Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
39c625cc by Moritz Muehlenhoff at 2026-10-14T01:06:30+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -267,7 +267,7 @@ CVE-2026-55823 (Frappe is a full-stack web application
framework. Prior to 16.23
CVE-2026-55695 (FearlessCMS is a flat-file content management system centered
on simpl ...)
NOT-FOR-US: FearlessCMS
CVE-2026-55675 (The Salty documentation repository builds and deploys the
docs.saltbox ...)
- TODO: check
+ NOT-FOR-US: Salty documentation repository
CVE-2026-55562 (Cronicle is a multi-server task scheduler and runner, with a
web based ...)
NOT-FOR-US: Cronicle
CVE-2026-55376 (Heym builds and runs agentic systems and business-process
automations ...)
@@ -275,9 +275,9 @@ CVE-2026-55376 (Heym builds and runs agentic systems and
business-process automa
CVE-2026-55183 (RClone Manager is a cross-platform GUI application designed to
help us ...)
NOT-FOR-US: RClone Manager
CVE-2026-54700 (ConnectBot SSH Client Library is written in Kotlin with Kaitai
Struct ...)
- TODO: check
+ NOT-FOR-US: ConnectBot
CVE-2026-54697 (ConnectBot SSH Client Library is written in Kotlin with Kaitai
Struct ...)
- TODO: check
+ NOT-FOR-US: ConnectBot
CVE-2026-54641 (OpenRemote is an open-source internet-of-things platform.
Prior to 1.2 ...)
NOT-FOR-US: OpenRemote
CVE-2026-54640 (OpenRemote is an open-source internet-of-things platform.
Prior to 1.2 ...)
@@ -285,7 +285,7 @@ CVE-2026-54640 (OpenRemote is an open-source
internet-of-things platform. Prior
CVE-2026-54454 (OpenCATS is an open-source applicant tracking system and
recruitment C ...)
NOT-FOR-US: OpenCATS
CVE-2026-54086 (SLE API for Java is an implementation of CCSDS Space Link
Extension Se ...)
- TODO: check
+ NOT-FOR-US: SLE API for Java
CVE-2026-53711 (MCP Context Forge provides an MCP Admin UI for managing
gateway resour ...)
NOT-FOR-US: MCP Context Forge
CVE-2026-53709 (MCP Context Forge is an MCP gateway and administrative
platform. Prior ...)
@@ -299,7 +299,7 @@ CVE-2026-53418 (Improper Authorization in Handler for
Custom URL Scheme in Zoom
CVE-2026-52394 (DeepSeek V4 is vulnerable to Incorrect Access Control via a
crafted in ...)
NOT-FOR-US: DeepSeek
CVE-2026-4869 (A potential privilege escalation issue was identified in
InstallShield ...)
- TODO: check
+ NOT-FOR-US: InstallShield
CVE-2026-49265 (OAuthLib is an implementation of the OAuth request-signing
logic for P ...)
TODO: check
CVE-2026-49264 (OAuthLib is an implementation of the OAuth request-signing
logic for P ...)
@@ -309,7 +309,7 @@ CVE-2026-44415 (Affected systems do not properly restrict
access to internal API
CVE-2026-44414 (A vulnerability has been identified in Industrial Edge Cloud
Device (I ...)
NOT-FOR-US: Siemens
CVE-2026-37107 (An issue in HTMLy v.3.1.1 allows a remote attacker to escalate
privile ...)
- TODO: check
+ NOT-FOR-US: HTMLy
CVE-2026-33374 (The Prometheus rule conversion API endpoints in Grafana do not
limit r ...)
NOT-FOR-US: Grafana
CVE-2026-23707 (An Improper Neutralization of Special Elements used in an SQL
Command ...)
@@ -331,7 +331,7 @@ CVE-2026-15399 (The Animated Number Counters plugin for
WordPress is vulnerable
CVE-2026-14308 (Zohocorp ManageEngine Malware Protection Plus versionsbefore
1.0.64.12 ...)
NOT-FOR-US: Zoho
CVE-2026-13138 (Client-Side Enforcement of Server-Side Security vulnerability
in Divas ...)
- TODO: check
+ NOT-FOR-US: Biletiva Ticketing Platform
CVE-2026-12656 (A denial-of-service security issue exists in the affected
product and ...)
NOT-FOR-US: Rockwell Automation
CVE-2026-12655 (A security issue exists within 1732E ArmorBlock\xae I/O, where
an unau ...)
@@ -347,179 +347,179 @@ CVE-2026-110249 (A malicious, compromised, or
MITM-controlled Exchange server ca
CVE-2026-110247 (Several buffer-growth sites in libmime performed size
arithmetic in 32 ...)
