Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
32972a48 by Salvatore Bonaccorso at 2026-10-01T12:41:11+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -121,7 +121,7 @@ CVE-2026-51570 (modelscope Agentscope v1.0.0-v1.0.8 is
vulnerable to Path Traver
CVE-2026-51568 (modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path
Traversal i ...)
NOT-FOR-US: modelscope Agentscope
CVE-2026-47096 (AJA HELO Plus firmware before 2.1.7 contains a stored
cross-site scrip ...)
- TODO: check
+ NOT-FOR-US: AJA HELO Plus firmware
CVE-2026-19253 (The Cache Enabler WordPress plugin before 1.8.17 does not
validate a U ...)
NOT-FOR-US: WordPress plugin
CVE-2026-14157 (Use of an Externally Controlled Format String in the ASUS
Router modul ...)
@@ -133,17 +133,17 @@ CVE-2026-12241 (The Advanced Woo Labels \u2013 Product
Labels & Badges for WooCo
CVE-2026-103641 (A flaw was found in GEGL. The Radiance HDR loader reads past
the end o ...)
TODO: check
CVE-2026-103592 (simple-php-router through 5.4.1.7 contains an IP restriction
bypass vu ...)
- TODO: check
+ NOT-FOR-US: simple-php-router
CVE-2026-103591 (DeepWiki-Open through commit d92819a contains an
unauthenticated arbit ...)
- TODO: check
+ NOT-FOR-US: DeepWiki-Open
CVE-2026-103590 (QloApps through 1.7.0 contains a reflected cross-site
scripting vulner ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-103589 (QloApps through 1.7.0 contains a reflected cross-site
scripting vulner ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-103588 (QloApps through 1.7.0 contains a reflected cross-site
scripting vulner ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-103587 (QloApps through 1.7.0 contains a reflected cross-site
scripting vulner ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-103585 (Improper neutralization of Script-Related HTML tags in a web
page (bas ...)
TODO: check
CVE-2026-103584 (Improper neutralization of Script-Related HTML tags in a web
page (bas ...)
@@ -151,33 +151,33 @@ CVE-2026-103584 (Improper neutralization of
Script-Related HTML tags in a web pa
CVE-2026-103548 (Improperly stored passwords in the config file in Itron MV-90
xi 3.0 a ...)
NOT-FOR-US: Palo Alto Networks
CVE-2026-103547 (In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before
errata 021, d ...)
- TODO: check
+ NOT-FOR-US: ldapd in OpenBSD
CVE-2026-103544 (A vulnerability was found in datadrivenconstruction
OpenConstructionER ...)
- TODO: check
+ NOT-FOR-US: OpenConstructionERP
CVE-2026-103543 (A vulnerability has been found in itsourcecode Leave
Management System ...)
NOT-FOR-US: itsourcecode System
CVE-2026-103542 (A flaw has been found in formtools.org Form Tools up to
3.1.1. Impacte ...)
- TODO: check
+ NOT-FOR-US: Form Tools
CVE-2026-103541 (A vulnerability was detected in formtools.org Form Tools up
to 3.1.1. ...)
- TODO: check
+ NOT-FOR-US: Form Tools
CVE-2026-103540 (A security vulnerability has been detected in formtools.org
Form Tools ...)
- TODO: check
+ NOT-FOR-US: Form Tools
CVE-2026-103539 (A weakness has been identified in ZongXR SuperMarket 1.0.0.0.
This aff ...)
- TODO: check
+ NOT-FOR-US: ZongXR SuperMarket
CVE-2026-103538 (A security flaw has been discovered in ZongXR SuperMarket
1.0.0.0. Aff ...)
- TODO: check
+ NOT-FOR-US: ZongXR SuperMarket
CVE-2026-103536 (A vulnerability was identified in ZongXR Supermarket 1.0.0.0.
Affected ...)
- TODO: check
+ NOT-FOR-US: ZongXR SuperMarket
CVE-2026-103534 (A vulnerability was determined in David-Crty databasement up
to 1.7.1. ...)
