Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
5649433d by security tracker role at 2026-09-25T19:15:03+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -103,25 +103,25 @@ CVE-2026-97063 (X-SpringBoot through 6.0 returns login
verification codes in HTT
CVE-2026-97060 (X-SpringBoot through 6.0 lacks object-level authorization in
user mana ...)
TODO: check
CVE-2026-96883 (pgcollection is an open source extension to PostgreSQL. A type
confusi ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-96874 (Improper neutralization of input during web page generation
('cross-si ...)
TODO: check
CVE-2026-96812 (Improper Exposure of Resource to Wrong Sphere in the host file
helper ...)
TODO: check
CVE-2026-96766 (The GeoDirectory \u2013 WP Business Directory Plugin and
Classified Li ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96752 (The Zero Spam for WordPress plugin for WordPress is vulnerable
to Stor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96568 (The Restaurant Menu and Food Ordering plugin for WordPress is
vulnerab ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96448 (A flaw was found in the Fine-Grained Admin Permissions (FGAP
v2) featu ...)
TODO: check
CVE-2026-96039 (The BA Book Everything plugin for WordPress is vulnerable to
Stored Cr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95866 (The User Profile Builder \u2013 Beautiful User Registration
Forms, Use ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95864 (The Themify Builder plugin for WordPress is vulnerable to
Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95835 (Missing Authorization in the askpass escape code handler in
kitty from ...)
TODO: check
CVE-2026-95834 (Use After Free in the drag source path of the drag and drop
protocol i ...)
@@ -131,37 +131,37 @@ CVE-2026-95832 (Improper Neutralization of Special
Elements in Output Used by a
CVE-2026-95699 (Prior to 9/18/2026, the iSteamX mobile application's AWS
policy could ...)
TODO: check
CVE-2026-94573 (The Repeater Fields for Elementor Forms plugin for WordPress
is vulner ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94445 (A malicious txtar could escape the intended execution context
and forc ...)
TODO: check
CVE-2026-94376 (The Better Messages \u2013 Chat Rooms, Group Chat, Private
Messages & ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93901 (The Optima Express IDX plugin for WordPress is vulnerable to
Privilege ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93899 (The Better Messages \u2013 Chat Rooms, Group Chat, Private
Messages & ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93897 (The GeoDirectory \u2013 WP Business Directory Plugin and
Classified Li ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93834 (A use-after-free vulnerability was found in QEMU's 9pfs
subsystem. A r ...)
TODO: check
CVE-2026-93747 (The wpForo Forum plugin for WordPress is vulnerable to Stored
Cross-Si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93656 (The User Profile Builder \u2013 Beautiful User Registration
Forms, Use ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93654 (The Premium Packages \u2013 Sell Digital Products Securely
plugin for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93647 (An unauthenticated calendar sender can place active markup in
a COUNTE ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93643 (When OnlyOffice/Document Editing is available, an
unauthenticated remo ...)
TODO: check
CVE-2026-93642 (An unauthenticated sender can forge a share notification that
triggers ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93641 (An unauthenticated sender can forge a share notification that
triggers ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93477 (Improperly Controlled Modification of Dynamically-Determined
Object At ...)
TODO: check
CVE-2026-93399 (The Bookly plugin for WordPress is vulnerable to Insecure
Direct Objec ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93366 (Bludit CMS through 3.22.0 contains an authorization bypass
vulnerabili ...)
TODO: check
CVE-2026-93365 (Bludit CMS through 3.22.0 contains a missing authorization
vulnerabili ...)
@@ -175,9 +175,9 @@ CVE-2026-93354 (Taskview Community before 1.56.0 contains a
missing authenticati
CVE-2026-93353 (copyparty contains a volume restriction bypass vulnerability
in its SF ...)
TODO: check
CVE-2026-93306 (IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00
through FW1 ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93303 (The HT Contact Form \u2013 Drag & Drop Form Builder for
WordPress plug ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93291 (Omni C20 lacks proper certificate validation which could allow
an atta ...)
TODO: check
CVE-2026-93290 (Omni C20 uses hard-coded credentials that could allow an
attacker to m ...)
@@ -185,35 +185,35 @@ CVE-2026-93290 (Omni C20 uses hard-coded credentials that
could allow an attacke
CVE-2026-93289 (The affected products are vulnerable to command injection
attack that ...)
