Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ae393f44 by Salvatore Bonaccorso at 2026-10-01T22:02:01+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -188,17 +188,17 @@ CVE-2026-56599 (HCL BigFix Service Management is affected
by an Insecure Cookie
CVE-2026-56589 (HCL BigFix Service Management is affected by a Stored
Cross-Site Scrip ...)
NOT-FOR-US: HCL
CVE-2026-56098 (A flaw was found in rubygem-katello. The
RegistryProxiesController in ...)
- TODO: check
+ NOT-FOR-US: Katello
CVE-2026-56097 (A flaw was found in rubygem-katello. An SQL injection
vulnerability ex ...)
- TODO: check
+ NOT-FOR-US: rubygem-katello
CVE-2026-55232 (Vvveb is a powerful and easy to use CMS with page builder to
build web ...)
- TODO: check
+ NOT-FOR-US: Vvveb
CVE-2026-55231 (Vvveb is a powerful and easy to use CMS with page builder to
build web ...)
- TODO: check
+ NOT-FOR-US: Vvveb
CVE-2026-55230 (Vvveb is a powerful and easy to use CMS with page builder to
build web ...)
- TODO: check
+ NOT-FOR-US: Vvveb
CVE-2026-55083 (DHIS2 is a flexible information system for data capture,
management, v ...)
- TODO: check
+ NOT-FOR-US: DHIS2
CVE-2026-34190 (Cross-Site Request Forgery (CSRF) vulnerability allows
unauthorized de ...)
NOT-FOR-US: Pandora FMS
CVE-2026-34189 (Cross-Site Request Forgery (CSRF) vulnerability allows
unauthorized de ...)
@@ -230,7 +230,7 @@ CVE-2026-13043 (A missing authentication vulnerability in
the Kernel Memory Acce
CVE-2026-12627 (Fortra's Core Privileged Access Manager (BoKS) contains a
stack-based ...)
NOT-FOR-US: Fortra
CVE-2026-12545 (A flaw was found in rubygem-hammer_cli. A command injection
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: rubygem-hammer_cli
CVE-2026-12544 (A flaw was found in Foreman. The foreman-rake initialization
logic in ...)
TODO: check
CVE-2026-12542 (A flaw was found in Foreman. The foreman-tail utility is
vulnerable to ...)
@@ -242,13 +242,13 @@ CVE-2026-12540 (A flaw was found in Foreman. A command
injection vulnerability e
CVE-2026-12423 (A flaw was found in Foreman. The Red Hat Satellite
/unattended/provisi ...)
TODO: check
CVE-2026-12405 (A flaw was found in rubygem-foreman_remote_execution. A
command inject ...)
- TODO: check
+ NOT-FOR-US: rubygem-foreman_remote_execution
CVE-2026-104059 (Lektor 3.3.14 and 3.4.0b15 contains a cross-site request
forgery vulne ...)
- TODO: check
+ NOT-FOR-US: Lektor CMS
CVE-2026-104058 (Podgrab contains a missing authentication vulnerability in
which the / ...)
- TODO: check
+ NOT-FOR-US: Podgrab
CVE-2026-104057 (Podgrab contains an unauthenticated denial-of-service
vulnerability ca ...)
- TODO: check
+ NOT-FOR-US: Podgrab
CVE-2026-104056 (Authlib version 1.7.2 and below contains a vulnerability
where discove ...)
TODO: check
CVE-2026-104018 (An improper privilege management vulnerability (CWE-269)
exists in the ...)
@@ -256,17 +256,17 @@ CVE-2026-104018 (An improper privilege management
vulnerability (CWE-269) exists
CVE-2026-103923 (KaTeX is a fast, easy-to-use JavaScript library for TeX math
rendering ...)
TODO: check
CVE-2026-103922 (Capacitor is a cross-platform native runtime for web
applications. Fro ...)
- TODO: check
+ NOT-FOR-US: Capacitor
CVE-2026-103921 (GraphQL Tools provides utilities for building, stitching, and
mocking ...)
- TODO: check
+ NOT-FOR-US: GraphQL Tools
CVE-2026-103884 (A flaw was found in the X.509 client certificate
authenticator of Keyc ...)
TODO: check
CVE-2026-103858 (MISP contains an incomplete authorization check in the
discussion post ...)
TODO: check
CVE-2026-103758 (Obot 0.21.1 through 0.24.1 contains an authorization bypass
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Obot
CVE-2026-103757 (Budibase through 3.41.0 contains a server-side request
forgery vulnera ...)
