Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
172b3c40 by Salvatore Bonaccorso at 2026-10-01T07:16:46+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -250,7 +250,7 @@ CVE-2026-93624 (Shop manager PHP Object Injection in Music
Player for WooCommerc
CVE-2026-93621 (Unauthenticated SQL Injection in WP Data Access <= 5.5.84
versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-93547 (A missing authorization check in the Vaadin Spreadsheet
component allo ...)
- TODO: check
+ NOT-FOR-US: Vaadin
CVE-2026-93514 (Unauthenticated Cross Site Scripting (XSS) in Notification for
Telegra ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-93512 (Unauthenticated Cross Site Scripting (XSS) in JW Player for
WordPress ...)
@@ -293,7 +293,7 @@ CVE-2026-92121 (In the WSS4J streaming (StAX) code, a
signature reference using
- wss4j <unfixed>
NOTE:
https://lists.apache.org/thread.html/oop9p4hpl5o9byosb1qg3z7q1sgnn4pc
CVE-2026-91860 (A prototype pollution vulnerability exists in the deep merge
helpers o ...)
- TODO: check
+ NOT-FOR-US: Vaadin
CVE-2026-89238 (WSS4J EncryptedHeader child confusion could promote an
attacker-contro ...)
- wss4j <unfixed>
NOTE:
https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w
@@ -802,17 +802,17 @@ CVE-2026-102490 (All versions of Zammad including the
latest alpha enable the lo
CVE-2026-102489 (Zammad versions 6.3.0 to 6.5.4 are vulnerable a session
hijack vulnera ...)
TODO: check
CVE-2026-102459 (EasyFlow .NET developed by Digiwin has a Reflected Cross-site
Scriptin ...)
- TODO: check
+ NOT-FOR-US: Digiwin
CVE-2026-102458 (EasyFlow .NET developed by Digiwin has a Missing
Authentication vulner ...)
- TODO: check
+ NOT-FOR-US: Digiwin
CVE-2026-102457 (EasyFlow .NET developed by Digiwin has an Arbitrary File Read
vulnerab ...)
- TODO: check
+ NOT-FOR-US: Digiwin
CVE-2026-102456 (EasyFlow .NET developed by Digiwin has an SQL Injection
vulnerability. ...)
- TODO: check
+ NOT-FOR-US: Digiwin
CVE-2026-102455 (EasyFlow .NET developed by Digiwin has a Insecure
Deserialization vuln ...)
- TODO: check
+ NOT-FOR-US: Digiwin
CVE-2026-102454 (EasyFlow .NET developed by Digiwin has an Arbitrary File
Upload vulner ...)
- TODO: check
+ NOT-FOR-US: Digiwin
CVE-2026-102427 (Joomla Extension - ordasoft.com - Unauthenticated Remote Code
Executio ...)
NOT-FOR-US: Joomla
CVE-2026-102399 (Unauthenticated Cross Site Request Forgery (CSRF) in Photo
Gallery by ...)
@@ -842,7 +842,7 @@ CVE-2026-102376 (Subscriber Cross Site Scripting (XSS) in
Branda <= 3.4.32 versi
CVE-2026-102375 (Subscriber Broken Access Control in Optimole <= 4.2.14
versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-101295 (Path traversal / arbitrary file write in oc-mirror's operator
catalog ...)
- TODO: check
+ NOT-FOR-US: openshift/oc-mirror
CVE-2026-100513 (Contributor Cross Site Scripting (XSS) in CF7 Views –
Complete E ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-100512 (Contributor PHP Object Injection in Nested Pages <= 3.3.2
versions.)
@@ -1041,7 +1041,7 @@ CVE-2026-79534 (mark3labs mcp-filesystem-server v0.11.1
is vulnerable to Directo
CVE-2026-79417 (Improper Access Control in ArgusMonitor.sys in Argotronic eGbR
ArgusMo ...)
NOT-FOR-US: Argotronic eGbR ArgusMonitor
CVE-2026-79403 (An issue in Kilo Code before v7.4.1 allows a local attacker to
execute ...)
- TODO: check
+ NOT-FOR-US: Kilo Code
CVE-2026-79348 (KitchenAsty through 0.3.0 contains a broken object level
authorization ...)
NOT-FOR-US: KitchenAsty
CVE-2026-78229 (Image Scanner Driver for Linux contains an OS command
injection vulner ...)
@@ -1185,9 +1185,9 @@ CVE-2026-103100 (Pexip Infinity before 40.1 is affected
by improper input valida
CVE-2026-103099 (Pexip Infinity before 41.1 is affected by improper input
validation in ...)
NOT-FOR-US: Pexip Infinity
CVE-2026-103088 (Handlebars.java before 4.5.5 allows directory traversal. In
handlebars ...)
