Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
3080defe by security tracker role at 2026-10-09T07:14:46+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,9 +1,9 @@
CVE-2026-9209 (mJobTime through build 15.7.3.32 contains an unauthenticated
SQL execu ...)
TODO: check
CVE-2026-97076 (Executable Regular Expression Error vulnerability in WP Media
WP Rocke ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96207 (Improper certificate validation in Microsoft Partner Center
allows an ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-95210 (Improper certificate validation in gnutls v3.8.13 causes the
applicati ...)
TODO: check
CVE-2026-95209 (An issue in gnutls v3.8.13 causes legitimate CA certificates
to be rej ...)
@@ -17,21 +17,21 @@ CVE-2026-95125 (libming through 0.4.8 contains a heap
buffer overflow in r_readc
CVE-2026-95116 (An issue in libming through 0.4.8 allows a remote attacker to
cause a ...)
TODO: check
CVE-2026-94510 (Authorization bypass through user-controlled key in Microsoft
Bookings ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-93699 (Argument injection in WP Toolkit for cPanel allows local users
to exec ...)
TODO: check
CVE-2026-93548 (The FooSales WordPress plugin before 1.43.3 does not verify
that an a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93509 (The Wallet System for WooCommerce WordPress plugin before
2.8.0 does n ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93034 (SGLang contains an arbitrary code execution vulnerability
caused by th ...)
TODO: check
CVE-2026-93017 (The `insights-operator-gather` ClusterRole grants the
operator's servi ...)
TODO: check
CVE-2026-92990 (The SendPress Newsletters WordPress plugin through 1.26.1.20
protects ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92989 (The SendPress Newsletters WordPress plugin through 1.26.1.20
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92555 (Insertion of sensitive information into sent data
vulnerability in AKI ...)
TODO: check
CVE-2026-91844 (Unrestricted upload of file with dangerous type vulnerability
in \u013 ...)
@@ -43,7 +43,7 @@ CVE-2026-89191 (Unsanitised input in the "template name"
field of SQLView KRIS's
CVE-2026-89091 (A flaw was found in ansible-core. When installing a collection
with `a ...)
TODO: check
CVE-2026-88931 (The Social Web Suite WordPress plugin through 4.1.12 does not
restric ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88648 (Incomplete X.509 implementation in GnuTLS v3.8.13 allows
attackers con ...)
TODO: check
CVE-2026-88647 (A hostname verification bypass in GnuTLS v3.8.13 allows
attackers to c ...)
@@ -51,11 +51,11 @@ CVE-2026-88647 (A hostname verification bypass in GnuTLS
v3.8.13 allows attacker
CVE-2026-88257 (Improper Input Validation vulnerability in BeamMCP.Schema in
ScriptKit ...)
TODO: check
CVE-2026-88131 (Deserialization of untrusted data in Microsoft Dataverse
allows an una ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-87980 (IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow
a local ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-87841 (The UnitechPay WordPress plugin through 1.0.6.3 does not
verify the a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87110 (An unauthenticated user with network access to the Ops Manager
web por ...)
TODO: check
CVE-2026-87109 (An authenticated Ops Manager organization member can retrieve
another ...)
@@ -63,109 +63,109 @@ CVE-2026-87109 (An authenticated Ops Manager organization
member can retrieve an
CVE-2026-87108 (An authenticated Ops Manager user with a read-only project
role can re ...)