- TODO: check
+ NOT-FOR-US: David-Crty databasement
CVE-2026-103533 (A vulnerability was found in David-Crty databasement up to
1.7.1. This ...)
- TODO: check
+ NOT-FOR-US: David-Crty databasement
CVE-2026-103532 (A vulnerability has been found in immich-app Immich up to
2.7.5. This ...)
- TODO: check
+ NOT-FOR-US: immich-app Immich
CVE-2026-103531 (A flaw has been found in OpenSC up to 0.27.1. The impacted
element is ...)
TODO: check
CVE-2026-103530 (A vulnerability was detected in decolua 9Router up to 0.5.55.
The affe ...)
- TODO: check
+ NOT-FOR-US: decolua 9Router
CVE-2026-103387 (A weakness has been identified in garycourt uri-js up to
4.4.1. This a ...)
TODO: check
CVE-2026-103001 (PyJWT is a Python implementation of JSON Web Token standards.
From 2.1 ...)
@@ -234,137 +234,137 @@ CVE-2026-102993 (pypdf is a free and open-source
pure-python PDF library. Prior
NOTE: https://github.com/py-pdf/pypdf/pull/4047
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/89db7c4fe9315ecc964bfdf05a4e8c4b94175163
(6.17.0)
CVE-2026-102992 (piscina is a node.js worker pool implementation. Prior to
4.9.4, 5.3.2 ...)
- TODO: check
+ NOT-FOR-US: piscina
CVE-2026-102991 (Mako is a template library written in Python. Prior to 1.4.2,
on Windo ...)
TODO: check
CVE-2026-102990 (basic-ftp is an FTP client for Node.js. Prior to 6.2.1,
Client.list() ...)
TODO: check
CVE-2026-102150 (A function in the Kiteworks Advanced Forms component was
reachable wit ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102149 (Kiteworks Email Protection Gateway did not sufficiently
restrict which ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102147 (A stored cross-site scripting (XSS) weakness in Kiteworks
Core could a ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102146 (An authenticated Email Protection Gateway administrator
holding only l ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102145 (An authenticated administrator could cause the server to
issue request ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102144 (A resource exhaustion vulnerability in Kiteworks Email
Protection Gate ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102143 (An unauthenticated attacker could cause a file with
attacker-controlle ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102142 (A system notification template on the Kiteworks appliance was
rendered ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102141 (Two Kiteworks Core cluster-management operations did not
validate file ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102140 (An authenticated administrator could initiate an
administrative import ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102139 (An authorization check in the large file exchange feature of
Kiteworks ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102138 (An authenticated administrator on a node with an optional,
separately ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102137 (An authenticated administrator could bypass the content
validation app ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102136 (In multi-node deployments, an attacker who had already
obtained code e ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102135 (On a Kiteworks Email Protection Gateway cluster with database
replicat ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102134 (Kiteworks Core did not apply its gateway-level API security
controls t ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102133 (An optional, separately licensed repository-connector feature
in Kitew ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102132 (An administrative import function in Kiteworks Core did not
verify tha ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102131 (Kiteworks Email Protection Gateway rejected certain
configuration sett ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102130 (Kiteworks Email Protection Gateway did not sufficiently
validate the c ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102129 (A user-provisioning interface in Kiteworks Core did not
verify that th ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102128 (An identity-verification weakness in Kiteworks Email
Protection Gatewa ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102127 (An XML parser used by Kiteworks Email Protection Gateway did
not restr ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102126 (A stored cross-site scripting (XSS) weakness in Kiteworks
Core could a ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102125 (The sandbox that isolates document conversion on a Kiteworks
appliance ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102124 (A Kiteworks appliance setup interface did not enforce
authentication o ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102123 (A Kiteworks appliance setup interface did not confine a
user-supplied ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102122 (Kiteworks did not correctly enforce which roles a shared
folder's mana ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102121 (A form-rendering interface in the Advanced Forms component is
reachabl ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102120 (A privilege escalation vulnerability in Kiteworks could have