- TODO: check
+ NOT-FOR-US: Budibase
CVE-2026-103754 (A flaw was found in ansible-runner. The unstream_dir()
function, which ...)
TODO: check
CVE-2026-103752 (Unauthenticated Privilege Escalation in Authorizer <= 3.15.3
versions.)
@@ -274,9 +274,9 @@ CVE-2026-103752 (Unauthenticated Privilege Escalation in
Authorizer <= 3.15.3 ve
CVE-2026-103690 (A flaw has been found in itsourcecode Leave Management System
1.0. Thi ...)
NOT-FOR-US: itsourcecode System
CVE-2026-103687 (A vulnerability has been found in rhukster dom-sanitizer up
to 1.0.15. ...)
- TODO: check
+ NOT-FOR-US: DOMSanitizer
CVE-2026-103686 (A flaw has been found in rhukster dom-sanitizer up to 1.0.15.
Impacted ...)
- TODO: check
+ NOT-FOR-US: DOMSanitizer
CVE-2026-103680 (A flaw was found in tnef. A heap-based buffer overflow can
occur in th ...)
TODO: check
CVE-2026-103679 (A flaw was found in tnef. A remote attacker could exploit
this vulnera ...)
@@ -390,9 +390,9 @@ CVE-2026-103267 (Ghost versions before 6.62.0 contain an
authentication bypass v
CVE-2026-103266 (Ghost versions 5.2.0 through versions prior to 6.62.0 allow a
remote a ...)
TODO: check
CVE-2026-103265 (Fleet versions before 4.89.0 fail to properly filter MDM
command resul ...)
- TODO: check
+ NOT-FOR-US: Fleet
CVE-2026-103264 (Fleet versions before 4.87.0 contain an authentication bypass
vulnerab ...)
- TODO: check
+ NOT-FOR-US: Fleet
CVE-2026-103263 (Tornado before 6.5.9 contains a path traversal vulnerability
in Static ...)
TODO: check
CVE-2026-103262 (Tornado versions before 6.5.9 contain an unbounded memory
accumulation ...)
@@ -432,7 +432,7 @@ CVE-2026-103246 (n8n versions before 2.39.6 and 2.40.0
before 2.40.1 fail to val
CVE-2026-103245 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and
from 2.40. ...)
NOT-FOR-US: n8n
CVE-2026-103244 (ground-station versions before 0.8.0 contain an
authentication bypass ...)
- TODO: check
+ NOT-FOR-US: ground-station
CVE-2026-103082 (Server-Side Request Forgery (SSRF) vulnerability in LA-Studio
LA-Studi ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-103068 (Subscriber Privilege Escalation in ByteCoreStack – MCP
Connector ...)
@@ -464,11 +464,11 @@ CVE-2026-102294 (TP-Link TL-WR841N contains an
authenticated OS command injectio
CVE-2026-101925 (The bbp style pack plugin for WordPress is vulnerable to
Stored Cross- ...)
NOT-FOR-US: WordPress plugin
CVE-2026-101890 (The Prime Mover plugin for WordPress before 2.2.1 contains a
stored cr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101889 (The Prime Mover plugin for WordPress before 2.2.1 contains a
path trav ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101888 (The Prime Mover plugin for WordPress before 2.2.1 contains a
Zip Slip ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101322 (In Eclipse BaSyx AAS Web UI versions v2-241220 through
releases before ...)
TODO: check
CVE-2026-100517 (Unauthenticated Insecure Direct Object References (IDOR) in
Photo Revi ...)
@@ -482,9 +482,9 @@ CVE-2026-100179 (The Calculated Fields Form \u2013 AI Form
Builder for WordPress
CVE-2025-31980 (HCL BigFix Service Management is affected by an Improper Input
Validat ...)
NOT-FOR-US: HCL
CVE-2024-58388 (Sharp (and Toshiba Tec rebranded) multifunction printers
contain an un ...)
- TODO: check
+ NOT-FOR-US: Sharp printers
CVE-2023-54404 (Zod schema-validation library through 4.6.5 contains an
uncontrolled r ...)
- TODO: check
+ NOT-FOR-US: Zod
CVE-2026-42356 (Deployment of wrong handler vulnerability in Apache HTTP
Server allows ...)
- apache2 <unfixed>
NOTE:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-42356
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae393f444e4ca97e635e30b0614a005ecc6f1c4c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae393f444e4ca97e635e30b0614a005ecc6f1c4c
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
