Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
05c04b63 by security tracker role at 2026-09-30T19:16:05+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,259 +1,259 @@
CVE-2026-97347 (The Post Views Stats Counter plugin for WordPress is
vulnerable to Sto ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97302 (Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97301 (Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <=
2.7.8 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97299 (Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay
Payment ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97298 (Contributor Cross Site Scripting (XSS) in King Addons for
Elementor <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97293 (Contributor SQL Injection in Media LIbrary Assistant <= 3.41
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97292 (Author Cross Site Scripting (XSS) in YITH WooCommerce Tab
Manager <= 2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97291 (Contributor PHP Object Injection in Schema & Structured Data
for WP & ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97290 (Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery
& Light ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97289 (Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey
Master < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97288 (Contributor Cross Site Scripting (XSS) in OAuth Server <=
4.5.1 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97287 (Contributor SQL Injection in Event Tickets <= 5.29.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97286 (Contributor Cross Site Scripting (XSS) in Strong Testimonials
<= 3.3.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97285 (Contributor Broken Access Control in The Events Calendar <=
6.17.5 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97282 (Unauthenticated Insecure Direct Object References (IDOR) in
Review Sch ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97279 (Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97274 (Unauthenticated Bypass Vulnerability in OAuth Single Sign On
\u2013 SS ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97272 (Unauthenticated Cross Site Scripting (XSS) in Premmerce
Permalink Mana ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97271 (Unauthenticated Cross Site Scripting (XSS) in WPFunnels <=
3.13.1 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97270 (Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97267 (Subscriber Broken Access Control in Prevent files / folders
access <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97266 (Contributor Cross Site Scripting (XSS) in
Virtue/Ascend/Pinnacle Toolk ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97265 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97262 (Contributor Cross Site Scripting (XSS) in Visual Composer
Website Buil ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97261 (Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97259 (Authorization Bypass Through User-Controlled Key vulnerability
in WP H ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97256 (Editor PHP Object Injection in Page Builder by SiteOrigin <=
2.36.0 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97253 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97250 (Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <=
1.13.21 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97249 (Unauthenticated Bypass Vulnerability in Paid Member
Subscriptions <= 3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97248 (Unauthenticated PHP Object Injection in Booking Activities <=
1.18.7.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97247 (Unauthenticated Broken Access Control in Blocksy Companion <=
2.1.55 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97246 (Subscriber PHP Object Injection in ShortPixel Image Optimizer
<= 6.5.5 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97245 (Shop Worker Privilege Escalation in SureCart <= 4.7.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97244 (Contributor Path Traversal in Creator LMS <= 1.2.19 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97243 (Subscriber Broken Access Control in AllAble Connector <=
0.13.4 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97242 (Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97241 (Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97240 (Unauthenticated Sensitive Data Exposure in StifLi Backup Tools
<= 2.2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97239 (Subscriber Broken Access Control in MCP Content Manager Lite
<= 1.1.0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97238 (Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97237 (Unauthenticated Cross Site Scripting (XSS) in JetEngine <=
3.8.14.3 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97236 (Subscriber Cross Site Scripting (XSS) in ThemeREX Addons <
2.45.0 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97235 (Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons
< 2.45.0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97197 (Unauthenticated Broken Access Control in WordPress Backup &
Migration ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97150 (When converting baserCMS4-style addons to baserCMS5-style
ones, BcAddo ...)