- TODO: check
+ NOT-FOR-US: Handlebars.java
CVE-2026-103087 (Uncontrolled recursion in the Gosub browser engine
(gosub-engine) thro ...)
- TODO: check
+ NOT-FOR-US: Gosub browser engine (gosub-engine)
CVE-2026-103057 (AiSOC versions 5.1.0 before 12.0.0 contain an authentication
bypass vu ...)
NOT-FOR-US: AiSOC
CVE-2026-103056 (AiSOC versions 7.2.0 before 12.0.0 contain a command
injection vulnera ...)
@@ -1215,7 +1215,7 @@ CVE-2026-103045 (Improper neutralization of input during
web page generation ('c
CVE-2026-103044 (XML injection (aka blind XPath injection) vulnerability in
The Wikimed ...)
TODO: check
CVE-2026-103043 (anchorme through 3.0.8 contains a regular expression denial
of service ...)
- TODO: check
+ NOT-FOR-US: anchorme Node.js module
CVE-2026-103042 (LightLLM through 1.2.0 contains a memory exhaustion
vulnerability in t ...)
NOT-FOR-US: LightLLM
CVE-2026-103041 (LightLLM through 1.2.0 multimodal deployments expose an
unauthenticate ...)
@@ -1235,7 +1235,7 @@ CVE-2026-102913 (A security flaw has been discovered in
SourceCodester Car Drivi
CVE-2026-102912 (A vulnerability was identified in SourceCodester Online Leave
Manageme ...)
NOT-FOR-US: SourceCodester
CVE-2026-102911 (A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7.
Affected is ...)
- TODO: check
+ NOT-FOR-US: zosmaai pi-llm-wiki
CVE-2026-102910 (A security flaw has been discovered in SourceCodester Online
Reviewer ...)
NOT-FOR-US: SourceCodester
CVE-2026-102909 (A vulnerability was identified in SourceCodester Online
Reviewer Manag ...)
@@ -1243,17 +1243,17 @@ CVE-2026-102909 (A vulnerability was identified in
SourceCodester Online Reviewe
CVE-2026-102908 (A vulnerability was determined in SourceCodester Online
Reviewer Manag ...)
NOT-FOR-US: SourceCodester
CVE-2026-102906 (A vulnerability was identified in 0xshariq github-mcp-server
up to 52e ...)
- TODO: check
+ NOT-FOR-US: 0xshariq github-mcp-server
CVE-2026-102904 (JupyterLab is an extensible environment for interactive and
reproducib ...)
- jupyterlab <unfixed>
NOTE:
https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3325-v43h-43rv
NOTE:
https://github.com/jupyterlab/jupyterlab/commit/e277bc958e737130ac47b6c5078d08b29298828f
(v4.6.4)
CVE-2026-102879 (ClaraVerse through 0.3.1 contains server-side request forgery
protecti ...)
- TODO: check
+ NOT-FOR-US: ClaraVerse
CVE-2026-102878 (mcp-chrome-bridge through 1.0.31 contains an origin
validation error i ...)
- TODO: check
+ NOT-FOR-US: mcp-chrome-bridge
CVE-2026-102877 (Fider before 0.38.0 contains a server-side request forgery
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Fider
CVE-2026-102876 (SurrealDB before 3.3.0 contains an authorization bypass in
HTTP sessio ...)
NOT-FOR-US: SurrealDB
CVE-2026-102875 (VLC media player before 3.0.24 contains a path traversal
vulnerability ...)
@@ -1262,31 +1262,31 @@ CVE-2026-102875 (VLC media player before 3.0.24
contains a path traversal vulner
NOTE:
https://code.videolan.org/videolan/vlc/-/commit/59934edbd03c6c1147d75d6c91e96633b710ec31
(3.0.24-rc1)
NOTE:
https://code.videolan.org/videolan/vlc/-/commit/8d43e99c2c01d9aab3ecad00e7a102806262b06b
(3.0.24-rc1)
CVE-2026-102874 (A vulnerability was identified in HKUDS AnyTool 0.1.0.
Affected is the ...)
- TODO: check
+ NOT-FOR-US: HKUDS AnyTool
CVE-2026-102847 (A flaw has been found in gedelumbung HospitalManagement up to
c2d45543 ...)
- TODO: check
+ NOT-FOR-US: gedelumbung HospitalManagement
CVE-2026-102846 (A vulnerability was detected in gedelumbung
HospitalManagement up to c ...)
- TODO: check
+ NOT-FOR-US: gedelumbung HospitalManagement
CVE-2026-102845 (A security vulnerability has been detected in gedelumbung
HospitalMana ...)
- TODO: check
+ NOT-FOR-US: gedelumbung HospitalManagement
CVE-2026-102844 (A weakness has been identified in gedelumbung
HospitalManagement up to ...)
- TODO: check
+ NOT-FOR-US: gedelumbung HospitalManagement
CVE-2026-102843 (A security flaw has been discovered in gedelumbung
HospitalManagement ...)
