Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ed87d949 by security tracker role at 2026-10-02T19:16:03+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,37 +1,37 @@
CVE-2026-97876 (A local attacker with control over GRUB's configuration can
bypass loc ...)
TODO: check
CVE-2026-97663 (The Customer Reviews for WooCommerce plugin for WordPress is
vulnerabl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97652 (The WP Statistics \u2013 Simple, privacy-friendly Google
Analytics alt ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97641 (The Relevanssi \u2013 A Better Search plugin for WordPress is
vulnerab ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97637 (The JSON API Auth plugin for WordPress is vulnerable to
Authentication ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97634 (The Event Tickets and Registration plugin for WordPress is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97342 (The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin
for WordP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97338 (The Download Manager plugin for WordPress is vulnerable to
Stored Cros ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97336 (The CMB2 plugin for WordPress is vulnerable to Stored
Cross-Site Scrip ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96990 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
TODO: check
CVE-2026-96940 (Weak authorization in Microsoft Exchange Server allows an
authenticate ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-96871 (The Mang Board plugin for WordPress is vulnerable to Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96647 (The Listdom: AI-powered Business Directory with Classifieds
Ads Listin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96613 (The Meari IoT Cloud Platform OpenAPI Service is vulnerable to
an autho ...)
TODO: check
CVE-2026-96578 (The GSpeech TTS \u2013 WordPress Text To Speech Plugin plugin
for Word ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96567 (The MW WP Form plugin for WordPress is vulnerable to Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96566 (The Newsletter \u2013 Send awesome emails from WordPress
plugin for Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96294 (Uncaught exception, Improper Handling of Exceptional
Conditions vulner ...)
TODO: check
CVE-2026-96292 (Inefficient regular expression complexity, Inefficient
Algorithmic Com ...)
@@ -47,9 +47,9 @@ CVE-2026-96286 (Uncaught exception vulnerability in Apache
Thrift Perl bindings.
CVE-2026-96277 (Uncaught exception, Improper Handling of Exceptional
Conditions vulner ...)
TODO: check
CVE-2026-95817 (The DoFollow Case by Case plugin for WordPress is vulnerable
to Stored ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95670 (The No External Links plugin for WordPress is vulnerable to
Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95662 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
TODO: check
CVE-2026-95512 (A flaw was found in FreeType, specifically within its CID font
loader. ...)
@@ -97,35 +97,35 @@ CVE-2026-94634 (Allocation of resources without limits or
throttling, Initializa
CVE-2026-94633 (Memory allocation with excessive size value, Improper handling
of leng ...)
TODO: check
CVE-2026-94544 (Next.js is a React framework for building full-stack web
applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94543 (Next.js is a React framework for building full-stack web
applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94541 (The WPMobile.App \u2013 Android and iOS App Builder plugin for
WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94486 (Next.js is a React framework for building full-stack web
applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94485 (Next.js is a React framework for building full-stack web
applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94484 (Next.js is a React framework for building full-stack web
applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94483 (Next.js is a React framework for building full-stack web
applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94432 (The Appointment Booking Plugin \u2013 LatePoint | Calendar &
Schedulin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94405 (Authorization Bypass Through User-Controlled Key vulnerability
in Shah ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94180 (Authorization Bypass Through User-Controlled Key vulnerability
in Mone ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93926 (Missing release of memory after effective lifetime, Missing
release of ...)
TODO: check
CVE-2026-93925 (Stack-based buffer overflow, Incorrect bitwise shift of
integer vulner ...)
TODO: check
CVE-2026-93880 (The Greenshift \u2013 animation and page builder blocks plugin
for Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93875 (The JetAppointment plugin for WordPress is vulnerable to
Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93756 (The Smash Balloon Social Post Feed \u2013 Simple Social Feeds
for Word ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92834 (Use of uninitialized resource, Return of wrong status code
vulnerabili ...)
TODO: check
CVE-2026-91784 (cjbassi/gotop is vulnerable to local argument injection via
process te ...)
@@ -135,11 +135,11 @@ CVE-2026-91137 (Improper validation of specified quantity
in input, Allocation o
CVE-2026-91135 (Heap-based buffer overflow vulnerability in Apache Thrift C++
THeaderT ...)
TODO: check
CVE-2026-90970 (GitLab has remediated a vulnerability in the GitLab AI Gateway
compone ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-90440 (Uncaught exception, improper handling of exceptional
conditions, impro ...)
