Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
3a0aea9f by Salvatore Bonaccorso at 2026-10-02T22:51:40+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -242,7 +242,7 @@ CVE-2026-80337 (Missing Authorization vulnerability in
HAVELSAN Inc. Sef - AI Ch
CVE-2026-80298 (Improper neutralization of special elements used in an SQL
command ('S ...)
NOT-FOR-US: Sef AI Chatbot Platform
CVE-2026-67989 (crmne/ruby_llm at commit
fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 cont ...)
- TODO: check
+ NOT-FOR-US: crmne/ruby_llm
CVE-2026-66859 (NULL Pointer Dereference, Use of Uninitialized Variable
vulnerability ...)
TODO: check
CVE-2026-66858 (The protocol skip routine in several Apache Thrift bindings
did not ap ...)
@@ -262,29 +262,29 @@ CVE-2026-64818
CVE-2026-63772 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
TODO: check
CVE-2026-63578 (Allocation of resources without limits in password-based
private-key d ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63577 (Improper certificate validation in the directoryName
name-constraint c ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63576 (Improper certificate validation in PkixNameConstraintValidator
(Extrac ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63575 (Loop with unreachable exit condition in the PKCS#12 key
derivation (Pk ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63574 (Memory allocation with excessive size value in the OpenPGP
signature a ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63573 (Observable discrepancy in the CMS RSA PKCS#1 v1.5
key-transport unwrap ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63572 (Allocation of resources without limits in PKCS#12 keystore
loading (Pk ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63571 (Improper verification of cryptographic signature in the
attribute cert ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63570 (Loop with unreachable exit condition in
Pkcs12Store.GetCertificateChai ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-61374 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
TODO: check
CVE-2026-61373 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
TODO: check
CVE-2026-5782 (Improper neutralization of input during web page generation
('cross-si ...)
- TODO: check
+ NOT-FOR-US: TurkHotspot
CVE-2026-59673 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
NOT-FOR-US: Repasat application
CVE-2026-59672 (Cross-Site Scripting vulnerability in the Repasat application.
Success ...)
@@ -318,31 +318,31 @@ CVE-2026-59659 (Cross-Site Scripting vulnerability in the
Repasat application. S
CVE-2026-59265 (A code execution issue in the Java integration in Apache
OpenOffice v4 ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-51922 (agentscope v1.0.20 contains code injection in
execute_shell_command (s ...)
- TODO: check
+ NOT-FOR-US: agentscope
CVE-2026-51918 (FinRobot 1.0.0 contains code injection in
CodingUtils.create_file_with ...)
- TODO: check
+ NOT-FOR-US: FinRobot
CVE-2026-51917 (FinRobot v1.0.0 is vulnerable to Code Injection in
CodingUtils.modify_ ...)
- TODO: check
+ NOT-FOR-US: FinRobot
CVE-2026-51916 (TransformerOptimus SuperAGI v0.0.14 contains an incorrect
access contr ...)
- TODO: check
+ NOT-FOR-US: TransformerOptimus SuperAGI
CVE-2026-51915 (TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect
Access ...)
- TODO: check
+ NOT-FOR-US: TransformerOptimus SuperAGI
CVE-2026-51914 (TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect
Access ...)
- TODO: check
+ NOT-FOR-US: TransformerOptimus SuperAGI
CVE-2026-51911 (vanna v2.0.2 contains a code injection vulnerability in
VannaBase.get_ ...)
- TODO: check
+ NOT-FOR-US: vanna
CVE-2026-51907 (In TaskingAI v0.3.0 in the QR Code Generator plugin
save_base64_image ...)
- TODO: check
+ NOT-FOR-US: TaskingAI
CVE-2026-51906 (In TaskingAI v0.3.0 in the DALL-E 3 image generation tool
save_url_ima ...)
- TODO: check
+ NOT-FOR-US: TaskingAI
CVE-2026-51904 (SuperAGI up to v0.0.14 contains an improper access control
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: SuperAGI
CVE-2026-51901 (SuperAGI up to 0.0.14 is vulnerable to Incorrect Access
Control. The a ...)
- TODO: check
+ NOT-FOR-US: SuperAGI
CVE-2026-51899 (In SuperAGI v0.0.14 and prior, controller endpoints
(/api/agents/creat ...)
- TODO: check
+ NOT-FOR-US: SuperAGI
CVE-2026-51898 (sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in
CodeExe ...)
- TODO: check
+ NOT-FOR-US: sinaptik-ai pandas-ai
CVE-2026-39717 (Missing Authorization vulnerability in ThimPress LearnPress
learnpress ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39601 (Concurrent Execution using Shared Resource with Improper
Synchronizati ...)
