Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
1c2ccbce by Salvatore Bonaccorso at 2026-10-10T09:45:53+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -69,7 +69,7 @@ CVE-2026-85571 (The Tutor LMS WordPress plugin before 4.1.1
does not verify tha
CVE-2026-83526 (The FV Player 8 plugin for WordPress is vulnerable to
Arbitrary File U ...)
NOT-FOR-US: WordPress plugin
CVE-2026-78797 (An issue in iStoreOS istoreos-24.10.7 and before allows a
remote attac ...)
- TODO: check
+ NOT-FOR-US: iStoreOS
CVE-2026-78068 (The Table Field Add-on for ACF and SCF plugin for WordPress is
vulnera ...)
NOT-FOR-US: WordPress plugin
CVE-2026-77183 (The FooSales \u2013 Point of Sale (POS) for WooCommerce plugin
for Wor ...)
@@ -79,15 +79,15 @@ CVE-2026-6723 (The Appointment Booking Calendar \u2014
Simply Schedule Appointme
CVE-2026-6243 (The Frontend Admin by DynamiApps plugin for WordPress is
vulnerable to ...)
NOT-FOR-US: WordPress plugin
CVE-2026-62376 (Vikunja is an open-source self-hosted task management
platform. Versio ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-62367 (Vikunja is an open-source self-hosted task management
platform. In ver ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-5727 (The Hello Plus plugin for WordPress is vulnerable to
authorization byp ...)
NOT-FOR-US: WordPress plugin
CVE-2026-5725 (The Favicon Rotator plugin for WordPress is vulnerable to
Reflected Cr ...)
NOT-FOR-US: WordPress plugin
CVE-2026-57458 (Vikunja is an open-source self-hosted task management
platform. In ver ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-3717 (The CV Builder \u2013 Professional Resume Builder SaaS plugin
for Word ...)
NOT-FOR-US: WordPress plugin
CVE-2026-22061 (Trident versions v25.02.1 through v26.06.1 are susceptible to
a vulner ...)
@@ -127,49 +127,49 @@ CVE-2026-108501 (ZTE Z80 Ultra has a system interface
permission verification de
CVE-2026-108474 (In JetBrains Exposed before 1.5.1 sQL injection was possible
via unesc ...)
NOT-FOR-US: JetBrains
CVE-2026-108269 (Remote Attestation TLS Clients provides multi-language
utilities for v ...)
- TODO: check
+ NOT-FOR-US: Remote Attestation TLS Clients (ra-tls-clients)
CVE-2026-108268 (Enclave OS Virtual runs container workloads inside
confidential virtua ...)
- TODO: check
+ NOT-FOR-US: Enclave OS Virtual
CVE-2026-108267 (Privasys Go is a maintained fork of the Go programming
language that a ...)
- TODO: check
+ NOT-FOR-US: Privasys Go (fork of Go)
CVE-2026-108266 (Privasys rustls is a maintained fork of the rustls TLS
library that ad ...)
- TODO: check
+ NOT-FOR-US: Privasys rustls (fork of rustls TLS library)
CVE-2026-108265 (Enclave OS Mini is a Rust-based runtime for confidential
applications ...)
- TODO: check
+ NOT-FOR-US: Enclave OS Mini
CVE-2026-108264 (Wizarr is an advanced user invitation and management system
for Jellyf ...)
- TODO: check
+ NOT-FOR-US: wizarr
CVE-2026-108263 (Astron Agent is an agentic workflow platform for building and
running ...)
- TODO: check
+ NOT-FOR-US: Astron Agent
CVE-2026-108261 (Tina is a headless content management system. Prior to
tinacms 3.14.0 ...)
- TODO: check
+ NOT-FOR-US: Tina CMS
CVE-2026-108260 (Tina is a headless content management system. Prior to 0.2.1,
the tina ...)
- TODO: check
+ NOT-FOR-US: Tina CMS
CVE-2026-108259 (Tina is a headless content management system. Prior to 3.0.0,
@tinacms ...)
