Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
e0be3f7b by Salvatore Bonaccorso at 2026-10-09T22:21:58+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -210,23 +210,23 @@ CVE-2026-76769 (Dell Secure Connect Gateway (SCG) Policy
Manager, versions prior
CVE-2026-75597 (pyLoad is a free and open-source download manager written in
Python. P ...)
- pyload <itp> (bug #1001980)
CVE-2026-75353 (OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in
the ser ...)
- TODO: check
+ NOT-FOR-US: OpENer
CVE-2026-75352 (OpENer v2.3/commit 76b95cf, contains an integer underflow in
the serve ...)
- TODO: check
+ NOT-FOR-US: OpENer
CVE-2026-75351 (OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in
the serv ...)
- TODO: check
+ NOT-FOR-US: OpENer
CVE-2026-75350 (EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a
buffer ov ...)
- TODO: check
+ NOT-FOR-US: OpENer
CVE-2026-75349 (EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf
contains an ou ...)
- TODO: check
+ NOT-FOR-US: OpENer
CVE-2026-75348 (An out-of-bounds read vulnerability exists in EIPStackGroup
OpENer v2. ...)
- TODO: check
+ NOT-FOR-US: OpENer
CVE-2026-75347 (EIPStackGroup OpENer v2.3 and master up to commit 76b95cf
contain an e ...)
- TODO: check
+ NOT-FOR-US: OpENer
CVE-2026-75346 (An out-of-bounds read vulnerability exists in EIPStackGroup
OpENer v2. ...)
- TODO: check
+ NOT-FOR-US: OpENer
CVE-2026-75345 (OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read
in the u ...)
- TODO: check
+ NOT-FOR-US: OpENer
CVE-2026-73179 (Improper enforcement of single-use authorization code
semantics in the ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71884 (In Bouncy Castle for Java LTS before 2.73.13, the native
one-shot CTR ...)
@@ -254,7 +254,7 @@ CVE-2026-62026 (Cross-Site Request Forgery (CSRF)
vulnerability in MIGHTYminnow
CVE-2026-55797 (Argo CD is a declarative, GitOps continuous delivery tool for
Kubernet ...)
NOT-FOR-US: Argo CD
CVE-2026-4264 (Reflected Cross-Site Scripting (XSS) on the BeeTienda
e-commerce platf ...)
- TODO: check
+ NOT-FOR-US: BeeTienda e-commerce platform
CVE-2026-48484 (pyLoad is a free and open-source download manager written in
Python. P ...)
- pyload <itp> (bug #1001980)
CVE-2026-42695 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -262,19 +262,19 @@ CVE-2026-42695 (Improper Neutralization of Input During
Web Page Generation ('Cr
CVE-2026-39779 (Missing Authorization vulnerability in Asgaros Asgaros Forum
asgaros-f ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39460 (Usernames and passwords, including the default factory
credentials, ar ...)
- TODO: check
+ NOT-FOR-US: Red Lion Controls
CVE-2026-39453 (Navigating to a certain URL on the switch\u2019s web server
causes the ...)
- TODO: check
+ NOT-FOR-US: Red Lion Controls
CVE-2026-33367 (SNMP can be used to perform administrative actions such as
retrieving ...)
- TODO: check
+ NOT-FOR-US: Red Lion Controls
CVE-2026-33272 (A malicious user with physical access to the device can boot
the switc ...)
- TODO: check
+ NOT-FOR-US: Red Lion Controls
CVE-2026-32645 (Default factory credentials with administrative access are
enabled and ...)
- TODO: check
+ NOT-FOR-US: Red Lion Controls
CVE-2026-29797 (No authentication is required when updating firmware or
bootloader, ma ...)
- TODO: check
+ NOT-FOR-US: Red Lion Controls
CVE-2026-28745 (Usernames and passwords, including the default credentials,
are stored ...)
- TODO: check
+ NOT-FOR-US: Red Lion Controls
CVE-2026-19575 (The user-mode verification handler for the device_deinit()
system call ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-19574 (The ARM64 MMU back-end allocated address space identifiers
(ASIDs) for ...)
@@ -288,35 +288,35 @@ CVE-2026-19569 (dynamic_object_create() in
kernel/userspace/userspace.c computed
CVE-2026-15340 (lwIP SMTP client does not check the size of inputs,
potentially allowi ...)
TODO: check
CVE-2026-108160 (AstronRPA through 1.1.6 contains a download of code without
integrity ...)
- TODO: check
+ NOT-FOR-US: AstronRPA
CVE-2026-108159 (AstronRPA through 1.1.6 contains a cross-site scripting
vulnerability ...)
