Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b5a28a29 by security tracker role at 2026-10-07T07:14:44+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,87 +1,87 @@
CVE-2026-97680 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97679 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97678 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97676 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97674 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97673 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97671 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97655 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97626 (Requesting a user or organization profile page (`GET
/{username}`) wit ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-97354 (The PowerPress Podcasting plugin by Blubrry WordPress plugin
before 11 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97331 (The User Private Files WordPress plugin before 2.1.9 does not
validat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97208 (The Gitea API endpoint for creating push mirrors (`POST
/api/v1/repos/ ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-97188 (The String locator WordPress plugin before 2.6.8 does not
restrict the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96594 (The Gitea API endpoint `GET
/api/v1/repos/{owner}/{repo}/media/{filepa ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-96589 (When a private repository is transferred to a user who lacks
access, G ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-96580 (Gitea expanded a workflow's static `strategy.matrix` into its
full Car ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-96530 (The Optimole WordPress plugin before 4.2.15 does not perform
a capabi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96404 (When Gitea's web installer is reachable against a database
that alread ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-96400 (With `[migrations] ALLOWED_DOMAINS` set to a matching entry
such as `* ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-96399 (A repository's external issue tracker regular expression
containing al ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-95112 (When processing issue and comment bodies, Gitea scanned the
entire pre ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-95106 (Gitea accepted pushed Git trees containing two entries with
the same n ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-94205 (Gitea Actions decided whether a fork pull request run needed
approval ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-94114 (Symbolic name not mapping to correct object vulnerability in
Apache Co ...)
TODO: check
CVE-2026-93679 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93678 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93677 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93675 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93674 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93449 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93448 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93447 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker
with acc ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93445 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93443 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-89430 (Gitea validated a push mirror's remote address against the
`[migration ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-89182 (With `[repository] FORCE_PRIVATE = true`, Gitea creates new
repositori ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-88962 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-87971 (The If-So Dynamic Content WordPress plugin before 1.10.2 does
not val ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87782 (The Koinonia Link WordPress plugin before 1.1.5 does not check
that a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86833 (The MetForm WordPress plugin before 4.3.1 does not sanitize or
escape ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86816 (The WPCafe WordPress plugin before 3.0.21 does not restrict
access to ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86684 (The Gitea push mirror API checked whether the repository
owner, instea ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-84897 (src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the
server-to-c ...)
TODO: check
CVE-2026-83742 (Unsigned integer underflow in wstrncat() in src/port.c in
wolfSSL wolf ...)
@@ -89,99 +89,99 @@ CVE-2026-83742 (Unsigned integer underflow in wstrncat() in
src/port.c in wolfSS
CVE-2026-83540 (When password or public key authentication is used with the
Windows po ...)
TODO: check
CVE-2026-82212 (The Nexi XPay Build WordPress plugin through 7.6.2 does not
correctly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82211 (The Nexi XPay Build WordPress plugin through 7.6.2 does not
verify the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81535 (In wolfSSH through 1.5.0 built
with--enable-fwd,DoChannelOpen()insrc/i ...)
TODO: check
CVE-2026-80048 (A flaw was found in `sssd-kcm`. A local user or process able
to connec ...)
