Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
7e790ca5 by security tracker role at 2026-10-06T19:15:41+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,13 +1,13 @@
CVE-2026-9226 (Authentication bypass in the Azure AD external login flow in
Devolutio ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-97308 (Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96890 (A Server-Side Request Forgery (SSRF) vulnerability was
identified in G ...)
- TODO: check
+ NOT-FOR-US: Github Enterprise Server
CVE-2026-95594 (Unauthenticated Privilege Escalation in SMS Alert Order
Notifications ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95526 (Unauthenticated Broken Access Control in BEAR <= 1.2.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95153 (An issue in Bludit CMS 3.22.0 allows a remote attacker to
obtain sensi ...)
TODO: check
CVE-2026-95140 (kkFileView v5.0.0 through v5.0.2 contains a directory
traversal vulner ...)
@@ -15,19 +15,19 @@ CVE-2026-95140 (kkFileView v5.0.0 through v5.0.2 contains a
directory traversal
CVE-2026-95105 (Reliance on Obfuscation or Encryption of Security-Relevant
Inputs with ...)
TODO: check
CVE-2026-94675 (Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro
Add On ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94206 (Use of Password Hash With Insufficient Computational Effort
vulnerabil ...)
TODO: check
CVE-2026-91140 (An OS command injection vulnerability in the shell-based
temporary-fil ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-88252 (A flaw was found in sssd. A local user can cause a Denial of
Service ( ...)
TODO: check
CVE-2026-86362 (Dell System Update, versions prior to 2.3.0.0, contains an
Improper Ac ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-86361 (Dell System Update, versions prior to 2.3.0.0, contains an
Incorrect P ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-86360 (Dell System Update, versions prior to 2.3.0.0, contains an
Improper Li ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-85523 (Improper neutralization of special elements used in an OS
command ('OS ...)
TODO: check
CVE-2026-85153 (This vulnerability exists in the Schmooze app due to the use
of hardco ...)
@@ -41,13 +41,13 @@ CVE-2026-82924 (Improper Control of Interaction Frequency
vulnerability in Pusul
CVE-2026-82531 (Smarty before 4.5.8 and 5.x before 5.8.5 contains a code
injection vul ...)
TODO: check
CVE-2026-82162 (Dell Command | Configure (DCC), versions prior to 5.2.3.35,
contain an ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-80327 (An open redirect vulnerability exists in the PingGateway
Fragment Filt ...)
- TODO: check
+ NOT-FOR-US: Ping Identity Corporation
CVE-2026-77178 (Oracle VM VirtualBox before 7.2.8 allows guest OS users to
cause an ou ...)
TODO: check
CVE-2026-76105 (Dell Container Storage Modules, versions prior to 1.18.0
contain(s) an ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-75820 (GNU Aspell contains an integer truncation vulnerability in the
Writabl ...)
TODO: check
CVE-2026-75819 (GNU Aspell contains an out-of-bounds read vulnerability in
ReadOnlyDic ...)
@@ -55,243 +55,243 @@ CVE-2026-75819 (GNU Aspell contains an out-of-bounds read
vulnerability in ReadO
CVE-2026-75818 (GNU Aspell prezip-bin contains a heap-based buffer overflow
vulnerabil ...)
TODO: check
CVE-2026-71168 (Dell System Update, versions prior to 2.3.0.0, contains an
Improper Li ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-70414 (Dell Command | Configure (DCC), versions prior to 5.2.3.35,
contain a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-70411 (Dell Container Storage Modules (CSM), versions prior to
1.18.0, contai ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-67273 (Dell Container Storage Modules, versions prior to 1.18.0,
contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-67270 (Dell Container Storage Modules (CSM) versions prior to 1.18.0,
contain ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-67269 (Dell Container Storage Modules (CSM) Operator, versions prior
to 1.18. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-66666 (Insertion of Sensitive Information Into Sent Data
vulnerability in Aut ...)