TODO: check
CVE-2026-87920 (The W3 Total Cache plugin for WordPress is vulnerable to
Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87117 (NULL pointer dereference vulnerability in Apache Thrift PHP
bindings. ...)
TODO: check
CVE-2026-86537 (Uncaught exception, Loop with unreachable exit condition
('infinite lo ...)
@@ -149,15 +149,15 @@ CVE-2026-86536 (Improperly controlled modification of
object prototype attribute
CVE-2026-86535 (Loop with unreachable exit condition ('infinite loop'),
Improperly con ...)
TODO: check
CVE-2026-86326 (An improper verification of cryptographic signature
vulnerability exis ...)
- TODO: check
+ NOT-FOR-US: Moxa
CVE-2026-86325 (A stack-based buffer overflow vulnerability exists in protocol
gateway ...)
- TODO: check
+ NOT-FOR-US: Moxa
CVE-2026-85494 (Improper handling of length parameter inconsistency, Uncaught
exceptio ...)
TODO: check
CVE-2026-85493 (Uncontrolled Recursion vulnerability in Apache Thrift Dart and
Java ME ...)
TODO: check
CVE-2026-85492 (The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings
& Traffi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85483 (Use of uninitialized resource, Return of wrong status code
vulnerabili ...)
TODO: check
CVE-2026-85476 (Loop with unreachable exit condition ('infinite loop')
vulnerability i ...)
@@ -265,7 +265,7 @@ CVE-2026-59660 (Cross-Site Scripting vulnerability in the
Repasat application. S
CVE-2026-59659 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
TODO: check
CVE-2026-59265 (A code execution issue in the Java integration in Apache
OpenOffice v4 ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-51922 (agentscope v1.0.20 contains code injection in
execute_shell_command (s ...)
TODO: check
CVE-2026-51918 (FinRobot 1.0.0 contains code injection in
CodingUtils.create_file_with ...)
@@ -293,23 +293,23 @@ CVE-2026-51899 (In SuperAGI v0.0.14 and prior, controller
endpoints (/api/agents
CVE-2026-51898 (sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in
CodeExe ...)
TODO: check
CVE-2026-39717 (Missing Authorization vulnerability in ThimPress LearnPress
learnpress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39601 (Concurrent Execution using Shared Resource with Improper
Synchronizati ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39600 (URL Redirection to Untrusted Site ('Open Redirect')
vulnerability in M ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39444 (Authorization Bypass Through User-Controlled Key vulnerability
in Publ ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39439 (Missing Authorization vulnerability in Kiera Howe WebSamurai
websamura ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32585 (Missing Authorization vulnerability in airano Airano MCP
Bridge airano ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32584 (Insertion of Sensitive Information Into Sent Data
vulnerability in Chi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-19856 (The All in One SEO WordPress plugin before 5.0.2.1 does not
correctly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19652 (The Divi Membership plugin for WordPress is vulnerable to
Privilege Es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18036 (In Bouncy Castle for Java before 1.86, NTRU reduced secret
values with ...)
TODO: check
CVE-2026-17508 (In Bouncy Castle for Java before 1.86, several password-based
key deri ...)
@@ -317,7 +317,7 @@ CVE-2026-17508 (In Bouncy Castle for Java before 1.86,
several password-based ke
CVE-2026-17507 (In Bouncy Castle for Java before 1.86, the MLS implementation
(org.bou ...)
TODO: check
CVE-2026-12951 (The Dc Woocommerce Multi Vendor plugin for WordPress is
vulnerable to ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11795 (Observable discrepancy vulnerability in Softtr Informatics
Trading Lim ...)
TODO: check
CVE-2026-104914 (MISP contains an improper access control vulnerability in its
attribut ...)
@@ -371,21 +371,21 @@ CVE-2026-104638 (A security vulnerability has been
detected in onetwothreeneth H
CVE-2026-104637 (A weakness has been identified in onetwothreeneth
HospitalManagementSy ...)
TODO: check
CVE-2026-104625 (A security flaw has been discovered in CodeAstro Simple Loan
Managemen ...)
- TODO: check
+ NOT-FOR-US: CodeAstro
CVE-2026-104614 (A vulnerability was identified in CodeAstro Simple Pharmacy
Management ...)
- TODO: check
+ NOT-FOR-US: CodeAstro
CVE-2026-104613 (A vulnerability was determined in CodeAstro Simple Pharmacy
Management ...)