TODO: check
CVE-2026-79960 (When a push was authenticated with a deploy key, Gitea
recorded the re ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-79818 (A vulnerability in an API interface of ClearPass Policy
Manager could ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79817 (A sensitive information disclosure vulnerability exists in the
client ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79816 (A vulnerability in a client interface of HPE Networking
ClearPass Poli ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79815 (A command injection vulnerability in the OnGuard agent of
ClearPass Po ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79814 (An arbitrary file write vulnerability in the ClearPass Policy
Manager ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79813 (A local privilege escalation vulnerability exists in the
ClearPass cli ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79812 (A denial of service vulnerability exists in the OnGuard agent
of HPE N ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79811 (A SQL injection vulnerability in the API of ClearPass Policy
Manager c ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79810 (Remote code execution vulnerabilities exist in the affected
interface ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79809 (An unauthenticated path traversal vulnerability exists in an
API endpo ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79808 (A buffer overflow vulnerability exists in the OnGuard agent of
ClearPa ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79807 (A missing integrity verification vulnerability in the Windows
client s ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79806 (A privilege escalation vulnerability in the ClearPass Policy
Manager O ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79805 (An authenticated path traversal vulnerability exists in
ClearPass Poli ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79803 (A command injection vulnerability exists in the API of
ClearPass Polic ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79802 (A command injection vulnerability exists in the client
software of Cle ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79801 (A missing integrity verification vulnerability in the client
agent sof ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79800 (An authenticated path traversal vulnerability exists in the
command li ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79799 (A vulnerability in the web-based management interface of
ClearPass Pol ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79798 (SQL injection vulnerabilities in the web-based management
interface of ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79797 (An improper access control vulnerability exists in the Android
client ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79796 (Vulnerabilities have been identified in the affected interface
of Clea ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79794 (A SQL injection vulnerability in the web-based management
interface of ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76754 (A vulnerability in an affected interface of ClearPass Policy
Manager c ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76753 (A format string vulnerability in an affected service interface
of HPE ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76752 (Authentication bypass vulnerabilities exist in the web-based
managemen ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76751 (A missing integrity verification vulnerability exists in the
OnGuard a ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76750 (Deserialization of untrusted data vulnerabilities exist in the
web int ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76749 (A sensitive information disclosure vulnerability exists in
AOS-S. Succ ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76748 (A privilege escalation vulnerability exists in the API of
AOS-S. Succe ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76747 (Buffer overflow vulnerabilities exist in the affected
interface of AOS ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76746 (An unauthenticated buffer overflow vulnerability exists in
AOS-S. Succ ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76745 (Memory corruption vulnerabilities exist in AOS-S that are
reachable by ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76744 (Buffer overflow vulnerabilities exist in the affected
interface of AOS ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76743 (A vulnerability have been identified in the management
interface of AO ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76742 (Authentication bypass vulnerabilities exist in the web
management inte ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76741 (Buffer overflow vulnerabilities exist in the affected
interface of AOS ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76061 (A flaw was found in CRI-O's `bind_mount_prefix` handling. When
configu ...)
TODO: check
CVE-2026-73278 (Gitea's OAuth2 and OpenID Connect sign-in paths do not require
a WebAu ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-70357 (Gitea validates a repository migration hostname against its
network al ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-65142 (NVIDIA Model-Optimizer contains a vulnerability where an
attacker may ...)
TODO: check
CVE-2026-65122 (NVIDIA TensorRT contains a vulnerability where an attacker can
cause a ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-59347 (VMware Workstation and Fusion contain a stack-based
buffer-overflow vu ...)
TODO: check
CVE-2026-59346 (VMware Workstation and Fusion contain an integer-overflow
vulnerabilit ...)
@@ -191,17 +191,17 @@ CVE-2026-43598 (Improper input validation in the AMD ROCm
Communication Collecti
CVE-2026-19572 (A security vulnerability has been identified in FlexNet
Publisher lmad ...)
TODO: check
CVE-2026-19396 (A predictable seed in the pseudo-random number generator
(PRNG) in the ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-19386 (A stack-based buffer overflow in the ASUS router modules
allows an aut ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-19029 (A heap-based buffer over-read in H5Z__filter_scaleoffset() in
src/H5Zs ...)
TODO: check
CVE-2026-16528 (Insertion of Sensitive Information into Log File in certain
ASUS route ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-16516 (wolfSSH does not validate that the ECDSA curve identifier in a
KEXDH_R ...)
TODO: check
CVE-2026-14911 (Improper Neutralization of Input During Web Page Generation
(\u201cCro ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-106589 (In sshd in OpenSSH through 10.6, in certain environments such
as QNX 6 ...)