TODO: check
CVE-2026-97079 (Subscriber Insecure Direct Object References (IDOR) in Webba
Booking < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97078 (Unauthenticated Insecure Direct Object References (IDOR) in
Client Inv ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97077 (Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <=
2.8.18 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97074 (Subscriber Insecure Direct Object References (IDOR) in
Newsletters, Em ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97067 (Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer
<= 8.7. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97066 (Unauthenticated Insecure Direct Object References (IDOR) in
GiveWP <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97065 (Unauthenticated Cross Site Scripting (XSS) in Happyforms <=
1.26.15 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96838 (Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist
Manager ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96837 (Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96836 (Unauthenticated Cross Site Scripting (XSS) in Parsi Date <=
6.3 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96835 (Contributor Cross Site Scripting (XSS) in King Addons for
Elementor <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96834 (Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96833 (Editor PHP Object Injection in Ultimate Addons for Contact
Form 7 <= 3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96832 (Shop manager PHP Object Injection in Content Egg <= 6.3.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96831 (Contributor PHP Object Injection in Themify Builder <= 7.8.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96830 (Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96829 (Contributor Cross Site Scripting (XSS) in The Plus Addons for
Elemento ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96828 (Administrator SQL Injection in Category Discount Woocommerce
<= 5.18 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96827 (Administrator SQL Injection in Admin Notices Manager <= 1.6.0
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96825 (Subscriber Bypass Vulnerability in All In One WP Security &
Firewall < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96824 (Editor Arbitrary File Deletion in Template Kit \u2013 Import
<= 1.0.16 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96823 (Unauthenticated Arbitrary Content Deletion in Customer Reviews
for Woo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96822 (Unauthenticated SQL Injection in Books Gallery <= 4.8.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96821 (Subscriber Privilege Escalation in FluentBoards <= 2.0.12
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96820 (Subscriber Cross Site Scripting (XSS) in Awesome Support <=
6.3.9 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96819 (Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96818 (Unauthenticated Broken Access Control in WP Express Checkout
(Accept P ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96817 (Subscriber Broken Access Control in MakeCommerce for
WooCommerce <= 4. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96816 (Unauthenticated Cross Site Scripting (XSS) in Trusted Shops
Easy Integ ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96815 (Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96814 (Unauthenticated Cross Site Scripting (XSS) in WooCommerce
Product Tabl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96450 (Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96352 (Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce
Ajax Se ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96351 (Unauthenticated Cross Site Scripting (XSS) in Classified
Listing <= 6. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96350 (Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96349 (Unauthenticated Remote Code Execution (RCE) in SiteSkite <=
2.1.8 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96348 (Unauthenticated Broken Access Control in Bookly <= 28.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96347 (Subscriber Insecure Direct Object References (IDOR) in Bookly
<= 28.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96346 (Author SQL Injection in WP ERP <= 1.17.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96345 (Administrator SQL Injection in Estatik <= 4.3.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96344 (Custom role PHP Object Injection in eCommerce Product Catalog
<= 3.6.0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96343 (Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96342 (Missing Authorization vulnerability in Amauri.IO WPMobile.App
wpappnin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96338 (Subscriber Cross Site Scripting (XSS) in Profile Builder <=
4.0.2 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95616 (An integer overflow in WSS4J's DER bounds check lets an
oversized allo ...)
TODO: check
CVE-2026-95587 (Unauthenticated Broken Access Control in Hostinger Migrator <=
1.0 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95531 (Subscriber PHP Object Injection in Conversational Forms for
ChatBot <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94683 (Contributor PHP Object Injection in DesignSetGo <= 2.8.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94681 (Unauthenticated Denial of Service Attack in WP Store Locator <
3.0.0 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94678 (Contributor PHP Object Injection in Go Live Update Urls <=
7.0.8 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94677 (Shop manager PHP Object Injection in Kadence WooCommerce Email
Designe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94674 (Contributor Cross Site Scripting (XSS) in Pixel Manager for
WooCommerc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94673 (Unauthenticated Insecure Direct Object References (IDOR) in
Simply Sch ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94672 (Contributor Insecure Direct Object References (IDOR) in Safe
SVG <= 2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94545 (Satori is a library to convert HTML and CSS to SVG. Starting
in versio ...)
