Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
4a630fb4 by Salvatore Bonaccorso at 2026-10-05T22:51:32+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -290,19 +290,19 @@ CVE-2026-105315 (A vulnerability has been found in
django-haystack up to 3.3.0.
NOTE:
https://github.com/django-haystack/django-haystack/security/advisories/GHSA-r3hx-x5rh-p9vv
NOTE: Fixed by:
https://github.com/django-haystack/django-haystack/commit/eb05f193c9771a68dcc8cfac6674a0d48a52ee9d
(v3.4.0)
CVE-2026-105314 (Papermerge 3.5.3 allows remote code execution by a standard
user via d ...)
- TODO: check
+ NOT-FOR-US: Papermerge
CVE-2026-105307 (A vulnerability was detected in Casdoor up to 3.161.1.
Affected is the ...)
- TODO: check
+ NOT-FOR-US: Casdoor
CVE-2026-105291 (A vulnerability was identified in feelec-yishu feelcrm-os
1.0.0. This ...)
- TODO: check
+ NOT-FOR-US: feelec-yishu feelcrm-os
CVE-2026-105290 (A vulnerability was determined in feelec-yishu feelcrm-os
1.0.0. This ...)
- TODO: check
+ NOT-FOR-US: feelec-yishu feelcrm-os
CVE-2026-105289 (A vulnerability was found in feelec-yishu feelcrm-os 1.0.0.
Affected b ...)
- TODO: check
+ NOT-FOR-US: feelec-yishu feelcrm-os
CVE-2026-105288 (A vulnerability has been found in feelec-yishu feelcrm-os
1.0.0. Affec ...)
- TODO: check
+ NOT-FOR-US: feelec-yishu feelcrm-os
CVE-2026-105287 (A flaw has been found in feelec-yishu feelcrm-os 1.0.0.
Affected is an ...)
- TODO: check
+ NOT-FOR-US: feelec-yishu feelcrm-os
CVE-2026-105286 (A vulnerability was detected in Totolink A3002MU
1.0.0-B20230403.1455. ...)
NOT-FOR-US: TOTOLINK
CVE-2026-105285 (A security vulnerability has been detected in Totolink
A3002MU 1.0.0-B ...)
@@ -318,13 +318,13 @@ CVE-2026-105254 (A vulnerability was identified in
itsourcecode Online Admission
CVE-2026-105253 (A vulnerability was determined in itsourcecode Online
Admission System ...)
NOT-FOR-US: itsourcecode System
CVE-2026-105251 (A vulnerability was detected in vgmstream up to r2117.
Affected by thi ...)
- TODO: check
+ NOT-FOR-US: vgmstream
CVE-2026-105250 (A security vulnerability has been detected in vgmstream up to
r2117. A ...)
- TODO: check
+ NOT-FOR-US: vgmstream
CVE-2026-105249 (A weakness has been identified in vgmstream up to r2117. This
impacts ...)
- TODO: check
+ NOT-FOR-US: vgmstream
CVE-2026-105248 (A security flaw has been discovered in vgmstream up to r2117.
This aff ...)
- TODO: check
+ NOT-FOR-US: vgmstream
CVE-2026-105247 (A vulnerability was determined in SourceCodester Online
Reviewer Manag ...)
NOT-FOR-US: SourceCodester
CVE-2026-105073 (Exposure of Sensitive System Information to an Unauthorized
Control Sp ...)
@@ -386,7 +386,7 @@ CVE-2026-104956 (Plane is an open-source project management
tool. Prior to 1.4.0
CVE-2026-104955 (Plane is an open-source project management tool. Prior to
1.4.0, a Pro ...)
NOT-FOR-US: Plane
CVE-2026-104905 (FacturaScripts before version 2026.7 contains a PHP object
injection v ...)
- TODO: check
+ NOT-FOR-US: FacturaScripts
CVE-2026-104894 (Plane is an open-source project management tool. Prior to
1.4.0, the m ...)
NOT-FOR-US: Plane
CVE-2026-104893 (Plane is an open-source project management tool. Prior to
1.4.0, GET / ...)
@@ -394,23 +394,23 @@ CVE-2026-104893 (Plane is an open-source project
management tool. Prior to 1.4.0
CVE-2026-104892 (Plane is an open-source project management tool. Prior to
1.4.0, aPITo ...)
NOT-FOR-US: Plane
CVE-2026-104891 (mppx-condition-gate provides conditional free-access wrappers
for mppx ...)
- TODO: check
+ NOT-FOR-US: mppx-condition-gate
CVE-2026-104890 (Kunstmaan CMS is an open source content management system
based on the ...)
- TODO: check
+ NOT-FOR-US: Kunstmaan CMS
CVE-2026-104811 (DigitalCanion SA has discovered a vulnerability that allows
remote att ...)
