Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
1b659b00 by security tracker role at 2026-10-13T07:22:57+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,101 +1,101 @@
CVE-2026-9268 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-97691 (Convex is an open-source reactive database for application
developers. ...)
TODO: check
CVE-2026-97229 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-96893 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-96266 (IBM Power Systems Firmware FW1060.00 through FW1060.81 is
affected by ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-96265 (IBM Power Systems Firmware FW1060.00 through FW1060.81 is
affected by ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-96264 (IBM Power Systems Firmware FW1060.00 through FW1060.81 is
affected by ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-96263 (IBM Power Systems Firmware FW1120.00 through FW1120.01,
FW1110.00 thro ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-96262 (IBM Power Systems FirmwareFW1060.00 through FW1060.81 is
affected by a ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-96261 (IBM Power Systems Firmware FW1060.00 through FW1060.81 is
affected by ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-96119 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote
authenticated attack ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-96012 (IBM Db2 Mirror for i 7.4, 7.5, and 7.6is vulnerable to
privilege escal ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-95838 (containerd is an open-source container runtime. Prior to
1.7.35, 2.0.1 ...)
TODO: check
CVE-2026-95837 (containerd is an open-source container runtime. From 2.1.0
until 2.2.7 ...)
TODO: check
CVE-2026-93892 (IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could
allow a rem ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93891 (IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could
allow a rem ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93886 (IBM i 7.3, 7.4, 7.5, and 7.6could allow a remote authenticated
attacke ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-92883 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-92876 (IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and
9.0.0 c ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-92832 (IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow
a local ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-92528 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-92120 (OAuth1 Request Replay Attackvulnerability in Apache Allura.
This is ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-92119 (REST API Mass Assignmentvulnerability in Apache Allura.
This issue ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-92116 (OAuth1 callback validationvulnerability in Apache Allura.
This issu ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-90921 (IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote
attacker t ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-90920 (IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote
attacker t ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-90912 (IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a
remote attac ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-90911 (IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote
attacker t ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-89271 (The WP-BusinessDirectory WordPress plugin through 4.0.2 does
not rest ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89269 (The WP Testimonials WordPress plugin through 1.4.13 does not
properly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89124 (Display Product Catalog Based on Customs Declaration
application does ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89122 (SAP NetWeaver Enterprise Portal does not sufficiently validate
input t ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89121 (SAP S/4HANA does not perform sufficient instance-level
authorization c ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89120 (A regression caused by an API change in SAP ABAP Platform
reintroduces ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89118 (SAP NetWeaver Enterprise Portal allows an unauthenticated
attacker to ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89117 (SAP NetWeaver Enterprise Portal allows an unauthenticated
attacker to ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89116 (The affected code used child_process.execSync with a shell
string for ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89113 (SAP Commerce Cloud does not sufficiently validate certain
user-supplie ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89112 (The admin API endpoint used to retrieve CLA signature records
does not ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89111 (The SAP Cloud SDK for Python contains an OAuth2 SSRF
vulnerability aff ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89110 (SAP NetWeaver Visual Composer does not perform sufficient
authorizatio ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89108 (SAP Manufacturing Integration and Intelligence does not
sufficiently e ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89107 (SAP S/4HANA (Manage Substitution/Validation Rules) does not
sufficient ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89106 (SAP UI5 does not perform sufficient input validation under
certain con ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-89105 (The HybridTokenAuthenticator component of the
SAP/cloud-security-servi ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-87689 (The Metasploit Framework Web Service REST API (msf-ws) exposes
the cre ...)
TODO: check
CVE-2026-85529 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-85457 (IBM Planning Analytics 2.0, and 2.1 could allow a remote
authenticated ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84418 (IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a
man-in-the-mid ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84360 (Nginx UI is a web user interface for the Nginx web server.
Prior to 2. ...)
TODO: check
CVE-2026-84321 (Nginx UI is a web user interface for the Nginx web server.
Prior to 2. ...)
@@ -119,69 +119,69 @@ CVE-2026-84313 (Nginx UI is a web user interface for the
Nginx web server. Prior
CVE-2026-84312 (Nginx UI is a web user interface for the Nginx web server.
Prior to 2. ...)