- TODO: check
+ NOT-FOR-US: Tina CMS
CVE-2026-108258 (Shiny for Python is a framework for building interactive web
applicati ...)
- TODO: check
+ NOT-FOR-US: Shiny
CVE-2026-107857 (Mindwtr is a free offline-first task management application
for deskto ...)
- TODO: check
+ NOT-FOR-US: Mindwtr
CVE-2026-107856 (CiviForm simplifies applications for government benefits
programs by r ...)
- TODO: check
+ NOT-FOR-US: CiviForm
CVE-2026-107854 (Jexactyl is a customisable game management panel and billing
system. F ...)
- TODO: check
+ NOT-FOR-US: Jexactyl
CVE-2026-107852 (Jexactyl is a customisable game management panel and billing
system. P ...)
- TODO: check
+ NOT-FOR-US: Jexactyl
CVE-2026-107851 (Contao is an Open Source CMS. From version 5.7.0 until
5.7.12, TableAc ...)
- TODO: check
+ NOT-FOR-US: Contao CMS
CVE-2026-107850 (Contao is an Open Source CMS. From version 5.7.1 until
5.7.12, core-bu ...)
- TODO: check
+ NOT-FOR-US: Contao CMS
CVE-2026-107848 (Contao is an Open Source CMS. From version 4.0.0 until 5.3.50
and 5.7. ...)
- TODO: check
+ NOT-FOR-US: Contao CMS
CVE-2026-107845 (Contao is an Open Source CMS. From version 4.0.0 until 5.3.50
and 5.7. ...)
- TODO: check
+ NOT-FOR-US: Contao CMS
CVE-2026-107844 (Contao is an Open Source CMS. From version 5.0.0 until 5.3.50
and 5.7. ...)
- TODO: check
+ NOT-FOR-US: Contao CMS
CVE-2026-107843 (Contao is an Open Source CMS. From version 4.1.0 until 5.3.50
and 5.7. ...)
- TODO: check
+ NOT-FOR-US: Contao CMS
CVE-2026-107842 (Contao is an Open Source CMS. From version 4.0.0 until 5.3.50
and 5.7. ...)
- TODO: check
+ NOT-FOR-US: Contao CMS
CVE-2026-107742 (The 10Web Booster \u2013 Website speed optimization, Cache &
Page Spee ...)
NOT-FOR-US: WordPress plugin
CVE-2026-107712 (The WP Booking System \u2013 Booking Calendar plugin for
WordPress is ...)
@@ -267,7 +267,7 @@ CVE-2026-102402 (The Team \u2013 Team Members Showcase
Plugin plugin for WordPre
CVE-2026-102401 (The Download Manager plugin for WordPress is vulnerable to
Stored Cros ...)
NOT-FOR-US: WordPress plugin
CVE-2026-101947 (ExifTool for photo and video 5.0.1-gms by CellHubs constructs
shell co ...)
- TODO: check
+ NOT-FOR-US: ExifTool for photo and video
CVE-2026-101324 (The Fluent Forms \u2013 Customizable Contact Forms, Survey,
Quiz, & Co ...)
NOT-FOR-US: WordPress plugin
CVE-2026-100196 (The LazyLoad Plugin \u2013 Lazy Load Images, Videos, and
Iframes plugi ...)
@@ -746,37 +746,37 @@ CVE-2026-105870 (Improper Neutralization of Input During
Web Page Generation ('C
CVE-2026-105318 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-105281 (The internal data publisher on openPDC accepts network
connections wit ...)
- TODO: check
+ NOT-FOR-US: openPDC
CVE-2026-105278 (The published Docker image for openPDC includes a fixed
administrative ...)
- TODO: check
+ NOT-FOR-US: openPDC
CVE-2026-104635 (Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode
in elixir ...)