TODO: check
CVE-2026-94499 (Subscriber Broken Access Control in FormGent <= 1.12.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94389 (Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP
Newslet ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94178 (Subscriber Privilege Escalation in Import and export users and
custome ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94177 (Unauthenticated SQL Injection in GamiPress <= 8.0.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94173 (Contributor Insecure Direct Object References (IDOR) in
Business Direc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94171 (Unauthenticated Cross Site Scripting (XSS) in CURCY <= 2.2.16
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94123 (Unauthenticated Arbitrary File Download in NextGEN Gallery <=
4.5.0 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94122 (Editor PHP Object Injection in Responsive Slider Gallery <=
1.5.5 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94121 (Contributor PHP Object Injection in 10Web Booster \u2013
Website speed ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94120 (Unauthenticated Broken Access Control in GravityExport Lite
for Gravit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94115 (Contributor SQL Injection in Easy Pricing Tables <= 4.1.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94082 (Author SQL Injection in Quiz Cat <= 3.1.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94081 (Unauthenticated Cross Site Scripting (XSS) in WordPress
Persistent Log ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94078 (Unauthenticated Cross Site Scripting (XSS) in Site Reviews <=
8.3.1 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94077 (Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94076 (Contributor PHP Object Injection in SEO Plugin by Squirrly SEO
<= 14.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94074 (Unauthenticated Broken Access Control in Simply Schedule
Appointments ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93908 (The Real Estate Manager \u2013 Property Listing and Agent
Management p ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93903 (LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles
internal r ...)
TODO: check
CVE-2026-93771 (Shop manager PHP Object Injection in Cost of Goods for
WooCommerce <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93770 (Unauthenticated Cross Site Scripting (XSS) in WP Statistics <=
14.16.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93651 (Author PHP Object Injection in Minimum and Maximum Quantity
for WooCom ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93624 (Shop manager PHP Object Injection in Music Player for
WooCommerce <= 1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93621 (Unauthenticated SQL Injection in WP Data Access <= 5.5.84
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93547 (A missing authorization check in the Vaadin Spreadsheet
component allo ...)
TODO: check
CVE-2026-93514 (Unauthenticated Cross Site Scripting (XSS) in Notification for
Telegra ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93512 (Unauthenticated Cross Site Scripting (XSS) in JW Player for
WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93464 (Stored Cross-Site Scripting via custom content descriptions
vulnerabil ...)
TODO: check
CVE-2026-93463 (Cross-Site Scripting via Script Validation Bypass exists in
baserCMS. ...)
@@ -279,7 +279,7 @@ CVE-2026-92868 (An improper certificate validation
vulnerability exists in Pgpoo
CVE-2026-92867 (An out-of-bounds write vulnerability exists in Pgpool-II ,
which may a ...)
TODO: check
CVE-2026-92712 (The ReactPress \u2013 Create React App for WordPress plugin
for WordPr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92121 (In the WSS4J streaming (StAX) code, a signature reference
using the WS ...)
TODO: check
CVE-2026-91860 (A prototype pollution vulnerability exists in the deep merge
helpers o ...)
@@ -289,7 +289,7 @@ CVE-2026-89238 (WSS4J EncryptedHeader child confusion could
promote an attacker-
CVE-2026-88920 (An authentication bypass in the DOM security processor in
Apache WSS4J ...)
TODO: check
CVE-2026-88037 (The Bold Page Builder plugin for WordPress is vulnerable to
Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87830 (In the StAX streaming WS-SecurityPolicy validator, certain
relative or ...)
TODO: check
CVE-2026-87004 (Tugtainer is a self-hosted app for automating updates of
Docker contai ...)
@@ -303,49 +303,49 @@ CVE-2026-82307 (Improper neutralization of special
elements used in an SQL comma
CVE-2026-79625 (Affected products do not properly synchronize access to their
monitori ...)
TODO: check
CVE-2026-76992 (The CODESYS Gateway Client allocates memory based on a size
field in a ...)
- TODO: check
+ NOT-FOR-US: CODESYS
CVE-2026-76570 (Joomla Extension - joomcode.com - Unauthenticated SQL
injection in rea ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-76504 (A vulnerability in the API session-based authentication
management of ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-75969 (Missing authentication for critical function vulnerability for
all PTZ ...)
TODO: check
CVE-2026-75098 (The Product Designer App plugin for WordPress is vulnerable to
Directo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-74865 (sogo_yhn configures SOGo with a parameter
"SOGoTrustProxyAuthenticatio ...)
TODO: check
CVE-2026-74864 (sogo_yhn configures SOGo with a parameter that forces the
request with ...)
TODO: check
CVE-2026-6806 (The Motors \u2013 Car Dealership & Classified Listings Plugin
plugin f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-6173 (The Bold Page Builder plugin for WordPress is vulnerable to
Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-6172 (The Bold Page Builder plugin for WordPress is vulnerable to
Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-6171 (The Bold Page Builder plugin for WordPress is vulnerable to
Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-6170 (The Bold Page Builder plugin for WordPress is vulnerable to
Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-62308 (Tugtainer is a self-hosted app for automating updates of
Docker contai ...)
