Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
7b827b4a by security tracker role at 2026-10-01T19:15:13+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,89 +1,89 @@
CVE-2026-9864 (Fortra BoKS Server Agent contains a predictable password
generation vu ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-9032 (Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in
the HTT ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-97662 (An argument injection issue in the diff scan operation in AWS
security ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-97661 (The Business Essentials for Contact Form 7 plugin for
WordPress is vul ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97297 (Subscriber Broken Access Control in Gratisfaction <= 4.6.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97284 (Contributor PHP Object Injection in Icegram <= 3.1.31
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97281 (Subscriber Broken Access Control in WP Project Manager <=
4.0.7 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97280 (Missing Authorization vulnerability in Mamunur Rashid Review
Schema re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97277 (Subscriber Broken Access Control in Social Boost <= 3.6.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97273 (Unauthenticated Cross Site Scripting (XSS) in Premmerce
Wishlist for W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97269 (Unauthenticated Insecure Direct Object References (IDOR) in
WPFunnels ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97268 (Unauthenticated Cross Site Scripting (XSS) in Premmerce
Wishlist for W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97260 (Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <=
6.5.3 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97258 (Subscriber Broken Access Control in Aruba Migration Tool <=
1.0.4 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97251 (Unauthenticated Insecure Direct Object References (IDOR) in
Bus Ticket ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96813 (The Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop
Contact For ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96659 (A flaw was found in Foreman. This vulnerability allows an
authenticate ...)
TODO: check
CVE-2026-96658 (A flaw was found in Foreman. An authenticated attacker with
low-level ...)
TODO: check
CVE-2026-96573 (The Appointment Hour Booking \u2013 Booking Calendar plugin
for WordPr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96268 (The Awesome Support \u2013 WordPress HelpDesk & Support Plugin
plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96256 (The Gutenberg Essential Blocks \u2013 Page Builder for
Gutenberg Block ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95687 (The WPC Shop as a Customer for WooCommerce plugin for
WordPress is vul ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95588 (Unauthenticated Arbitrary File Deletion in AcyMailing SMTP
Newsletter ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95137
REJECTED
CVE-2026-94620 (Classroom 50 is a free and open-source tool for managing and
grading p ...)
TODO: check
CVE-2026-94390 (Editor PHP Object Injection in Hide Shipping Method For
WooCommerce <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94276 (Improper Authentication vulnerability in Apache APISIX. On a
route us ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-94269 (Use of Non-Canonical URL paths for authorization decisions
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-94250 (Allocation of resources without limits or throttling
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-94220 (Cross-Site request forgery (CSRF) vulnerability in feishu-auth
and din ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-94212 (Improper verification of cryptographic signature vulnerability
in Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-93882 (The LearnPress \u2013 WordPress LMS Plugin for Create and Sell
Online ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92244 (The PDF Invoices & Packing Slips for WooCommerce plugin for
WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92144 (The Forminator Forms \u2013 Contact Form, Payment Form &
Custom Form B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90992 (The Redux Framework plugin for WordPress is vulnerable to
Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-8618 (A stack-based buffer overflow vulnerability exists in the
TDDPv2 servi ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-89427 (The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for
WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89424 (The Duplicate Post plugin for WordPress is vulnerable to
Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89047 (The Social Media Share Buttons & Social Sharing Icons plugin
for WordP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88789 (Improper Restriction of XML External Entity Reference in the
XSLT supp ...)
TODO: check
CVE-2026-85235 (The Forminator Forms \u2013 Contact Form, Payment Form &
Custom Form B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84682 (A command injection vulnerability exists in the TDDPv2 service
(/usr/b ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-82806 (Exposure of data element to wrong session vulnerability in
Apache APIS ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-7176 (CVE-2026-7176: the Help text and Title parameters in the
endpoint /eve ...)
TODO: check
CVE-2026-7175 (CVE-2026-7175: the Business Name parameter in the
/promoters/edit endp ...)
@@ -93,29 +93,29 @@ CVE-2026-7174 (CVE-2026-7174: Stored Cross-Site Scripting
vulnerability in Entra
CVE-2026-7173 (CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium,
by Cro ...)
