Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
52592448 by Salvatore Bonaccorso at 2026-09-28T22:26:38+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -76,9 +76,9 @@ CVE-2026-87752 (Improper neutralization of input during web
page generation ('cr
CVE-2026-87114 (A flaw was found in kube-compare. When processing a
'container://' ref ...)
NOT-FOR-US: kube-compare
CVE-2026-86595 (Improper neutralization of special elements used in an SQL
command ('S ...)
- TODO: check
+ NOT-FOR-US: enVision
CVE-2026-86530 (BUFFALO Wi-Fi products handle some web form input improperly
to assemb ...)
- TODO: check
+ NOT-FOR-US: BUFFALO
CVE-2026-86507 (Improper neutralization of input in Apache Roller 6.1.5 allows
an anon ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-86335 (Missing Authorization in imageDownload in Canonical LXD before
5.0.10, ...)
@@ -88,31 +88,31 @@ CVE-2026-86334 (Path traversal in the CLI client image
export and copy functiona
- lxd <removed>
NOTE:
https://github.com/canonical/lxd/security/advisories/GHSA-g4cm-f533-78hq
CVE-2026-86330 (An OS command injection flaw was found in the
set_hostname_internal fu ...)
- TODO: check
+ NOT-FOR-US: NooBaa
CVE-2026-86102 (An OS command injection vulnerability in the WatchGuard AP
internal AP ...)
NOT-FOR-US: WatchGuard
CVE-2026-85134 (Unrestricted upload of file with dangerous type vulnerability
in Bimse ...)
- TODO: check
+ NOT-FOR-US: eBA Plus Document and Workflow Management System:
CVE-2026-84894 (In moxygen before commit 004123dd24c3,
MoQSession::dataStreamReadLoop ...)
TODO: check
CVE-2026-82969 (Improper neutralization of input during web page generation
('cross-si ...)
- TODO: check
+ NOT-FOR-US: eBA Plus Document and Workflow Management System:
CVE-2026-82936 (mH-DEVELOPER smart home module is vulnerable to Denial of
Service due ...)
- TODO: check
+ NOT-FOR-US: mH-DEVELOPER smart home module
CVE-2026-82935 (mH-DEVELOPER smart home module ships with an end-of-life,
unsupported ...)
- TODO: check
+ NOT-FOR-US: mH-DEVELOPER smart home module
CVE-2026-82933 (mH-DEVELOPER smart home module sends its web interface and API
traffic ...)
- TODO: check
+ NOT-FOR-US: mH-DEVELOPER smart home module
CVE-2026-82932 (mH-DEVELOPER smart home module does not load any firewall
rules at sta ...)
- TODO: check
+ NOT-FOR-US: mH-DEVELOPER smart home module
CVE-2026-82930 (mH-DEVELOPER smart home module does not verify tokens in its
authoriza ...)
- TODO: check
+ NOT-FOR-US: mH-DEVELOPER smart home module
CVE-2026-82929 (mH-DEVELOPER smart home module uses the same hard-coded SSH
host keys ...)
- TODO: check
+ NOT-FOR-US: mH-DEVELOPER smart home module
CVE-2026-82928 (mH-DEVELOPER smart home module contains a hardcoded SSH public
key in ...)
- TODO: check
+ NOT-FOR-US: mH-DEVELOPER smart home module
CVE-2026-82915 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ NOT-FOR-US: eBA Plus Document and Workflow Management System
CVE-2026-82546 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82387 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -144,13 +144,13 @@ CVE-2026-82375 (Server-Side Request Forgery (SSRF) in
Apache Roller 6.1.5 allows
CVE-2026-82348 (Authorization Bypass Through User-Controlled Key in Apache
Roller 6.1. ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82326 (Improper neutralization of input during web page generation
('cross-si ...)
- TODO: check
+ NOT-FOR-US: Enocta Platform
CVE-2026-82323 (Authorization bypass through User-Controlled key vulnerability
in Enoc ...)
- TODO: check
+ NOT-FOR-US: Enocta Platform
CVE-2026-81867 (A Deserialization of Untrusted Data vulnerability in the
JavaScript Ta ...)
- TODO: check
+ NOT-FOR-US: Google Cloud Application Integration
CVE-2026-81375 (A Confused Deputy vulnerability in the EmailTask component in
Google C ...)
- TODO: check
+ NOT-FOR-US: Google Cloud Application Integration
CVE-2026-80359 (Dell Boot Optimized Server Storage (BOSS), versions prior to
2.2.13.20 ...)
NOT-FOR-US: Dell / EMC
CVE-2026-80358 (Dell Boot Optimized Server Storage (BOSS), versions prior to
2.2.13.20 ...)