TODO: check
CVE-2026-93030 (FTM 4.x ALL could allow a remote authenticated attacker to
obtain sens ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-92829 (The Blog2Social: Social Media Auto Post & Scheduler plugin for
WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92799 (The Online Scheduling and Appointment Booking System \u2013
Bookly plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92746 (The Gutenverse \u2013 WordPress Blocks, Page Builder & Site
Editor plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92713 (The Modula Image Gallery \u2013 Photo Grid & Video Gallery
plugin for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92212 (The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin
for WordP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92161 (FriendsOfFlarum OAuth allows users to log in to Flarum with
GitHub, Tw ...)
TODO: check
CVE-2026-92106 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
TODO: check
CVE-2026-89426 (The Knit Pay \u2013 Cashfree, Instamojo, Razorpay, PayPal and
more plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89406 (The Modula Image Gallery \u2013 Photo Grid & Video Gallery
plugin for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89055 (The Customer Reviews for WooCommerce plugin for WordPress is
vulnerabl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89032 (BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant
isolation bypass ...)
TODO: check
CVE-2026-88996 (The WPForms \u2013 AI Form Builder for WordPress \u2013
Contact Forms, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88956 (The Botslab G980H dash camera firmware contains an
authentication vuln ...)
TODO: check
CVE-2026-88848 (The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50
does not v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88761 (The Botslab G980H dash camera firmware generates the default
WiFi pass ...)
TODO: check
CVE-2026-88421 (Incorrect access control in the BlogPage.get_entries()
component of AP ...)
@@ -237,15 +237,15 @@ CVE-2026-87720 (Incorrect Authorization (CWE-863) in
project name normalization
CVE-2026-87118 (The Botslab G980H dash camera firmware contains an out of
bounds write ...)
TODO: check
CVE-2026-86837 (The Bookly WordPress plugin before 28.3 does not properly
verify a cus ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85750 (Piwigo before v16.4.0 is vulnerable to arbitrary file read and
remote ...)
TODO: check
CVE-2026-85542 (IBM Guardium Data Protection 12.2 is affected by a command
injection v ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-85496 (The Botslab G980H dash camera firmware generates session
identifiers u ...)
TODO: check
CVE-2026-85417 (Incomplete property masking in the SANnav logging subsystem
permits SN ...)
- TODO: check
+ NOT-FOR-US: Brocade
CVE-2026-85293 (InvoicePlane is a self-hosted open source application for
managing inv ...)
TODO: check
CVE-2026-85292 (InvoicePlane is a self-hosted open source application for
managing inv ...)
@@ -261,15 +261,15 @@ CVE-2026-85274 (InvoicePlane is a self-hosted open source
application for managi
CVE-2026-85082 (Root Browser Classic 3.3.0 passes the path of a selected
SQLite databa ...)
TODO: check
CVE-2026-85029 (IBM Guardium Data Protection 12.2 could allow a remote
attacker to obt ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84893 (IBM Guardium Data Protection 12.2 is vulnerable to SQL
injection in th ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84884 (IBM Guardium Data Protection 12.2 stores internal REST
service-account ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84882 (IBM Guardium Data Protection 12.2 is vulnerable to path
traversal in t ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84862 (IBM Guardium Data Protection 12.2 is vulnerable to insecure
deserializ ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84465 (Zammad is a web based open source helpdesk/customer support
system. Pr ...)
TODO: check
CVE-2026-84464 (Zammad is a web based open source helpdesk/customer support
system. Pr ...)
@@ -291,13 +291,13 @@ CVE-2026-84399 (The Botslab G980H dash camera firmware
contains an authorization
CVE-2026-84283 (Secure Folder 1.2 stores files selected for its
password-protected vau ...)
TODO: check
CVE-2026-84281 (The Fancy Product Designer plugin for WordPress is vulnerable
to Store ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84280 (The Fancy Product Designer plugin for WordPress is vulnerable
to Store ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84279 (The Fancy Product Designer plugin for WordPress is vulnerable
to Store ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-83591 (The AMP for WP \u2013 Accelerated Mobile Pages plugin for
WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82716 (The Botslab G980H dash camera firmware includes sensitive
configuratio ...)
TODO: check
CVE-2026-82708 (The Botslab G980H dash camera firmware contains a path
traversal vulne ...)
@@ -307,13 +307,13 @@ CVE-2026-82585 (The Botslab G980H dash camera firmware
transmits sensitive infor
CVE-2026-82566 (The Botslab G980H dash camera firmware contains a session
management v ...)
TODO: check
CVE-2026-82372 (Improper handling of sensitive data during IPsec policy
creation and m ...)
- TODO: check
+ NOT-FOR-US: Brocade
CVE-2026-82164 (Dell Trusted Device Client, versions prior to 8.1.359.0,
contain an In ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-81630 (The Botslab G980H dash camera firmware does not adequately
verify the ...)