- TODO: check
+ NOT-FOR-US: elixir-protobuf protobuf
CVE-2026-104629 (A component loading mechanism in openPDC and openHistorian
will constr ...)
- TODO: check
+ NOT-FOR-US: openPDC
CVE-2026-104392 (Deserialization of Untrusted Data vulnerability in
ExpressTech Quiz An ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-104117 (A missing authorization check in the illumos IP management
daemon (ipm ...)
- TODO: check
+ NOT-FOR-US: illumos IP management daemon (ipmgmtd)
CVE-2026-104116 (A missing authorization check in the illumos zones statistics
daemon ( ...)
- TODO: check
+ NOT-FOR-US: illumos zones statistics daemon (zonestatd)
CVE-2026-104115 (A stack-based buffer overflow in the illumos reparse point
daemon (rep ...)
- TODO: check
+ NOT-FOR-US: illumos reparse point daemon (reparsed)
CVE-2026-104114 (A NULL pointer dereference in the illumos Network Auto-Magic
daemon (n ...)
- TODO: check
+ NOT-FOR-US: illumos Network Auto-Magic daemon (nwamd)
CVE-2026-104113 (A double free in the IP management daemon (ipmgmtd) of OmniOS
and Smar ...)
- TODO: check
+ NOT-FOR-US: IP management daemon (ipmgmtd) of OmniOS and SmartOS
CVE-2026-104112 (A missing release of resources in the illumos name service
cache daemo ...)
- TODO: check
+ NOT-FOR-US: illumos
CVE-2026-104084 (SmarterMail before build 9777 contains a privilege escalation
vulnerab ...)
- TODO: check
+ NOT-FOR-US: SmarterMail
CVE-2026-104083 (SmarterMail before build 9777 contains a stored mutation
cross-site sc ...)
- TODO: check
+ NOT-FOR-US: SmarterMail
CVE-2026-104082 (SmarterMail before build 9777 contains a remote code
execution vulnera ...)
- TODO: check
+ NOT-FOR-US: SmarterMail
CVE-2026-104081 (KodExplorer before 4.55 contains a path traversal
vulnerability in the ...)
- TODO: check
+ NOT-FOR-US: KodExplorer
CVE-2026-104079 (Envira Gallery Lite before 1.16.2 contains a missing
authorization vul ...)
- TODO: check
+ NOT-FOR-US: Envira Gallery Lite
CVE-2026-103413 (Improper input validation vulnerability in Apache Camel
Karavan. Wh ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103412 (Improper limitation of a pathname to a restricted directory
('path tra ...)
@@ -786,7 +786,7 @@ CVE-2026-103329 (The Super Payments WordPress plugin before
1.43.1 does not prop
CVE-2026-103220 (The Affinity by Canva application before 3.3.1 (October 2026
release) ...)
NOT-FOR-US: Canva
CVE-2026-102916 (A reachable assertion in the illumos bhyve instruction
emulator allows ...)
- TODO: check
+ NOT-FOR-US: illumos
CVE-2026-102554 (Allocation of resources without limits or throttling
(CWE-770) during ...)
TODO: check
CVE-2026-101130 (The Affinity by Canva application before 3.3.1 (October 2026
release) ...)
@@ -794,9 +794,9 @@ CVE-2026-101130 (The Affinity by Canva application before
3.3.1 (October 2026 re
CVE-2026-101094 (The Affinity by Canva application before 3.3.1 (October 2026
release) ...)
NOT-FOR-US: Canva
CVE-2026-101022 (A Modbus connection feature on openPDC accepts a
caller-specified dest ...)
- TODO: check
+ NOT-FOR-US: openPDC
CVE-2026-100730 (A service console interface on openPDC and openHistorian
deserializes ...)
- TODO: check
+ NOT-FOR-US: openPDC
CVE-2026-100227 (Improper Verification of Cryptographic Signature
vulnerability in Apac ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2025-61560 (A race condition vulnerability in the SessionManager of CNCF:
Cloud Na ...)
