Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
5a91a368 by security tracker role at 2026-10-13T19:15:54+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,9 +1,9 @@
CVE-2026-9218 (Insufficient input validation vulnerability in time server
(NTP) setti ...)
- TODO: check
+ NOT-FOR-US: Netgear
CVE-2026-97334 (The network messaging layer contained improper handling of
highly comp ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-97333 (QAPI contained a stack-based buffer overflow affecting service
availab ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-96535 (Cross-Site Scripting on the YouMind portal, specifically in
the avatar ...)
TODO: check
CVE-2026-96299 (A security issue was discovered in MongoDB mongos (the sharded
cluster ...)
@@ -11,13 +11,13 @@ CVE-2026-96299 (A security issue was discovered in MongoDB
mongos (the sharded c
CVE-2026-96297 (Use of freed memory in the aggregation feature of MongoDB
Server can c ...)
TODO: check
CVE-2026-95680 (IBM WebSphere Application Server 8.5, and 9.0 could allow an
authentic ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-95631 (Adobe Commerce is affected by an Improper Input Validation
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-95630 (Adobe Commerce is affected by an Improper Input Validation
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-95502 (A Git server that Grafana's Git Sync (provisioning) is
configured to u ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-95127 (An issue in libass v.0.17.5 allows a remote attacker to cause
a denial ...)
TODO: check
CVE-2026-95124 (Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4
allows ...)
@@ -35,61 +35,61 @@ CVE-2026-95114 (libwebsockets contains an out-of-bounds
read vulnerability in th
CVE-2026-94410 (A low privileged remote attacker is able to view a list of
roles that ...)
TODO: check
CVE-2026-93907 (IBM WebSphere Application Server 8.5, and 9.0 could allow a
remote att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93347 (Wazuh from 4.1.1 before 4.14.8 contains a path traversal
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-93346 (Wazuh from 4.0.0 before 4.14.8 contains a race condition in
API login ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-93294 (A user with query access to an Azure Monitor data source can
use its r ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-92922 (Adobe Commerce is affected by a stored Cross-Site Scripting
(XSS) vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-92911 (Adobe Commerce is affected by a stored Cross-Site Scripting
(XSS) vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-92910 (Adobe Commerce is affected by an Incorrect Authorization
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-92909 (Adobe Commerce is affected by an Incorrect Authorization
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-92908 (Adobe Commerce is affected by an Incorrect Authorization
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-92892 (Potential arbitrary code execution, under specific
configurations.)
TODO: check
CVE-2026-92464 (Adobe Commerce is affected by an Improper Input Validation
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-92088 (Improper handling of undefined values vulnerability in
upKeeper Soluti ...)
- TODO: check
+ NOT-FOR-US: upKeeper Solutions
CVE-2026-91013 (Adobe Commerce is affected by a stored Cross-Site Scripting
(XSS) vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-89309 (Vulnerability in tbc. This issue affects tbc: before 1.)
TODO: check
CVE-2026-89279 (Cross-Site request forgery (CSRF) vulnerability in AuthTake
Technology ...)
TODO: check
CVE-2026-89208 (A vulnerability has been identified in Capital Embedded AR
Classic 431 ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89206 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89205 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89204 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89203 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89202 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89201 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89200 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89199 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89198 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89197 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89196 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89097 (The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for
WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88838 (A flaw was found in BusyBox's mount utility. A non-root user
can bypas ...)
TODO: check
CVE-2026-88836
@@ -105,9 +105,9 @@ CVE-2026-85747 (Distribution is a toolkit to pack, ship,
store, and deliver cont
CVE-2026-85733 (FrankenPHP is a modern application server for PHP. Prior to
1.12.5, th ...)
TODO: check
CVE-2026-85115 (A vulnerability has been identified in .NET Client Library for
SIMATIC ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-85114 (A vulnerability has been identified in .NET Client Library for
SIMATIC ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-82416 (FrankenPHP is a modern application server for PHP. Prior to
1.12.5, Fr ...)
TODO: check
CVE-2026-81507 (ESF-IDF is the Espressif Internet of Things (IOT) Development
Framewor ...)
@@ -117,11 +117,11 @@ CVE-2026-78802 (An issue in SKYWORTH DIGITAL CO.,LTD
SK-WR6640X Wi-Fi 6 Dual-Ban
CVE-2026-78799 (Directory Traversal vulnerability in Quanxun Huiju Network
Technology ...)