TODO: check
CVE-2026-86850 (The SKU Error Fixer for WooCommerce WordPress plugin through
1.0 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84891 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84875 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84290 (IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by
an improp ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84278 (IBM Guardium Data Protection 12.2 is affected by a command
injection v ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84276 (IBM Guardium Data Protection 12.2.2 is affected by a
denial-of-service ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84275 (IBM Guardium Data Protection 12.2 is vulnerable to path
traversal in t ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84274 (IBM Guardium Data Protection 12.2.2 is affected by a sensitive
informa ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84272 (IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to
missing ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84271 (IBM Guardium Data Protection 12.2 is vulnerable to a signature
verific ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84250 (IBM Guardium Data Protection 12.2 is vulnerable due to weak
cryptograp ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84249 (IBM Guardium Data Protection 12.2, and 12.2.2 could allow a
remote att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84247 (IBM Guardium Data Protection 12.2 could allow a remote
authenticated a ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84246 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84245 (IBM Guardium Data Protection 12.2 is vulnerable to a local
privilege e ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84244 (IBM Guardium Data Protection 12.2 IBM Security Guardium Data
Protectio ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84230 (IBM Guardium Data Protection 12.2.2 could allow a remote
attacker to c ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84209 (IBM Guardium Data Protection 12.2.2, and 12.1 could allow a
remote att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84198 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84058 (IBM Guardium Data Protection 12.0, 12.1, and 12.2is vulnerable
to a bu ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84057 (IBM Guardium Data Protection 12.2.2, and 12.1 could allow a
remote att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84035 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84032 (IBM Guardium Data Protection 12.2.2 could allow a remote
attacker to c ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-83947 (Missing authorization in Azure Event Grid allows an authorized
attacke ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-83943 (Exposure of sensitive information to an unauthorized actor in
Azure AP ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-82900 (IBM Guardium Data Protection 12.2.2, and 12.1 could allow a
remote att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-82895 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-82344 (IBM Guardium Data Protection 12.0, 12.1is vulnerable to a
heap-based b ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-82335 (IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to
a heap- ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-82334 (IBM Guardium Data Protection 12.0, 12.1, 12.2is vulnerable to
a heap-b ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-81932 (IBM Guardium Data Protection 12.0, 12.1, and 12.2is vulnerable
to SQL ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-81929 (The Ocean Pro Demos and Ocean eComm Treasure Box plugins for
WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-80381 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-7827 (A stack-based buffer overflow in the _RdbLoadEntity function of
the RD ...)
TODO: check
CVE-2026-7826 (A heap-based out-of-bounds read in the
BufferSerializerIOv2_ReadBuffer ...)
TODO: check
CVE-2026-79842 (An authentication bypass vulnerability exists in HPE
Intelligent Manag ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-78407 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-78406 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-78401 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-78399 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-78388 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-77900 (Missing authentication for critical function in Azure App
Service allo ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-75875 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a
remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-71896 (An authorization vulnerability in Apache DolphinScheduler
allows authe ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71895 (An authorization vulnerability in Apache DolphinScheduler
allows authe ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71183 (An authorization vulnerability in Apache DolphinScheduler
allows authe ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-69435 (Missing authorization in Azure SRE Agent allows an authorized
attacker ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-67693 (An issue in gnutls v.3.8.13 allows an attacker to obtain
sensitive inf ...)
TODO: check
CVE-2026-66479 (Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web
/ Stella ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66087 (An authorization bypass vulnerability in Apache
DolphinScheduler allow ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-66084 (An authorization bypass vulnerability in Apache
DolphinScheduler allow ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-66082 (An authorization bypass vulnerability in Apache
DolphinScheduler allow ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-62181
REJECTED
CVE-2026-62171
@@ -179,19 +179,19 @@ CVE-2026-62166
CVE-2026-62163
REJECTED
CVE-2026-62142 (Cross-Site Request Forgery (CSRF) vulnerability in Melapress
WP 2FA wp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62128 (Missing Authorization vulnerability in Creator LMS Creator LMS
creator ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62127 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61801 (The `github.com/moby/sys/user` package provides Go utilities
for parsi ...)
TODO: check
CVE-2026-5759 (A double free and use-after-free vulnerability in the
RdbLoadDeletedNo ...)
TODO: check
CVE-2026-50055 (A policy-enforcement flaw in Zimbra Collaboration Suite allows
an auth ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-50054 (An authorization flaw in Zimbra Collaboration Suite\u2019s
GrantRights ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-4894 (A vulnerability has been identified regarding insufficient
validation ...)