TODO: check
CVE-2026-80514 (The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does
not ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-80432 (Missing Authorization in the drop handling path of the drag
and drop p ...)
TODO: check
CVE-2026-80431 (Out-of-bounds Write in the natural width branch of the text
sizing pro ...)
@@ -327,11 +327,11 @@ CVE-2026-79153 (Seclore FileSecure Desktop Client before
3.25.1.0 contains impro
CVE-2026-78902 (Cross Site Scripting vulnerability in Netgate pfSense
26.03.1-RELEASE ...)
TODO: check
CVE-2026-78397 (The Link Library WordPress plugin before 7.9.6 does not
validate the d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78394 (The Link Library WordPress plugin before 7.9.6 does not
sanitize a use ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78393 (The Link Library WordPress plugin before 7.9.6 does not
properly escap ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-77967 (The Botslab G980H dash camera firmware accepts a reusable
authenticati ...)
TODO: check
CVE-2026-75558 (The Botslab G980H dash camera firmware uses a hard-coded
cryptographic ...)
@@ -425,7 +425,7 @@ CVE-2026-63006 (Zammad is a web based open source
helpdesk/customer support syst
CVE-2026-62262 (Piwigo is a full featured open source photo gallery
application for th ...)
TODO: check
CVE-2026-62062 (Cross-Site Request Forgery (CSRF) vulnerability in Elementor
Website B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61855 (Zammad is a web based open source helpdesk/customer support
system. In ...)
TODO: check
CVE-2026-61837 (RabbitMQ is a messaging and streaming broker. From 4.0.0 until
4.3.3, ...)
@@ -535,9 +535,9 @@ CVE-2026-33639 (InvoicePlane is a self-hosted open source
application for managi
CVE-2026-27867 (An attacker with access via network to the Regesta Smart
HD-PLC of the ...)
TODO: check
CVE-2026-19804 (The s2Member \u2013 Excellent for All Kinds of Memberships,
Content Re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19775 (The OpenStation \u2014 Desktop Windows, Dock & Virtual
Desktops for WP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18320 (Readwise Reader for Android uses a sanitize-html configuration
that pe ...)
TODO: check
CVE-2026-18312 (Readwise Reader for Android constructs URLs in its WebView
using attac ...)
@@ -545,23 +545,23 @@ CVE-2026-18312 (Readwise Reader for Android constructs
URLs in its WebView using
CVE-2026-18311 (Readwise Reader for Android contains a cross-site scripting
vulnerabil ...)
TODO: check
CVE-2026-17602 (The SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects
plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-17577 (The SSL Zen plugin for WordPress is vulnerable to Reflected
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14443 (Incomplete log sanitization during bulk IPsec policy
collection in Bro ...)
- TODO: check
+ NOT-FOR-US: Brocade
CVE-2026-14442 (An information exposure vulnerability in the job scheduling
component ...)
- TODO: check
+ NOT-FOR-US: Brocade
CVE-2026-14441 (A logic flaw in Java cache key handling object comparison
handling cou ...)
- TODO: check
+ NOT-FOR-US: Brocade
CVE-2026-14281 (The Automation Web Platform \u2013 Notifications and OTP for
WooCommer ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13456 (The WP Maps \u2013 Google Maps,OpenStreetMap,Mapbox,Store
Locator,List ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13179 (The WP Maps \u2013 Google Maps,OpenStreetMap,Mapbox,Store
Locator,List ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12037 (The Asset CleanUp: Page Speed Booster plugin for WordPress is
vulnerab ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100306 (TDuck survey form through 6.0 fails to validate write
passwords on sub ...)
TODO: check
CVE-2026-100305 (TDuck survey form through 6.0 fails to enforce form fill-in
restrictio ...)
@@ -591,9 +591,9 @@ CVE-2026-100174 (The AIL Framework tag selector component
(var/www/static/js/tag
CVE-2026-100172 (The AIL Framework (ail-project/ail-framework) contains a
stored cross- ...)
TODO: check
CVE-2025-51457 (D-Link DAP-2610 up to 2.06B08r099 contains an authenticated
command in ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2025-14814 (The CSS & JavaScript Toolbox plugin for WordPress is
vulnerable to Sto ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-98162 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
- linux 7.2.6-1
NOTE:
https://git.kernel.org/linus/39f2032096715daae5f6fd0f587ca7a474b019df (7.3-rc1)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5649433db6038a7ffa3dfe6f3e029856fdaf75f7
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5649433db6038a7ffa3dfe6f3e029856fdaf75f7
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