TODO: check
CVE-2026-84284 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-82632 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-82110 (IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a
remote authe ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-82108 (IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a
remote authe ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-82103 (IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a
remote authe ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-82101 (IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a
remote authe ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-82096 (IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a
remote authe ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-81858 (IBM i 7.3, 7.4, 7.5, and 7.6could allow a remote authenticated
attacke ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-81839 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-7767 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-78673 (IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote
attacker t ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-78335 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-76976 (Applications based on SAP GUI for HTML in SAP NetWeaver
Application Se ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-76975 (Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability,
an unauth ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-76972 (Due to a Cross-Site Scripting (XSS) vulnerability in SAP
Manufacturing ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-75881 (IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and
9.0.0 c ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-75826 (Command injection in the backup function in Teltonika Networks
RUTOS 7 ...)
- TODO: check
+ NOT-FOR-US: Teltonika Networks
CVE-2026-75782 (IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow
a local ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-75621 (IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow
a local ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-75095 (IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow
a remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-75076 (IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow
a remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-75063 (IBM Planning Analytics 2.0, and 2.1 could allow a remote
authenticated ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-75061 (IBM Planning Analytics 2.0, and 2.1 could allow a remote
attacker to t ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-6567 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-5954 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-58462
REJECTED
CVE-2026-58249 (SAP NetWeaver and SAP Web Dispatcher do not properly validate
certain ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-58242 (SAP Cloud Connector contains an improper authorization check,
which co ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-54870 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54869 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54868 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54867 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54459 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
TODO: check
CVE-2026-53997 (Netherman Portal del Hermano (portaldelhermano.es) before
2026-10-06 c ...)
@@ -205,199 +205,199 @@ CVE-2026-41210 (Moonlight Qt is a GameStream client for
Windows, macOS, Linux, a
CVE-2026-35001 (OpenS100 through commit daa35b contains an integer overflow
vulnerabil ...)
TODO: check
CVE-2026-19938 (The Bluetooth host's ATT transmit path releases a buffer it
does not o ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-19937 (The Bluetooth Mesh Access layer delayable-message machinery in
subsys/ ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-19936 (The Bluetooth Mesh Access-layer delayable message queue in
subsys/blue ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-19627 (IBM Planning Analytics 2.0, and 2.1 could allow a remote
attacker to r ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19622 (IBM Planning Analytics 2.0, and 2.1 could allow a remote
attacker to b ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19620 (IBM Planning Analytics 2.0, and 2.1 could allow a remote
attacker to g ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-18541 (IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored
cross-site ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-18537 (IBM Maximo Application Suite - Location Service for Esri
Component 9.2 ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-18533 (IBM Maximo Application Suite - Location Service for Esri
Component 9.2 ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-18529 (IBM Maximo Application Suite - Location Service for Esri
Component 9.2 ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-18517 (IBM Maximo Application Suite - Location Service for Esri
Component 9.2 ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-18513 (IBM Maximo Application Suite - Location Service for Esri
Component 9.2 ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-18343 (IBM i 7.3, 7.4, 7.5, and 7.6could allow a local attacker to
modify the ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-18318 (IBM i 7.3, 7.4, 7.5, and 7.6could allow a remote attacker to
perform b ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17487 (IBM i 7.3, 7.4, 7.5, and 7.6could allow a remote attacker to
enumerate ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17484 (IBM i 7.3, 7.4, 7.5, and 7.6could allow a local attacker to
cause a de ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17475 (IBM Planning Analytics 2.0, and 2.1 could allow a remote
authenticated ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16678 (IBM Power Systems Firmware FW1110.00 through FW1110.31,
FW1120.00 thro ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16301 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-16275 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-14814 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-14552 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-14210 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-109786 (In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd
filter (conf ...)
TODO: check
CVE-2026-109758 (Perforce Helix Authentication Service (HAS) deployments that
retain th ...)
