Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f1e537e3 by Moritz Muehlenhoff at 2026-09-27T23:05:02+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -52,63 +52,63 @@ CVE-2026-15442 (In all builds that make use of (D)TLS,
including default builds,
- wolfssl <unfixed>
NOTE: https://github.com/wolfSSL/wolfssl/pull/10863 (v5.9.4-stable)
CVE-2026-101061 (utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain
server-s ...)
- TODO: check
+ NOT-FOR-US: utcp
CVE-2026-101060 (python-utcp versions before 1.1.4 contain a server-side
request forger ...)
- TODO: check
+ NOT-FOR-US: utcp
CVE-2026-101059 (utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl
field fro ...)
- TODO: check
+ NOT-FOR-US: utcp
CVE-2026-101058 (python-utcp (pip package utcp-http) before 1.1.12 does not
verify whet ...)
- TODO: check
+ NOT-FOR-US: utcp
CVE-2026-101057 (utcp-mcp (the MCP plugin of python-utcp) through 1.1.2
connects to the ...)
- TODO: check
+ NOT-FOR-US: utcp
CVE-2026-101056 (Cloudreve before 4.16.1 fails to revalidate share access when
restorin ...)
- TODO: check
+ NOT-FOR-US: Cloudreve
CVE-2026-101051 (Cloudreve before 4.16.1 fails to properly sanitize file paths
returned ...)
- TODO: check
+ NOT-FOR-US: Cloudreve
CVE-2026-101050 (Heym before 0.0.53 fails to verify the
X-Telegram-Bot-Api-Secret-Token ...)
- TODO: check
+ NOT-FOR-US: Heym
CVE-2026-101049 (Heym before 0.0.53 fails to verify Slack request signatures
when trigg ...)
- TODO: check
+ NOT-FOR-US: Heym
CVE-2026-101048 (Cloudreve before 4.17.0 registers the administrative node
test endpoin ...)
- TODO: check
+ NOT-FOR-US: Cloudreve
CVE-2026-101047 (Fleet before 4.87.0 does not protect the two endpoints that
serve in-h ...)
- TODO: check
+ NOT-FOR-US: Fleet
CVE-2026-101046 (Fleet before 4.89.0 contains an SQL injection vulnerability
in the act ...)
- TODO: check
+ NOT-FOR-US: Fleet
CVE-2026-101045 (Fleet-maintained app install and uninstall scripts for macOS
are gener ...)
- TODO: check
+ NOT-FOR-US: Fleet
CVE-2026-101044 (pacquet, the Rust package-manager component shipped in the
pnpm npm pa ...)
- TODO: check
+ - pnpm <itp> (bug #985669)
CVE-2026-101043 (pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5
expand $ ...)
- TODO: check
+ - pnpm <itp> (bug #985669)
CVE-2026-101042 (Parse Server is an open-source backend server. In versions >=
9.0.0 < ...)
NOT-FOR-US: Parse Server
CVE-2026-101041 (The account recovery (password reset) functionality in the
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: vulnerability-lookup
CVE-2026-101033 (KitchenOwl through 0.7.10 fails to verify that category IDs
belong to ...)
- TODO: check
+ NOT-FOR-US: KitchenOwl
CVE-2026-101032 (navi through 2.24.0 fails to properly escape cheatsheet
variable value ...)
- TODO: check
+ NOT-FOR-US: navi
CVE-2026-100875 (A vulnerability has been found in mathurvishal
CloudClassroom-PHP-Proj ...)
- TODO: check
+ NOT-FOR-US: CloudClassroom-PHP-Project
CVE-2026-100874 (A flaw has been found in mathurvishal
CloudClassroom-PHP-Project up to ...)
- TODO: check
+ NOT-FOR-US: CloudClassroom-PHP-Project
CVE-2026-100873 (A vulnerability was detected in mathurvishal
CloudClassroom-PHP-Projec ...)
- TODO: check
+ NOT-FOR-US: CloudClassroom-PHP-Project
CVE-2026-100872 (Sylius versions before 2.1.16 and 2.2.9 fail to validate
payment amoun ...)
- TODO: check
+ NOT-FOR-US: Sylius
CVE-2026-100871 (Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and
2.2.9 fa ...)
- TODO: check
+ NOT-FOR-US: Sylius
CVE-2026-100870 (Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and
2.2.9 bu ...)
- TODO: check
+ NOT-FOR-US: Sylius
CVE-2026-100869 (Sylius versions before 2.1.16 and 2.2.9 fail to restrict
payment reque ...)
- TODO: check
+ NOT-FOR-US: Sylius
CVE-2026-100868 (Penpot before 2.18.0 binds the MCP server plugin WebSocket
bridge to a ...)
- TODO: check
+ NOT-FOR-US: Penpot
CVE-2026-100867 (spaceship-prompt through 4.22.5 fails to sanitize control
characters f ...)
- TODO: check
+ NOT-FOR-US: spaceship-prompt
CVE-2026-100866 (onefetch through 2.28.1 writes repository information field
values to ...)
- TODO: check
+ NOT-FOR-US: oenfetch
CVE-2026-100749 (Joomla Extension - svenbluege.de - CSRF in backend cleanup
actions in ...)
NOT-FOR-US: Joomla
CVE-2026-100748 (Joomla Extension - svenbluege.de - CSRF in various cart
actions in Eve ...)
@@ -116,7 +116,7 @@ CVE-2026-100748 (Joomla Extension - svenbluege.de - CSRF in
various cart actions
CVE-2026-100747 (Joomla Extension - svenbluege.de - CSRF in image upload in
Event Galle ...)
NOT-FOR-US: Joomla
CVE-2026-100741 (Eval injection in the JScript event-script dispatcher in
Progressive R ...)
- TODO: check
+ NOT-FOR-US: hMailServer
CVE-2026-XXXX [Infinite loops and heap OOB read when parsing malformed ASF
headers]
- libmms <unfixed> (bug #1149047)
CVE-2026-XXXX [unbounded list indices from a Word document reach a wild
pointer dereference in wvAssembleSimplePAP]
@@ -1002,7 +1002,7 @@ CVE-2026-97878 (A vulnerability was identified in
zhistaredu StarTraining up to
CVE-2026-97877 (A vulnerability was determined in zhistaredu StarTraining up
to 3.8.1. ...)
NOT-FOR-US: zhistaredu StarTraining
CVE-2026-97875 (Rojo's "rojo serve" HTTP API (default port 34872) has no
Host/Origin h ...)
- TODO: check
+ NOT-FOR-US: Rojo
CVE-2026-97871 (A vulnerability has been found in Zhonglun CloudPos up to
3.0.1.76. Th ...)
NOT-FOR-US: Zhonglun CloudPos
CVE-2026-97869 (A flaw has been found in langchain4j up to
1.5.3-beta10/1.11.10-beta18 ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f1e537e314b683227ae7f56faf6582b9b45adfd4
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f1e537e314b683227ae7f56faf6582b9b45adfd4
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