@@ -370,7 +370,7 @@ CVE-2026-17507 (In Bouncy Castle for Java before 1.86, the
MLS implementation (o
CVE-2026-12951 (The Dc Woocommerce Multi Vendor plugin for WordPress is
vulnerable to ...)
NOT-FOR-US: WordPress plugin
CVE-2026-11795 (Observable discrepancy vulnerability in Softtr Informatics
Trading Lim ...)
- TODO: check
+ NOT-FOR-US: E-Commerce Pack
CVE-2026-104914 (MISP contains an improper access control vulnerability in its
attribut ...)
- misp <itp> (bug #1144317)
CVE-2026-104912 (MISP contains an authorization flaw in its correlation
handling during ...)
@@ -388,27 +388,27 @@ CVE-2026-104901 (MISP contains a cross-site scripting
(XSS) vulnerability in the
CVE-2026-104900 (MISP contains a stored cross-site scripting (XSS)
vulnerability in the ...)
- misp <itp> (bug #1144317)
CVE-2026-104861 (probe-image-size gets image dimensions without downloading
the entire ...)
- TODO: check
+ NOT-FOR-US: probe-image-size
CVE-2026-104859 (Nx is a monorepo solution for TypeScript and polyglot
codebases. From ...)
- TODO: check
+ NOT-FOR-US: Nx
CVE-2026-104855 (Wasmtime is a runtime for WebAssembly. From 46.0.0 until
46.0.2 and 47 ...)
TODO: check
CVE-2026-104854 (Nx is a monorepo solution for TypeScript and polyglot
codebases. From ...)
- TODO: check
+ NOT-FOR-US: Nx
CVE-2026-104853 (Nx is a monorepo solution for TypeScript and polyglot
codebases. From ...)
- TODO: check
+ NOT-FOR-US: Nx
CVE-2026-104851 (fsspec is a specification and Python implementation framework
for file ...)
TODO: check
CVE-2026-104849 (Tinypool is a minimal Node.js worker thread pool
implementation. Prior ...)
- TODO: check
+ NOT-FOR-US: Tinypool
CVE-2026-104848 (Tinypool is a minimal Node.js worker thread pool
implementation. Prior ...)
- TODO: check
+ NOT-FOR-US: Tinypool
CVE-2026-104847 (ProseMirror's view component renders and manages the editable
browser ...)
- TODO: check
+ NOT-FOR-US: ProseMirror
CVE-2026-104846 (Seroval facilitates JS value stringification, including
complex struct ...)
- TODO: check
+ NOT-FOR-US: Seroval
CVE-2026-104845 (Seroval facilitates JS value stringification, including
complex struct ...)
- TODO: check
+ NOT-FOR-US: Seroval
CVE-2026-104844 (PostCSS Selector Parser is a CSS selector parser that
integrates with ...)
TODO: check
CVE-2026-104843 (uv is a Python package and project manager written in Rust.
From 0.12. ...)
@@ -418,9 +418,9 @@ CVE-2026-104733 (User Impersonation in ProcessOnes XMMP
Server ejabberd <= 26.04
CVE-2026-104721 (Path-traversal vulnerability in QOS.CH Sarl Logback-classic
on Java (l ...)
TODO: check
CVE-2026-104638 (A security vulnerability has been detected in onetwothreeneth
Hospital ...)
- TODO: check
+ NOT-FOR-US: onetwothreeneth HospitalManagementSystem
CVE-2026-104637 (A weakness has been identified in onetwothreeneth
HospitalManagementSy ...)
- TODO: check
+ NOT-FOR-US: onetwothreeneth HospitalManagementSystem
CVE-2026-104625 (A security flaw has been discovered in CodeAstro Simple Loan
Managemen ...)
NOT-FOR-US: CodeAstro
CVE-2026-104614 (A vulnerability was identified in CodeAstro Simple Pharmacy
Management ...)
@@ -434,7 +434,7 @@ CVE-2026-104611 (A vulnerability was detected in Tenda AC9
15.03.02.13. Affected
CVE-2026-104610 (A security vulnerability has been detected in Tenda HG7, HG9
and HG10 ...)
NOT-FOR-US: Tenda
CVE-2026-104609 (A weakness has been identified in onetwothreeneth
HospitalManagementSy ...)
- TODO: check
+ NOT-FOR-US: onetwothreeneth HospitalManagementSystem
CVE-2026-104606 (A security flaw has been discovered in itsourcecode Online
Admission S ...)
NOT-FOR-US: itsourcecode System
CVE-2026-104473 (YesWiki before 4.5.3 contains multiple reflected cross-site
scripting ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3a0aea9f7baa370c4e1d04c7a89063d667dfc46f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3a0aea9f7baa370c4e1d04c7a89063d667dfc46f
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
