Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
a4cb4024 by Salvatore Bonaccorso at 2026-10-02T09:58:06+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -83,75 +83,75 @@ CVE-2026-64893 (- Cleartext Transmission of Sensitive
Information vulnerability
CVE-2026-64892 (- Exposure of Sensitive Information vulnerability in Johnson
Controls ...)
NOT-FOR-US: Johnson Controls
CVE-2026-63569 (Improper input validation in DHAgreement.CalculateAgreement
(MTI/A0 tw ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63568 (Allocation of resources without limits or throttling in the
CMP/CRMF p ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63567 (Observable discrepancy in IesEngine.DecryptBlock in Legion of
the Boun ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63566 (Memory allocation with excessive size value in the DTLS
handshake reas ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-56662 (GetSimple CMS is a content management system (CMS), and
GetSimple CMS ...)
- TODO: check
+ NOT-FOR-US: GetSimple CMS
CVE-2026-56661 (GetSimple CMS is a content management system (CMS), and
GetSimple CMS ...)
- TODO: check
+ NOT-FOR-US: GetSimple CMS
CVE-2026-56660 (GetSimple CMS is a content management system (CMS), and
GetSimple CMS ...)
- TODO: check
+ NOT-FOR-US: GetSimple CMS
CVE-2026-55396 (Cleartext transmission without a cryptographic integrity check
in oper ...)
- TODO: check
+ NOT-FOR-US: Teledyne FLIR Aware2
CVE-2026-55395 (Hardcoded passwords in the access control in Teledyne FLIR
Aware2 vers ...)
- TODO: check
+ NOT-FOR-US: Teledyne FLIR Aware2
CVE-2026-55394 (Unencrypted traffic in the 802.11 network of Teledyne FLIR
Aware2 vers ...)
- TODO: check
+ NOT-FOR-US: Teledyne FLIR Aware2
CVE-2026-55393 (Unvalidated pathnames in the web interface in Teledyne FLIR
Aware2 ver ...)
- TODO: check
+ NOT-FOR-US: Teledyne FLIR Aware2
CVE-2026-55252 (OpenRun is an open-source, self-hosted GitOps platform for
deploying w ...)
- TODO: check
+ NOT-FOR-US: OpenRun
CVE-2026-55251 (NetBox Device Type Library is a collection of
community-sourced device ...)
- TODO: check
+ NOT-FOR-US: NetBox Device Type Library
CVE-2026-54049 (Sakai is a Collaboration and Learning Environment (CLE). From
versions ...)
- TODO: check
+ NOT-FOR-US: Sakai
CVE-2026-53964 (Document Merge Service is a document template merge service
providing ...)
- TODO: check
+ NOT-FOR-US: Document Merge Service
CVE-2026-53953 (GetSimple CMS is a content management system (CMS), and
GetSimple CMS ...)
- TODO: check
+ NOT-FOR-US: GetSimple CMS
CVE-2026-51897 (RAGFlow 0.24.0 contains improper access control in get_dataset
(api/ap ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-51896 (infiniflow ragflow 0.25.3 contains improper access control in
resume ( ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-51895 (Ragflow 0.24.0 and prior contains improper access control in
update_me ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-51894 (infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access
Control vi ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-51893 (infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access
Control vi ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-51892 (infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access
Control vi ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-51888 (langflow-ai langflow v1.8.4 is affected by: Directory
Traversal. The i ...)
- TODO: check
+ NOT-FOR-US: langflow-ai langflow
CVE-2026-51886 (langflow-ai langflow v1.9.3 is affected by: Code Injection.
The impact ...)
- TODO: check
+ NOT-FOR-US: langflow-ai langflow
CVE-2026-51884 (The /knowledge_base/upload_temp_docs temporary document upload
endpoin ...)
- TODO: check
+ NOT-FOR-US: Langchain Chatchat
CVE-2026-51883 (The knowledge base creation and document upload interfaces in
Langchai ...)
- TODO: check
+ NOT-FOR-US: Langchain Chatchat
CVE-2026-51882 (The OpenAI-compatible file upload endpoint `/v1/files` in
Langchain-Ch ...)
- TODO: check
+ NOT-FOR-US: Langchain Chatchat
CVE-2026-51881 (deeptutor 1.4.0 contains code injection in ExecTool.execute.
Through t ...)
- TODO: check
+ NOT-FOR-US: deeptutor
CVE-2026-51880 (deeptutor 1.4.0 contains a path traversal issue in
EditFileTool.execut ...)