- TODO: check
+ NOT-FOR-US: AstronRPA
CVE-2026-108158 (plugNmeet Server through 2.5.2 contains a path traversal
vulnerability ...)
- TODO: check
+ NOT-FOR-US: plugNmeet Server
CVE-2026-108157 (Pingvin Share X from 0.19.0 before 1.22.0 contains an
improper authent ...)
- TODO: check
+ NOT-FOR-US: Pingvin Share X
CVE-2026-108156 (LobsterAI 2026.5.27 through 2026.9.23 contains an external
control of ...)
- TODO: check
+ NOT-FOR-US: LobsterAI
CVE-2026-108125 (Improper neutralization of special elements used in an SQL
command ('S ...)
- TODO: check
+ NOT-FOR-US: wp-post-author
CVE-2026-108124 (Improper neutralization of special elements used in an SQL
command ('S ...)
- TODO: check
+ NOT-FOR-US: wp-post-author
CVE-2026-108119 (A flaw was found in busybox. The tar applet's deferred
link-creation h ...)
TODO: check
CVE-2026-108113 (ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted
file uploa ...)
- TODO: check
+ NOT-FOR-US: ILIAS
CVE-2026-108112 (ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization
vulnerab ...)
- TODO: check
+ NOT-FOR-US: ruoyi-ai
CVE-2026-108111 (ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization
vulnerab ...)
- TODO: check
+ NOT-FOR-US: ruoyi-ai
CVE-2026-108110 (MOVO through 0.2.3 contains an authorization bypass
vulnerability in t ...)
- TODO: check
+ NOT-FOR-US: MOVO
CVE-2026-108109 (PHPNuxBill through 2025.3.20 contains an account takeover
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: PHPNuxBill
CVE-2026-108108 (PHPNuxBill through 2025.3.20 contains an authentication
bypass vulnera ...)
NOT-FOR-US: MikroTik
CVE-2026-108107 (PHPNuxBill through 2025.3.20 contains an unauthenticated SQL
injection ...)
- TODO: check
+ NOT-FOR-US: PHPNuxBill
CVE-2026-108106 (Xerial snappy-java before 1.1.10.9 contains an unbounded
memory alloca ...)
TODO: check
CVE-2026-108105 (Open5GS through 2.8.0 contains a reachable assertion
vulnerability in ...)
@@ -328,9 +328,9 @@ CVE-2026-108103 (Open5GS through 2.8.0 contains a heap
out-of-bounds read vulner
CVE-2026-108102 (Open5GS through 2.8.0 contains a heap out-of-bounds read
vulnerability ...)
TODO: check
CVE-2026-108101 (HortusFox (hortusfox-web) through 6.3 contains an
unrestricted file up ...)
- TODO: check
+ NOT-FOR-US: HortusFox (hortusfox-web)
CVE-2026-108100 (HortusFox (hortusfox-web) before 6.2 contains an SQL
injection vulnera ...)
- TODO: check
+ NOT-FOR-US: HortusFox (hortusfox-web)
CVE-2026-108096 (Improper authorization in the query resolvers generated by
@aws-amplif ...)
NOT-FOR-US: Amazon
CVE-2026-108093 (A flaw was found in GIMP. The XCF loader processes
image-simulation-in ...)
@@ -346,29 +346,29 @@ CVE-2026-107937 (In Apache CXF, the parser for
multipart/MTOM attachment part he
CVE-2026-107935 (A path traversal vulnerability was found in gvproxy, the
network forwa ...)
TODO: check
CVE-2026-107841 (pacioli provides least-privilege governance and a governed
agent broke ...)
- TODO: check
+ NOT-FOR-US: pacioli for ERPNext
CVE-2026-107840 (yopass is a service for securely sharing secrets, passwords,
and files ...)
- TODO: check
+ NOT-FOR-US: yopass
CVE-2026-107839 (ageLANServer provides a cross-platform web server and
launcher for off ...)
- TODO: check
+ NOT-FOR-US: ageLANServer
CVE-2026-107838 (RIOT is an open-source microcontroller operating system
designed for I ...)
- TODO: check
+ NOT-FOR-US: RIOT-OS
CVE-2026-107837 (RIOT is an open-source microcontroller operating system
designed for I ...)
- TODO: check
+ NOT-FOR-US: RIOT-OS
CVE-2026-107836 (RIOT is an open-source microcontroller operating system
designed for I ...)
- TODO: check
+ NOT-FOR-US: RIOT-OS
CVE-2026-107835 (OWASP Coraza WAF is a golang modsecurity compatible web
application fi ...)