TODO: check
CVE-2026-62146 (A trust-boundary flaw in CRI-O's sandbox state persistence
allows atta ...)
TODO: check
CVE-2026-62097 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62085 (Administrator SQL Injection in WP Activity Log <= 5.6.6
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62084 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62083 (Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62081 (Contributor Insecure Direct Object References (IDOR) in
Flexible PDF C ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62080 (Contributor Cross Site Scripting (XSS) in Happy Addons for
Elementor < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62079 (Contributor Cross Site Scripting (XSS) in Qi Addons For
Elementor <= 1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62078 (Contributor Cross Site Scripting (XSS) in Premium Addons for
Elementor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-55494 (Tugtainer is a self-hosted app for automating updates of
Docker contai ...)
TODO: check
CVE-2026-55224 (MineAdmin is a ready-to-use backend management system suitable
for qui ...)
@@ -597,9 +597,9 @@ CVE-2026-47097 (AJA HELO Plus firmware before 2.1.7
contains an information disc
CVE-2026-46711 (Soft Machine is a Virtual Machine\u2013based agentic
development envir ...)
TODO: check
CVE-2026-27371 (Unauthenticated Cross Site Scripting (XSS) in WPFunnels <=
3.13.1 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27085 (Shop manager Content Injection in Astra WordPress Theme <=
4.13.12 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-19553 (ssl.SSLContext.wrap_bio() didn't require the server_hostname
argument ...)
TODO: check
CVE-2026-18783 (Missing authentication for critical function vulnerability in
Trex Dig ...)
@@ -607,21 +607,21 @@ CVE-2026-18783 (Missing authentication for critical
function vulnerability in Tr
CVE-2026-18782 (Improper neutralization of special elements used in an SQL
command ('S ...)
TODO: check
CVE-2026-16596 (The WP Directory Kit plugin for WordPress is vulnerable to
generic SQL ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14876 (The Smart Slider 3 plugin for WordPress is vulnerable to
Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13720 (An Editor can set file-provisioning metadata (the
grafana.app/managedB ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-13719 (An authenticated user can list alert rules stored in folders
they are ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-11895 (The HT Mega Addons for Elementor \u2013 Elementor Widgets &
Template B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-10764 (Information disclosure in BVMS 4.5 up to 12.3 including allows
man-in- ...)
TODO: check
CVE-2026-10739 (Cato Networks SDP Client for Windows before 6.12.6 allows a
local user ...)
- TODO: check
+ NOT-FOR-US: Cato
CVE-2026-10726 (Cato Windows SDP Client before version 6.12.6 contains an
arbitrary fi ...)
- TODO: check
+ NOT-FOR-US: Cato
CVE-2026-103500 (An attacker could cause a heap buffer overflow by getting a
user to op ...)
TODO: check
CVE-2026-103476 (yii2-starter-kit through 4.2.0 fails to validate article
publication s ...)
@@ -727,7 +727,7 @@ CVE-2026-102984 (Astro is a web framework for
content-driven websites. Prior to
CVE-2026-102983 (Astro is a web framework for content-driven websites. From
5.2.0 until ...)
TODO: check
CVE-2026-102717 (MQTT WebSocket setter ABI mismatch may disclose memory or
cause a cras ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102588 (A flaw was found in Moodle. The XML grade import feature
lacks proper ...)
TODO: check
CVE-2026-102587 (A flaw was found in Moodle. User list filters do not properly
enforce ...)
@@ -777,103 +777,103 @@ CVE-2026-102455 (EasyFlow .NET developed by Digiwin has
a Insecure Deserializati
CVE-2026-102454 (EasyFlow .NET developed by Digiwin has an Arbitrary File
Upload vulner ...)