TODO: check
CVE-2026-109675 (Frappe Suite before commit
2697564a9c46da6acc614743eaf9915fe5238f4f co ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109674 (Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains
an SQL i ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109673 (Frappe ERPNext before 15.103.0 and 16.x before 16.12.0
contains a stor ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109672 (Frappe ERPNext before 15.118.0 and 16.x before 16.27.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109671 (Frappe ERPNext before 15.113.0 and 16.x before 16.24.0
contains a stor ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109670 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0
contains a stor ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109669 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109668 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109667 (Frappe ERPNext before 15.111.0 and 16.x before 16.22.0
contains a priv ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109666 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109665 (Frappe ERPNext before 15.108.0 and 16.x before 16.18.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109664 (Frappe ERPNext before 15.112.0 contains a missing
authorization vulner ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109663 (Frappe ERPNext before 15.113.0 and 16.x before 16.22.0
contains an SQL ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109662 (Frappe ERPNext before 15.112.0 and 16.x before 16.23.0
contains a stor ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109661 (Frappe ERPNext before 15.116.0 and 16.x before 16.27.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109660 (Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has
certain end ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109659 (Frappe ERPNext before 15.113.0 and 16.x before 16.24.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109658 (Frappe ERPNext before 15.115.0 and 16.x before 16.26.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109657 (Frappe ERPNext 16.x before 16.27.0 contains a stored
cross-site script ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109656 (Frappe ERPNext before 15.118.2 and 16.x before 16.30.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109655 (Frappe ERPNext before 15.115.0 and 16.x before 16.26.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109654 (Frappe ERPNext before 15.119.0 and 16.x before 16.31.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109653 (Frappe ERPNext before 15.119.0 and 16.x before 16.31.0
contains a stor ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109652 (Frappe ERPNext before 15.119.1 and 16.x before 16.32.0
contains a serv ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109651 (Frappe ERPNext before 15.112.0 and 16.x before 16.23.0
contains a serv ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109650 (Frappe ERPNext before 15.112.0 and 16.x before 16.23.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109649 (Frappe ERPNext before 15.102.0 and 16.x before 16.11.0
contains an SQL ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109648 (Frappe ERPNext before 15.106.0 and 16.x before 16.16.0
contains an SQL ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109647 (Frappe ERPNext before 15.106.0 and 16.x before 16.16.0
contains an SQL ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109646 (Frappe ERPNext before 15.106.0 and 16.x before 16.16.0
contains an SQL ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109645 (Frappe ERPNext before 15.119.0 and 16.x before 16.31.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109644 (Frappe ERPNext before 15.119.0 and 16.x before 16.31.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109643 (Frappe ERPNext before 15.111.0 and 16.x before 16.22.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109642 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109641 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109640 (Frappe ERPNext before 16.22.0 contains a missing
authorization vulnera ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109639 (Frappe ERPNext before 15.102.0 and 16.x before 16.8.0
contains an SQL ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109638 (Frappe ERPNext before 15.110.0 and 16.x before 16.21.0
contains a SQL ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109637 (Frappe ERPNext before 16.14.0 contains a missing
authorization vulnera ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109636 (Frappe ERPNext before 15.115.0 and 16.x before 16.26.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109635 (Frappe ERPNext before 15.105.0 and 16.x before 16.15.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109634 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0
contains an SQL ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109633 (Frappe ERPNext before 15.119.1 and 16.x before 16.32.0
contains a stor ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109632 (Frappe ERPNext before 15.121.0 and 16.x before 16.33.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109631 (Frappe ERPNext before 15.119.1 and 16.x before 16.32.0
contains an SQL ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109630 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109629 (Frappe ERPNext before 15.121.3 and 16.x before 16.35.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109628 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109627 (Frappe ERPNext before 15.120.0 and 16.x before 16.33.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109626 (Frappe ERPNext before 16.34.2 contains an SQL injection
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109625 (Frappe ERPNext before 15.121.3 and 16.x before 16.35.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109624 (Frappe ERPNext before 15.120.0 and 16.x before 16.33.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109623 (Frappe ERPNext before 15.121.1 and 16.x before 16.34.2
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109622 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109621 (Frappe ERPNext before 15.120.0 and 16.x before 16.23.0
contains an aut ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109617 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109616 (Frappe ERPNext before 15.121.3 and 16.x before 16.35.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109615 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109614 (Frappe ERPNext before 16.34.0 contains a missing
authorization vulnera ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109613 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109612 (Frappe ERPNext before 15.120.0 and 16.x before 16.33.0
contains a stor ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109611 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109610 (Frappe ERPNext before 15.119.1 and 16.x before 16.32.0
contains a miss ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109609 (Frappe ERPNext before 15.119.1 and 16.x before 16.32.0
contains an SQL ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109608 (Frappe ERPNext before 15.121.0 and 16.x before 16.34.0
contains an SQL ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109604 (Frappe ERPNext before 15.112.0 and 16.x before 16.23.0
contains a stor ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109603 (Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0
relies o ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109602 (Frappe before 15.118.0 and 16.x before 16.31.0 contains a
stored cross ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109601 (Frappe Framework before 15.117.0 and 16.x before 16.30.0
contains an a ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109600 (Frappe Framework before 15.118.0 and 16.x before 16.31.0 does
not chec ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109599 (Frappe before 15.113.3 and 16.x before 16.25.0 contains a
missing auth ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109598 (Frappe Framework before 15.120.0 and 16.x before 16.33.0
contains a mi ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-109597 (Hugo from v0.60.0 before v0.167.0 contains a stored
cross-site scripti ...)
TODO: check
CVE-2026-109596 (Hugo from v0.162.0 before v0.167.0 contains an improper link
resolutio ...)