TODO: check
CVE-2026-66588 (Unauthenticated Broken Access Control in The7 <= 14.2.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-63697 (Dell System Update, versions prior to 2.3.0.0, contains an
Improper Ce ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-63692 (Dell Container Storage Modules, versions prior to 1.18.0,
contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-63691 (Dell Container Storage Modules, versions prior to 1.18.0,
contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-63690 (Dell Container Storage Modules, versions prior to 1.18.0,
contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-63689 (Dell Container Storage Modules, versions prior to 1.18.0,
contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-63688 (Dell Container Storage Modules (CSM), versions prior to
v1.18.0, conta ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-62072 (Subscriber Broken Access Control in Progress Planner <= 1.10.0
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61421 (Dell Container Storage Modules, versions prior to 1.18.0,
contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-61411 (Dell Container Storage Modules, versions prior to 1.18.0,
contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-56952 (In platform_msg_handler_init of default_msg_handlers.c, there
is a pos ...)
- TODO: check
+ NOT-FOR-US: Google devices
CVE-2026-56936 (In wacom_hid_set_device_mode of wacom_sys.c, there is a
possible out-o ...)
- TODO: check
+ NOT-FOR-US: Google devices
CVE-2026-56906 (In ep_free of eventpoll.c, there is a possible use-after-free
due to a ...)
- TODO: check
+ NOT-FOR-US: Google devices
CVE-2026-56596 (HCL BigFix Service Management is affected by an Improper Input
Validat ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-55330 (In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there
is a pos ...)
- TODO: check
+ NOT-FOR-US: Google devices
CVE-2026-55307 (In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible
informa ...)
- TODO: check
+ NOT-FOR-US: Google devices
CVE-2026-54472 (Dell Container Storage Modules, versions prior to 1.18.0,
contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-4889 (SQL injection (SQLi) vulnerability in the eLoanApp application,
specif ...)
TODO: check
CVE-2026-48199 (Unauthenticated Broken Access Control in Sermon'e <= 1.0.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48197 (Incorrect Privilege Assignment vulnerability in PublishPress
PublishPr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42638 (Unauthenticated Broken Access Control in Easy Digital
Downloads <= 3.7 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42637 (Unauthenticated Settings Change in PayPlug for WooCommerce
(Official) ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42636 (Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice
for GDP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42635 (Unauthenticated Cross Site Scripting (XSS) in WooCommerce
Simple Aucti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42634 (Unauthenticated Cross Site Scripting (XSS) in Video Background
Block \ ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42418 (Unauthenticated Cross Site Scripting (XSS) in Social Rocket <=
1.3.5 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42417 (Unauthenticated SQL Injection in ARMember Premium <= 7.8
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42416 (Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42415 (Unauthenticated SQL Injection in Porto Theme - Functionality
<= 3.9.3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42414 (Subscriber SQL Injection in ListingPro <= 2.9.12 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42413 (Unauthenticated Sensitive Data Exposure in Snapshotify –
All-in- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-41562 (Unauthenticated Sensitive Data Exposure in Norvis Backup <=
1.1.0 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-41561 (Unauthenticated Sensitive Data Exposure in Museder RestoreOne
<= 2.7.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-41560 (Unauthenticated Broken Access Control in WXD Backup Lite <=
1.0.2 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-41559 (Unauthenticated Sensitive Data Exposure in SafeSnap \u2013
Verified Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-41555 (Unauthenticated SQL Injection in Newsletter Subscription Form
\u2013 U ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40807 (Unauthenticated Cross Site Scripting (XSS) in CF7 Views
– Comple ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40806 (Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and
Category ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39798 (Unauthenticated Settings Change in TrueBooker <= 1.2.9
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39797 (Unauthenticated PHP Object Injection in GDPR Framework By
Data443 <= 2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39796 (Unauthenticated Broken Access Control in Advanced Posts
Listing \u2013 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39795 (Unauthenticated SQL Injection in SendPress Newsletters <=
1.26.1.20 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39794 (Unauthenticated Broken Access Control in WooCommerce
Multivendor Marke ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39793 (Subscriber Broken Authentication in Simple JWT Login 4.0.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39792 (Unauthenticated Arbitrary File Deletion in Simple File List <=
6.3.11 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39791 (Unauthenticated Sensitive Data Exposure in Mailjet Email
Marketing <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39790 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <=
1.4.6 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39788 (Subscriber Cross Site Scripting (XSS) in Front End PM <=
11.4.6 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39787 (Unauthenticated Broken Access Control in 10Web Social Photo
Feed <= 1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39785 (Unauthenticated SQL Injection in Gmedia Photo Gallery <=
1.25.1 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39784 (Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <=
3.8 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39781 (Unauthenticated Cross Site Scripting (XSS) in Document Gallery
