Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
606d9c2a by security tracker role at 2026-09-29T19:15:53+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -9,7 +9,7 @@ CVE-2026-97688 (urllib3 is an HTTP client library for Python.
From 2.6.2 until 2
CVE-2026-97687 (urllib3 is an HTTP client library for Python. From 1.26.0
until 2.8.0, ...)
TODO: check
CVE-2026-97395 (Apache Polaris allows an authenticated principal with
permission to cr ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-96440 (Improper Limitation of a Pathname to a Restricted
Directory\uff08Path ...)
TODO: check
CVE-2026-96431 (Unrestricted Upload of File with Dangerous Type in the
/WebAgenda/down ...)
@@ -25,59 +25,59 @@ CVE-2026-95520 (A heap-based buffer overflow flaw was found
in rpm. Parsing a sy
CVE-2026-95509 (Strings optimized for Latin-1 displaying Latin-1 characters
cause inco ...)
TODO: check
CVE-2026-94954 (A stack-based buffer overflow vulnerability exists in the web
manageme ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-93332 (Improper access control in the partial connection API in
Devolutions S ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-93330 (Improper rule enforcement in the PAM Active Directory provider
in Devo ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-92371 (TeamViewer Full Client and Host for Linux prior version 15.82
contains ...)
- TODO: check
+ NOT-FOR-US: TeamViewer
CVE-2026-92370 (An improper access control vulnerability in TeamViewer Full
Client, Ho ...)
- TODO: check
+ NOT-FOR-US: TeamViewer
CVE-2026-92369 (TeamViewer Full Client and Host prior to version 15.82 on
Windows cont ...)
- TODO: check
+ NOT-FOR-US: TeamViewer
CVE-2026-92368 (TeamViewer Full Client and Host for Linux and macOS prior
version 15.8 ...)
- TODO: check
+ NOT-FOR-US: TeamViewer
CVE-2026-92232 (Joomla! Core - [20260916] - Core - XSS filter bypass in
InputFilter vi ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92231 (Joomla! Core - [20260915] - Core - XSS filter bypass in
InputFilter vi ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92227 (Joomla! Core - [20260914] - Core - MFA Authentication Bypass
through r ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92226 (Joomla! Core - [20260913] - Core - Improper ACL checks for
varous webs ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92225 (Joomla! Core - [20260912] - Core - XSS in module list in
Joomla 4.0.0- ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92224 (Joomla! Core - [20260911] - Core - XSS in link toolbar layout
in Jooml ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92223 (Joomla! Core - [20260910] - Core - Improper ACL checks for
workflow st ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92222 (Joomla! Core - [20260909] - Core - SSRF vectors in various
core extens ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90918 (Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates
in Jooml ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90917 (Joomla! Core - [20260907] - Core - Improper ACL checks in
outputs for ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90916 (Joomla! Core - [20260906] - Core - Improper ACL checks in
content hist ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90915 (Joomla! Core - [20260905] - Core - Arbitrary directory
deletion via ca ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90914 (Joomla! Core - [20260904] - Core - XSS in the generic media
output lay ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90913 (Joomla! Core - [20260903] - Core - Improper ACL checks for
access leve ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90907 (Joomla! Core - [20260902] - Core - Unauthorized user account
creation ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90906 (Joomla! Core - [20260901] - XSS in HTMLHelper::link method in
Joomla 1 ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-8937 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-8067 (An improper authorization vulnerability in the end-of-life
versions of ...)
- TODO: check
+ NOT-FOR-US: Hitachi Energy
CVE-2026-8066 (A directory traversal vulnerability in the file upload
functionality o ...)
- TODO: check
+ NOT-FOR-US: Hitachi Energy
CVE-2026-8065 (An authentication bypass vulnerability in the firmware update
endpoint ...)
- TODO: check
+ NOT-FOR-US: Hitachi Energy
CVE-2026-87748 (Missing Authorization vulnerability in Interprobe Information
Technolo ...)