@@ -804,7 +804,7 @@ CVE-2025-61560 (A race condition vulnerability in the
SessionManager of CNCF: Cl
CVE-2025-14123 (The Redux Framework plugin for WordPress is vulnerable to
privilege es ...)
NOT-FOR-US: WordPress plugin
CVE-2016-20098 (Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14
contains a ...)
- TODO: check
+ NOT-FOR-US: Moderator Toolbox (reddit-moderator-toolbox)
CVE-2026-98384 (In the Linux kernel, the following vulnerability has been
resolved: b ...)
- linux 7.2.9-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
@@ -1539,7 +1539,7 @@ CVE-2026-107378 (CairoSVG is an SVG converter based on
Cairo, a 2D graphics libr
NOTE:
https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c
NOTE: Fixed by:
https://github.com/Kozea/CairoSVG/commit/6dde8685ed3f19837767bce7a13a5491e3d0e0bf
(2.9.0)
CVE-2026-107377 (datamodel-code-generator generates Python data models from
schema defi ...)
- TODO: check
+ NOT-FOR-US: datamodel-code-generator
CVE-2026-107376 (webonyx graphql-php is a PHP implementation of the GraphQL
specificati ...)
NOT-FOR-US: webonyx graphql-php
CVE-2026-107375 (JHipster is a development platform to quickly generate,
develop, and d ...)
@@ -1680,7 +1680,7 @@ CVE-2026-106428 (An out-of-bounds read in SCRAM
authentication response parsing
CVE-2026-106177 (A kernel buffer overflow vulnerability in HP Sure Click
versions prior ...)
NOT-FOR-US: HP
CVE-2026-106126 (A command injection vulnerability in the Active Directory
Events Liste ...)
- TODO: check
+ NOT-FOR-US: Tenable Identity Exposure (SaaS)
CVE-2026-106097 (The Code Snippets WordPress plugin before 3.10.0 does not
sanitise and ...)
NOT-FOR-US: WordPress plugin
CVE-2026-106095 (The Code Snippets WordPress plugin before 3.10.0 does not
perform a ca ...)
@@ -1728,9 +1728,9 @@ CVE-2026-105673 (An unauthenticated denial-of-service
vulnerability exists in Ta
CVE-2026-105672 (TP-Link Tapo C325WB V2 contains an unauthenticated
authorization bypas ...)
NOT-FOR-US: TPLink
CVE-2026-105570 (Docker Sandboxes compared OAuth token-endpoint hostnames
case-sensitiv ...)
- TODO: check
+ NOT-FOR-US: Docker Sandboxes
CVE-2026-105452 (Docker Sandboxes could forward a client-supplied credential
alongside ...)
- TODO: check
+ NOT-FOR-US: Docker Sandboxes
CVE-2026-105436 (Deserialization of Untrusted Data vulnerability in MainWP
MainWP Child ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-105405
@@ -1752,13 +1752,13 @@ CVE-2026-105398
CVE-2026-105331 (Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10
allows a u ...)
NOT-FOR-US: Checkmk
CVE-2026-105275 (Satel Netco Design versions prior to v2.1.7 contains a
relative path t ...)
- TODO: check
+ NOT-FOR-US: Satel Netco Design
CVE-2026-105269 (Satel Netco Design versions prior to v2.1.7 contains a stored
cross si ...)
- TODO: check
+ NOT-FOR-US: Satel Netco Design
CVE-2026-105190 (The Easy Digital Downloads WordPress plugin before 3.7.1 does
not cons ...)
NOT-FOR-US: WordPress plugin
CVE-2026-105110 (OS Command Injection in the login.xgi CGI endpoint in
Iskratel Innbox ...)