TODO: check
CVE-2026-102427 (Joomla Extension - ordasoft.com - Unauthenticated Remote Code
Executio ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-102399 (Unauthenticated Cross Site Request Forgery (CSRF) in Photo
Gallery by ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102398 (Unauthenticated Cross Site Scripting (XSS) in Popup by
Supsystic <= 1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102397 (Unauthenticated Broken Access Control in Ultimate Maps by
Supsystic <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102396 (Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps
by Supsyst ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102395 (Unauthenticated Cross Site Scripting (XSS) in Easy Google
Maps <= 1.14 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102392 (Shop manager PHP Object Injection in Extra Product Options
For WooComm ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102391 (Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder
<= 3.6.5. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102386 (Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus
<= 9.3.02 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102385 (Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <=
3.15.3 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102384 (Author Cross Site Scripting (XSS) in Supreme Modules Lite <=
2.5.63 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102377 (Contributor PHP Object Injection in Photo Gallery by 10Web <=
1.8.46 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102376 (Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102375 (Subscriber Broken Access Control in Optimole <= 4.2.14
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-101295 (Path traversal / arbitrary file write in oc-mirror's operator
catalog ...)
TODO: check
CVE-2026-100513 (Contributor Cross Site Scripting (XSS) in CF7 Views –
Complete E ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100512 (Contributor PHP Object Injection in Nested Pages <= 3.3.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100510 (Unauthenticated Cross Site Scripting (XSS) in Post and Page
Builder by ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100508 (Unauthenticated Denial of Service Attack in Two Factor <=
0.16.0 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100507 (Unauthenticated Cross Site Scripting (XSS) in If-So Dynamic
Content Pe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100280 (In JetBrains YouTrack before 2026.2.19197 creating a project
from an u ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100279 (In JetBrains YouTrack before 2026.2.19197 changing an
integration URL ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100278 (In JetBrains YouTrack before 2026.2.19197 users with
restricted permis ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100277 (In JetBrains YouTrack before 2026.2.19197 account takeover
was possibl ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100276 (In JetBrains YouTrack before 2026.2.19197 guest users could
remove a w ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100275 (In JetBrains YouTrack before 2026.2.19197 stored XSS in the
workflow e ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100274 (In JetBrains YouTrack before 2026.2.19197 project Admin could
trigger ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100273 (In JetBrains YouTrack before 2026.2.19197 authorisation
bypass in the ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100272 (In JetBrains YouTrack before 2026.2.19197 missing
authorisation in the ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100271 (In JetBrains YouTrack before 2026.2.19197 missing
authorisation on sev ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100270 (In JetBrains YouTrack before 2026.2.19197 low-level Admin
Read permiss ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100269 (In JetBrains YouTrack before 2026.2.19197 helpdesk project's
Authorize ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100268 (In JetBrains YouTrack before 2026.2.19197 project
administrators could ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100267 (In JetBrains YouTrack before 2026.2.19197 reDoS attack was
possible vi ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100266 (In JetBrains Hub before 2026.2.52366 missing authorisation
allowed aut ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100265 (In JetBrains Rider before 2026.2.1 aI Assistant could
auto-update thir ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100264 (In JetBrains YouTrack before 2026.2.18991 stored SMTP server
credentia ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100263 (In JetBrains YouTrack before 2026.2.18991 stored HTML
injection via th ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100262 (In JetBrains YouTrack before 2026.2.18991 missing
authorisation allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100261 (In JetBrains YouTrack before 2026.2.18991 changing article
visibility ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100260 (In JetBrains YouTrack before 2026.2.18991 mailbox integration
allowed ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100259 (In JetBrains YouTrack before 2026.2.18991 improper access
control on G ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100258 (In JetBrains YouTrack before 2026.2.18991 missing
authorisation allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100257 (In JetBrains YouTrack before 2026.2.18991 sSRF via stored
XHTML inject ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100256 (In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural
Search s ...)
TODO: check
CVE-2026-100255 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8
administrat ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100254 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8
authenticat ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100253 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8
sandbox esc ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2025-14564 (The Viable URL Media Uploader plugin for WordPress is
vulnerable to St ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19445 (A remote, unauthenticated TLS client can make a server crash
or call t ...)
- python3.15 <unfixed>
- python3.14 <unfixed>
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/05c04b633b395d43aa5fb3e1b864aaf874cbb576
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/05c04b633b395d43aa5fb3e1b864aaf874cbb576
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