TODO: check
CVE-2026-110240 (Lancet through 2.3.9 contains an SSRF protection bypass
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Lancet
CVE-2026-110239 (Rapyd Admin before 9.20.0 contains a stored cross-site
scripting vulne ...)
- TODO: check
+ NOT-FOR-US: Rapyd Admin
CVE-2026-110238 (Rapyd Admin from 9.0.0 before 9.20.0 contains an
authorization bypass ...)
- TODO: check
+ NOT-FOR-US: Rapyd Admin
CVE-2026-110237 (Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO
in the s ...)
TODO: check
CVE-2026-110236 (KDE Dolphin 24.08.0 through 26.08.2 contains an OS command
injection v ...)
TODO: check
CVE-2026-110235 (MP Manager through 1.1.0 contains a path traversal
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: MP Manager
CVE-2026-110234 (Elio through 1.13.0 contains an insecure temporary file
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Elio
CVE-2026-110233 (Rovr through 0.10.3 on Windows contains an OS command
injection vulner ...)
- TODO: check
+ NOT-FOR-US: Rovr
CVE-2026-110232 (Fossify File Manager through 1.6.2 contains a path traversal
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Fossify File Manager
CVE-2026-110231 (muCommander through 1.6.2 contains a path traversal
vulnerability in U ...)
- TODO: check
+ NOT-FOR-US: muCommander
CVE-2026-110230 (XBackBone through 3.8.2 contains a missing authorization
vulnerability ...)
- TODO: check
+ NOT-FOR-US: XBackBone
CVE-2026-110229 (QloApps through 1.7.0 contains an improper access control
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-110228 (wallabag 2.6.13 through 2.6.14 contains a stored cross-site
scripting ...)
- TODO: check
+ NOT-FOR-US: wallabag
CVE-2026-110226 (QloApps through 1.7.0 contains a broken access control
vulnerability t ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-110225 (Shaarli through 0.16.9 contains a server-side request forgery
vulnerab ...)
TODO: check
CVE-2026-110224 (QloApps through 1.7.0 contains a reflected cross-site
scripting vulner ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-110223 (Kavita 0.9.0 through 0.9.1.4 contains a server-side request
forgery vu ...)
- TODO: check
+ NOT-FOR-US: Kavita
CVE-2026-110222 (Razorpay IFSC Ruby gem through 2.0.62 contains a server-side
request f ...)
- TODO: check
+ NOT-FOR-US: Razorpay IFSC Ruby gem
CVE-2026-110221 (QloApps through 1.7.0 contains a reflected cross-site
scripting vulner ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-110220 (Kubeflow Model Registry through 0.3.17 contains a server-side
request ...)
TODO: check
CVE-2026-110219 (QloApps through 1.7.0 contains a reflected cross-site
scripting vulner ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-110218 (Aureus ERP through 1.6.0 contains an authorization bypass
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Aureus ERP
CVE-2026-110217 (Lenve vhr through commit 03abbd3 contains an information
disclosure vu ...)
TODO: check
CVE-2026-110216 (youlai-boot through 2.21.1 contains a missing authorization
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: youlai-boot
CVE-2026-110215 (youlai-boot through 2.21.1 contains a missing authorization
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: youlai-boot
CVE-2026-110214 (Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that
allows u ...)
- TODO: check
+ NOT-FOR-US: Snowy
CVE-2026-110213 (Stonewuu ai-fusion-video through 1.2.0 contains an insecure
direct obj ...)
- TODO: check
+ NOT-FOR-US: ai-fusion-videoSnowy
CVE-2026-110212 (Stonewuu ai-fusion-video through 1.2.0 contains a path
traversal vulne ...)
- TODO: check
+ NOT-FOR-US: ai-fusion-videoSnowy
CVE-2026-110211 (iFlytek SkillHub through 0.2.22 contains a missing
authorization vulne ...)
- TODO: check
+ NOT-FOR-US: iFlytek SkillHub
CVE-2026-110210 (Phase Console through 2.77.3 contains a missing authorization
vulnerab ...)
- TODO: check
+ NOT-FOR-US: Phase Console
CVE-2026-110209 (Stonewuu ai-fusion-video through 1.2.0 contains a missing
authorizatio ...)
- TODO: check
+ NOT-FOR-US: ai-fusion-videoSnowy
CVE-2026-110208 (Wukong AICRM through 20260610 contains a missing
authorization vulnera ...)
- TODO: check
+ NOT-FOR-US: Wukong AICRM
CVE-2026-110207 (Wukong AICRM through 20260610 contains a missing
authorization vulnera ...)