TODO: check
CVE-2026-44038 (A global out-of-bounds read in the Huffman decoder of the
bundled IJG ...)
@@ -209,139 +209,139 @@ CVE-2026-44033 (Uncontrolled recursion in
XMLNode::ParseXMLElement() and XMLNode
CVE-2026-44031 (Uncontrolled recursion in DcmSequenceOfItems::read() and
DcmItem::read ...)
TODO: check
CVE-2026-42698 (Concurrent Execution using Shared Resource with Improper
Synchronizati ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40804 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27420 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-19878 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19585 (HashiCorp go-getter versions before 1.8.10 and go-getter/v2
versions b ...)
TODO: check
CVE-2026-19498 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19494 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19493 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19491 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19482 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19218 (Weak Password Recovery Mechanism for Forgotten Password
vulnerability ...)
TODO: check
CVE-2026-19083 (Authorization bypass through User-Controlled key vulnerability
in AKIN ...)
TODO: check
CVE-2026-18740 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17189 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16916 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16830 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16823 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16340 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16182 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through
10.5.0.22, 10. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16181 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16179 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16178 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16177 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16176 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16170 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16169 (IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a
remote a ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16167 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16165 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16164 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16163 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16161 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16159 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16111 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15824 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15822 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15819 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15784 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15781 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15762 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14999 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14992 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14991 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14990 (IBM DataPower Gateway 10.6.0.0 through 10.6.0.10is vulnerable
to cross ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14988 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14905 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14888 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14521 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14509 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14508 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14507 (IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a
remote a ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14502 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14497 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14496 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14273 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14269 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-13258 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-13257 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1
through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12859 (Missing Authorization vulnerability in Caz Informatics
Services Trade ...)
TODO: check
CVE-2026-12260 (SQL injection in the NetBoard CRM demo platform; specifically,
the vul ...)
TODO: check
CVE-2026-12109 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12091 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11939 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11936 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11930 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11888 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM
Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11318 (Deskin through 3.3.4.3 contains a privilege escalation
vulnerability i ...)
TODO: check
CVE-2026-10631 (An authorization bypass in the EWS FindItem handler of Zimbra
Collabor ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-107914 (Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1
doesn't suffici ...)
TODO: check
CVE-2026-107911 (A type confusion vulnerability in the _read_flags function
(src/comman ...)
@@ -455,7 +455,7 @@ CVE-2026-107708 (MIT krb5 through 1.22.2 contains a NULL
pointer dereference vul
CVE-2026-107707 (Intego Antivirus for Windows through 3.0.0.1 contains a link
following ...)
TODO: check
CVE-2026-107706 (Dolibarr ERP CRM before 24.0.2 contains an incorrect
authorization vul ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-107705 (Poppler 0.42.0 through 26.10.0 contains a stack-based buffer
overflow ...)
TODO: check
CVE-2026-107704 (The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an
OS comman ...)
@@ -517,7 +517,7 @@ CVE-2026-107612 (Incorrect permission assignment in
GlavSoft TightVNC Server for
CVE-2026-107611 (An out-of-bounds read vulnerability in the ZRLE decoder of
GlavSoft Ti ...)
TODO: check
CVE-2026-107608 (Improper link resolution before file access in the asset
bundling outp ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-107604 (A flaw was found in the installation provider and client
registration ...)
TODO: check
CVE-2026-107589 (Insufficient job validation for service accounts in Jacamar
CI prior t ...)
@@ -565,7 +565,7 @@ CVE-2026-107503 (Unvalidated environments URL allows OAuth
authorization code +
CVE-2026-107466 (A flaw was found in flatpak-builder. This vulnerability
allows an atta ...)
TODO: check
CVE-2026-107406 (Memory overflow vulnerability leading to Remote Code
Execution or Deni ...)