- TODO: check
+ NOT-FOR-US: Coraza WAF
CVE-2026-107834 (OWASP Coraza WAF is a golang modsecurity compatible web
application fi ...)
- TODO: check
+ NOT-FOR-US: Coraza WAF
CVE-2026-107833 (OWASP Coraza WAF is a golang modsecurity compatible web
application fi ...)
- TODO: check
+ NOT-FOR-US: Coraza WAF
CVE-2026-107826 (OWASP Coraza WAF is a golang modsecurity compatible web
application fi ...)
- TODO: check
+ NOT-FOR-US: Coraza WAF
CVE-2026-107825 (OWASP Coraza WAF is a golang modsecurity compatible web
application fi ...)
- TODO: check
+ NOT-FOR-US: Coraza WAF
CVE-2026-107824 (x64dbg-MCP Server is a native Model Context Protocol (MCP)
plugin for ...)
- TODO: check
+ NOT-FOR-US: x64dbg-MCP Server
CVE-2026-107823 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
TODO: check
CVE-2026-107822 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
@@ -376,7 +376,7 @@ CVE-2026-107822 (MariaDB server is a community developed
fork of MySQL server. F
CVE-2026-107821 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
TODO: check
CVE-2026-107820 (x64dbg-MCP Server is a native Model Context Protocol (MCP)
plugin for ...)
- TODO: check
+ NOT-FOR-US: x64dbg-MCP Server
CVE-2026-107819 (MariaDB Connector/C is a C and C++ client library for
connecting appli ...)
TODO: check
CVE-2026-107818 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
@@ -390,29 +390,29 @@ CVE-2026-107815 (MariaDB server is a community developed
fork of MySQL server. F
CVE-2026-107814 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
TODO: check
CVE-2026-107813 (Nginx UI is a web user interface for the Nginx web server.
From 2.0.0 ...)
- TODO: check
+ NOT-FOR-US: Nginx UI
CVE-2026-107812 (Nginx UI is a web user interface for the Nginx web server.
From 2.0.0 ...)
- TODO: check
+ NOT-FOR-US: Nginx UI
CVE-2026-107811 (Nginx UI is a web user interface for the Nginx web server.
From 2.0.0 ...)
- TODO: check
+ NOT-FOR-US: Nginx UI
CVE-2026-107810 (Nginx UI is a web user interface for the Nginx web server.
From 2.0.0 ...)
- TODO: check
+ NOT-FOR-US: Nginx UI
CVE-2026-107809 (Nginx UI is a web user interface for the Nginx web server.
From 2.0.0 ...)
- TODO: check
+ NOT-FOR-US: Nginx UI
CVE-2026-107808 (Nginx UI is a web user interface for the Nginx web server.
From 2.0.0 ...)
- TODO: check
+ NOT-FOR-US: Nginx UI
CVE-2026-107807 (Nginx UI is a web user interface for the Nginx web server.
From 2.0.0 ...)
- TODO: check
+ NOT-FOR-US: Nginx UI
CVE-2026-107806 (Nginx UI is a web user interface for the Nginx web server.
From 2.3.8 ...)
- TODO: check
+ NOT-FOR-US: Nginx UI
CVE-2026-107805 (Nginx UI is a web user interface for the Nginx web server.
From 2.5.0 ...)
- TODO: check
+ NOT-FOR-US: Nginx UI
CVE-2026-107804 (Nginx UI is a web user interface for the Nginx web server.
From 2.2.0 ...)
- TODO: check
+ NOT-FOR-US: Nginx UI
CVE-2026-107803 (ProcessMaker is an open source workflow management software
suite. Pri ...)
- TODO: check
+ NOT-FOR-US: ProcessMaker
CVE-2026-107785 (Crux Agent from 1.9.0 before 2.0.3 uses the full SKA
bilocation key as ...)
- TODO: check
+ NOT-FOR-US: Crux Agent
CVE-2026-107783 (Insertion of sensitive information into log file in AWS Tools
for Powe ...)
NOT-FOR-US: Amazon
CVE-2026-107655 (A flaw was found in CUPS. When processing embedded job ticket
comments ...)
@@ -1237,21 +1237,21 @@ CVE-2026-107377 (datamodel-code-generator generates
Python data models from sche
CVE-2026-107376 (webonyx graphql-php is a PHP implementation of the GraphQL
specificati ...)
NOT-FOR-US: webonyx graphql-php
CVE-2026-107375 (JHipster is a development platform to quickly generate,
develop, and d ...)
- TODO: check
+ NOT-FOR-US: JHipster
CVE-2026-107362 (Malcolm file-upload component ships the upstream FilePond PHP
server ( ...)