TODO: check
CVE-2026-78557 (A vulnerability has been identified in Industrial Edge App
Publisher ( ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-78556 (A vulnerability has been identified in Industrial Edge App
Publisher ( ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-77459 (Argo CD is a declarative, GitOps continuous delivery tool for
Kubernet ...)
- TODO: check
+ NOT-FOR-US: Argo CD
CVE-2026-77375 (SFTPGo is an open source, event-driven file transfer solution.
Prior t ...)
TODO: check
CVE-2026-77362 (obsidian-tc is a governed, agent-ready Model Context Protocol
server f ...)
@@ -129,59 +129,59 @@ CVE-2026-77362 (obsidian-tc is a governed, agent-ready
Model Context Protocol se
CVE-2026-77361 (obsidian-tc is a governed, agent-ready Model Context Protocol
server f ...)
TODO: check
CVE-2026-77100 (MediaAgent contained a heap-based buffer overflow issue
affecting serv ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-77099 (CVFS contained an input validation issue affecting command
execution. ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-77096 (CVFS contained a missing authentication condition affecting
command ex ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-77095 (CvFWD contained a null pointer dereference affecting service
availabil ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-77094 (CvFWD contained an out-of-bounds write affecting service
availability. ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-77093 (CvFWD contained an integer overflow affecting service
availability. S ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-77090 (CVFS contained an XML external entity (XXE) reference handling
issue a ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-75120 (The OpenText\u2122 (EnCase SAFE Agents) component utilized by
OpenText ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2026-74047 (Wazuh from 4.0.0 before 4.14.8 contains an information
disclosure vuln ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74045 (Wazuh from 3.12.0 before 4.14.8 contains a heap buffer
overflow in fim ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74043 (Wazuh from 4.1.1 before 4.14.8 contains a path traversal
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74041 (Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity
mismatch betwee ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74040 (Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary
file over ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74037 (Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens
for run_as ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74036 (Wazuh from 4.3.0 before 4.14.8 contains a remote code
execution vulner ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74035 (Wazuh versions from 4.6.0 before 4.14.8 contain an
authentication bypa ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74034 (Wazuh from 4.1.0 before 4.14.8 contains a missing origin check
in wm_a ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74033 (Wazuh from 4.1.1 before 4.14.8 contains a path traversal
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74032 (Wazuh from 4.0.0 before 4.14.8 contains an authorization
bypass vulner ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74031 (Wazuh from 4.1.1 before 4.14.8 contains a path traversal
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74030 (Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML
alias exp ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-72895 (A vulnerability has been identified in SIMATIC IPC BX-21A (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-69227 (A flaw in Portal for ArcGIS allows unauthenticated access to
certain / ...)
- TODO: check
+ NOT-FOR-US: Esri
CVE-2026-69226 (A flaw in Portal for ArcGIS allows unauthenticated users to
create new ...)
- TODO: check
+ NOT-FOR-US: Esri
CVE-2026-67456 (NVIDIA Warp contains a vulnerability where an attacker could
cause a h ...)
TODO: check
CVE-2026-67165 (HCL Connections is vulnerable to a cross-site scripting attack
where a ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66057 (Frappe is a full-stack web application framework. Prior to
15.116.0 an ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-65200 (The openUBMC device-management process parses PLDM-over-MCTP
and NCSI- ...)
TODO: check
CVE-2026-65199 (openUBMC assigns the full privilege set to pseudo-identities
represent ...)
@@ -191,61 +191,61 @@ CVE-2026-65198 (Huawei's openUBMC ships a default SNMPv3
USM key that uses one v
CVE-2026-65197 (H3C HDM Family-A verifies the RSA signature of a firmware
image agains ...)
TODO: check
CVE-2026-65180 (NVIDIA Megatron-LM contains a vulnerability in checkpoint
loading wher ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65173 (NVIDIA AIStore for Linux contains a missing authentication
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65172 (NVIDIA AIStore for Linux and Kubernetes contains a missing
authorizati ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65170 (NVIDIA AIStore for Linux contains a vulnerability in the
experimental ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65164 (NVIDIA AIStore for Linux contains a path traversal
vulnerability in th ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65162 (NVIDIA AIStore for Linux contains a vulnerability in the
legacy ETL Ku ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65161 (NVIDIA AIStore for Linux contains a vulnerability in the
Promote API w ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65150 (NVIDIA DALI contains a vulnerability where an attacker could
cause an ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65149 (NVIDIA DALI contains a vulnerability where an attacker could
cause an ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65148 (NVIDIA DALI contains a vulnerability where an attacker could
cause a s ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65147 (NVIDIA DALI contains a vulnerability where an attacker could
cause an ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65141 (NVIDIA Isaac Lab contains a vulnerability where an attacker
could caus ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65131 (NVIDIA NVSentinel for Linux contains a vulnerability in the
platform-c ...)
