Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
00fcd964 by Salvatore Bonaccorso at 2026-09-29T22:28:18+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -10,15 +10,15 @@ CVE-2026-97711 (Serialize JavaScript serializes JavaScript
values to a superset
CVE-2026-97395 (Apache Polaris allows an authenticated principal with
permission to cr ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-96440 (Improper Limitation of a Pathname to a Restricted
Directory\uff08Path ...)
- TODO: check
+ NOT-FOR-US: Flowring Agentflow
CVE-2026-96431 (Unrestricted Upload of File with Dangerous Type in the
/WebAgenda/down ...)
- TODO: check
+ NOT-FOR-US: Flowring Agentflow
CVE-2026-96430 (Exposed Dangerous Method or Function in the
/WebAgenda/SQLWin.do API e ...)
- TODO: check
+ NOT-FOR-US: Flowring Agentflow
CVE-2026-96429 (SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API
endpoint o ...)
- TODO: check
+ NOT-FOR-US: Flowring Agentflow
CVE-2026-96428 (SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API
endpoint of ...)
- TODO: check
+ NOT-FOR-US: Flowring Agentflow
CVE-2026-95520 (A heap-based buffer overflow flaw was found in rpm. Parsing a
symlink ...)
TODO: check
CVE-2026-95509 (Strings optimized for Latin-1 displaying Latin-1 characters
cause inco ...)
@@ -78,13 +78,13 @@ CVE-2026-8066 (A directory traversal vulnerability in the
file upload functional
CVE-2026-8065 (An authentication bypass vulnerability in the firmware update
endpoint ...)
NOT-FOR-US: Hitachi Energy
CVE-2026-87748 (Missing Authorization vulnerability in Interprobe Information
Technolo ...)
- TODO: check
+ NOT-FOR-US: Qorela DC
CVE-2026-86450 (Insertion of sensitive information into sent data
vulnerability in Par ...)
- TODO: check
+ NOT-FOR-US: DetaWix Mobile Web Portal
CVE-2026-86035 (Weblate is a web-based continuous localization platform used
to manage ...)
TODO: check
CVE-2026-85520 (Google Merchant Center Feed (gmfeed) module for PrestaShop is
vulnerab ...)
- TODO: check
+ NOT-FOR-US: PrestaShop module
CVE-2026-84842 (IBM Guardium Data Protection 12.2 is vulnerable to path
traversal and ...)
NOT-FOR-US: IBM
CVE-2026-84739 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
@@ -102,7 +102,7 @@ CVE-2026-84414 (IBM i 7.6, 7.5, 7.4, and 7.3 could allow a
local authenticated a
CVE-2026-84154 (A Code Injection vulnerability affecting GEOVIA Geospatial
Data Manage ...)
NOT-FOR-US: Dassault Systemes
CVE-2026-82973 (Improper neutralization of CRLF sequences in IMAP command
construction ...)
- TODO: check
+ NOT-FOR-US: psyb0t/docker-mailbox
CVE-2026-82804 (The scriptPath parameter is incorporated into a /bin/sh -c
command wit ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-81569 (An improper authorization vulnerability exists in the handling
of sub- ...)
@@ -110,13 +110,13 @@ CVE-2026-81569 (An improper authorization vulnerability
exists in the handling o
CVE-2026-7395 (Asset Suite allows unauthenticated users to access
HTTPPublishAdapterT ...)
NOT-FOR-US: Hitachi Energy
CVE-2026-7193 (A vulnerability relating to the use of predefined credentials
in the D ...)
- TODO: check
+ NOT-FOR-US: Dbit T-CPE301K 4G WiFi mini-router
CVE-2026-7192 (A stack-based buffer overflow vulnerability in the Dbit
T-CPE301K 4G W ...)
- TODO: check
+ NOT-FOR-US: Dbit T-CPE301K 4G WiFi mini-router
CVE-2026-78214 (An authentication bypass vulnerability exists in the
protection of Act ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-77177 (Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta
AI backe ...)