- TODO: check
+ NOT-FOR-US: DigitalCanion
CVE-2026-104810 (This vulnerability allows remote attackers to delete
sensitive files o ...)
- TODO: check
+ NOT-FOR-US: DigitalCanion
CVE-2026-104809 (DigitalCanion has discovered a vulnerability that allows an
attacker t ...)
- TODO: check
+ NOT-FOR-US: DigitalCanion
CVE-2026-104808 (DigitalCanion has discovered a stored Cross-Site Scripting
(XSS) vulne ...)
- TODO: check
+ NOT-FOR-US: DigitalCanion
CVE-2026-104807 (DigitalCanion has discovered a stored Cross-Site Scripting
(XSS) vulne ...)
- TODO: check
+ NOT-FOR-US: DigitalCanion
CVE-2026-104806 (DigitalCanion has discovered a path traversal vulnerability
that allow ...)
- TODO: check
+ NOT-FOR-US: DigitalCanion
CVE-2026-104805 (DigitalCanion has discovered a vulnerability in the backup
restoration ...)
- TODO: check
+ NOT-FOR-US: DigitalCanion
CVE-2026-104714 (Concurrent execution using shared resource with improper
synchronizati ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-104713 (Allocation of resources without limits or throttling
vulnerability in ...)
@@ -420,7 +420,7 @@ CVE-2026-104712 (Asymmetric resource consumption
(amplification) vulnerability i
CVE-2026-104711 (Improper neutralization of special elements used in an
expression lang ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-104706 (DigitalCanion has discovered a path traversal vulnerability
that allow ...)
- TODO: check
+ NOT-FOR-US: DigitalCanion
CVE-2026-104675 (Missing Authorization vulnerability in Liquid Web / StellarWP
Event Ti ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-104673 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -450,13 +450,13 @@ CVE-2026-104386 (Missing Authorization vulnerability in
WPFunnels Team WP VR wpv
CVE-2026-103684 (Missing Authorization vulnerability in Arraytics WP Event
Solution wp- ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-103512 (Perforce P4 Search prior to 2026.4.2 trusts a client-supplied
address ...)
- TODO: check
+ NOT-FOR-US: Perforce
CVE-2026-103511 (Perforce P4 Search prior to 2026.4.2 does notvalidatefile
names suppli ...)
- TODO: check
+ NOT-FOR-US: Perforce
CVE-2026-103510 (P4 Search prior to 2026.4.2 does not fail securely when its
service au ...)
- TODO: check
+ NOT-FOR-US: Perforce
CVE-2026-103507 (Perforce P4 Search prior to 2026.4.2 does not restrict file
paths writ ...)
- TODO: check
+ NOT-FOR-US: Perforce
CVE-2026-103352 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-103351 (Improper Validation of Specified Quantity in Input
vulnerability in Ma ...)
@@ -492,7 +492,7 @@ CVE-2026-102776 (Joomla Extension - svenbluege.de -
Cross-site request forgery o
CVE-2026-102775 (Joomla Extension - phoca.cz - Authorisation bypass through
user-contro ...)
NOT-FOR-US: Joomla
CVE-2026-102576 (A flaw was found in Quay. A remote attacker could trick a
user into lo ...)
- TODO: check
+ NOT-FOR-US: Red Hat Quay
CVE-2026-102428 (Joomla Extension - ordasoft.com - Unauthenticated SQL
injection in Ord ...)
NOT-FOR-US: Joomla
CVE-2026-102426 (Joomla Extension - joomshaper.com - Reflected XSS in the
Dynamic Conte ...)
@@ -502,19 +502,19 @@ CVE-2026-102393 (Improper Neutralization of Input During
Web Page Generation ('C
CVE-2026-102383 (Missing Authorization vulnerability in VillaTheme Lookzy
woo-lookbook ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-102295 (A flaw was found in Quay. A cross-site scripting (XSS)
vulnerability i ...)
- TODO: check
+ NOT-FOR-US: Red Hat Quay
CVE-2026-102282 (adm-zip is a JavaScript library for creating and extracting
ZIP archiv ...)
- TODO: check
+ NOT-FOR-US: adm-zip
CVE-2026-101919 (A flaw was found in the HyperShift operator. The operator
copies user- ...)
- TODO: check
+ NOT-FOR-US: HyperShift operator
CVE-2026-100515 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-100509 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-100103 (Perforce P4 Search container images prior to 2026.4.2 reset
the servic ...)
- TODO: check
+ NOT-FOR-US: Perforce
CVE-2026-100102 (Perforce P4 Search container images prior to 2026.4.2enablean
unauthen ...)
- TODO: check
+ NOT-FOR-US: Perforce
CVE-2025-15643 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-XXXX [OSSN-0112]
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4a630fb487587527b61a9b92a1434d66679c6de6
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4a630fb487587527b61a9b92a1434d66679c6de6
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