TODO: check
CVE-2026-79901 (In deployments using BoKS keytab management, affected versions
of boks ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-79900 (boks_ksllogsd accepts a checksum algorithm name in the MD
field of an ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-79899 (Fortra BoKS Manager contains an insecure temporary file
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-79898 (Fortra BoKS Manager contains a command injection vulnerability
in crls ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-79896 (Fortra BoKS Manager contains an out-of-bounds read
vulnerability in th ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-78578 (Tapo C120 v1 and C200 v5 do not enforce authentication for do
method H ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-78577 (Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS
onboardi ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-78249 (A path traversal vulnerability exists in the web management
interface ...)
TODO: check
CVE-2026-78242 (Insertion of sensitive information into log file vulnerability
in Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-77387 (geopy is a geocoding library for Python. Prior to 2.5.0,
geopy.Point a ...)
TODO: check
CVE-2026-75957 (The Ultimate Multisite \u2013 WordPress Multisite SaaS & WaaS
Platform ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75786 (Unsanitized concatenation of the module parameter in the
Grafana datas ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-73976 (djehuty is a research data repository system developed by
4TU.Research ...)
TODO: check
CVE-2026-73975 (djehuty is a research data repository system developed by
4TU.Research ...)
@@ -125,57 +125,57 @@ CVE-2026-68496 (The Smile parser in FasterXML
jackson-dataformats-binary never i
CVE-2026-68495 (The CBOR parser in FasterXML jackson-dataformats-binary never
invokes ...)
TODO: check
CVE-2026-67172 (HCL BigFix Service Management is affected by an Information
Disclosure ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-67171 (HCL BigFix Service Management is affected by an Information
Disclosure ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-67106 (HCL BigFix Service Management is affected by an Information
Disclosure ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-67105 (HCL BigFix Service Management is affected by an Insecure
Communication ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-67104 (HCL BigFix Service Management is affected by an Information
Disclosure ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66253 (iControl is affected by a Session Timeout vulnerability, which
could a ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66249 (iControl is affected by a Missing Secure Attribute
vulnerability, whic ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66248 (iControl is affected by an Improper Error Handling
vulnerability, whic ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66247 (iControl is affected by an insecure Cross-Origin Resource
Sharing (COR ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66246 (iControl is affected by a Broken Access Control vulnerability,
which c ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-64950 (Missing input validation and output encoding on the directory
name par ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-64949 (Incomplete extension blacklist in the File Manager module
allows authe ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-64948 (Missing authorization in module data retrieval allows
unauthorized cro ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-64947 (A chained CSRF bypass and unrestricted file upload
vulnerability in th ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-64946 (A chained CSRF and unrestricted SVG file upload vulnerability
in the F ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-63724
REJECTED
CVE-2026-63721
REJECTED
CVE-2026-62073 (Unauthenticated Broken Access Control in WP Full Stripe Free
<= 8.5.6 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62071 (Unauthenticated SQL Injection in WordPress File Upload <=
5.1.10 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62063 (Missing Authorization vulnerability in Magepeople inc.
WpTravelly tour ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62061 (Authorization Bypass Through User-Controlled Key vulnerability
in Meta ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62060 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62059 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62058 (Insertion of Sensitive Information Into Sent Data
vulnerability in WPE ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56599 (HCL BigFix Service Management is affected by an Insecure
Cookie Attrib ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-56589 (HCL BigFix Service Management is affected by a Stored
Cross-Site Scrip ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-56098 (A flaw was found in rubygem-katello. The
RegistryProxiesController in ...)
TODO: check
CVE-2026-56097 (A flaw was found in rubygem-katello. An SQL injection
vulnerability ex ...)
@@ -189,35 +189,35 @@ CVE-2026-55230 (Vvveb is a powerful and easy to use CMS
with page builder to bui
CVE-2026-55083 (DHIS2 is a flexible information system for data capture,
management, v ...)