- TODO: check
+ NOT-FOR-US: Open GenAI Stack (aka ogx-ai)
CVE-2026-76875 (PyPy before versions 3.11.16 and 3.12.14 contains a
use-after-free vul ...)
TODO: check
CVE-2026-76720 (A vulnerability in HPE OneView can be remotely exploited to
cause a UR ...)
@@ -162,11 +162,11 @@ CVE-2026-4034 (Injection Vulnerability in Tibco
Administrator version 5.13.0 & p
CVE-2026-49243 (Webmin is a web-based system administration tool for Unix-like
servers ...)
TODO: check
CVE-2026-41875 (Quick.Cart is vulnerable to Cross-Site Request Forgery in
admin config ...)
- TODO: check
+ NOT-FOR-US: Quick.Cart
CVE-2026-22101 (The access to the service menu is obfuscated, but possible
with only p ...)
- TODO: check
+ NOT-FOR-US: EVbee
CVE-2026-22094 (The firmware for the EVbee DC-80 has a weak hardcoded root
password, w ...)
- TODO: check
+ NOT-FOR-US: EVbee
CVE-2026-19743 (Improper path validation in the local IPC service of
TeamViewer Full C ...)
NOT-FOR-US: TeamViewer
CVE-2026-19547 (Ghostscript for Windows is vulnerable to local privilege
escalation th ...)
@@ -184,13 +184,13 @@ CVE-2026-102831 (JupyterLab is an extensible environment
for interactive and rep
CVE-2026-102830 (JupyterLab is an extensible environment for interactive and
reproducib ...)
TODO: check
CVE-2026-102829 (simple-git, an interface for running git commands in any
node.js appli ...)
- TODO: check
+ NOT-FOR-US: simple-git
CVE-2026-102828 (simple-git, an interface for running git commands in any
node.js appli ...)
- TODO: check
+ NOT-FOR-US: simple-git
CVE-2026-102827 (simple-git, an interface for running git commands in any
node.js appli ...)
- TODO: check
+ NOT-FOR-US: simple-git
CVE-2026-102826 (simple-git, an interface for running git commands in any
node.js appli ...)
- TODO: check
+ NOT-FOR-US: simple-git
CVE-2026-102825 (Russh is a Rust SSH client and server library. Prior to
0.62.6, the US ...)
TODO: check
CVE-2026-102824 (Russh is a Rust SSH client and server library. Prior to
0.63.0, the hy ...)
@@ -204,13 +204,13 @@ CVE-2026-102821 (Russh is a Rust SSH client and server
library. Prior to 0.63.2,
CVE-2026-102820 (pageant provides a [PageantStream] type that implements
[AsyncRead] an ...)
TODO: check
CVE-2026-102811 (Marmite through 0.4.2 contains missing authentication in the
developme ...)
- TODO: check
+ NOT-FOR-US: Marmite
CVE-2026-102810 (Marmite through 0.4.2 contains a path traversal vulnerability
in the d ...)
- TODO: check
+ NOT-FOR-US: Marmite
CVE-2026-102809 (PX4 Autopilot through 1.17.0 contains an uncontrolled stack
allocation ...)
- TODO: check
+ NOT-FOR-US: PX4 Autopilot
CVE-2026-102808 (PX4 Autopilot through 1.17.0 contains a NULL pointer
dereference vulne ...)
- TODO: check
+ NOT-FOR-US: PX4 Autopilot
CVE-2026-102807 (OpenClaw before 2026.9.4 contains an incorrect authorization
vulnerabi ...)
NOT-FOR-US: OpenClaw
CVE-2026-102806 (OpenClaw before 2026.9.5 contains an incorrect authorization
vulnerabi ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/00fcd964dfe4ce68a3c40992c7e56b0b7a0f2f41
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/00fcd964dfe4ce68a3c40992c7e56b0b7a0f2f41
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