<= 5.1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39780 (Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39778 (Unauthenticated Cross Site Scripting (XSS) in Ansar Import
\u2013 One ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39776 (Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39775 (Subscriber Privilege Escalation in JobZilla - Job Board
WordPress Them ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39774 (Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39773 (Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39772 (Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft
<= 5.2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39771 (Subscriber SQL Injection in Buddyboss Platform <= 3.1.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39770 (Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39769 (Unauthenticated Broken Authentication in Graphina <= 3.1.12
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39768 (Unauthenticated Cross Site Scripting (XSS) in Security &
Malware scan ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39767 (Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39766 (Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39765 (Shop Manager Privilege Escalation in Challan <= 3.7.88
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39764 (Unauthenticated SQL Injection in Radius Booking \u2014 Booking
Calenda ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39762 (Missing Authorization vulnerability in Patterns In The Cloud
Autoship ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39761 (Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39759 (Employer / Sales Representative Arbitrary File Upload in
Workreap Core ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39758 (Unauthenticated Cross Site Scripting (XSS) in
Midtrans-WooCommerce <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39757 (Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39756 (Unauthenticated Insecure Direct Object References (IDOR) in
Wappointme ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39755 (Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39754 (Contributor Arbitrary File Download in Piotnet Addons For
Elementor <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39753 (Unauthenticated Privilege Escalation in Taskbot <= 6.6
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39752 (Contributor Arbitrary File Deletion in Jobs for WordPress <=
2.8.2 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39751 (Unauthenticated Broken Access Control in PayPlug for
WooCommerce (Offi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39750 (Unauthenticated Cross Site Scripting (XSS) in StoreGrowth:
Smart Sales ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39749 (Subscriber Broken Access Control in App for Cloudflare\xae <=
1.10.1 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39748 (Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39747 (Subscriber SQL Injection in Woffice <= 5.4.35 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39746 (Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39745 (Unauthenticated Cross Site Scripting (XSS) in Contact Form to
DB by Be ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39731 (Unauthenticated Cross Site Scripting (XSS) in Database for CF7
<= 1.2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39730 (Missing Authorization vulnerability in Marcin Wise Chat
wise-chat allo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39729 (Unauthenticated Sensitive Data Exposure in Edwiser Bridge <=
4.3.4 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39728 (Unauthenticated Server Side Request Forgery (SSRF) in
Instapage Plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39727 (Subscriber Cross Site Scripting (XSS) in WC Fields Factory <=
4.1.12 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39726 (Unauthenticated Cross Site Scripting (XSS) in Lumise Product
Designer ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39725 (Contributor Remote Code Execution (RCE) in Content Visibility
for Divi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39724 (Unauthenticated Cross Site Scripting (XSS) in HTTP Requests
Manager <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39722 (Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39720 (Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps
<= 2.0.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39719 (Unauthenticated Server Side Request Forgery (SSRF) in PDF
Smart Viewer ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-34498 (Improper input validation vulnerability in Johnson Controls
Illustra S ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-32581 (Subscriber SQL Injection in Mooberry Book Manager 4.16.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32580 (Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32579 (Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for
WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32578 (Subscriber Broken Access Control in ECPay Ecommerce for
WooCommerce <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32577 (Unauthenticated Cross Site Scripting (XSS) in Frontend File
Manager <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32575 (Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates
Pro <= 1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32574 (Unauthenticated Cross Site Scripting (XSS) in Smart Forms <=
2.6.104 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32572 (Unauthenticated Cross Site Scripting (XSS) in WP User Frontend
Pro <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32571 (Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32570 (Unauthenticated Cross Site Scripting (XSS) in Progressify -
Progressiv ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32569 (Unauthenticated Cross Site Scripting (XSS) in WP Media folder
<= 6.2.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32568 (Subscriber Remote Code Execution (RCE) in WooCommerce Designer
Pro <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32557 (Unauthenticated SQL Injection in WooCommerce Appointments <=
5.3.2 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-26287 (External Secrets Operator reads information from a third-party
service ...)