@@ -409,9 +409,9 @@ CVE-2026-109575 (In HAProxy Data Plane API 2.2.0 through
3.4.3 (and correspondin
CVE-2026-109574 (Hugo before v0.167.0 contains a path traversal vulnerability
in css.Sa ...)
TODO: check
CVE-2026-109573 (phpMyFAQ before 4.1.9 contains an SQL injection vulnerability
in PdoMy ...)
- TODO: check
+ NOT-FOR-US: phpMyFAQ
CVE-2026-109572 (Open WebUI from 0.8.6 before 0.11.4 contains a privilege
escalation vu ...)
- TODO: check
+ NOT-FOR-US: Open WebUI
CVE-2026-109571 (Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains
a missin ...)
TODO: check
CVE-2026-109570 (Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains
a missin ...)
@@ -465,29 +465,29 @@ CVE-2026-109375 (Vercel deepsec from 0.1.0 before 1.1.17
contains a link followi
CVE-2026-109106 (A security flaw has been discovered in Polaris Office App
9.9.19 on An ...)
TODO: check
CVE-2026-108975 (A security flaw has been discovered in SourceCodester Library
Manageme ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-108974 (A vulnerability was identified in SourceCodester E-Learning
System 1.0 ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-108973 (A vulnerability was determined in SourceCodester Contact
Tracing Syste ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-108972 (A vulnerability was found in SourceCodester Human Resource
Management ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-108971 (A flaw has been found in D-Link DCS-930L B1.08B4. This
impacts the fun ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2026-108970 (A vulnerability was detected in itsmeravitejak
Online-Examination-Syst ...)
TODO: check
CVE-2026-108969 (A security vulnerability has been detected in itsmeravitejak
Online-Ex ...)
TODO: check
CVE-2026-108968 (A weakness has been identified in SourceCodester Performance
Indicator ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-108967 (A security flaw has been discovered in SourceCodester
Performance Indi ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-108966 (A vulnerability was identified in SourceCodester Performance
Indicator ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-108965 (A vulnerability was determined in SourceCodester Performance
Indicator ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-108964 (A vulnerability was found in SourceCodester Performance
Indicator Syst ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-108962 (A vulnerability has been found in storyicon
comfyui_segment_anything u ...)
TODO: check
CVE-2026-108961 (A flaw has been found in PaddlePaddle PaddleX up to 3.7.2.
Affected by ...)
@@ -495,19 +495,19 @@ CVE-2026-108961 (A flaw has been found in PaddlePaddle
PaddleX up to 3.7.2. Affe
CVE-2026-108960 (A vulnerability was detected in Tiiny-AI PowerInfer up to
8bd56d69906c ...)
TODO: check
CVE-2026-108959 (A security vulnerability has been detected in itsourcecode
Online Cake ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-108958 (A weakness has been identified in TensorLayer up to 2.2.4.
This affect ...)
TODO: check
CVE-2026-108957 (A security flaw has been discovered in TinyLLaVA
TinyLLaVA_Factory up ...)
TODO: check
CVE-2026-108956 (A vulnerability was identified in code-projects Online
Reviewer System ...)
- TODO: check
+ NOT-FOR-US: code-projects
CVE-2026-108955 (A vulnerability was determined in Tiiny-AI PowerInfer up to
8bd56d6990 ...)
TODO: check
CVE-2026-108954 (A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8.
This iss ...)
TODO: check
CVE-2026-108948 (A vulnerability has been found in code-projects Online
Reviewer System ...)
- TODO: check
+ NOT-FOR-US: code-projects
CVE-2026-108947 (A flaw has been found in yoshitomo-matsubara torchdistill up
to 1.1.5. ...)
TODO: check
CVE-2026-108945 (A vulnerability was detected in iMoonLab yolov13 up to
73289949533efac ...)
@@ -525,17 +525,17 @@ CVE-2026-108940 (A vulnerability was found in
EricLBuehler Mistral.rs up to 0.9.
CVE-2026-108939 (A vulnerability has been found in EricLBuehler mistral.rs up
to 0.9.3. ...)
TODO: check
CVE-2026-108938 (A flaw has been found in code-projects Matrimonial System
1.0. This is ...)
- TODO: check
+ NOT-FOR-US: code-projects
CVE-2026-108937 (A vulnerability was detected in code-projects Online Ticket
Reservatio ...)
- TODO: check
+ NOT-FOR-US: code-projects
CVE-2026-108936 (A security vulnerability has been detected in Edimax
BR-6208AC 1.32. T ...)