@@ -158,21 +158,21 @@ CVE-2026-80358 (Dell Boot Optimized Server Storage
(BOSS), versions prior to 2.2
CVE-2026-80357 (Dell Boot Optimized Server Storage (BOSS), versions prior to
2.2.13.20 ...)
NOT-FOR-US: Dell / EMC
CVE-2026-7172 (Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the
followi ...)
- TODO: check
+ NOT-FOR-US: TPVEnlanube
CVE-2026-7171 (Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the
followi ...)
- TODO: check
+ NOT-FOR-US: TPVEnlanube
CVE-2026-7170 (Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the
followi ...)
- TODO: check
+ NOT-FOR-US: TPVEnlanube
CVE-2026-78424 (Improper parameter handling in NeuVector allows any
authenticated user ...)
- TODO: check
+ NOT-FOR-US: NeuVector
CVE-2026-75600 (FreePBX is an open source IP PBX. Prior to version 17.0.9,
authenticat ...)
- TODO: check
+ NOT-FOR-US: FreePBX
CVE-2026-73642 (Dayforce Payroll is vulnerable to Path Traversal in file
download func ...)
- TODO: check
+ NOT-FOR-US: Dayforce Payroll
CVE-2026-73641 (Dayforce Payroll is vulnerable to Reflected XSS in multiple
endpoints. ...)
- TODO: check
+ NOT-FOR-US: Dayforce Payroll
CVE-2026-73640 (Dayforce Payroll is vulnerable to Time Based-Blind SQL
Injection in pa ...)
- TODO: check
+ NOT-FOR-US: Dayforce Payroll
CVE-2026-70413 (Dell Live Optics Collector, versions prior to 27.2.13.310,
contain(s) ...)
NOT-FOR-US: Dell / EMC
CVE-2026-59563 (Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where
HMAC co ...)
@@ -182,33 +182,33 @@ CVE-2026-58464
CVE-2026-58463
REJECTED
CVE-2026-55160 (Stringer is a self-hosted, anti-social RSS reader. Prior to
commit 75c ...)
- TODO: check
+ NOT-FOR-US: Stringer
CVE-2026-55157 (Token Optimizer MCP measures token savings per AI coding
agent, optimi ...)
- TODO: check
+ NOT-FOR-US: Token Optimizer MCP
CVE-2026-55156 (Token Optimizer MCP measures token savings per AI coding
agent, optimi ...)
- TODO: check
+ NOT-FOR-US: Token Optimizer MCP
CVE-2026-55096 (fast-mcp-telegram is a Telegram MCP Server. Prior to version
30.1, the ...)
- TODO: check
+ NOT-FOR-US: fast-mcp-telegram
CVE-2026-54710 (FreePBX is an open source IP PBX. Prior to versions 16.0.40
and 17.0.7 ...)
- TODO: check
+ NOT-FOR-US: FreePBX
CVE-2026-54708 (FreePBX is an open source IP PBX. Prior to versions 16.0.72
and 17.0.7 ...)
- TODO: check
+ NOT-FOR-US: FreePBX
CVE-2026-54675 (FreePBX is an open source IP PBX. Prior to versions 16.0.10
and 17.0.5 ...)
- TODO: check
+ NOT-FOR-US: FreePBX
CVE-2026-54674 (FreePBX is an open source IP PBX. Prior to versions 16.0.39
and 17.0.7 ...)
- TODO: check
+ NOT-FOR-US: FreePBX
CVE-2026-54160 (Network UPS Tools is a collection of programs which provide a
common i ...)
TODO: check
CVE-2026-52749 (The Kaon AR2140X router improperly issues session cookies in
responses ...)
- TODO: check
+ NOT-FOR-US: Kaon
CVE-2026-52748 (The Kaon AR2140X router contains a vulnerability where the
backup func ...)
- TODO: check
+ NOT-FOR-US: Kaon
CVE-2026-4556 (Exam4 is affected by a local privilege escalation vulnerability
in the ...)
TODO: check
CVE-2026-49994 (Bluehood monitors local bluetooth activity. Prior to version
0.7.1, wh ...)
- TODO: check
+ NOT-FOR-US: Bluehood
CVE-2026-48100 (Payy is an Ethereum L2 zk-rollup for privacy preserving and
regulatory ...)
- TODO: check
+ NOT-FOR-US: Payy
CVE-2026-45562 (FreePBX is an open source IP PBX. Prior to versions 16.0.4 and
17.0.6, ...)
TODO: check
CVE-2026-19759 (An Incorrect Authorization vulnerabilityin the task
configuration in G ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5259244804475605caf09033068da3f1620f2bc0
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5259244804475605caf09033068da3f1620f2bc0
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