TODO: check
CVE-2026-25434 (Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-25433 (Subscriber Broken Access Control in WP2LEADS <= 3.5.7
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-12380 (Improper neutralization of input during web page generation
('cross-si ...)
TODO: check
CVE-2026-106513 (MISP (Malware Information Sharing Platform) exposes critical
infrastru ...)
@@ -725,9 +725,9 @@ CVE-2026-106221 (Confused deputy in WebAPKs in Google
Chrome on on Android prior
CVE-2026-106220 (Information leak in Passwords in Google Chrome prior to
155.0.8059.39 ...)
TODO: check
CVE-2026-106219 (In JetBrains TeamCity before 2026.2.1 missing validation of
Git submod ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-106218 (In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL
sandbox esc ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-106217 (Missing authorization in Google Lens in Google Chrome prior
to 155.0.8 ...)
TODO: check
CVE-2026-106216 (Cross-site request forgery in ReadingList in Google Chrome on
on Andro ...)
@@ -869,9 +869,9 @@ CVE-2026-106026 (tftp-hpa 5.4 before 6.0 contains an
out-of-bounds read vulnerab
CVE-2026-106016 (Mitigation bypass in the File Handling component. This
vulnerability w ...)
TODO: check
CVE-2026-105985 (Craft CMS 5.10.13.2 contains an authenticated remote code
execution vu ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-105957 (A vulnerability was detected in SourceCodester Performance
Indicator S ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-105950 (A security vulnerability has been detected in getformwork
formwork up ...)
TODO: check
CVE-2026-105922 (A security flaw has been discovered in vllm-project vLLM up
to 0.31.0. ...)
@@ -885,7 +885,7 @@ CVE-2026-105919 (A vulnerability was found in Kusalkasilva
Learning-Management-S
CVE-2026-105918 (A vulnerability has been found in Kusalkasilva
Learning-Management-Sys ...)
TODO: check
CVE-2026-105879 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105868 (Payload is a free and open source headless content management
system. ...)
TODO: check
CVE-2026-105867 (Payload is a free and open source headless content management
system. ...)
@@ -955,11 +955,11 @@ CVE-2026-105835 (PLANKA 2.2.0 through 2.2.1 fails to
limit incorrect TOTP codes
CVE-2026-105834 (Rundeck before 6.2.0 contains a path traversal vulnerability
that allo ...)
TODO: check
CVE-2026-105809 (A vulnerability was identified in SourceCodester Simple
Student Inform ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-105808 (A vulnerability was determined in SourceCodester Simple
Student Inform ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-105807 (A vulnerability was found in SourceCodester Simple Student
Information ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-105806 (Payload is a free and open source headless content management
system. ...)
TODO: check
CVE-2026-105805 (Payload is a free and open source headless content management
system. ...)
@@ -995,55 +995,55 @@ CVE-2026-105789 (Microsoft UFO is an open-source
framework for intelligent autom
CVE-2026-105788 (Microsoft UFO is an open-source framework for intelligent
automation a ...)
TODO: check
CVE-2026-105488 (Missing authorization in the global vault in Devolutions
Server 2026.3 ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-105485 (Authentication bypass OAuth device authorization flow in
Devolutions S ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-105317 (Subscriber SQL Injection in Paid Member Subscriptions <=
3.1.1 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105305 (A flaw was found in the OIDC implementation of Keycloak,
specifically ...)