TODO: check
CVE-2026-65110 (NVIDIA Megatron-LM contains a vulnerability in checkpoint
loading wher ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65104 (NVIDIA Megatron-LM for all platforms contains a vulnerability
in infer ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65103 (NVIDIA AIStore for Linux contains a path traversal
vulnerability in th ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65101 (NVIDIA AIStore for Linux contains a vulnerability in the
distributed s ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-63357 (Affected devices do not properly sanitize calculated signal
data conta ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63356 (Affected devices do not properly sanitize calculated signal
names cont ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63355 (Affected devices do not properly sanitize signal names
contained in im ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63354 (Affected devices do not properly validate and sanitize visual
marker d ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63353 (Affected devices do not properly sanitize comment fields
contained in ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63352 (Affected devices do not properly sanitize calculated signal
data conta ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63351 (Affected devices do not properly validate and sanitize visual
properti ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63350 (Affected devices do not properly restrict executable content
contained ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63316 (A SQL injection vulnerability has been identified in Payload
CMS. Impr ...)
TODO: check
CVE-2026-59241 (A vulnerability has been identified in SIMATIC WinCC V7.5 (All
version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-55823 (Frappe is a full-stack web application framework. Prior to
16.23.0, th ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-55695 (FearlessCMS is a flat-file content management system centered
on simpl ...)
TODO: check
CVE-2026-55675 (The Salty documentation repository builds and deploys the
docs.saltbox ...)
@@ -273,11 +273,11 @@ CVE-2026-53711 (MCP Context Forge provides an MCP Admin
UI for managing gateway
CVE-2026-53709 (MCP Context Forge is an MCP gateway and administrative
platform. Prior ...)
TODO: check
CVE-2026-53562 (Improper link resolution before file access ('link following')
vulnera ...)
- TODO: check
+ NOT-FOR-US: Citrix
CVE-2026-53420 (Buffer overflow in a Zoom Phone feature of Zoom Workplace
Clients may ...)
- TODO: check
+ NOT-FOR-US: Zoom
CVE-2026-53418 (Improper Authorization in Handler for Custom URL Scheme in
Zoom Workpl ...)
- TODO: check
+ NOT-FOR-US: Zoom
CVE-2026-52394 (DeepSeek V4 is vulnerable to Incorrect Access Control via a
crafted in ...)
TODO: check
CVE-2026-4869 (A potential privilege escalation issue was identified in
InstallShield ...)
@@ -287,43 +287,43 @@ CVE-2026-49265 (OAuthLib is an implementation of the
OAuth request-signing logic
CVE-2026-49264 (OAuthLib is an implementation of the OAuth request-signing
logic for P ...)
TODO: check
CVE-2026-44415 (Affected systems do not properly restrict access to internal
APIs and ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-44414 (A vulnerability has been identified in Industrial Edge Cloud
Device (I ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-37107 (An issue in HTMLy v.3.1.1 allows a remote attacker to escalate
privile ...)
TODO: check
CVE-2026-33374 (The Prometheus rule conversion API endpoints in Grafana do not
limit r ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-23707 (An Improper Neutralization of Special Elements used in an SQL
Command ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-23706 (An Improper Neutralization of Special Elements used in an SQL
Command ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-23705 (An Improper Neutralization of Special Elements used in an SQL
Command ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-19940 (The Bluetooth Classic Hands-Free Profile Audio Gateway
implementation ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-19939 (The AVDTP signalling layer arms a 6-second command timeout
(AVDTP_TIME ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-18228 (HyperScale contained a path traversal issue affecting
information disc ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-15577 (A user or service account with read-only access to Git Sync
(provision ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-15399 (The Animated Number Counters plugin for WordPress is
vulnerable to gen ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14308 (Zohocorp ManageEngine Malware Protection Plus versionsbefore
1.0.64.12 ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-13138 (Client-Side Enforcement of Server-Side Security vulnerability
in Divas ...)