- TODO: check
+ NOT-FOR-US: CISA Malcolm
CVE-2026-107361 (The Arkime live capture service (arkime-live) in Malcolm runs
with net ...)
- TODO: check
+ NOT-FOR-US: CISA Malcolm
CVE-2026-107337 (The Malcolm kiosk Flask application exposes a POST
/script_call/<scrip ...)
- TODO: check
+ NOT-FOR-US: CISA Malcolm
CVE-2026-107336 (Malcolm's front nginx reverse proxy defines a "Dashboards
\u2192 Arkim ...)
- TODO: check
+ NOT-FOR-US: CISA Malcolm
CVE-2026-107335 (Malcolm's upload-processing pipeline
(scripts/safe-extract.py) enforce ...)
- TODO: check
+ NOT-FOR-US: CISA Malcolm
CVE-2026-107334 (Malcolm's nginx Lua role-based access control (RBAC) layer
decides whe ...)
- TODO: check
+ NOT-FOR-US: CISA Malcolm
CVE-2026-107333 (Malcolm's nginx based reverse proxy contains a URL path
normalization ...)
- TODO: check
+ NOT-FOR-US: CISA Malcolm
CVE-2026-107332 (Insecure file permissions in the CodeCatalyst connection
handler in AW ...)
NOT-FOR-US: Amazon
CVE-2026-107325 (Improper validation of a BSON array length in the MongoDB Go
Driver ca ...)
@@ -1265,23 +1265,23 @@ CVE-2026-107324 (An integer overflow in BSON
value-length handling in the MongoD
CVE-2026-107322 (An incomplete list of disallowed inputs in Amazon Agent
Plugins for AW ...)
NOT-FOR-US: Amazon
CVE-2026-107318 (@fastify/reply-from is a Fastify plugin that forwards
requests to an u ...)
- TODO: check
+ NOT-FOR-US: fastify/reply-from
CVE-2026-107303 (JHipster is a development platform to quickly generate,
develop, and d ...)
- TODO: check
+ NOT-FOR-US: JHipster
CVE-2026-107302 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
- TODO: check
+ NOT-FOR-US: Node msgpack5
CVE-2026-107301 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
- TODO: check
+ NOT-FOR-US: Node msgpack5
CVE-2026-107300 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
- TODO: check
+ NOT-FOR-US: Node msgpack5
CVE-2026-107299 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
- TODO: check
+ NOT-FOR-US: Node msgpack5
CVE-2026-107298 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
- TODO: check
+ NOT-FOR-US: Node msgpack5
CVE-2026-107297 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
- TODO: check
+ NOT-FOR-US: Node msgpack5
CVE-2026-107296 (msgpack5 is a msgpack v5 implementation for node.js and the
browser. P ...)
- TODO: check
+ NOT-FOR-US: Node msgpack5
CVE-2026-107295 (Pydantic AI is a Python agent framework for building
applications and ...)
NOT-FOR-US: Pydantic AI
CVE-2026-107294 (Pydantic AI is a Python agent framework for building
applications and ...)
@@ -1303,7 +1303,7 @@ CVE-2026-107287 (Pydantic AI is a Python agent framework
for building applicatio
CVE-2026-107286 (Pydantic AI is a Python agent framework for building
applications and ...)
NOT-FOR-US: Pydantic AI
CVE-2026-107275 (@fastify/jwt is a JSON Web Token plugin for the Fastify web
framework. ...)
- TODO: check
+ NOT-FOR-US: fastify/jwt
CVE-2026-106611 (Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV
Forminator ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-106603 (Authorization Bypass Through User-Controlled Key
vulnerability in Grou ...)
@@ -1368,7 +1368,7 @@ CVE-2026-106428 (An out-of-bounds read in SCRAM
authentication response parsing
NOTE: Fixed by:
https://github.com/mongodb/mongo-c-driver/commit/9655909e15c83149c0fc68e53f38e696bbd23569
(2.4.0)
NOTE: Fixed by:
https://github.com/mongodb/mongo-c-driver/commit/57054353fdf79383341de21540a2adab196eb6a4
(1.30.13)
CVE-2026-106177 (A kernel buffer overflow vulnerability in HP Sure Click
versions prior ...)
- TODO: check
+ NOT-FOR-US: HP
CVE-2026-106126 (A command injection vulnerability in the Active Directory
Events Liste ...)
TODO: check
CVE-2026-106097 (The Code Snippets WordPress plugin before 3.10.0 does not
sanitise and ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e0be3f7bda7fdd868f268f9469062749aac73249
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e0be3f7bda7fdd868f268f9469062749aac73249
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