- TODO: check
+ NOT-FOR-US: CodeAstro
CVE-2026-104612 (A vulnerability was found in SourceCodester Student Result
Management ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-104611 (A vulnerability was detected in Tenda AC9 15.03.02.13.
Affected is an ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-104610 (A security vulnerability has been detected in Tenda HG7, HG9
and HG10 ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-104609 (A weakness has been identified in onetwothreeneth
HospitalManagementSy ...)
TODO: check
CVE-2026-104606 (A security flaw has been discovered in itsourcecode Online
Admission S ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-104473 (YesWiki before 4.5.3 contains multiple reflected cross-site
scripting ...)
TODO: check
CVE-2026-104472 (YesWiki before 4.6.7 contains a missing authorization
vulnerability in ...)
@@ -511,17 +511,17 @@ CVE-2026-104412 (Ghost 0.5.0 before 6.64.0 does not
correctly restrict staff rol
CVE-2026-104411 (Ghost from 6.22.1 before 6.64.0 contains a stored cross-site
scripting ...)
TODO: check
CVE-2026-104410 (SiYuan before 3.8.5 contains an information disclosure
vulnerability t ...)
- TODO: check
+ NOT-FOR-US: SiYuan
CVE-2026-104403 (Authorization Bypass Through User-Controlled Key
vulnerability in Thim ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104026 (In Sapling SCM prior to v0.2.20260929-102736, control
characters were ...)
TODO: check
CVE-2026-103958 (Server-side request forgery in the tool server and remote
agent connec ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-103957 (Server-side request forgery in the OAuth2 discovery handling
in Loom f ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-103956 (Missing authentication for critical function in the
authentication dep ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-103885 (Asymmetric Resource Consumptionvulnerability in Apache
Directory LDAP ...)
TODO: check
CVE-2026-103880 (Asymmetric Resource Consumptionvulnerability in Apache
Directory LDAP ...)
@@ -531,9 +531,9 @@ CVE-2026-103878 (Cleartext transmission of sensitive
informationvulnerability in
CVE-2026-103877 (Deserialization of Untrusted Data vulnerability in Apache
Directory LD ...)
TODO: check
CVE-2026-103763 (SiYuan before v3.8.5 contains an information disclosure
vulnerability ...)
- TODO: check
+ NOT-FOR-US: SiYuan
CVE-2026-103762 (SiYuan before v3.8.5 contains a missing authorization
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: SiYuan
CVE-2026-103648 (Path traversal in image-downloader 4.3.0 allows an attacker
who can co ...)
TODO: check
CVE-2026-103631 (Buffer overflow in WebRTC in Google Chrome prior to
154.0.8037.97 allo ...)
@@ -571,27 +571,27 @@ CVE-2026-103600 (Uncontrolled recursion in the ASN.1
parser (Asn1InputStream, As
CVE-2026-103552 (Stack Overflow vulnerability in Apache Directory LDAP API.
Before b ...)
TODO: check
CVE-2026-103426 (The Relevanssi Premium plugin for WordPress is vulnerable to
Stored Cr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102798 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102797 (Server-Side Request Forgery (SSRF) vulnerability in ThemeREX
Group The ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102795 (Improper Access Control vulnerability in Apache Traffic
Server. Thi ...)
TODO: check
CVE-2026-102772 (The CMB2 plugin for WordPress is vulnerable to Stored
Cross-Site Scrip ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102731 (Memory allocation with excessive size value vulnerability in
Apache Di ...)
TODO: check
CVE-2026-102626 (An authenticated LimeSurvey Community Edition 7.4.0user with
the globa ...)
TODO: check
CVE-2026-102002 (The Otter Blocks \u2013 Gutenberg Blocks, Page Builder for
Gutenberg E ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101104 (The Meari IoT Cloud Platform OpenAPI Service is vulnerable to
an autho ...)
TODO: check
CVE-2026-100182 (The Download Monitor plugin for WordPress is vulnerable to
Stored Cros ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100107 (The Kubio AI Page Builder plugin for WordPress is vulnerable
to Stored ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-54405 (H3C CVM, the Cloud Virtualization Management component of the
H3C CAS ...)
TODO: check
CVE-2020-37278 (Weaver e-Bridge contains an unauthenticated arbitrary file
read vulner ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ed87d949305eb327affef8f5a1ac8dcf9e2b3c1a
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ed87d949305eb327affef8f5a1ac8dcf9e2b3c1a
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