- TODO: check
+ NOT-FOR-US: deeptutor
CVE-2026-51879 (deeptutor 1.4.0 contains an authorization bypass through a
user-contro ...)
- TODO: check
+ NOT-FOR-US: deeptutor
CVE-2026-51878 (deeptutor 1.4.0 contains an authorization bypass through a
user-contro ...)
- TODO: check
+ NOT-FOR-US: deeptutor
CVE-2026-51876 (DeepTutor 1.4.0 contains an authorization bypass vulnerability
in the ...)
- TODO: check
+ NOT-FOR-US: deeptutor
CVE-2026-51875 (In Devika v1.0, the Feature Agent save_code_to_project
function contai ...)
- TODO: check
+ NOT-FOR-US: Devika
CVE-2026-51874 (In Devika v1.0, the Patcher Agent save_code_to_project
function contai ...)
- TODO: check
+ NOT-FOR-US: Devika
CVE-2026-51873 (Devika v1.0 is vulnerable to Directory Traversal in the
Coder.save_cod ...)
- TODO: check
+ NOT-FOR-US: Devika
CVE-2026-34494 (- On-Chip Debug Interface vulnerability in Johnson Controls
Neo Series ...)
NOT-FOR-US: Johnson Controls
CVE-2026-34493 (- On-Chip Debug Interface vulnerability in Johnson Controls
EasyIO FS3 ...)
@@ -167,21 +167,21 @@ CVE-2026-1661 (The WP Mail Logging WordPress plugin
before 1.17.0 does not prope
CVE-2026-19660 (The Divi Membership plugin for WordPress is vulnerable to
Authenticati ...)
NOT-FOR-US: WordPress plugin
CVE-2026-18397 (This vulnerability enables unauthenticated remote code
execution (RCE) ...)
- TODO: check
+ NOT-FOR-US: Thales SConnect
CVE-2026-16001 (Exposure of the message authentication key through the
encryption keys ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-16000 (Missing cryptographic step in the DSTU 7624 CCM mode
implementation (K ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-15999 (Improper validation of integrity check value in the AES-CCM
implementa ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-15897 (The Super Forms \u2013 Drag & Drop Form Builder plugin for
WordPress i ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15896 (The Super Forms \u2013 Drag & Drop Form Builder plugin for
WordPress i ...)
NOT-FOR-US: WordPress plugin
CVE-2026-14984 (Cleartext transmission in the primary control endpoints of
Teledyne FL ...)
- TODO: check
+ NOT-FOR-US: Teledyne FLIR Aware2
CVE-2026-14983 (Missing authentication in the web interface in Teledyne FLIR
Aware2 ve ...)
- TODO: check
+ NOT-FOR-US: Teledyne FLIR Aware2
CVE-2026-14378 (The DevKit Pro plugin for WordPress is vulnerable to
Authentication By ...)
NOT-FOR-US: WordPress plugin
CVE-2026-13718 (The Tabs Responsive WordPress plugin through 2.5 does not
sanitize th ...)
@@ -191,43 +191,43 @@ CVE-2026-13413 (The CMP \u2013 Coming Soon & Maintenance
WordPress plugin before
CVE-2026-10026 (The CTX Feed Pro plugin for WordPress is vulnerable to Code
Injection ...)
NOT-FOR-US: WordPress plugin
CVE-2026-104480 (Discord libdave before 1.2.0 did not reject an MLS Welcome
message whe ...)
- TODO: check
+ NOT-FOR-US: Discord libdave
CVE-2026-104356 (PictShare before version 3.7.1 contains a weak randomness
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: PictShare
CVE-2026-104286 (An improper limitation of a pathname to a restricted
directory ('path ...)
NOT-FOR-US: Fortinet
CVE-2026-104183 (stream-json is a micro-library of stream components for
processing JSO ...)
- TODO: check
+ NOT-FOR-US: stream-json
CVE-2026-104182 (stream-json is a micro-library of stream components for
processing JSO ...)
- TODO: check
+ NOT-FOR-US: stream-json
CVE-2026-104181 (Filament is a collection of full-stack components for
accelerated Lara ...)
- TODO: check
+ NOT-FOR-US: Filament
CVE-2026-104123 (A vulnerability was detected in SourceCodester Online
Reviewer Managem ...)
NOT-FOR-US: SourceCodester
CVE-2026-104120 (A security vulnerability has been detected in
modelcontextprotocol mcp ...)