TODO: check
CVE-2026-86450 (Insertion of sensitive information into sent data
vulnerability in Par ...)
@@ -87,79 +87,79 @@ CVE-2026-86035 (Weblate is a web-based continuous
localization platform used to
CVE-2026-85520 (Google Merchant Center Feed (gmfeed) module for PrestaShop is
vulnerab ...)
TODO: check
CVE-2026-84842 (IBM Guardium Data Protection 12.2 is vulnerable to path
traversal and ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84739 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-84440 (IBM Guardium Data Protection 12.2 is vulnerable to command
injection i ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84436 (IBM Guardium Data Protection 12.2 is vulnerable to command
injection i ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84422 (IBM Guardium Data Protection 12.2 is vulnerable to command
injection i ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84421 (IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a
remote authe ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84414 (IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated
attacke ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84154 (A Code Injection vulnerability affecting GEOVIA Geospatial
Data Manage ...)
- TODO: check
+ NOT-FOR-US: Dassault Systemes
CVE-2026-82973 (Improper neutralization of CRLF sequences in IMAP command
construction ...)
TODO: check
CVE-2026-82804 (The scriptPath parameter is incorporated into a /bin/sh -c
command wit ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-81569 (An improper authorization vulnerability exists in the handling
of sub- ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-7395 (Asset Suite allows unauthenticated users to access
HTTPPublishAdapterT ...)
- TODO: check
+ NOT-FOR-US: Hitachi Energy
CVE-2026-7193 (A vulnerability relating to the use of predefined credentials
in the D ...)
TODO: check
CVE-2026-7192 (A stack-based buffer overflow vulnerability in the Dbit
T-CPE301K 4G W ...)
TODO: check
CVE-2026-78214 (An authentication bypass vulnerability exists in the
protection of Act ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-77177 (Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta
AI backe ...)
TODO: check
CVE-2026-76875 (PyPy before versions 3.11.16 and 3.12.14 contains a
use-after-free vul ...)
TODO: check
CVE-2026-76720 (A vulnerability in HPE OneView can be remotely exploited to
cause a UR ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76719 (A security vulnerability in HPE OneView may be exploited
remotely to p ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76718 (A potential security vulnerability in HPE OneView can be
exploited to ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76114 (Dell Secure Connect Gateway (SCG) Policy Manager, versions
prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73599 (Dell Secure Connect Gateway (SCG) Policy Manager, versions
prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73598 (Dell Secure Connect Gateway (SCG) Policy Manager, versions
prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73597 (Dell Secure Connect Gateway (SCG) Policy Manager, versions
prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73596 (Dell Secure Connect Gateway (SCG) Policy Manager, versions
prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73595 (Dell Secure Connect Gateway (SCG) Policy Manager, versions
prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73594 (Dell Secure Connect Gateway (SCG) Policy Manager, versions
prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73593 (Dell Secure Connect Gateway (SCG) Policy Manager, versions
prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-71899 (A missing authorization vulnerability exists in the
`query-dynamic-sub ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71898 (An incorrect authorization check in Apache DolphinScheduler
allows an ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71897 (An improper authorization check in Apache DolphinScheduler
allows an a ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-68911 (Nicotine+ is a graphical client for the Soulseek peer-to-peer
network. ...)
TODO: check
CVE-2026-66083 (The /datasources/unauth-datasource endpoint does not properly
enforce ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-65102 (NVIDIA DeepStream contains a vulnerability where an attacker
could ca ...)
TODO: check
CVE-2026-63209 (compress provides various compression algorithms. Prior to
version 1.1 ...)
TODO: check
CVE-2026-4523 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-4034 (Injection Vulnerability in Tibco Administrator version 5.13.0 &
prior ...)
- TODO: check
+ NOT-FOR-US: TIBCO
CVE-2026-49243 (Webmin is a web-based system administration tool for Unix-like
servers ...)
TODO: check
CVE-2026-41875 (Quick.Cart is vulnerable to Cross-Site Request Forgery in
admin config ...)
