Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
0220e831 by Salvatore Bonaccorso at 2026-10-08T07:30:46+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -266,7 +266,7 @@ CVE-2026-107177 (Express Gateway through 1.16.11 contains a
hardcoded cryptograp
CVE-2026-107175 (MISP contains a defect in its event save workflow that
prevents the co ...)
- misp <itp> (bug #1144317)
CVE-2026-107174 (A flaw was found in source-to-image. When unpacking archive
files, the ...)
- TODO: check
+ NOT-FOR-US: source-to-image in OpenShift
CVE-2026-107170 (A flaw was found in m17n-lib. A partial failure during
library initial ...)
- m17n-lib <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547411
@@ -287,17 +287,17 @@ CVE-2026-107159 (MiniUPnPd through 2.3.11 built with
--strict contains a divide-
- miniupnpd <unfixed>
NOTE: Fixed by:
https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a
CVE-2026-107151 (Missing authentication has been found in remote-execution
task updates ...)
- TODO: check
+ NOT-FOR-US: rubygem-smart_proxy_dynflow
CVE-2026-107125 (A flaw has been found in XnView Classic 2.52.5. Impacted is
an unknown ...)
- TODO: check
+ NOT-FOR-US: XnView
CVE-2026-107121 (A flaw was found in the SMTP email configuration handling of
the keycl ...)
TODO: check
CVE-2026-107104 (This vulnerability exists in the ERP system due to unsafe
deserializat ...)
- TODO: check
+ NOT-FOR-US: Manacle Technologies Multi-tenant ERP System
CVE-2026-107103 (This vulnerability exists in the ERP system due to
insufficient valida ...)
- TODO: check
+ NOT-FOR-US: Manacle Technologies Multi-tenant ERP System
CVE-2026-107102 (This vulnerability exists in the ERP system due to improper
validation ...)
- TODO: check
+ NOT-FOR-US: Manacle Technologies Multi-tenant ERP System
CVE-2026-106580 (ImageMagick is free and open-source software used for editing
and mani ...)
- imagemagick 8:7.1.2.31+dfsg1-1
NOTE:
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r868-pmwh-fv2c
@@ -419,13 +419,13 @@ CVE-2026-106064 (A heap-based buffer overflow was found
in GIMP\u2019s GIF expor
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547446
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
CVE-2026-106059 (GitAhead through 2.7.1 on macOS contains a command injection
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: GitAhead
CVE-2026-106058 (GitAhead through 2.7.1 contains an OS command injection
vulnerability ...)
- TODO: check
+ NOT-FOR-US: GitAhead
CVE-2026-106057 (patool before 4.0.6 contains an OS command injection
vulnerability on ...)
- TODO: check
+ NOT-FOR-US: wummel/patool
CVE-2026-106056 (Rundeck before 6.2.0 contains an OS command injection
vulnerability th ...)
- TODO: check
+ NOT-FOR-US: Rundeck
CVE-2026-105884 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-105876 (Missing Authorization vulnerability in WP Chill Modula Image
Gallery m ...)
@@ -437,13 +437,13 @@ CVE-2026-105873 (Improper Neutralization of Input During
Web Page Generation ('C
CVE-2026-105871 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-105192 (LMCache multiprocess mode, also called distributed mode,
opens an unau ...)
- TODO: check
+ NOT-FOR-US: LMCache
CVE-2026-105140 (Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a
race con ...)
- TODO: check
+ NOT-FOR-US: Obot
CVE-2026-105139 (Obot 0.26.0 before 0.26.2 contains an authorization bypass
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Obot
CVE-2026-105138 (Obot 0.12.0 before 0.26.2 contains an insufficiently
protected credent ...)
- TODO: check
+ NOT-FOR-US: Obot
CVE-2026-104393 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-104391 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -455,7 +455,7 @@ CVE-2026-104074 (Coturn 4.10.0 contains an uninitialized
memory disclosure vulne
CVE-2026-103668 (An SQL Injection vulnerability exists in the Site Search
function of M ...)
TODO: check
CVE-2026-103435 (Claude Code validated that a target file path resided within
the proje ...)
- TODO: check
+ NOT-FOR-US: Claude Code
CVE-2026-103416 (Out-of-bounds write via the TLS 1.3 handshake message cache
in NetX Du ...)
NOT-FOR-US: Eclipse
CVE-2026-103371 (Insertion of Sensitive Information into Log File in Apache
Geode Web M ...)
@@ -475,29 +475,29 @@ CVE-2026-102256 (Post-authentication Improper
Neutralization of Special Elements
CVE-2026-102255 (A Pre-authentication SSRF vulnerability exists in the SMA1000
Applianc ...)
NOT-FOR-US: SonicWall
CVE-2026-101886 (Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364
contains ...)
- TODO: check
+ NOT-FOR-US: Cisco Jabber for Android (com.cisco.im)
CVE-2025-70522 (The request handler of Fanvil x7a firmware version 2.6.0.1182
does not ...)
- TODO: check
+ NOT-FOR-US: Fanvil
CVE-2025-70521 (The management portal's diagnostic ping tool of Fanvil x7a
firmware ve ...)
- TODO: check
+ NOT-FOR-US: Fanvil
CVE-2025-70520 (The websocket handler of Fanvil x7a firmware version
2.6.0.1182 does n ...)
- TODO: check
+ NOT-FOR-US: Fanvil
CVE-2025-70519 (The device log component of Fanvil x7a firmware version
2.6.0.1182 doe ...)
- TODO: check
+ NOT-FOR-US: Fanvil
CVE-2025-70518 (The management portal's diagnostic ping tool of Fanvil x7a
firmware ve ...)
- TODO: check
+ NOT-FOR-US: Fanvil
CVE-2025-70517 (The request handler of Fanvil x7a firmware version 2.6.0.1182
does not ...)
- TODO: check
+ NOT-FOR-US: Fanvil
CVE-2025-70516 (The websocket handler of Fanvil x7a firmware version
2.6.0.1182 does n ...)
- TODO: check
+ NOT-FOR-US: Fanvil
CVE-2025-70515 (The device log component of Fanvil x7a firmware version
2.6.0.1182 doe ...)
- TODO: check
+ NOT-FOR-US: Fanvil
CVE-2025-64393 (This vulnerability in Veeam Backup & Replication allows a
Backup Viewe ...)
- TODO: check
+ NOT-FOR-US: Veeam
CVE-2025-64392 (This vulnerability in Veeam Backup Enterprise Manager allows
an attack ...)
- TODO: check
+ NOT-FOR-US: Veeam
CVE-2025-64391 (This vulnerability in Veeam Agent for Microsoft Windows allows
a low-p ...)
- TODO: check
+ NOT-FOR-US: Veeam
CVE-2026-92415 (\u2014 Use of Externally-Controlled Input to Select Classes or
Code vu ...)
- jackrabbit <unfixed>
NOTE: https://www.openwall.com/lists/oss-security/2026/10/07/28
@@ -696,7 +696,7 @@ CVE-2026-73278 (Gitea's OAuth2 and OpenID Connect sign-in
paths do not require a
CVE-2026-70357 (Gitea validates a repository migration hostname against its
network al ...)
NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-65142 (NVIDIA Model-Optimizer contains a vulnerability where an
attacker may ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65122 (NVIDIA TensorRT contains a vulnerability where an attacker can
cause a ...)
NOT-FOR-US: NVIDIA
CVE-2026-59347 (VMware Workstation and Fusion contain a stack-based
buffer-overflow vu ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0220e831b5bfb19b43e401d94deedb5e12f310f5
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0220e831b5bfb19b43e401d94deedb5e12f310f5
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