TODO: check
CVE-2026-106588 (In sshd in OpenSSH through 10.6, use of the macOS 27 (or
later) SDK ha ...)
@@ -323,21 +323,21 @@ CVE-2026-106062 (A heap-based buffer overflow was found
in GIMP\u2019s DirectDra
CVE-2026-106061 (A flaw was found in GIMP\u2019s X cursor (XMC) thumbnail
loader. When ...)
TODO: check
CVE-2026-106032 (Server-side request forgery in the OpenAPI schema processing
of the ag ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-105812 (Improper control of code generation in the agent import
functionality ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-105811 (Authorization bypass through a user-controlled key in the
optional Ama ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-105324 (An HTTP header injection vulnerability in
start-page-loader.cgi of ADM ...)
- TODO: check
+ NOT-FOR-US: Asustor
CVE-2026-105322 (The Magee Shortcodes WordPress plugin through 2.1.1 does not
restrict ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105316 (The Magee Shortcodes WordPress plugin through 2.1.1 does not
sanitise ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105268 (The Gitea API routes for issue attachments
(`/api/v1/repos/{owner}/{re ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-105267 (The Gitea web route for deleting tags (`POST
/{owner}/{repo}/tags/dele ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-105244 (Improper Encoding or Escaping of Output vulnerability in the
RemoteSys ...)
TODO: check
CVE-2026-105243 (Insufficient Logging vulnerability in the EventLogAppender of
Apache l ...)
@@ -353,35 +353,35 @@ CVE-2026-105239 (Improper Neutralization of Null Byte or
NUL Character vulnerabi
CVE-2026-105111 (Improper neutralization of input during web page generation
('cross-si ...)
TODO: check
CVE-2026-104953 (The MPG WordPress plugin before 4.2.3 does not properly
validate the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104678 (The CP Media Player WordPress plugin before 1.3.4 does not
perform a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104677 (The WP Coder WordPress plugin before 4.5.2 does not restrict
access t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104667 (The Animated Number Counters WordPress plugin before 3.1 does
not sani ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104653 (The Envira Gallery WordPress plugin before 1.16.1 does not
sanitise o ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104652 (The Envira Gallery WordPress plugin before 1.16.1 does not
sanitise a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104651 (The Yaad Sarig Payment Gateway For WC WordPress plugin before
2.2.13 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104636 (Gitea validated the initial remote URL for push mirrors, wiki
remote c ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-104633 (When migrating a repository from another Gitea instance,
Gitea used th ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-104632 (Gitea Actions blocks the jobs of workflow runs from
first-time fork pu ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-104626 (A user who can open a fork pull request can place workflow
content wit ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-104335 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104334 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104050 (The Academy LMS WordPress plugin before 4.0.0 does not
verify that a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104049 (The Academy LMS WordPress plugin before 4.0.0 does not
verify course ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104048 (A flaw was found in SSSD. In trust-enabled identity
management environ ...)
TODO: check
CVE-2026-104047 (A flaw was found in SSSD. When configured to use Microsoft
Entra ID, s ...)
@@ -397,113 +397,113 @@ CVE-2026-103869 (A flaw was found in pulp-ansible's
bearer-token refresh for col
CVE-2026-103868 (A flaw was found in pulp-container when it authenticates to
an upstrea ...)
TODO: check
CVE-2026-103681 (The Frontend Dashboard WordPress plugin before 3.0.0 does not
perform ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103670 (When a Gitea Actions run was inserted, older runs in the same
workflow ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-103667 (Gitea's container registry served blob downloads with a
`Content-Type` ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-103504 (Changing an organization team's permission through the API
with only t ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-103378 (The Geliver Ak\u0131ll\u0131 Kargo Pazaryeri WordPress plugin
before 3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103360 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-103323 (The Integration for Epos Now and WooCommerce WordPress plugin
before 4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103059 (When Gitea's built-in SSH server is enabled
(`START_SSH_SERVER = true` ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-103009 (Authorization Bypass Through User-Controlled Key (CWE-639) in
Elastics ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-103008 (Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to
Denial o ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-103007 (Incorrect Authorization (CWE-863) in Elasticsearch can lead
to Privile ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-103006 (Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to
Denial o ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-103005 (Memory Allocation with Excessive Size Value (CWE-789) in
Elasticsearch ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102478 (In affected versions of Octopus Server, an authenticated user
with per ...)
