Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
4e4fa81a by security tracker role at 2026-09-28T19:13:44+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,5 +1,5 @@
CVE-2026-97686 (Wind River VxWorks 7 prior to 26.09, specific system call
arguments ca ...)
- TODO: check
+ NOT-FOR-US: WindRiver
CVE-2026-97399 (The strncasecmp function in the GNU C Library 2.24 and later
optimized ...)
TODO: check
CVE-2026-97335 (Incorrect authorization in the custom storage volume creation
endpoint ...)
@@ -35,9 +35,9 @@ CVE-2026-93348 (Unsloth Zoo versions 2025.9.9 before
2026.8.14, as implemented i
CVE-2026-92103 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
TODO: check
CVE-2026-91206 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-91204 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-91154 (Missing Authentication for Critical Function (CWE-306) in the
product ...)
TODO: check
CVE-2026-91043 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
@@ -55,7 +55,7 @@ CVE-2026-88805 (Incorrect credential cleaning on logout could
be used by remote
CVE-2026-88804 (An unauthenticated update of public UI settings could be used
by remot ...)
TODO: check
CVE-2026-87969 (An OS command injection vulnerability in the WatchGuard AP
diagnostic ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-87799 (Improper link resolution in the migration receive path in
Canonical LX ...)
TODO: check
CVE-2026-87798 (Improper link resolution in the recursive file pull feature of
the LXD ...)
@@ -69,7 +69,7 @@ CVE-2026-86595 (Improper neutralization of special elements
used in an SQL comma
CVE-2026-86530 (BUFFALO Wi-Fi products handle some web form input improperly
to assemb ...)
TODO: check
CVE-2026-86507 (Improper neutralization of input in Apache Roller 6.1.5 allows
an anon ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-86335 (Missing Authorization in imageDownload in Canonical LXD before
5.0.10, ...)
TODO: check
CVE-2026-86334 (Path traversal in the CLI client image export and copy
functionality i ...)
@@ -77,7 +77,7 @@ CVE-2026-86334 (Path traversal in the CLI client image export
and copy functiona
CVE-2026-86330 (An OS command injection flaw was found in the
set_hostname_internal fu ...)
TODO: check
CVE-2026-86102 (An OS command injection vulnerability in the WatchGuard AP
internal AP ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-85526 (Path traversal in the Btrfs storage driver (unpackVolume) in
Canonical ...)
TODO: check
CVE-2026-85185 (Path traversal in the btrfs storage driver in Canonical LXD
versions 4 ...)
@@ -105,35 +105,35 @@ CVE-2026-82928 (mH-DEVELOPER smart home module contains a
hardcoded SSH public k
CVE-2026-82915 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
TODO: check
CVE-2026-82546 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82387 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82386 (Improper Restriction of XML External Entity Reference in
Apache Roller ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82385 (Exposure of Sensitive Information to an Unauthorized Actor in
Apache R ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82384 (Deserialization of Untrusted Data in Apache Roller 6.1.5
allows an una ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82383 (Missing Authentication for Critical Function in Apache Roller
6.1.5 al ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82382 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82381 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82380 (Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5
allows a remo ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82379 (Authentication Bypass by Capture-replay in Apache Roller 6.1.5
allows ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82378 (Incorrect Authorization in the OAuth 1.0a authorization
endpoint of Ap ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82377 (Missing Authorization in Apache Roller 6.1.5 allows an
authenticated u ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82376 (Improper Restriction of XML External Entity Reference in
Apache Roller ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82375 (Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5
allows an au ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82348 (Authorization Bypass Through User-Controlled Key in Apache
Roller 6.1. ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82326 (Improper neutralization of input during web page generation
('cross-si ...)
TODO: check
CVE-2026-82323 (Authorization bypass through User-Controlled key vulnerability
in Enoc ...)
@@ -143,11 +143,11 @@ CVE-2026-81867 (A Deserialization of Untrusted Data
vulnerability in the JavaScr
CVE-2026-81375 (A Confused Deputy vulnerability in the EmailTask component in
Google C ...)
TODO: check
CVE-2026-80359 (Dell Boot Optimized Server Storage (BOSS), versions prior to
2.2.13.20 ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-80358 (Dell Boot Optimized Server Storage (BOSS), versions prior to
2.2.13.20 ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-80357 (Dell Boot Optimized Server Storage (BOSS), versions prior to
2.2.13.20 ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-7172 (Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the
followi ...)
TODO: check
CVE-2026-7171 (Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the
followi ...)
@@ -165,9 +165,9 @@ CVE-2026-73641 (Dayforce Payroll is vulnerable to Reflected
XSS in multiple endp
CVE-2026-73640 (Dayforce Payroll is vulnerable to Time Based-Blind SQL
Injection in pa ...)