- TODO: check
+ NOT-FOR-US: Iskratel Innbox GPON ONT devices
CVE-2026-105079 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-105078 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -1766,33 +1766,33 @@ CVE-2026-105078 (Improper Neutralization of Input
During Web Page Generation ('C
CVE-2026-105076 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-104704 (Progressive Robot hMailServer 6.0.0 through 6.3.5 does not
enforce TLS ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-104671 (The TutorStarter WordPress theme before 4.0.4 does not
respect the sit ...)
NOT-FOR-US: WordPress plugin
CVE-2026-104660 (Missing authorization on COM objects in Progressive Robot
hMailServer ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-104659 (Missing Host header validation and missing throttling of
failed admini ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-104658 (The Linux live-update apply helper (hmailserver-update) of
Progressive ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-104634 (Incorrect Type Conversion or Cast vulnerability in
BeamMCP.Server in S ...)
- TODO: check
+ NOT-FOR-US: BeamMCP.Server
CVE-2026-104628 (Satel Netco Design versions prior to v2.1.7 contains an
inefficient re ...)
- TODO: check
+ NOT-FOR-US: Satel Netco Design
CVE-2026-104078 (Obsidian Desktop before 1.14.0 contains a filter bypass
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Obsidian Desktop
CVE-2026-104077 (Obsidian Desktop before 1.14.0 contains a remote code
execution vulner ...)
- TODO: check
+ NOT-FOR-US: Obsidian Desktop
CVE-2026-104076 (TVU Networks Receiver/Transceiver devices running firmware
before vers ...)
- TODO: check
+ NOT-FOR-US: TVU Networks Receiver/Transceiver devices
CVE-2026-104075 (TVU Networks Receiver/Transceiver devices running firmware
before vers ...)
- TODO: check
+ NOT-FOR-US: TVU Networks Receiver/Transceiver devices
CVE-2026-103663 (Ollama is vulnerable to path traversal in the `/api/pull`
endpoint due ...)
- ollama <itp> (bug #1094806)
CVE-2026-103649 (Missing network timeouts in the Linux builds of Progressive
Robot hMai ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-103647 (Cross-site scripting in the webmail of Progressive Robot
hMailServer 6 ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-103517 (The Airwallex Online Payments Gateway WordPress plugin before
1.36.0 d ...)
NOT-FOR-US: WordPress plugin
CVE-2026-103072 (Missing Authorization vulnerability in VillaTheme VillaTheme
Core vill ...)
@@ -1800,9 +1800,9 @@ CVE-2026-103072 (Missing Authorization vulnerability in
VillaTheme VillaTheme Co
CVE-2026-103070 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-103011 (Heap-based buffer overflow in the legacy Blowfish encryption
routine ( ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-103010 (Heap-based buffer overflow in the legacy Blowfish decryption
routine ( ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-102784 (Joomla Extension - balbooa.com - CSRF in language
installation feature ...)
NOT-FOR-US: Joomla
CVE-2026-102783 (Joomla Extension - balbooa.com - Path Traversal in image
preview Gridb ...)
@@ -1810,11 +1810,11 @@ CVE-2026-102783 (Joomla Extension - balbooa.com - Path
Traversal in image previe
CVE-2026-102368 (Affected Tapo device firmware stores device-specific
cryptographic mat ...)
NOT-FOR-US: TPLink
CVE-2026-101998 (Docker Sandboxes could fail open while masking credentials in
protecte ...)
- TODO: check
+ NOT-FOR-US: Docker Sandboxes
CVE-2026-101028 (Incorrect Authorization vulnerability in ash-project ash
allows an act ...)
- TODO: check
+ NOT-FOR-US: ash-project
CVE-2026-101024 (Satel Netco Design versions prior to v2.1.7 contains a
relative path t ...)
- TODO: check
+ NOT-FOR-US: Satel Netco Design
CVE-2026-100197
REJECTED
CVE-2025-71428 (Jivejdon through 5.0 contains a sql injection vulnerability in
Account ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1c2ccbced7a0b49b418e2a0d2b85699ad186408b
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1c2ccbced7a0b49b418e2a0d2b85699ad186408b
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