- TODO: check
+ NOT-FOR-US: gedelumbung HospitalManagement
CVE-2026-102842 (A vulnerability was identified in gedelumbung
HospitalManagement up to ...)
- TODO: check
+ NOT-FOR-US: gedelumbung HospitalManagement
CVE-2026-102805 (A flaw has been found in Nothings stb up to 1.16. This
affects the fun ...)
TODO: check
CVE-2026-102804 (A vulnerability was detected in Nothings stb up to
2c980bb59875b0d3214 ...)
TODO: check
CVE-2026-102794 (A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0.
This iss ...)
- TODO: check
+ NOT-FOR-US: Ziroom ZHOME A0101
CVE-2026-102793 (A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Ziroom ZHOME A0101
CVE-2026-102792 (A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0.
This affec ...)
- TODO: check
+ NOT-FOR-US: Ziroom ZHOME A0101
CVE-2026-102771 (A security vulnerability has been detected in Naichen
ThinkCMF up to 8 ...)
- TODO: check
+ NOT-FOR-US: Naichen ThinkCMF
CVE-2026-102621 (A vulnerability was identified in Freedesktop Poppler up to
26.08.0. A ...)
- poppler <unfixed>
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1763
@@ -1310,31 +1310,31 @@ CVE-2026-102253 (iperf3 versions prior to 3.22 contains
a denial of service vuln
NOTE:
https://github.com/esnet/iperf/commit/a25378f8cbbaa7b3db5674ca3dcc19658ae65da3
(3.22)
NOTE: https://github.com/esnet/iperf/releases/tag/3.22
CVE-2026-102252 (A path traversal vulnerability (CWE-22) in the embedded VMDK
filesyste ...)
- TODO: check
+ NOT-FOR-US: Google OSV-SCALIBR
CVE-2026-100299 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4,
the devi ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100298 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4,
two user ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100297 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4,
an unaut ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100296 (In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an
empty-body POST ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100295 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4,
an inter ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100294 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4,
the firm ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100293 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4,
both the ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100292 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4,
a hidden ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100291 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4,
several ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100143 (The FluentCart A New Era of eCommerce WordPress plugin
before 1.6.5 d ...)
NOT-FOR-US: WordPress plugin
CVE-2024-31027 (Cross Site Scripting vulnerability in Greek Universities
Network (GUne ...)
- TODO: check
+ NOT-FOR-US: Greek Universities Network (GUnet) Open eClass Platform
CVE-2024-31026 (An issue in Greek Universities Network (GUnet) Open eClass
Platform v. ...)
- TODO: check
+ NOT-FOR-US: Greek Universities Network (GUnet) Open eClass Platform
CVE-2026-XXXX [GHSA-5rfj-p5qw-w48g: Unauthenticated remote DoS via
attacker-controlled reverse-DNS hostname in auto-hosts parsing]
- sshuttle 2.0.0-1
NOTE:
https://github.com/sshuttle/sshuttle/security/advisories/GHSA-5rfj-p5qw-w48g
@@ -2838,11 +2838,11 @@ CVE-2026-100392 (InvoicePlane is a self-hosted open
source application for manag
CVE-2026-100371 (InvoicePlane is a self-hosted open source application for
managing inv ...)
NOT-FOR-US: InvoicePlane
CVE-2026-100370 (DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+.
Prior to vers ...)
- TODO: check
+ NOT-FOR-US: DOMSanitizer
CVE-2024-58386 (ZoneMinder versions 1.37.0 before 1.38.0 contain a path
traversal vuln ...)
TODO: check
CVE-2024-42002 (A code injection vulnerability has been discovered in the
Robot Operat ...)
- TODO: check
+ NOT-FOR-US: Operating System 2 (ROS 2) 'ros2topic' CLI tool
CVE-2026-96415 (Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8
and 4.4.0 ...)
- wireshark <unfixed>
NOTE: https://www.wireshark.org/security/wnpa-sec-2026-110
@@ -10918,7 +10918,7 @@ CVE-2026-87902 (An unauthenticated attacker can make
`get_page_template()` page-
CVE-2026-87119 (Authentication Bypass by Capture-replay in ZenHive mpp allows
an attac ...)
NOT-FOR-US: ZenHive mpp
CVE-2026-86698 (Insufficient Session Expiration vulnerability in OAuth token
issuance ...)
- TODO: check
+ NOT-FOR-US: hexpm (server side)
CVE-2026-86062 (LightRAG provides simple and fast retrieval-augmented
generation. Prio ...)
NOT-FOR-US: LightRAG
CVE-2026-86059 (Dokploy is a free, self-hostable Platform as a Service (PaaS).
Prior t ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/172b3c40d3d8af2a1b607d32b587d946492d7fbd
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/172b3c40d3d8af2a1b607d32b587d946492d7fbd
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