- TODO: check
+ NOT-FOR-US: Edimax
CVE-2026-108935 (A weakness has been identified in Edimax BR-6208AC 1.32.
Affected by t ...)
- TODO: check
+ NOT-FOR-US: Edimax
CVE-2026-108934 (A security flaw has been discovered in Edimax BR-6208AC 1.32.
Affected ...)
- TODO: check
+ NOT-FOR-US: Edimax
CVE-2026-108933 (A vulnerability was identified in Edimax BR-6208AC 1.32.
Affected is a ...)
- TODO: check
+ NOT-FOR-US: Edimax
CVE-2026-108932 (A vulnerability was determined in Netcore NR268 1.7.121109.
This impac ...)
TODO: check
CVE-2026-108931 (A vulnerability was found in Netcore NR268 1.7.121109. This
affects th ...)
@@ -545,11 +545,11 @@ CVE-2026-108930 (A vulnerability has been found in
Netcore NR268 1.7.121109. The
CVE-2026-108929 (A flaw has been found in Netcore NR268 1.7.121109. The
affected elemen ...)
TODO: check
CVE-2026-108928 (A security vulnerability has been detected in itsourcecode
Online Admi ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-108927 (A weakness has been identified in itsourcecode Baptism
Information Man ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-108926 (A security flaw has been discovered in itsourcecode Baptism
Informatio ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-108924 (A vulnerability was identified in getkirby Kirby up to
4.9.5/5.5.3. Af ...)
TODO: check
CVE-2026-108923 (A vulnerability was determined in 1024-lab smart-admin up to
3.30.0. A ...)
@@ -561,71 +561,71 @@ CVE-2026-108361 (Privasys Remote Attestation TLS Clients
provides multi-language
CVE-2026-106495 (Backstage is an open framework for building developer
portals. Prior t ...)
TODO: check
CVE-2026-105458 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-105052 (IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2
could allow ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104774 (OWASP Coraza WAF is a golang modsecurity compatible web
application fi ...)
TODO: check
CVE-2026-104661 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-104364 (IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5could
allow a ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104332 (IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104140 (QGIS is a free, open source, cross-platform geographic
information sys ...)
TODO: check
CVE-2026-103549 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-103316 (The macOS version of the DigiD app is not signed with
Hardened Runtime ...)
TODO: check
CVE-2026-102627 (IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could
allow a rem ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-102596 (Nango is an open-source platform for connecting agents and
products to ...)
TODO: check
CVE-2026-102539 (Super Productivity is an advanced todo list app with
integrated timebo ...)
TODO: check
CVE-2026-101168 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-100755 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-100104 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2025-71432 (Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains
a refle ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2025-71431 (Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP
injecti ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2025-71430 (Frappe before 14.99.10 and 15.x before 15.91.1 contains a
stored cross ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2025-71429 (GPT-SoVITS through 20250606v2pro contains an OS command
injection vuln ...)
TODO: check
CVE-2025-27902 (IBM DB2 Recovery Expert for Linux, UNIX and Windows5.5 IF 2
uses a web ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2025-27897 (IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2
is vulner ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2025-27896 (IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2
is vulner ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2025-27895 (IBMDB2 Recovery Expert for Linux, UNIX and Windows5.5 IF 2is
vulnerabl ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2024-58391 (Frappe before 14.58.0 and 15.x before 15.4.0 contains a
cross-site scr ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2024-58390 (Frappe before 14.81.4 and 15.x before 15.41.0 contains an
improper pri ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2024-58389 (HoloViz Panel from 1.2.2 before 1.9.0 contains an open
redirect vulner ...)
TODO: check
CVE-2023-54412 (Frappe before 13.46.3 and 14.x before 14.21.1 contains an
improper acc ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2023-54411 (Frappe framework before 13.32.0 uses weak authentication for
print vie ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2023-54410 (Frappe before 13.22.0 contains an improper authorization
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2023-54409 (Frappe before 13.46.1 and 14.x before 14.20.0 contains a
cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2023-54408 (Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML
injecti ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2023-54407 (Frappe 14.x before 14.45.0 contains an information disclosure
vulnerab ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2023-54406 (Frappe before 14.59.0 and 15.x before 15.5.0 contains a
sandbox flaw w ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2022-51020 (Flower before 2.2.0 contains a cross-site request forgery
vulnerabilit ...)
TODO: check
CVE-2021-48012 (fast-toml through 0.5.4 contains a prototype pollution
vulnerability t ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1b659b000ad491dc8baf8c95bc1b4ce4acdb7a1c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1b659b000ad491dc8baf8c95bc1b4ce4acdb7a1c
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
