Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ac263aa0 by security tracker role at 2026-10-02T07:14:31+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,87 +1,87 @@
CVE-2026-97318 (The Giveaways and Contests by RafflePress WordPress plugin
before 1.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97317 (The Giveaways and Contests by RafflePress WordPress plugin
before 1.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97219 (The MStore API WordPress plugin before 4.22.1 does not
restrict which ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96780 (figlet.js is a FIG driver written in JavaScript that aims to
implement ...)
TODO: check
CVE-2026-94298 (The BuildKit WordPress plugin before 1.0.29 does not properly
sanitis ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93832 (A component of one of the Motorola system applications was
exported wi ...)
- TODO: check
+ NOT-FOR-US: Lenovo
CVE-2026-93698 (Insufficient validation allows arbitrary commands to be
executed via t ...)
TODO: check
CVE-2026-93697 (There is a stored XSS vulnerability allowing arbitrary code
execution ...)
TODO: check
CVE-2026-93367 (The Visitors Traffic Real Time Statistics Pro plugin for
WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93029 (There is a stored XSS vulnerability allowing arbitrary code
execution ...)
TODO: check
CVE-2026-92924 (The Unlimited Elements for Elementor WordPress plugin before
2.0.21 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92820 (The Ninja Forms - File Uploads plugin for WordPress is
vulnerable to a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92174 (The SiteOrigin Widgets Bundle plugin for WordPress is
vulnerable to Lo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91828 (The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91023 (The Motors WordPress plugin before 1.4.124 does not properly
verify t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91022 (The Motors WordPress plugin before 1.4.124 does not sanitise
and esca ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91020 (The WebToffee Gift Cards for WooCommerce WordPress plugin
before 1.3.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90988 (The Request a Quote WordPress plugin through 2.5.6 does not
perform a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90987 (The Easy PayPal & Stripe Buy Now Button WordPress plugin
before 2.0.6 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90952 (The WP Edit Password Protected WordPress plugin before 2.0.7
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90438 (The Ninja Forms \u2013 The Contact Form Builder That Grows
With You pl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85016 (The Unlimited Elements for Elementor WordPress plugin before
2.0.21 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85005 (The Popup Maker WP WordPress plugin through 1.4.5 does not
perform aut ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85004 (The Popup Maker WordPress plugin through 1.4.5 does not
perform a cap ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84925 (The Avada | Website Builder For WordPress & WooCommerce theme
for Word ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84740 (The Events Calendar WordPress plugin before 6.17.5.1 does not
validate ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82358 (RT-Labs AB C-Open CANopen contains a write protection bypass
in the SD ...)
TODO: check
CVE-2026-82357 (RT-Labs AB C-Open CANopen contains a NULL pointer dereference
if the L ...)
TODO: check
CVE-2026-81740 (The Paytm Payment Gateway WordPress plugin before 2.8.9 does
not verif ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-79618 (The WP User Frontend WordPress plugin before 4.3.12 does not
enforce i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78471 (The Autoptimize plugin for WordPress is vulnerable to Stored
Cross-Sit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-71542 (GetSimple CMS is a content management system (CMS), and
GetSimple CMS ...)
TODO: check
CVE-2026-71454 (Improper neutralization of input during web page generation
('cross-si ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71453 (- External Control of File Name or Path vulnerability in
Johnson Contr ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71452 (- OS Command Injection vulnerability in Johnson Controls
EasyIO FS32 a ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71451 (- OS Command Injection vulnerability in Johnson Controls
EasyIO FS32 a ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71449 (: Use of Hard-coded Cryptographic Key vulnerability in Johnson
Control ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71448 (: Insecure Default Initialization of Resource vulnerability in
Johnson ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71426 (GetSimple CMS is a content management system (CMS), and
GetSimple CMS ...)
TODO: check
CVE-2026-70650 (GetSimple CMS is a content management system (CMS), and
GetSimple CMS ...)
TODO: check
CVE-2026-64893 (- Cleartext Transmission of Sensitive Information
vulnerability in Joh ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-64892 (- Exposure of Sensitive Information vulnerability in Johnson
Controls ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-63569 (Improper input validation in DHAgreement.CalculateAgreement
(MTI/A0 tw ...)
TODO: check
CVE-2026-63568 (Allocation of resources without limits or throttling in the
CMP/CRMF p ...)
@@ -153,19 +153,19 @@ CVE-2026-51874 (In Devika v1.0, the Patcher Agent
save_code_to_project function
CVE-2026-51873 (Devika v1.0 is vulnerable to Directory Traversal in the
Coder.save_cod ...)
TODO: check
CVE-2026-34494 (- On-Chip Debug Interface vulnerability in Johnson Controls
Neo Series ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-34493 (- On-Chip Debug Interface vulnerability in Johnson Controls
EasyIO FS3 ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-27874 (: Use of Hard-coded Credentials vulnerability in Johnson
Controls Easy ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-27873 (- Use of Hard-coded Credentials vulnerability in Johnson
Controls Easy ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-21140 (Improper access control in ManagedProvisioning prior to SMR
Sep-2026 R ...)
- TODO: check
+ NOT-FOR-US: Samsung Mobile
CVE-2026-1661 (The WP Mail Logging WordPress plugin before 1.17.0 does not
properly r ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19660 (The Divi Membership plugin for WordPress is vulnerable to
Authenticati ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18397 (This vulnerability enables unauthenticated remote code
execution (RCE) ...)