TODO: check
CVE-2026-12656 (A denial-of-service security issue exists in the affected
product and ...)
- TODO: check
+ NOT-FOR-US: Rockwell Automation
CVE-2026-12655 (A security issue exists within 1732E ArmorBlock\xae I/O, where
an unau ...)
- TODO: check
+ NOT-FOR-US: Rockwell Automation
CVE-2026-11732 (An insufficient input validation vulnerability in the website
blocking ...)
- TODO: check
+ NOT-FOR-US: Netgear
CVE-2026-11731 (An authentication bypass vulnerability in the listed NETGEAR
RAX serie ...)
- TODO: check
+ NOT-FOR-US: Netgear
CVE-2026-11730 (Insufficient session randomness vulnerability in the listed
NETGEAR Ex ...)
- TODO: check
+ NOT-FOR-US: Netgear
CVE-2026-110249 (A malicious, compromised, or MITM-controlled Exchange server
can retur ...)
TODO: check
CVE-2026-110247 (Several buffer-growth sites in libmime performed size
arithmetic in 32 ...)
@@ -473,7 +473,7 @@ CVE-2026-110036 (A flaw was found in
device-mapper-persistent-data. A local atta
CVE-2026-110025 (A flaw has been found in slackero phpwcms up to
1.9.49/1.12.3. This is ...)
TODO: check
CVE-2026-10759 (A flaw in Portal for ArcGIS could allow LDAP injection through
adminis ...)
- TODO: check
+ NOT-FOR-US: Esri
CVE-2026-109976 (A flaw was found in the clevis PKCS#11 pin. The
clevis-pkcs11-afunix-s ...)
TODO: check
CVE-2026-109967 (yt-dlp-web-ui through 4.0.0 contains a NULL pointer
dereference vulner ...)
@@ -503,7 +503,7 @@ CVE-2026-109956 (NLTK through 3.10.3 contains a path
traversal vulnerability in
CVE-2026-109955 (Hono from 4.12.4 before 4.13.11 contains a middleware bypass
vulnerabi ...)
TODO: check
CVE-2026-109954 (Parse Server 5.4.0 before 8.6.96 and 9.0.0 before
9.10.2-alpha.5 share ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-109953 (FreeRDP 3.0.0 before 3.32.0 contains an insufficiently
protected crede ...)
TODO: check
CVE-2026-109952 (The FreeRDP client 3.0.0 before 3.32.0 does not check a
server-selecte ...)
@@ -537,11 +537,11 @@ CVE-2026-109939 (FreeRDP 3.27.1 before 3.32.0 contains a
NULL pointer dereferenc
CVE-2026-109938 (Positive mapped-video coordinates overflow and abort FreeRDP
clients A ...)
TODO: check
CVE-2026-109898 (Missing Authorization vulnerability in Arraytics WP Event
Solution wp- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109896 (Missing Authorization vulnerability in WP Chill Download
Monitor integ ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109890 (Missing Authorization vulnerability in LeapWorx Premium
Addons for Ele ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109854 (A flaw was found in m17n-lib. An attacker who supplies
crafted input t ...)
TODO: check
CVE-2026-109833 (A flaw was found in gnome-remote-desktop as shipped in Red
Hat Enterpr ...)
@@ -553,19 +553,19 @@ CVE-2026-109828 (A vulnerability was found in libsndfile
up to 1.2.2. This issue
CVE-2026-109827 (A vulnerability has been found in GPAC up to 26.07.0. This
vulnerabili ...)
TODO: check
CVE-2026-109703 (Missing Authorization vulnerability in WPGraphQL WPGraphQL
wp-graphql ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109699 (Missing Authorization vulnerability in ThemeGrill User
Registration us ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109697 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109696 (Missing Authorization vulnerability in WP ManageNinja LLC
FluentBoards ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109691 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109687 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109684 (Missing Authorization vulnerability in TMS Amelia
ameliabooking allows ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109680 (FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds
write in f ...)
TODO: check
CVE-2026-109679 (FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer
dereference ...)
@@ -577,13 +577,13 @@ CVE-2026-109677 (FreeRDP from 2.0.0-beta1 before 3.28.0
contains an out-of-bound
CVE-2026-109676 (FreeRDP from 3.0.0-beta1 before 3.32.0 contains a
use-after-free vulne ...)