@@ -169,7 +169,7 @@ CVE-2026-22101 (The access to the service menu is
obfuscated, but possible with
CVE-2026-22094 (The firmware for the EVbee DC-80 has a weak hardcoded root
password, w ...)
TODO: check
CVE-2026-19743 (Improper path validation in the local IPC service of
TeamViewer Full C ...)
- TODO: check
+ NOT-FOR-US: TeamViewer
CVE-2026-19547 (Ghostscript for Windows is vulnerable to local privilege
escalation th ...)
TODO: check
CVE-2026-15390 (Das U-Bootwith CONFIG_IP_DEFRAG=y parameter fails to clear IP
reassemb ...)
@@ -177,9 +177,9 @@ CVE-2026-15390 (Das U-Bootwith CONFIG_IP_DEFRAG=y parameter
fails to clear IP re
CVE-2026-12345 (The cleanup of tempfile.TemporaryDirectory is vulnerable to a
race con ...)
TODO: check
CVE-2026-11796 (Asset Suite allows unauthenticated users to access
PropertiesReloadSer ...)
- TODO: check
+ NOT-FOR-US: Hitachi Energy
CVE-2026-10518 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-102831 (JupyterLab is an extensible environment for interactive and
reproducib ...)
TODO: check
CVE-2026-102830 (JupyterLab is an extensible environment for interactive and
reproducib ...)
@@ -213,65 +213,65 @@ CVE-2026-102809 (PX4 Autopilot through 1.17.0 contains an
uncontrolled stack all
CVE-2026-102808 (PX4 Autopilot through 1.17.0 contains a NULL pointer
dereference vulne ...)
TODO: check
CVE-2026-102807 (OpenClaw before 2026.9.4 contains an incorrect authorization
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: OpenClaw
CVE-2026-102806 (OpenClaw before 2026.9.5 contains an incorrect authorization
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: OpenClaw
CVE-2026-102796 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
TODO: check
CVE-2026-102762 (The NetX Duo MQTT client leaks the packet carrying a
malformed PUBLISH ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102761 (NetX Duo's WebSocket client resets the unmasking cursor to
the first ` ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102760 (When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every
TLS record ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102759 (NetX Secure TLS accepts an empty application-data record
without verif ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102758 (The `_nx_secure_x509_asn1_tlv_block_parse()` function parses
ASN.1 TLV ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102757 (An unprivileged, memory-protected ThreadX module can have the
kernel r ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102730 (Mounting an attacker-controlled NAND flash image
(`lx_nand_flash_open( ...)
TODO: check
CVE-2026-102729 (`gx_binres_theme_load()` sizes its theme buffer for the theme
it was a ...)
TODO: check
CVE-2026-102728 (Two client-side TLS/DTLS handshake parsers in NetX Secure
read fields ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102727 (FTP Passive Data Connection Not Bound to the Authenticated
Control Pee ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102726 (Unbounded PPP IPCP Option Parsing Causes a Worker Stall and
Out-of-bou ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102725 (Out-of-bounds Read from Unvalidated MSRP Attribute List
Length)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102724 (NULL Pointer Dereference When Evicting the Sole MSRP
Attribute)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102723 (NULL Pointer Dereference on MSRP Attribute Table Exhaustion)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102722 (In the IPv4 PASV path, the FTP Client accepts whatever
address was sen ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102721 (A TFTP server that answers with a short ERROR packet makes
the client ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102720 (A DHCP server, or anyone on the LAN who answers a DISCOVER
first, can ...)
TODO: check
CVE-2026-102719 (Predictable DTLS HelloVerifyRequest Cookie in NetX Secure)
TODO: check
CVE-2026-102718 (hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP
addon do ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102716 (An unauthenticated client can drain the RTSP server's packet
pool with ...)
TODO: check
CVE-2026-102715 (Any host on the LAN can send two mDNS records and make the
responder w ...)
