Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
a8ea7c22 by Salvatore Bonaccorso at 2026-10-12T21:43:07+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -177,17 +177,17 @@ CVE-2026-109359 (Contrast 1.8.0 before 1.24.1 contains an
improper verification
CVE-2026-109358 (Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an
incorrect pe ...)
TODO: check
CVE-2026-109357 (LibreNMS before 26.9.0 contains an LDAP filter injection in
ldap-autho ...)
- TODO: check
+ NOT-FOR-US: LibreNMS
CVE-2026-109356 (LibreNMS before 26.9.0 contains a missing authorization
vulnerability ...)
- TODO: check
+ NOT-FOR-US: LibreNMS
CVE-2026-109355 (LibreNMS before 26.9.0 contains a stored cross-site scripting
vulnerab ...)
- TODO: check
+ NOT-FOR-US: LibreNMS
CVE-2026-109354 (LibreNMS before 26.9.0 contains a path traversal
vulnerability in nfse ...)
- TODO: check
+ NOT-FOR-US: LibreNMS
CVE-2026-109353 (LibreNMS before 26.9.0 contains an SQL injection
vulnerability that al ...)
- TODO: check
+ NOT-FOR-US: LibreNMS
CVE-2026-109352 (LibreNMS before 26.9.0 contains a stored cross-site scripting
vulnerab ...)
- TODO: check
+ NOT-FOR-US: LibreNMS
CVE-2026-109351 (Gitoxide gix-pack before 0.75.0 contains an uncontrolled
memory alloca ...)
TODO: check
CVE-2026-109350 (Gitoxide gix-pack before 0.75.0 contains a denial of service
vulnerabi ...)
@@ -291,41 +291,41 @@ CVE-2026-109302 (Parse Server 8.2.2 before 8.6.94 and
9.0.0 before 9.10.1-alpha.
CVE-2026-109301 (Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3
does not re ...)
NOT-FOR-US: Parse Server
CVE-2026-109300 (Open WebUI from 0.6.31 before 0.11.4 contains a stored
cross-site scri ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109299 (Open WebUI from 0.9.0 before 0.11.4 contains a denial of
service vulne ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109298 (Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep
patterns for ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109297 (Open WebUI 0.11.0 before 0.11.4 contains a denial of service
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109296 (Open WebUI before 0.11.4 contains a missing authorization
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109295 (Open WebUI from 0.11.0 before 0.11.4 contains a regular
expression den ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109294 (Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled
resource ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109293 (Open WebUI from 0.11.0 before 0.11.4 contains an information
disclosur ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109292 (Open WebUI from 0.6.27 before 0.11.4 contains an information
disclosur ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109291 (Open WebUI from 0.6.33 before 0.11.4 contains a cross-site
scripting v ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109290 (Open WebUI from 0.11.1 before 0.11.4 contains a stored
cross-site scri ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109289 (Open WebUI from 0.8.8 before 0.11.4 contains an improper
authorization ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109288 (Open WebUI before 0.11.4 contains a stored cross-site
scripting vulner ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109287 (Open WebUI from 0.9.6 before 0.11.4 contains an authorization
flaw whe ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109286 (Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin
message ha ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109285 (Open WebUI from 0.6.0 before 0.11.4 contains an improper
access contro ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109284 (Open WebUI from 0.11.0 before 0.11.4 contains an improper
authorizatio ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109283 (Open WebUI from 0.11.1 before 0.11.4 contains an
authorization bypass ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109282 (ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains
a type c ...)
TODO: check
CVE-2026-109281 (ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer
over-read ...)
@@ -377,21 +377,21 @@ CVE-2026-109259 (ImageMagick before 6.9.13-57 and 7.x
before 7.1.2-32 contains a
CVE-2026-109258 (ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid
memory free v ...)
TODO: check
CVE-2026-109239 (Crawl4AI before 0.9.4 contains a blind server-side request
forgery vul ...)
- TODO: check
+ NOT-FOR-US: Crawl4AI
CVE-2026-109238 (Crawl4AI 0.7.0 before 0.9.4 contains a server-side request
forgery vul ...)
- TODO: check
+ NOT-FOR-US: Crawl4AI
CVE-2026-109237 (Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config
gate byp ...)
- TODO: check
+ NOT-FOR-US: Crawl4AI
CVE-2026-109229 (SGLang through 0.5.21 contains a denial of service
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-109228 (SGLang through 0.5.21 contains a resource budget bypass
vulnerability ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-109227 (SGLang through 0.5.21 contains an unbounded memory allocation
vulnerab ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-109226 (SGLang through 0.5.21 contains a decompression amplification
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-109225 (SGLang through 0.5.21 contains an unbounded memory allocation
vulnerab ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-109222
REJECTED
CVE-2026-109206 (LogicalDOC Community Edition through 9.3 contains a username
enumerati ...)
@@ -415,27 +415,27 @@ CVE-2026-109195 (A flaw was found in Quay. An
authenticated attacker can access
CVE-2026-109194 (A flaw was found in Red Hat Quay. The build trigger
management applica ...)
TODO: check
CVE-2026-109188 (jshERP through 3.6 contains a missing authorization
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: jshERP
CVE-2026-109187 (jshERP through 3.6 contains an information disclosure
vulnerability th ...)
- TODO: check
+ NOT-FOR-US: jshERP
CVE-2026-109186 (jshERP through 3.6 contains a mass assignment vulnerability
in the Use ...)
- TODO: check
+ NOT-FOR-US: jshERP
CVE-2026-109185 (jshERP through 3.6 contains a missing authorization
vulnerability in t ...)
- TODO: check
+ NOT-FOR-US: jshERP
CVE-2026-109184 (jshERP through 3.6 contains an improper authorization
vulnerability th ...)
- TODO: check
+ NOT-FOR-US: jshERP
CVE-2026-109183 (jshERP through 3.6 contains an authorization bypass
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: jshERP
CVE-2026-109182 (jshERP through 3.6 contains an incorrect authorization
vulnerability i ...)
- TODO: check
+ NOT-FOR-US: jshERP
CVE-2026-109181 (jshERP through 3.6 contains an authorization bypass
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: jshERP
CVE-2026-109180 (jshERP through 3.6 contains an authorization bypass
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: jshERP
CVE-2026-109179 (jshERP through 3.6 contains a missing authorization
vulnerability in L ...)
- TODO: check
+ NOT-FOR-US: jshERP
CVE-2026-109178 (jshERP through 3.6 contains a missing authorization
vulnerability in L ...)
- TODO: check
+ NOT-FOR-US: jshERP
CVE-2026-109177 (MoguBlog through 6.2 contains a broken access control
vulnerability th ...)
TODO: check
CVE-2026-109176 (MoguBlog through 6.2 contains an insecure direct object
reference vuln ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a8ea7c22d181bcfe0b0c96f4f4bcf40a47694e0d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a8ea7c22d181bcfe0b0c96f4f4bcf40a47694e0d
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