TODO: check
CVE-2026-109620 (A vulnerability has been found in SourceCodester Online
Reviewer Syste ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-109607 (A flaw has been found in SourceCodester Online Exam System
1.0. Affect ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-109606 (A vulnerability was detected in SourceCodester Art Gallery
Management ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-109605 (A security vulnerability has been detected in SourceCodester
Simple Ca ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-109526 (A vulnerability has been found in HBAI-Ltd Toonflow-app up to
1.1.8. T ...)
TODO: check
CVE-2026-109525 (A vulnerability was identified in girishsaraf
Online-Appointment-Booki ...)
@@ -605,7 +605,7 @@ CVE-2026-109429 (Mistral Vibe before 2.25.4 contains a
command permission gate b
CVE-2026-109428 (Mistral Vibe before 2.25.5 contains a permission validation
bypass vul ...)
TODO: check
CVE-2026-109412 (An exposed dangerous endpoint in Ivanti Neurons Patch for
Intune allow ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-109410 (A vulnerability has been found in macrozheng mall 1.0.3
dcaa93b. The i ...)
TODO: check
CVE-2026-109409 (A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8.
The affect ...)
@@ -627,11 +627,11 @@ CVE-2026-109190 (A vulnerability has been found in
conductor-oss conductor 3.31.
CVE-2026-109189 (A vulnerability was detected in fit2cloud MeterSphere up to
3.6.9-lts. ...)
TODO: check
CVE-2026-109162 (Forms using FileUpload or ImageUpload elements with a custom
saveToFil ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-109160 (A vulnerability was determined in PublicCMS up to 5.202608.a.
Affected ...)
TODO: check
CVE-2026-109157 (A vulnerability was found in TRENDnet TEW-432BRP 3.10B20.
Affected by ...)
- TODO: check
+ NOT-FOR-US: TRENDnet
CVE-2026-109156 (A vulnerability has been found in SeldonIO MLServer up to
1.6.1. Affec ...)
TODO: check
CVE-2026-109155 (A flaw has been found in DeepPavlov up to 1.7.0. This impacts
the func ...)
@@ -653,29 +653,29 @@ CVE-2026-109115 (A vulnerability was found in
AdithyaYelloju Restaurant-Manageme
CVE-2026-109114 (A vulnerability has been found in AdithyaYelloju
Restaurant-Management ...)
TODO: check
CVE-2026-109110 (A flaw has been found in Wavlink WL-WN592AX6 250422. This
issue affect ...)
- TODO: check
+ NOT-FOR-US: Wavlink
CVE-2026-109109 (A vulnerability was detected in Wavlink WL-WN530BE1-A 251117.
This vul ...)
- TODO: check
+ NOT-FOR-US: Wavlink
CVE-2026-109108 (A security vulnerability has been detected in Wavlink
WL-WN530BE1-A 25 ...)
- TODO: check
+ NOT-FOR-US: Wavlink
CVE-2026-109107 (A weakness has been identified in Wavlink WL-WN592AX6 250422.
Affected ...)
- TODO: check
+ NOT-FOR-US: Wavlink
CVE-2026-108496 (Missing Authorization vulnerability in WP User Manager WP
User Manager ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108495 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108493 (Missing Authorization vulnerability in Karol\xedna
Vysko\u010dilov\xe1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108492 (Missing Authorization vulnerability in Fullworks Plugins
Quick Paypal ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108490 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108489 (Insertion of Sensitive Information Into Sent Data
vulnerability in Plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108488 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108487 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108385 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
TODO: check
CVE-2026-108384 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
@@ -699,17 +699,17 @@ CVE-2026-108376 (dataclasses-avroschema generates Avro
schemas from Python datac
CVE-2026-108375 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
TODO: check
CVE-2026-108185 (Improper certificate validation in the My Notes feature of
certain Zoo ...)
- TODO: check
+ NOT-FOR-US: Zoom
CVE-2026-108184 (Improper certificate validation in certain Zoom Clients for
Windows ma ...)
- TODO: check
+ NOT-FOR-US: Zoom
CVE-2026-108179 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108174 (Missing Authorization vulnerability in PluginUs.Net FOX
woocommerce-cu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-107918 (Insufficient input validation vulnerability in the LAN Setup
feature o ...)