TODO: check
CVE-2026-102714 (`_nx_icmpv6_validate_options()` scans the option area with
`while (len ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102713 (The TFTP server accepts a DATA datagram of any size. The
dispatcher re ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102712 (On the first DTLS ClientHello, the parser copies a
device-claimed sess ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102711 (Two issues in the ThreadX loadable-module loader, reached
when a devic ...)
TODO: check
CVE-2026-102710 (Attacker model / Preconditions: a loaded
`TXM_MODULE_USER_MODE | TXM_M ...)
TODO: check
CVE-2026-102709 (Improper validation of non-secure (NS) pointers in multiple
TrustZone- ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102697 (Ollama versions 0.14.0 before 0.31.2 contain an incorrect
authorizatio ...)
TODO: check
CVE-2026-102677 (Electron is a framework for writing cross-platform desktop
application ...)
@@ -345,9 +345,9 @@ CVE-2026-102473 (A flaw was found in dash. When built
without libc fnmatch, the
CVE-2026-102437 (OS Command Injection in internal/gitcmd (git diff
filter.clean/smudge ...)
TODO: check
CVE-2026-102425 (Joomla Extension - balbooa.com - Unauthenticated RCE via
field shortco ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-102424 (Joomla Extension - balbooa.com - Unauthenticated path
traversal exfilt ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-102371 (In wsl-pro-service before 0.1.19ubuntu3, the service
component which r ...)
TODO: check
CVE-2026-102360 (A missing bounds check in the binary decoder in lib0,
versions 0.2.1-0 ...)
@@ -355,39 +355,39 @@ CVE-2026-102360 (A missing bounds check in the binary
decoder in lib0, versions
CVE-2026-102242 (Improper link resolution (CWE-59 / CWE-22) in the
allowedLocalRoots pa ...)
TODO: check
CVE-2026-101271 (OAuth credentials (access tokens) are valid for the entirety
of their ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-101270 (Malicious HTML content could be injected into the help texts
of variou ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-101269 (The mechanism binding API-uploaded files to the uploader's
authenticat ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-101268 (If an attacker is able to convince a victim on a specially
crafted lin ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-101267 (A missing permission check allowed low-privileged users with
access to ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-101266 (A logic flaw in the checkout flow allows users to bypass
validations p ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-101169 (In affected versions of Octopus Server, an authenticated user
with per ...)
- TODO: check
+ NOT-FOR-US: Octopus Deploy
CVE-2026-101127 (Joomla Extension - balbooa.com - Unauthenticated upload
filename store ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-101126 (Joomla Extension - balbooa.com - File meta data tampering in
Balbooa F ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-101112 (Joomla Extension - balbooa.com - Unauthorized Deletion of
Attachments ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-100308 (Deserialization of untrusted data in the model loading
component in Am ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-100289 (Missing authorization in the gateway network scan token API
in Devolut ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-100288 (Cleartext storage of sensitive information in the database in
Devoluti ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-100287 (Missing authorization in the attachment history API in
Devolutions Ser ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-100286 (Missing authorization in the data source settings API in
Devolutions S ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-100245 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100244 (Exposure of Sensitive Information to an Unauthorized Actor
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100243 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
TODO: check
CVE-2026-100242 (Dependency on Vulnerable Third-Party Component and
Uncontrolled Resour ...)
@@ -395,7 +395,7 @@ CVE-2026-100242 (Dependency on Vulnerable Third-Party
Component and Uncontrolled
CVE-2026-100241 (Exposure of Sensitive Information to an Unauthorized Actor
vulnerabili ...)
TODO: check
CVE-2026-100240 (Missing Authorization vulnerability in Wikimedia Foundation
Mediawiki ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100238 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
TODO: check
CVE-2025-33207 (NVIDIA ConnectX and Bluefield contain a vulnerability in a
control reg ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/606d9c2ab11e4f5cb606c7d11854859be40cc856
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/606d9c2ab11e4f5cb606c7d11854859be40cc856
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