TODO: check
CVE-2026-70413 (Dell Live Optics Collector, versions prior to 27.2.13.310,
contain(s) ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-59563 (Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where
HMAC co ...)
- TODO: check
+ NOT-FOR-US: Zscaler
CVE-2026-58464
REJECTED
CVE-2026-58463
@@ -209,23 +209,23 @@ CVE-2026-19444 (A path traversal vulnerability was
discovered in the Kubernetesk
CVE-2026-18825 (An Origin Validation Error in the middleware of the
connect-xcors npm ...)
TODO: check
CVE-2026-15953 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ NOT-FOR-US: ABB group
CVE-2026-15952 (Incorrect Permission Assignment for Critical Resource
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: ABB group
CVE-2026-13018 (Insufficient validation of untrusted input in Codecs in Google
Chrome ...)
TODO: check
CVE-2026-12342 (This vulnerability impacts all versions of IdentityIQ and
allows an un ...)
TODO: check
CVE-2026-12269 (Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a
Keepali ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-12268 (ManageEngine DDI Central versions below 6201 are vulnerable
toPowerShe ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-12267 (ManageEngine DDI Central versions below 6201 are vulnerable
toCommand ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-12265 (Zohocorp ManageEngine DDI Central versions before 6201 are
vulnerable ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-12264 (Zohocorp ManageEngine DDI Central versions before 6201 are
vulnerable ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-102010 (A flaw was found in GCC. When an application calls the
erase_if functi ...)
TODO: check
CVE-2026-101913 (ip-address is a library for parsing and manipulating IPv4 and
IPv6 add ...)
@@ -261,7 +261,7 @@ CVE-2026-101898 (Axios is a promise-based HTTP client for
the browser and Node.j
CVE-2026-101894 (The decompress package for Node.js extracts archives. Prior
to 10.2.2 ...)
TODO: check
CVE-2026-101891 (An improper access control vulnerability in an internal API
service on ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-101861 (Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0
contain an unsa ...)
TODO: check
CVE-2026-101333 (A flaw was found in the Micrometer user-event metrics
listener of Keyc ...)
@@ -273,15 +273,15 @@ CVE-2026-101132 (A security flaw has been discovered in
DeepSeek deepseek-harnes
CVE-2026-101131 (A vulnerability was identified in deepseek-ai
deepseek-harness up to 0 ...)
TODO: check
CVE-2026-101111 (Joomla Extension - ordasoft.com - Reflected Cross-Site
Scripting in Bo ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-101110 (Joomla Extension - ordasoft.com - Unauthenticated SQL
Injection in Boo ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-101109 (Joomla Extension - ordasoft.com - Reflected Cross-Site
Scripting in Ve ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-101108 (Joomla Extension - ordasoft.com - Unauthenticated SQL
Injection in Veh ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-101105 (A vulnerability was determined in code-projects Matrimonial
System 1.0 ...)
- TODO: check
+ NOT-FOR-US: code-projects
CVE-2026-101102 (A vulnerability was found in deepseek-ai deepseek-harness up
to 0.1.0- ...)
TODO: check
CVE-2026-101101 (A vulnerability has been found in ag-ui-protocol ag-ui up to
2026-09-0 ...)
@@ -297,7 +297,7 @@ CVE-2026-101083 (A security vulnerability has been detected
in PMWeb v7.x/v8.x/v
CVE-2026-101082 (A weakness has been identified in PMWeb 7.x/8.x/2025.x. This
issue aff ...)
TODO: check
CVE-2026-101081 (A security flaw has been discovered in D-Link DI-8400 16.07.
This vuln ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2026-101080 (A vulnerability was identified in Tencent AI-Infra-Guard up
to 4.5.2/4 ...)
TODO: check
CVE-2026-101079 (A vulnerability was found in agentverus agentverus-scanner up
to 0.8.1 ...)
@@ -371,13 +371,13 @@ CVE-2026-101009 (A vulnerability was determined in
aaPanel BaoTa up to 11.8.0. T
CVE-2026-101008 (A vulnerability was found in aaPanel BaoTa up to 11.8.0.
Impacted is t ...)
TODO: check
CVE-2026-100753 (Joomla Extension - ordasoft.com - Reflected Cross-Site
Scripting in Re ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-100752 (Joomla Extension - ordasoft.com - Unauthenticated SQL
Injection in Rea ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-100751 (Joomla Extension - regularlabs.com - Privileged stored XSS
via data-rl ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-100750 (Joomla Extension - regularlabs.com - LFI / SSRF in Modules
Anywhere 1. ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-85644 (XS::Parse::Infix versions from 0.40 through 0.49 for Perl
treat a numb ...)
- libxs-parse-keyword-perl <unfixed> (bug #1149243)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/43916020/
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4e4fa81a8aa43d63ad143f837229ae7b99a388de
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4e4fa81a8aa43d63ad143f837229ae7b99a388de
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