- TODO: check
+ NOT-FOR-US: Netgear
CVE-2026-107917 (Insufficient input validation vulnerability in the PPPoE
Setup feature ...)
- TODO: check
+ NOT-FOR-US: Netgear
CVE-2026-107832 (fastify is a fast and low overhead web framework for Node.js.
In versi ...)
TODO: check
CVE-2026-107607 (SWIFI-SE2KIC firmware versions 2.0.22 and prior are
vulnerable to a Mi ...)
@@ -721,37 +721,37 @@ CVE-2026-107605 (SWIFI-SE2KIC firmware versions 2.0.22
and prior are vulnerable
CVE-2026-107460 (Server-Side Request Forgery (SSRF) protection in the
UrlImageConverter ...)
TODO: check
CVE-2026-106625 (Adobe Framemaker is affected by an out-of-bounds write
vulnerability t ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-106598 (Missing Authorization vulnerability in ThemeGrill User
Registration us ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106597 (Missing Authorization vulnerability in ThemeGrill User
Registration us ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106176 (A missing authorization vulnerability in Fortinet FortiSIEM
7.5.0 may ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-106175 (A Double Free vulnerability [CWE-415] vulnerability in
Fortinet FortiO ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-106173 (A improper limitation of a pathname to a restricted directory
('path t ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-106172 (A use of hard-coded cryptographic key vulnerability in
Fortinet FortiS ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-106171 (A improper neutralization of special elements used in an os
command (' ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-106170 (An Uncaught Exception vulnerability [CWE-248] vulnerability
in Fortine ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-106108 (Quasar Framework is a framework for building high-performance
Vue.js u ...)
TODO: check
CVE-2026-106047 (A Path Traversal vulnerability in the template export
functionality of ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-106043 (A Missing Authentication for Critical Function vulnerability
in Ivanti ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-106042 (An External Control of File Name or Path vulnerability in
Ivanti Xtrac ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-106035 (An Information Exposure Through Log Files vulnerability in
Ivanti Xtra ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-106034 (A Path Traversal vulnerability in Ivanti Xtraction before
version 2026 ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-105881 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105460 (A flaw was found in BlueZ. An out-of-bounds read
vulnerability exists ...)
TODO: check
CVE-2026-105445 (An Incorrect Privilege Assignment vulnerability in Docker
Hub's accoun ...)
@@ -759,21 +759,21 @@ CVE-2026-105445 (An Incorrect Privilege Assignment
vulnerability in Docker Hub's
CVE-2026-104937 (Shopware version 6.7 allows the upload of
attacker\u2011controlled HTM ...)
TODO: check
CVE-2026-104935 (Authentication bypass by spoofing in ICS before version
25.1.3.0 allow ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-104817 (Misskey is an open source, federated social media platform.
From 12.11 ...)
TODO: check
CVE-2026-104816 (Misskey is an open source, federated social media platform.
From 12.0. ...)
TODO: check
CVE-2026-104344 (Adobe Framemaker is affected by a Heap-based Buffer Overflow
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-104343 (Adobe Framemaker is affected by a NULL Pointer Dereference
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-104342 (Adobe Framemaker is affected by a Use After Free
vulnerability that co ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-104341 (Adobe Framemaker is affected by an out-of-bounds write
vulnerability t ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-104340 (Adobe Framemaker is affected by a Heap-based Buffer Overflow
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-104250 (The unstructured library provides open-source components for
ingesting ...)
TODO: check
CVE-2026-104192 (Dragonfly is an in-memory data store built for modern
application work ...)
@@ -789,9 +789,9 @@ CVE-2026-104005 (A security issue was discovered in MongoDB
mongos (the sharded
CVE-2026-104004 (MongoDB Server's collection validation feature may not
properly handle ...)
TODO: check
CVE-2026-103967 (Adobe Framemaker is affected by an out-of-bounds write
vulnerability t ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-103966 (Adobe Framemaker is affected by a Heap-based Buffer Overflow
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-103965 (An issue in MongoDB Server's aggregation framework can cause
certain c ...)
TODO: check
CVE-2026-103937 (Misskey is an open source, federated social media platform.
From 13.0. ...)
@@ -799,21 +799,21 @@ CVE-2026-103937 (Misskey is an open source, federated
social media platform. Fro
CVE-2026-103928 (Metabase is an open source business intelligence and
analytics platfor ...)