TODO: check
CVE-2026-16001 (Exposure of the message authentication key through the
encryption keys ...)
@@ -175,27 +175,27 @@ CVE-2026-16000 (Missing cryptographic step in the DSTU
7624 CCM mode implementat
CVE-2026-15999 (Improper validation of integrity check value in the AES-CCM
implementa ...)
TODO: check
CVE-2026-15897 (The Super Forms \u2013 Drag & Drop Form Builder plugin for
WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15896 (The Super Forms \u2013 Drag & Drop Form Builder plugin for
WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14984 (Cleartext transmission in the primary control endpoints of
Teledyne FL ...)
TODO: check
CVE-2026-14983 (Missing authentication in the web interface in Teledyne FLIR
Aware2 ve ...)
TODO: check
CVE-2026-14378 (The DevKit Pro plugin for WordPress is vulnerable to
Authentication By ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13718 (The Tabs Responsive WordPress plugin through 2.5 does not
sanitize th ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13413 (The CMP \u2013 Coming Soon & Maintenance WordPress plugin
before 4.1.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-10026 (The CTX Feed Pro plugin for WordPress is vulnerable to Code
Injection ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104480 (Discord libdave before 1.2.0 did not reject an MLS Welcome
message whe ...)
TODO: check
CVE-2026-104356 (PictShare before version 3.7.1 contains a weak randomness
vulnerabilit ...)
TODO: check
CVE-2026-104286 (An improper limitation of a pathname to a restricted
directory ('path ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-104183 (stream-json is a micro-library of stream components for
processing JSO ...)
TODO: check
CVE-2026-104182 (stream-json is a micro-library of stream components for
processing JSO ...)
@@ -203,21 +203,21 @@ CVE-2026-104182 (stream-json is a micro-library of stream
components for process
CVE-2026-104181 (Filament is a collection of full-stack components for
accelerated Lara ...)
TODO: check
CVE-2026-104123 (A vulnerability was detected in SourceCodester Online
Reviewer Managem ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-104120 (A security vulnerability has been detected in
modelcontextprotocol mcp ...)
TODO: check
CVE-2026-104054 (A security flaw has been discovered in calcom cal.diy up to
6.2.0. Thi ...)
TODO: check
CVE-2026-104053 (A vulnerability was identified in itsourcecode Pet Shop
Management Sys ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-104052 (A vulnerability was determined in itsourcecode Pet Shop
Management Sys ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-104051 (PictShare before 3.7.1 contains an information disclosure
vulnerabilit ...)
TODO: check
CVE-2026-104020 (Uncontrolled recursion in the Ion reader in Amazon Ion Python
before 0 ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-104002 (A fail-open error handling issue within the data masking
utility of Po ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-103766 (ClipBucket v5 through 5.5.3-#197 contains an sql injection
vulnerabili ...)
TODO: check
CVE-2026-103765 (Mooncake through 0.3.13.post1 contains a missing
authentication vulner ...)
@@ -231,11 +231,11 @@ CVE-2026-103760 (Mooncake transfer engine through
0.3.13.post1 contains a denial
CVE-2026-103484 (IVFFlat index build in pgvector before 0.8.7 allows a
database user to ...)
TODO: check
CVE-2026-103098 (Transmission of a sensitive key in the URL over an
unencrypted HTTP co ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-103097 (An API key is hardcoded and retrievable from the application
package. ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-103096 (API key is hardcoded and retrievable from the application
package. Sin ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-102671 (The Joyland AI app accepts invalid SSL certificates in the
invisible a ...)
TODO: check
CVE-2026-102670 (Joyland AI app explicitly permits cleartext HTTP traffic on
Android 9+ ...)
@@ -251,11 +251,11 @@ CVE-2026-102666 (The Joyland AI app contains hard-coded
credentials for the GeTu
CVE-2026-102628 (The Cadmos LTI application hosted at cadmos.eummena.io had
Laravel deb ...)
TODO: check
CVE-2026-102565 (The BA Book Everything plugin for WordPress is vulnerable to
Stored Cr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102514 (Out-of-bounds Write (CWE-787) in the PEA archive extraction
routine (p ...)
TODO: check
CVE-2026-102370 (Kasa EC70 v4 and EC71 v4 do not logically disable the
production debug ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-100251 (Wormhole.app as deployed before 2026-08-22 misconfigures the
coturn TU ...)
TODO: check
CVE-2025-71427 (Office-PowerPoint-MCP-Server through 2.0.7 contains a path
traversal v ...)
@@ -349,7 +349,7 @@ CVE-2026-89424 (The Duplicate Post plugin for WordPress is
vulnerable to Stored
CVE-2026-89047 (The Social Media Share Buttons & Social Sharing Icons plugin
for WordP ...)
NOT-FOR-US: WordPress plugin
CVE-2026-88789 (Improper Restriction of XML External Entity Reference in the
XSLT supp ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85235 (The Forminator Forms \u2013 Contact Form, Payment Form &
Custom Form B ...)
NOT-FOR-US: WordPress plugin
CVE-2026-84682 (A command injection vulnerability exists in the TDDPv2 service
(/usr/b ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ac263aa00900f6c7ed46dbec1a0a1223e96a1fb6
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ac263aa00900f6c7ed46dbec1a0a1223e96a1fb6
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