- TODO: check
+ NOT-FOR-US: NetScaler
CVE-2026-107399 (The Mechanize library is used for automating interaction with
websites ...)
TODO: check
CVE-2026-107397 (Indico is an event management system that uses
Flask-Multipass, a mult ...)
@@ -627,13 +627,13 @@ CVE-2026-107334 (Malcolm's nginx Lua role-based access
control (RBAC) layer deci
CVE-2026-107333 (Malcolm's nginx based reverse proxy contains a URL path
normalization ...)
TODO: check
CVE-2026-107332 (Insecure file permissions in the CodeCatalyst connection
handler in AW ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-107325 (Improper validation of a BSON array length in the MongoDB Go
Driver ca ...)
TODO: check
CVE-2026-107324 (An integer overflow in BSON value-length handling in the
MongoDB Go Dr ...)
TODO: check
CVE-2026-107322 (An incomplete list of disallowed inputs in Amazon Agent
Plugins for AW ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-107318 (@fastify/reply-from is a Fastify plugin that forwards
requests to an u ...)
TODO: check
CVE-2026-107303 (JHipster is a development platform to quickly generate,
develop, and d ...)
@@ -675,13 +675,13 @@ CVE-2026-107286 (Pydantic AI is a Python agent framework
for building applicatio
CVE-2026-107275 (@fastify/jwt is a JSON Web Token plugin for the Fastify web
framework. ...)
TODO: check
CVE-2026-106611 (Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV
Forminator ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106603 (Authorization Bypass Through User-Controlled Key
vulnerability in Grou ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106600 (Missing Authorization vulnerability in Liquid Web / StellarWP
GiveWP g ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106596 (Missing Authorization vulnerability in Visual Composer Visual
Composer ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106438 (An incorrect calculation in Decimal128 string parsing in the
MongoDB C ...)
TODO: check
CVE-2026-106437 (The BSON buffer-reservation API in the MongoDB C Driver can
record a l ...)
@@ -709,23 +709,23 @@ CVE-2026-106177 (A kernel buffer overflow vulnerability
in HP Sure Click version
CVE-2026-106126 (A command injection vulnerability in the Active Directory
Events Liste ...)
TODO: check
CVE-2026-106097 (The Code Snippets WordPress plugin before 3.10.0 does not
sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-106095 (The Code Snippets WordPress plugin before 3.10.0 does not
perform a ca ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105893 (Authorization Bypass Through User-Controlled Key
vulnerability in Liqu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105891 (Missing Authorization vulnerability in Liquid Web / StellarWP
Event Ti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105890 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105888 (Missing Authorization vulnerability in Liquid Web / StellarWP
Event Ti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105887 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105886 (Missing Authorization vulnerability in BdThemes Ultimate Post
Kit ulti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105878 (Missing Authorization vulnerability in YITH YITH WooCommerce
Product B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105833 (EspoCRM before 10.0.5 contains an insecure direct object
reference vul ...)
TODO: check
CVE-2026-105832 (EspoCRM before 10.0.6 contains an authentication bypass
vulnerability ...)
@@ -737,7 +737,7 @@ CVE-2026-105830 (league/commonmark from 2.0.0 before 2.10.2
contains a quadratic
CVE-2026-105829 (League CommonMark from 1.3.0 before 2.10.2 contains a
cross-site scrip ...)
TODO: check
CVE-2026-105828 (Parse Server 8.2.2 before 8.6.92 and 9.0.0 before
9.10.1-alpha.12 cont ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-105827 (ImageMagick before 7.1.2-30 and 6.9.13-55 contains an
uncontrolled rec ...)
TODO: check
CVE-2026-105826 (ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains
a securi ...)
@@ -749,17 +749,17 @@ CVE-2026-105824 (ImageMagick before 6.9.13-55 and 7.x
before 7.1.2-30 contains a
CVE-2026-105823 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a
security ...)