TODO: check
CVE-2026-103857 (Adobe Framemaker is affected by an out-of-bounds read
vulnerability th ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-103856 (Adobe Framemaker is affected by an out-of-bounds read
vulnerability th ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-103849 (Adobe Commerce is affected by an Improper Neutralization of
Special El ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-103572 (Improper control of generation of code ('code injection') in
Visual St ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-103499 (IBM WebSphere Application Server - Liberty 17.0.0.3 through
26.0.0.10 ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-103418 (Firefox for iOS directly interpolated the page\u2019s HTML
language at ...)
TODO: check
CVE-2026-103417 (Firefox for iOS could autofill saved credentials into a new
page if cr ...)
TODO: check
CVE-2026-103076 (Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill
User Reg ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103030 (Dio is a powerful HTTP client for Dart and Flutter. From
1.0.0 until 2 ...)
TODO: check
CVE-2026-103028 (SFTPGo is an open source, event-driven file transfer
solution. From 2. ...)
@@ -827,9 +827,9 @@ CVE-2026-102982 (Plane is an open-source project management
tool. Prior to 1.4.0
CVE-2026-102981 (Plane is an open-source project management tool. Prior to
1.4.0, self- ...)
TODO: check
CVE-2026-102850 (Heap-based buffer overflow in Microsoft Office Access allows
an unauth ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-102849 (Heap-based buffer overflow in Microsoft Office Access allows
an unauth ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-102832 (JupyterLab is an extensible environment for interactive and
reproducib ...)
TODO: check
CVE-2026-102734 (asteval is a Python expression evaluator designed for
restricted execu ...)
@@ -839,41 +839,41 @@ CVE-2026-102672 (Electron is a framework for writing
cross-platform desktop appl
CVE-2026-102603 (Gotify server is a simple server for sending and receiving
messages in ...)
TODO: check
CVE-2026-102562 (The AcyMailing plugin for WordPress is vulnerable to Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102342 (ammonia is a Rust library for repairing and securing
untrusted HTML. P ...)
TODO: check
CVE-2026-102250 (CWE-345: Insufficient Verification of Data Authenticity
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Schneider Electric
CVE-2026-102076 (A vulnerability has been identified in APOGEE MBC (PPC)
(BACnet) (All ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-102075 (A vulnerability has been identified in APOGEE MBC (PPC)
(BACnet) (All ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-102074 (A vulnerability has been identified in APOGEE MBC (PPC)
(BACnet) (All ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-102073 (A vulnerability has been identified in APOGEE MBC (PPC)
(BACnet) (All ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-102007 (The Bit integrations \u2013 Form Integration, Webhook,
Spreadsheets, C ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101899 (Axios is a promise-based HTTP client for the browser and
Node.js. From ...)
TODO: check
CVE-2026-101020 (An incorrect permission assignment for critical resource
issue exists ...)
TODO: check
CVE-2026-100133 (Adobe Commerce is affected by a stored Cross-Site Scripting
(XSS) vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-0893 (AMI APTIOV contains a vulnerability in BIOS where an attacker
may caus ...)
- TODO: check
+ NOT-FOR-US: AMI
CVE-2025-58774 (AMI APTIOV contains vulnerabilities in BIOS where users may
cause \u20 ...)
- TODO: check
+ NOT-FOR-US: AMI
CVE-2025-58773 (AMI APTIOV contains vulnerabilities in BIOS where users may
cause "Out ...)
- TODO: check
+ NOT-FOR-US: AMI
CVE-2025-58772 (AMI APTIOV contains vulnerabilities in BIOS where users may
cause \u20 ...)
- TODO: check
+ NOT-FOR-US: AMI
CVE-2025-58771 (AMI APTIOV contains vulnerabilities in BIOS where users may
cause \u20 ...)
- TODO: check
+ NOT-FOR-US: AMI
CVE-2025-57739 (An improper neutralization of special elements used in an SQL
Command ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2025-46773 (An Improper Neutralization of Special Elements used in an SQL
Command ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2024-34326 (ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain
a reflec ...)
TODO: check
CVE-2024-34324 (An issue in ProPhoenix Law RMS v2022.2403.3.101 allows
attackers to ex ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5a91a3682107379ba91f0efcd61f1a9aabe42181
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5a91a3682107379ba91f0efcd61f1a9aabe42181
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
