Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
9f815a1c by Moritz Muehlenhoff at 2026-10-10T21:30:52+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -81,59 +81,59 @@ CVE-2026-57806 (Improper Neutralization of Input During Web
Page Generation ('Cr
CVE-2026-4791 (The PeproDev Ultimate Profile Solutions plugin for WordPress is
vulner ...)
NOT-FOR-US: WordPress plugin
CVE-2026-108600 (open-multi-agent (@open-multi-agent/core) 1.5.0 through
1.21.2 contain ...)
- TODO: check
+ NOT-FOR-US: open-multi-agent
CVE-2026-108599 (phi 0.1.1 through 0.28.4 contains an improper link resolution
vulnerab ...)
- TODO: check
+ NOT-FOR-US: phi
CVE-2026-108598 (Floci 1.1.0 before 2.2.0 contains a code injection
vulnerability in Vt ...)
- TODO: check
+ NOT-FOR-US: Floci
CVE-2026-108597 (Cohere Python SDK 5.11.0 through 7.2.0 contains a path
traversal (tar ...)
- TODO: check
+ NOT-FOR-US: Cohere Python SDK
CVE-2026-108596 (OpenLIT 2.1.0 contains an authorization bypass vulnerability
that allo ...)
- TODO: check
+ NOT-FOR-US: OpenLIT
CVE-2026-108595 (Phi 0.3.0 through 0.28.4 contains a permission bypass
vulnerability th ...)
- TODO: check
+ NOT-FOR-US: phi
CVE-2026-108594 (Mealie 3.26.0 through 3.28.0 contains a server-side request
forgery vu ...)
- TODO: check
+ NOT-FOR-US: Maelie
CVE-2026-108593 (9router 0.4.1 through 0.5.99 contains a configuration
injection vulner ...)
- TODO: check
+ NOT-FOR-US: 9router
CVE-2026-108592 (mini-swe-agent 1.10.0 through 2.4.6 contains an information
exposure v ...)
- TODO: check
+ NOT-FOR-US: mini-swe-agent
CVE-2026-108591 (InnoShop 0.9.2 contains a local file disclosure vulnerability
that all ...)
- TODO: check
+ NOT-FOR-US: InnoShop
CVE-2026-108586 (1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an
incorrect a ...)
- TODO: check
+ NOT-FOR-US: 1MCP Agent
CVE-2026-108585 (argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path
traversa ...)
NOT-FOR-US: Argo CD
CVE-2026-108583 (zotero-mcp 0.10.0 through 0.14.1 contains a server-side
request forger ...)
- TODO: check
+ NOT-FOR-US: zotero-mcp
CVE-2026-108582 (GenOffice through 0.11.505 contains an incorrect permissions
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: GenOffice
CVE-2026-108581 (TencentCloud Octop through 1.0.2b6 contains a missing
authorization vu ...)
- TODO: check
+ NOT-FOR-US: TencentCloud Octop
CVE-2026-108580 (AniWorld Downloader before 5.3.0 contains an improper
restriction of a ...)
- TODO: check
+ NOT-FOR-US: AniWorld Downloader
CVE-2026-108579 (OpenPanel through 2.3.0 contains a CSV formula injection
vulnerability ...)
- TODO: check
+ NOT-FOR-US: OpenPanel
CVE-2026-108555 (PairDrop through 1.11.2 contains an IP spoofing vulnerability
in Peer. ...)
- TODO: check
+ NOT-FOR-US: PairDrop
CVE-2026-108554 (PDFMathTranslate (pdf2zh) through 1.9.11 contains a
server-side reques ...)
- TODO: check
+ NOT-FOR-US: PDFMathTranslate
CVE-2026-108553 (OpenRefine through 3.10.1 contains a cross-site request
forgery vulner ...)
TODO: check
CVE-2026-108551 (openapi-typescript-codegen through 0.31.0 contains a code
injection vu ...)
- TODO: check
+ NOT-FOR-US: openapi-typescript-codegen
CVE-2026-108550 (SkillHub before 0.2.22 contains an incorrect authorization
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: SkillHub
CVE-2026-108549 (cc-connect through 1.5.0 contains a missing authentication
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: cc-connect
CVE-2026-108548 (AstronRPA through 1.1.6 contains an authentication bypass
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: AstronRPA
CVE-2026-108547 (AstronRPA through 1.1.6 contains a missing tenant
authorization check ...)
- TODO: check
+ NOT-FOR-US: AstronRPA
CVE-2026-108546 (Spotweb through 1.5.8 contains an OS command injection
vulnerability i ...)
- TODO: check
+ NOT-FOR-US: Spotweb
CVE-2026-108545 (SillyTavern 1.12.13 through 1.19.0 contains a denial of
service vulner ...)
- TODO: check
+ NOT-FOR-US: SillyTavern
CVE-2026-108506 (ZTE Z80 Ultra's system interfaces do not have robust
invocation authen ...)
NOT-FOR-US: ZTE
CVE-2026-108505 (ZTE Z80 Ultra has a local information disclosure
vulnerability. Third- ...)
@@ -141,19 +141,19 @@ CVE-2026-108505 (ZTE Z80 Ultra has a local information
disclosure vulnerability.
CVE-2026-108504 (ZTE Z80 Ultra has an unauthorized information disclosure
vulnerability ...)
NOT-FOR-US: ZTE
CVE-2026-108165 (Immich through 3.3.1 contains a missing authorization
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Immich
CVE-2026-108164 (Open Source Social Network (OSSN) through 10.1 contains an
insecure di ...)
- TODO: check
+ NOT-FOR-US: Open Source Social Network (OSSN)
CVE-2026-108163 (Pingvin Share X before 1.22.0 contains an ineffective rate
limiting vu ...)
- TODO: check
+ NOT-FOR-US: Pingvin Share X
CVE-2026-108162 (Pingvin Share X before 1.22.0 contains a rate limit bypass
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Pingvin Share X
CVE-2026-108161 (FusionPBX through 5.6.5 contains an OS command injection
vulnerability ...)
- TODO: check
+ NOT-FOR-US: FusionPBX
CVE-2026-108115 (Kortix Suna 0.10.7 before 0.13.52 contains a server-side
request forge ...)
- TODO: check
+ NOT-FOR-US: Kortix Suna
CVE-2026-108114 (Strapi 5.47.0 through 5.57.0 contains an improper
authorization vulner ...)
- TODO: check
+ NOT-FOR-US: Strapi
CVE-2026-107657 (The HivePress \u2013 Business Directory, Listings &
Classified Ads Plu ...)
NOT-FOR-US: WordPress plugin
CVE-2026-106610 (Incorrect Privilege Assignment vulnerability in miniOrange
miniorange ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9f815a1c76aeec099f80ad9a6a79ec5206d44b39
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9f815a1c76aeec099f80ad9a6a79ec5206d44b39
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