allowed a ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102119 (A path traversal weakness in an optional, non-default
administrative f ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102118 (A local privilege escalation vulnerability in Kiteworks could
have all ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102117 (On deployments where the remote-support capability is
licensed and ena ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102116 (-A weakness could have allowed an authenticated Kiteworks
Email Protec ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102115 (Kiteworks Core did not correctly validate a parameter
submitted to the ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102114 (A command injection vulnerability in Kiteworks could allow a
high-priv ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102113 (A privilege escalation vulnerability in Kiteworks could allow
an attac ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102112 (A privilege escalation vulnerability in Kiteworks could allow
an attac ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102111 (Kiteworks did not enforce the maximum permitted value for a
configurab ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102110 (An endpoint used during initial appliance setup did not
require authen ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102109 (A SQL injection vulnerability existed in Kiteworks Secure
Data Forms, ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102108 (An authenticated administrator of Kiteworks Email Protection
Gateway c ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102107 (Kiteworks Core contains a business logic flaw in a Kiteworks
file-requ ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102106 (Improper authentication in a Kiteworks Email Protection
Gateway admini ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102105 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102104 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102103 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102102 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102101 (Kiteworks Core before version 9.5.0 is vulnerable to
Deserialization o ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102100 (Kiteworks Core before version 9.5.0 is vulnerable to Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102099 (Kiteworks Core before version 9.5.0 is vulnerable to
Arbitrary File Wr ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102098 (Kiteworks Core before version 9.5.0 is vulnerable to SQL
Injection. A ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102097 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102096 (Kiteworks Core before version 9.5.0 is vulnerable to OS
Command Inject ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102095 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102094 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102093 (Kiteworks Core before version 9.5.0 is vulnerable to Improper
Privileg ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102092 (Kiteworks Core before version 9.5.0 is vulnerable to Stored
Cross-site ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102091 (Kiteworks Secure Data Forms before version 9.5.0 is
vulnerable to Serv ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102090 (Kiteworks Core before version 9.5.1 is vulnerable to Content
Injection ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102089 (Kiteworks Email Protection Gateway before version 9.5.0 is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-101887 (BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero
vulnerabil ...)
TODO: check
CVE-2026-101885 (ZeroClaw versions before 0.8.5 built with plugins-wasm
feature contain ...)
- TODO: check
+ NOT-FOR-US: ZeroClaw
CVE-2026-101884 (OpenClaw Windows Node before 2026.7.1 contains an incomplete
environme ...)
NOT-FOR-US: OpenClaw
CVE-2026-101883 (OpenClaw Windows Node through 2026.9.4 contains a server-side
request ...)
@@ -382,13 +382,13 @@ CVE-2026-101148 (The BackupSheep WordPress Backup Plugin
WordPress plugin throug
CVE-2026-101147 (The Featured Image from URL (FIFU) WordPress plugin before
6.0.8, Feat ...)
NOT-FOR-US: WordPress plugin
CVE-2025-41753 (The object name of a dynamically created BACnet File Object is
interpr ...)
- TODO: check
+ NOT-FOR-US: WAGO
CVE-2024-58387 (Inspur Haiyue HCM Cloud contains an arbitrary file read
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Inspur Haiyue HCM Cloud
CVE-2023-54403 (Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file
read vul ...)
- TODO: check
+ NOT-FOR-US: Yonyou U8 CRM
CVE-2023-54402 (iDocView contains a server-side request forgery vulnerability
in its / ...)
- TODO: check
+ NOT-FOR-US: iDocView
CVE-2026-XXXX [GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses
multipart filename rules]
- modsecurity <unfixed>
- modsecurity-apache <unfixed>
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/32972a4843107df94a2020d137e0588160189b11
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/32972a4843107df94a2020d137e0588160189b11
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