- TODO: check
+ NOT-FOR-US: Octopus Deploy
CVE-2026-102413 (Uncaught Exception (CWE-248) in Elastic Endpoint can lead to
denial of ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102412 (Incorrect Authorization (CWE-863) in Kibana can lead to
sensitive info ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102411 (Allocation of Resources Without Limits or Throttling
(CWE-770) in Elas ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102410 (Missing Authorization (CWE-862) in Kibana can lead to
information disc ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102409 (Uncontrolled Recursion (CWE-674) in Elasticsearch can allow
an authent ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102408 (Inefficient Regular Expression Complexity (CWE-1333) in
Elasticsearch ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102407 (Incorrect Authorization (CWE-863) in Elasticsearch can lead
to unautho ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102406 (Authorization Bypass Through User-Controlled Key (CWE-639) in
Kibana c ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102404 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch
can lead ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102173 (The Kirki \u2013 Freeform Page Builder, Website Builder &
Customizer p ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102169 (On affected Arista Wi-Fi access points with Captive Portal
enabled, an ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102168 (On affected Arista Wi-Fi access points with Captive Portal
enabled, an ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102167 (On affected Arista Wi-Fi access points, a memory corruption
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102165 (On affected Arista Wi-Fi access points, an unauthenticated
attacker wi ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102164 (On affected Arista access points configured with VXLAN
tunnelling and ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102163 (On affected Arista access points with Wireless Intrusion
Prevention Sy ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102162 (On affected Arista Wi-Fi access points with captive portal,
or applica ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102161 (An unauthenticated attacker located on an adjacent private
network (or ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102160 (An operating system (OS) command injection vulnerability in
CloudVisio ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102159 (An access-control flaw in the CV-CUE backend may allow an
unauthentica ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102158 (Improper validation of selected CloudVision CUE application
programmin ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102157 (An insecure direct object reference (IDOR) vulnerability in a
CloudVis ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102156 (Improper neutralization of Lightweight Directory Access
Protocol (LDAP ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102155 (An XML External Entity (XXE) injection vulnerability in the
WiFi-serve ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101331 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-101329 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-101258 (A flaw was found in Ghostscript. When Ghostscript renders a
crafted Po ...)
TODO: check
CVE-2026-101158 (A missing input validation vulnerability in the Fileserver
upload API ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101157 (A stored cross-site scripting (XSS) vulnerability may allow
an unauthe ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101156 (A stored cross-site scripting (XSS) vulnerability may allow
an authent ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101155 (An authenticated remote attacker with specific permissions
can read or ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101154 (An authenticated remote attacker with specific permissions
can read or ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101153 (On affected versions of CloudVision Portal (on-premises) or
CloudVisio ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101152 (Insufficient validation in the Single Sign-On (SSO) login
flow could a ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101151 (Insufficient validation of request in login flow could allow
a remote, ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101150 (Insufficient validation of OIDC bearer token configuration
could allow ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101149 (Insufficient validation of OIDC SSO provider configuration
could allow ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101029 (Gitea's repository migration and pull mirror egress checks
could be by ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-101027 (When `[migrations] ALLOWED_DOMAINS` was configured, a
hostname matchin ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-101023 (Gitea's OAuth2 token endpoint verified the signature and
grant of a to ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-88812 [XKB SetGeometry TextDoodad Double Free]
- xorg-server <unfixed>
- xwayland <unfixed>
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b5a28a29a87fd453f6625bd208068d9b64c4229c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b5a28a29a87fd453f6625bd208068d9b64c4229c
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