TODO: check
CVE-2026-105071 (Unauthenticated Sensitive Data Exposure in SiteVault \u2013
Backup, Re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105070 (Unauthenticated Privilege Escalation in Salon booking system
<= 10.31. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105061 (Unauthenticated Cross Site Scripting (XSS) in WP Mailster <=
1.9.0.0 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105059 (Subscriber Broken Access Control in Delete All Comments of
wordpress < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105058 (Subscriber Privilege Escalation in WP User Profiles <= 2.7.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105057 (Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104945 (TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-104944 (TP-Link Tapo C500 v2.0 contains an out-of-bounds
function-pointer disp ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-104850 (MCP TypeScript SDK is the official TypeScript SDK for Model
Context Pr ...)
TODO: check
CVE-2026-104814 (Unauthenticated Cross Site Scripting (XSS) in Form Block <=
1.8.1 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104757 (Editor Privilege Escalation in Import and export users and
customers < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104747 (Unauthenticated PHP Object Injection in Haaken <= 1.5
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104672 (Unauthenticated Cross Site Scripting (XSS) in GiveWP <=
4.17.0 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104670 (Unauthenticated Cross Site Scripting (XSS) in LearnPress <=
4.4.9 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104406 (Unauthenticated Broken Access Control in picu <= 3.10.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104405 (Unauthenticated Privilege Escalation in GiveWP <= 4.17.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104399 (Insertion of Sensitive Information Into Sent Data
vulnerability in Sty ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104395 (Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104394 (Unauthenticated Cross Site Scripting (XSS) in Charitable <=
1.8.12.3 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104387 (Unauthenticated Broken Access Control in PowerPress
Podcasting <= 11.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104385 (Unauthenticated Sensitive Data Exposure in Groundhogg <=
4.8.3 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104073 (NetBox versions 2.9.5 before 4.7.0 contain a server-side
template inje ...)
TODO: check
CVE-2026-104070 (The Crayons plugin for SPIP before 3.5.0 contains a missing
authorizat ...)
@@ -1053,23 +1053,23 @@ CVE-2026-104069 (HortusFox before 6.2 contains a remote
code execution vulnerabi
CVE-2026-103831 (CVE-2026-103831: Insecure deserialization vulnerability in
the Psr16Ca ...)
TODO: check
CVE-2026-103778 (Dell Command | Configure (DCC), versions prior to 5.2.3.35
contain a U ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-103620 (A missing authorization vulnerability was identified in
GitHub Enterpr ...)
- TODO: check
+ NOT-FOR-US: Github Enterprise Server
CVE-2026-103346 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102915 (Subscriber Broken Access Control in WPO365 <= 44.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102387 (Unauthenticated Sensitive Data Exposure in Xserver Migrator
<= 1.6.6 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102322 (Incorrect Authorization in SiteIsolation in Google Chrome
prior to 155 ...)
TODO: check
CVE-2026-101207 (Dell OpenManage Integration with Microsoft Windows Admin
Center, versi ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-100518 (Unauthenticated Broken Authentication in Advanced Google
reCAPTCHA <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-0198 (In is_pd_allowed of gem_msg.c, there is a possible permission
bypass d ...)
- TODO: check
+ NOT-FOR-US: Google devices
CVE-2025-8352 (Allocation of resources without limits or throttling
vulnerability in ...)
TODO: check
CVE-2025-71384 (Dbit WIFI4 N300 1.0.0 devices allows administrators (from the
local Wi ...)
@@ -1079,7 +1079,7 @@ CVE-2025-71383 (Dbit WIFI4 N300 1.0.0 devices allow the
management interface to
CVE-2025-45871 (LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to
blind SQL i ...)
TODO: check
CVE-2025-15591 (Cross-site Scripting (XSS) in the Forums feature of OpenText
Content M ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2026-77050 (An issue was discovered in Django 6.1 before 6.1.2, 6.0 before
6.0.9, ...)
- python-django 3:5.2.18-1 (bug #1150176)
NOTE:
https://www.djangoproject.com/weblog/2026/oct/06/security-releases/
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7e790ca55f74f3f7cc5b5a8ad873b3a889caebbd
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7e790ca55f74f3f7cc5b5a8ad873b3a889caebbd
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