- TODO: check
+ NOT-FOR-US: modelcontextprotocol
CVE-2026-104054 (A security flaw has been discovered in calcom cal.diy up to
6.2.0. Thi ...)
- TODO: check
+ NOT-FOR-US: calcom cal.diy
CVE-2026-104053 (A vulnerability was identified in itsourcecode Pet Shop
Management Sys ...)
NOT-FOR-US: itsourcecode System
CVE-2026-104052 (A vulnerability was determined in itsourcecode Pet Shop
Management Sys ...)
NOT-FOR-US: itsourcecode System
CVE-2026-104051 (PictShare before 3.7.1 contains an information disclosure
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: PictShare
CVE-2026-104020 (Uncontrolled recursion in the Ion reader in Amazon Ion Python
before 0 ...)
NOT-FOR-US: Amazon
CVE-2026-104002 (A fail-open error handling issue within the data masking
utility of Po ...)
NOT-FOR-US: Amazon
CVE-2026-103766 (ClipBucket v5 through 5.5.3-#197 contains an sql injection
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: ClipBucket
CVE-2026-103765 (Mooncake through 0.3.13.post1 contains a missing
authentication vulner ...)
- TODO: check
+ NOT-FOR-US: Mooncake
CVE-2026-103764 (Mooncake transfer engine before 0.3.13 contains an untrusted
pointer d ...)
- TODO: check
+ NOT-FOR-US: Mooncake
CVE-2026-103761 (Mooncake transfer engine through 0.3.13.post1 contains a
memory exhaus ...)
- TODO: check
+ NOT-FOR-US: Mooncake
CVE-2026-103760 (Mooncake transfer engine through 0.3.13.post1 contains a
denial of ser ...)
- TODO: check
+ NOT-FOR-US: Mooncake
CVE-2026-103484 (IVFFlat index build in pgvector before 0.8.7 allows a
database user to ...)
TODO: check
CVE-2026-103098 (Transmission of a sensitive key in the URL over an
unencrypted HTTP co ...)
@@ -237,19 +237,19 @@ CVE-2026-103097 (An API key is hardcoded and retrievable
from the application pa
CVE-2026-103096 (API key is hardcoded and retrievable from the application
package. Sin ...)
NOT-FOR-US: GeoVision
CVE-2026-102671 (The Joyland AI app accepts invalid SSL certificates in the
invisible a ...)
- TODO: check
+ NOT-FOR-US: Joyland AI app
CVE-2026-102670 (Joyland AI app explicitly permits cleartext HTTP traffic on
Android 9+ ...)
- TODO: check
+ NOT-FOR-US: Joyland AI app
CVE-2026-102669 (Joyland AI app does not verify hostnames, allowing a
malicious host to ...)
- TODO: check
+ NOT-FOR-US: Joyland AI app
CVE-2026-102668 (The Joyland AI app accepts any TLS certificates from any
server withou ...)
- TODO: check
+ NOT-FOR-US: Joyland AI app
CVE-2026-102667 (Joyland AI app allows an attacker with shared network access
to inject ...)
- TODO: check
+ NOT-FOR-US: Joyland AI app
CVE-2026-102666 (The Joyland AI app contains hard-coded credentials for the
GeTui push ...)
- TODO: check
+ NOT-FOR-US: Joyland AI app
CVE-2026-102628 (The Cadmos LTI application hosted at cadmos.eummena.io had
Laravel deb ...)
- TODO: check
+ NOT-FOR-US: Cadmos LTI application
CVE-2026-102565 (The BA Book Everything plugin for WordPress is vulnerable to
Stored Cr ...)
NOT-FOR-US: WordPress plugin
CVE-2026-102514 (Out-of-bounds Write (CWE-787) in the PEA archive extraction
routine (p ...)
@@ -257,9 +257,9 @@ CVE-2026-102514 (Out-of-bounds Write (CWE-787) in the PEA
archive extraction rou
CVE-2026-102370 (Kasa EC70 v4 and EC71 v4 do not logically disable the
production debug ...)
NOT-FOR-US: TPLink
CVE-2026-100251 (Wormhole.app as deployed before 2026-08-22 misconfigures the
coturn TU ...)
- TODO: check
+ NOT-FOR-US: Wormhole.app
CVE-2025-71427 (Office-PowerPoint-MCP-Server through 2.0.7 contains a path
traversal v ...)
- TODO: check
+ NOT-FOR-US: Office-PowerPoint-MCP-Server
CVE-2026-94603
- podman <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2542566
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a4cb402413b910745d5e514a0b870b61ad87f136
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a4cb402413b910745d5e514a0b870b61ad87f136
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