TODO: check
CVE-2026-34190 (Cross-Site Request Forgery (CSRF) vulnerability allows
unauthorized de ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-34189 (Cross-Site Request Forgery (CSRF) vulnerability allows
unauthorized de ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-27872 (- Improper Privilege Management vulnerability in Johnson
Controls Easy ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-21833 (HCL AION is affected by a vulnerability in which the
Content-Security- ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-19902 (The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for
WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19807 (The ByteCoreStack \u2013 MCP Connector for AI Tools plugin for
WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18734
REJECTED
CVE-2026-17053 (The SMBus driver API exposed smbus_smbalert_remove_cb() and
smbus_host ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-15989 (The Super Forms \u2013 Drag & Drop Form Builder plugin for
WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15983 (The Super Forms \u2013 Drag & Drop Form Builder plugin for
WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15911 (Confluent Kafka Python client's HashiCorp Vault KMS
integration could ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14995 (The Autoptimize plugin for WordPress is vulnerable to Stored
Cross-Sit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14316 (The revoked-key error path builds a human-readable failure
reason usin ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-13043 (A missing authentication vulnerability in the Kernel Memory
Access Dri ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-12627 (Fortra's Core Privileged Access Manager (BoKS) contains a
stack-based ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-12545 (A flaw was found in rubygem-hammer_cli. A command injection
vulnerabil ...)
TODO: check
CVE-2026-12544 (A flaw was found in Foreman. The foreman-rake initialization
logic in ...)
@@ -241,7 +241,7 @@ CVE-2026-104057 (Podgrab contains an unauthenticated
denial-of-service vulnerabi
CVE-2026-104056 (Authlib version 1.7.2 and below contains a vulnerability
where discove ...)
TODO: check
CVE-2026-104018 (An improper privilege management vulnerability (CWE-269)
exists in the ...)
- TODO: check
+ NOT-FOR-US: WindRiver
CVE-2026-103923 (KaTeX is a fast, easy-to-use JavaScript library for TeX math
rendering ...)
TODO: check
CVE-2026-103922 (Capacitor is a cross-platform native runtime for web
applications. Fro ...)
@@ -259,9 +259,9 @@ CVE-2026-103757 (Budibase through 3.41.0 contains a
server-side request forgery
CVE-2026-103754 (A flaw was found in ansible-runner. The unstream_dir()
function, which ...)
TODO: check
CVE-2026-103752 (Unauthenticated Privilege Escalation in Authorizer <= 3.15.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103690 (A flaw has been found in itsourcecode Leave Management System
1.0. Thi ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-103687 (A vulnerability has been found in rhukster dom-sanitizer up
to 1.0.15. ...)
TODO: check
CVE-2026-103686 (A flaw has been found in rhukster dom-sanitizer up to 1.0.15.
Impacted ...)
@@ -285,47 +285,47 @@ CVE-2026-103655 (MISP contains a vulnerability in its
two-factor authentication
CVE-2026-103651 (MISP contains a vulnerability in its one-time password (OTP)
authentic ...)
TODO: check
CVE-2026-103505 (Improper neutralization of argument delimiters in the volume
handling ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-103497 (In JetBrains YouTrack before 2026.2.19422 sSRF was possible
via the Gi ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103496 (In JetBrains YouTrack before 2026.2.19422 iDOR in inbox
threads allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103495 (In JetBrains YouTrack before 2026.2.19422 missing
authorisation allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103494 (In JetBrains YouTrack before 2026.2.19422 privilege
escalation was pos ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103493 (In JetBrains YouTrack before 2026.2.19422 stored XSS via
Mermaid and L ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103492 (In JetBrains YouTrack before 2026.2.19422 doS attack was
possible via ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103491 (In JetBrains YouTrack before 2026.2.19422 iDOR in the issue
activities ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103490 (In JetBrains YouTrack before 2026.2.19422 privilege
escalation was pos ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103489 (In JetBrains YouTrack before 2026.2.19422 hTML injection in
VCS comman ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103488 (In JetBrains YouTrack before 2026.2.19422 missing
authorisation allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103431 (colmux in collectl before 4.3.20.2 does not sanitize
ANSI/VT100 termin ...)
