CVE-2026-85219 (Denial-of-Service in Redis module in Thinkst Canary's
OpenCanary 0.9.9 ...)
TODO: check
CVE-2026-85113 (The GiveWP WordPress plugin before 4.16.9 does not remove
shortcode de ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85010 (The RestroPress WordPress plugin before 3.4.6 does not
validate a clie ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84990 (ntopng is a web-based network traffic monitoring application.
Prior to ...)
TODO: check
CVE-2026-84298 (Hatchet is a platform for orchestrating background tasks, AI
agents, a ...)
TODO: check
CVE-2026-84285 (An OS Command Injection vulnerability affecting Tuleap
Enterprise Edit ...)
- TODO: check
+ NOT-FOR-US: Dassault Systemes
CVE-2026-83621 (ntopng is a web-based network traffic monitoring application.
Prior to ...)
TODO: check
CVE-2026-82412 (ntopng is a web-based network traffic monitoring application.
Prior to ...)
@@ -223,11 +223,11 @@ CVE-2026-82412 (ntopng is a web-based network traffic
monitoring application. Pr
CVE-2026-82355 (When a request to the Airflow core API carries both a session
cookie a ...)
TODO: check
CVE-2026-82165 (Dell Command | Integration Suite for System Center, versions
prior to ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-82163 (Dell Command | Intel vPro Out of Band, versions prior to
4.7.2, contai ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-81469 (Dell Inventory Collector Client, versions prior to 15.0.0,
contain an ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-79920 (Ajenti is a Linux & BSD modular server admin panel. Prior to
version 2 ...)
TODO: check
CVE-2026-79919 (MaxKB is an open-source AI assistant for enterprise. Prior to
version ...)
@@ -283,9 +283,9 @@ CVE-2026-77166 (The emoji field in the page emoji update
endpoint does not prope
CVE-2026-77165 (File owners were unable to unlock TYPE_TOKEN locks placed by
other use ...)
TODO: check
CVE-2026-77021 (Improper handling of highly compressed data (data
amplification) in Ch ...)
- TODO: check
+ NOT-FOR-US: Checkmk
CVE-2026-76974 (SAP Fiori Launchpad does not sufficiently validate certain
user-contro ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-76898 (draw.io is a configurable diagramming and whiteboarding
application. P ...)
TODO: check
CVE-2026-75158 (Apache Airflow's `/assets/events` API returned asset events
for every ...)
@@ -377,7 +377,7 @@ CVE-2026-61612 (CKAN MCP Server is a tool for querying CKAN
open data portals. P
CVE-2026-61541 (Zapros, a Python HTTP client, prior to version 0.14.0 is
vulnerable to ...)
TODO: check
CVE-2026-59830 (Discourse is an open-source discussion platform. Prior to
2026.7.0, th ...)
- TODO: check
+ NOT-FOR-US: Discourse
CVE-2026-59816 (Joplin is an open source note-taking and to-do application
that organi ...)
TODO: check
CVE-2026-59815 (Joplin is an open source note-taking and to-do application
that organi ...)
@@ -443,9 +443,9 @@ CVE-2026-52740 (GoCD is a continuous deliver server. From
18.7.0 until 26.1.0, t
CVE-2026-49995 (Tautulli is a Python based monitoring and tracking tool for
Plex Media ...)
TODO: check
CVE-2026-49811 (Dell Command | Monitor (DCM), versions prior to 10.13.2,
contain an In ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-49810 (Dell Command Powershell Provider (DCPP), versions prior to
2.10.2 cont ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-49453 (Joplin is an open source note-taking and to-do application
that organi ...)
TODO: check
CVE-2026-49450 (Joplin is an open source note-taking and to-do application
that organi ...)
@@ -479,25 +479,25 @@ CVE-2026-36468 (Cross-site Scripting (XSS) in index.php
in CuteNews v.2.1.2 allo
CVE-2026-36467 (Unrestricted Upload of File with Dangerous Type in
core/modules/media. ...)
TODO: check
CVE-2026-19658 (The Give Tributes plugin for WordPress is vulnerable to PHP
Object Inj ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-17054 (The Espressif ESP-hosted Wi-Fi driver
(drivers/wifi/esp_hosted/) parse ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-17052 (The Time-aware GPIO syscall verification handler
z_vrfy_tgpio_pin_read ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-17051 (The Intel SEDI IPM (inter-processor mailbox) driver in
drivers/ipm/ipm ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-17050 (The experimental USB host stack allocates a per-device
configuration-d ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-16652 (Temporal Server did not bound the work performed while
searching for a ...)
TODO: check
CVE-2026-16651 (temporalio/sqlparser can panic when Parse, ParseStrictDDL, or
ParseNex ...)
TODO: check
CVE-2026-15890 (The default AEAD nonce provider for the PSA Internal Trusted
Storage t ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-13355 (The Meta Box AIO plugin for WordPress is vulnerable to
Privilege Escal ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12470 (The CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes
plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-71421 (UVdesk core-framework before 1.1.7 contains an improper
privilege mana ...)
TODO: check
CVE-2025-71420 (UVdesk core-framework before 1.1.7 contains an authorization
bypass vu ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/83d60f73b2a408ee55e732a2dc6f3bfa2a96eaa3
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/83d60f73b2a408ee55e732a2dc6f3bfa2a96eaa3
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