TODO: check
CVE-2026-105674 (TP-Link Tapo C325WB V2 generates the pre-shared key used by
its local ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-105673 (An unauthenticated denial-of-service vulnerability exists in
Tapo C325 ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-105672 (TP-Link Tapo C325WB V2 contains an unauthenticated
authorization bypas ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-105570 (Docker Sandboxes compared OAuth token-endpoint hostnames
case-sensitiv ...)
TODO: check
CVE-2026-105452 (Docker Sandboxes could forward a client-supplied credential
alongside ...)
TODO: check
CVE-2026-105436 (Deserialization of Untrusted Data vulnerability in MainWP
MainWP Child ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105405 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains
an inval ...)
TODO: check
CVE-2026-105404 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains
a code i ...)
@@ -777,25 +777,25 @@ CVE-2026-105399 (ImageMagick before 6.9.13-56 and 7.x
before 7.1.2-31 contains a
CVE-2026-105398 (ImageMagick before 7.1.2-31 contains a heap buffer overflow
vulnerabil ...)
TODO: check
CVE-2026-105331 (Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10
allows a u ...)
- TODO: check
+ NOT-FOR-US: Checkmk
CVE-2026-105275 (Satel Netco Design versions prior to v2.1.7 contains a
relative path t ...)
TODO: check
CVE-2026-105269 (Satel Netco Design versions prior to v2.1.7 contains a stored
cross si ...)
TODO: check
CVE-2026-105190 (The Easy Digital Downloads WordPress plugin before 3.7.1 does
not cons ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105110 (OS Command Injection in the login.xgi CGI endpoint in
Iskratel Innbox ...)
TODO: check
CVE-2026-105079 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105078 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105076 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104704 (Progressive Robot hMailServer 6.0.0 through 6.3.5 does not
enforce TLS ...)
TODO: check
CVE-2026-104671 (The TutorStarter WordPress theme before 4.0.4 does not
respect the sit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104660 (Missing authorization on COM objects in Progressive Robot
hMailServer ...)
TODO: check
CVE-2026-104659 (Missing Host header validation and missing throttling of
failed admini ...)
@@ -821,21 +821,21 @@ CVE-2026-103649 (Missing network timeouts in the Linux
builds of Progressive Rob
CVE-2026-103647 (Cross-site scripting in the webmail of Progressive Robot
hMailServer 6 ...)
TODO: check
CVE-2026-103517 (The Airwallex Online Payments Gateway WordPress plugin before
1.36.0 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103072 (Missing Authorization vulnerability in VillaTheme VillaTheme
Core vill ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103070 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103011 (Heap-based buffer overflow in the legacy Blowfish encryption
routine ( ...)
TODO: check
CVE-2026-103010 (Heap-based buffer overflow in the legacy Blowfish decryption
routine ( ...)
TODO: check
CVE-2026-102784 (Joomla Extension - balbooa.com - CSRF in language
installation feature ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-102783 (Joomla Extension - balbooa.com - Path Traversal in image
preview Gridb ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-102368 (Affected Tapo device firmware stores device-specific
cryptographic mat ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-101998 (Docker Sandboxes could fail open while masking credentials in
protecte ...)
TODO: check
CVE-2026-101028 (Incorrect Authorization vulnerability in ash-project ash
allows an act ...)
@@ -847,7 +847,7 @@ CVE-2026-100197
CVE-2025-71428 (Jivejdon through 5.0 contains a sql injection vulnerability in
Account ...)
TODO: check
CVE-2025-15700 (The AWP Classifieds WordPress plugin before 4.4.9 does not
validate th ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97147 (In OpenStack Mistral through 23.0.0, several of the v2 API
write paths ...)
- mistral <unfixed> (bug #1150346)
NOTE: https://launchpad.net/bugs/2160267
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3080defe80cbb45cc5b5d763dbe78055bff50dc7
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3080defe80cbb45cc5b5d763dbe78055bff50dc7
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