TODO: check
CVE-2026-103353 (Incorrect Behavior Order vulnerability in WP ManageNinja LLC
FluentFor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103347 (Unauthenticated Bypass Vulnerability in hCaptcha for WP <=
5.3.0 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103345 (Insertion of Sensitive Information Into Sent Data
vulnerability in Sha ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103343 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103341 (Missing Authorization vulnerability in Unlimited Elements
Unlimited El ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103340 (Missing Authorization vulnerability in Gemini Labs Site
Reviews site-r ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103339 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103338 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103336 (Insertion of Sensitive Information Into Sent Data
vulnerability in Sma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103292 (Ghost versions from 0.5.3 through versions prior to 6.50.0
fail to san ...)
TODO: check
CVE-2026-103291 (Ghost versions from 3.20.2 before 6.51.0 contain a
server-side request ...)
@@ -389,69 +389,69 @@ CVE-2026-103262 (Tornado versions before 6.5.9 contain an
unbounded memory accum
CVE-2026-103261 (Tornado before 6.5.9 fails to limit the number of query
string fields ...)
TODO: check
CVE-2026-103260 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain
an approva ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103259 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a
session ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103258 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain
an unescap ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103257 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and
from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103256 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a
credenti ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103255 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and
from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103254 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and
from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103253 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and
from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103252 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and
from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103251 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and
from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103250 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and
from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103249 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and
from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103248 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and
from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103247 (n8n versions before 1.123.80 contain a credential tampering
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103246 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to
validate c ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103245 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and
from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103244 (ground-station versions before 0.8.0 contain an
authentication bypass ...)
TODO: check
CVE-2026-103082 (Server-Side Request Forgery (SSRF) vulnerability in LA-Studio
LA-Studi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103068 (Subscriber Privilege Escalation in ByteCoreStack – MCP
Connector ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103067 (Cross-Site Request Forgery (CSRF) vulnerability in Memberful
Memberful ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103064 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103063 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103004 (Next.js versions from 16.3.0 to 16.3.7 warm `use cache`
handlers using ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-102394 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102390 (Missing Authorization vulnerability in VillaTheme AFFI \u2013
Affiliat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102382 (Authorization Bypass Through User-Controlled Key
vulnerability in Ahma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102381 (Missing Authorization vulnerability in Ahmad Majestic Support
majestic ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102379 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102378 (Unauthenticated Cross Site Scripting (XSS) in Parallax
Section block < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102369 (Tapo C120 v1 and C200 V5 do not adequately protect login
challenge dat ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-102294 (TP-Link TL-WR841N contains an authenticated OS command
injection vulne ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-101925 (The bbp style pack plugin for WordPress is vulnerable to
Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101890 (The Prime Mover plugin for WordPress before 2.2.1 contains a
stored cr ...)
TODO: check
CVE-2026-101889 (The Prime Mover plugin for WordPress before 2.2.1 contains a
path trav ...)
@@ -461,15 +461,15 @@ CVE-2026-101888 (The Prime Mover plugin for WordPress
before 2.2.1 contains a Zi
CVE-2026-101322 (In Eclipse BaSyx AAS Web UI versions v2-241220 through
releases before ...)
TODO: check
CVE-2026-100517 (Unauthenticated Insecure Direct Object References (IDOR) in
Photo Revi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100514 (Unauthenticated Insecure Direct Object References (IDOR) in
REST API L ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100184 (The Calculated Fields Form \u2013 AI Form Builder for
WordPress \u2013 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100179 (The Calculated Fields Form \u2013 AI Form Builder for
WordPress \u2013 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-31980 (HCL BigFix Service Management is affected by an Improper Input
Validat ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2024-58388 (Sharp (and Toshiba Tec rebranded) multifunction printers
contain an un ...)
TODO: check
CVE-2023-54404 (Zod schema-validation library through 4.6.5 contains an
uncontrolled r ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7b827b4a11335547fbae7321c9cda678a9cd8d92
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7b827b4a11335547fbae7321c9cda678a9cd8d92
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