- TODO: check
+ NOT-FOR-US: Wukong AICRM
CVE-2026-110206 (Roo Code through 3.54.0 contains a command approval bypass
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Roo Code
CVE-2026-110205 (Roo Code through 3.54.0 contains a command approval bypass
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Roo Code
CVE-2026-110204 (Roo Code through 3.54.0 contains a command approval bypass
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Roo Code
CVE-2026-110203 (Roo Code through 3.54.0 contains a command approval bypass
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Roo Code
CVE-2026-110202 (Roo Code through 3.54.0 contains a command approval bypass
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Roo Code
CVE-2026-110131 (ThriveX-Server through 4.0 contains a missing authorization
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: ThriveX-Server
CVE-2026-110129 (fuintCatering through commit 122c9e6 contains an insecure
direct objec ...)
- TODO: check
+ NOT-FOR-US: fuintCatering
CVE-2026-110128 (fuint through commit 4c4bc8a contains a missing
authentication vulnera ...)
- TODO: check
+ NOT-FOR-US: fuint
CVE-2026-110127 (waynboot-mall through 2.0.0 contains an insecure direct
object referen ...)
- TODO: check
+ NOT-FOR-US: waynboot-mall
CVE-2026-110126 (waynboot-mall through 2.0.0 contains an insecure direct
object referen ...)
- TODO: check
+ NOT-FOR-US: waynboot-mall
CVE-2026-110125 (Waynboot-mall through 2.0.0 contains an insecure direct
object referen ...)
- TODO: check
+ NOT-FOR-US: waynboot-mall
CVE-2026-110124 (FastBee through 2.1.0 contains an insecure direct object
reference vul ...)
- TODO: check
+ NOT-FOR-US: FastNee
CVE-2026-110123 (Makunet maku-boot 4.3.0 through 5.0.0 contains a missing
authorization ...)
- TODO: check
+ NOT-FOR-US: maku-boot
CVE-2026-110122 (PickMall lilishop through 4.4 contains an insecure direct
object refer ...)
- TODO: check
+ NOT-FOR-US: PickMall lilishop
CVE-2026-110121 (PickMall lilishop through 4.4 contains an insecure direct
object refer ...)
- TODO: check
+ NOT-FOR-US: PickMall lilishop
CVE-2026-110120 (Yshopmall through 2.0.0 contains an insecure direct object
reference v ...)
- TODO: check
+ NOT-FOR-US: Yshopmall
CVE-2026-110119 (Yshopmall through 2.0.0 contains an insecure direct object
reference v ...)
- TODO: check
+ NOT-FOR-US: Yshopmall
CVE-2026-110118 (WorkFlow-Engine through 9.6.11 contains a missing
authorization vulner ...)
- TODO: check
+ NOT-FOR-US: WorkFlow-Engine
CVE-2026-110117 (SmartAdmin through 3.30.0 contains a missing authorization
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: SmartAdmin
CVE-2026-110116 (Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11
contains a pat ...)
- TODO: check
+ NOT-FOR-US: Risesoft
CVE-2026-110115 (Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains
a path t ...)
- TODO: check
+ NOT-FOR-US: Risesoft
CVE-2026-110114 (FJ-OMS oms-erp through PRE contains a missing authentication
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: FJ-OMS oms-erp
CVE-2026-110113 (PublicCMS through V6.202608.a contains an insecure direct
object refer ...)
- TODO: check
+ NOT-FOR-US: PublicCMS
CVE-2026-110110 (JetLinks Community through 2.10.0 contains a missing
authorization vul ...)
- TODO: check
+ NOT-FOR-US: JetLinks
CVE-2026-110109 (JetLinks Community through 2.10.0 contains a missing
authorization vul ...)
- TODO: check
+ NOT-FOR-US: JetLinks
CVE-2026-110108 (MateCloud through 5.0.8 contains a missing authorization
vulnerability ...)
- TODO: check
+ NOT-FOR-US: MateCloud
CVE-2026-110107 (RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct
object refe ...)
- TODO: check
+ NOT-FOR-US: RuoYi
CVE-2026-110106 (RuoYi-Vue-Plus through 6.0.0 contains an insecure direct
object refere ...)
- TODO: check
+ NOT-FOR-US: RuoYi
CVE-2026-110105 (B3log Symphony through 3.6.4 contains a missing authorization
vulnerab ...)
- TODO: check
+ NOT-FOR-US: B3log Symphony
CVE-2026-110104 (Xxyopen novel through 3.5.0 contains a weak password hashing
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Xxyopen novel
CVE-2026-110103 (bbs-go through 4.4.6 contains a stored cross-site scripting
vulnerabil ...)
TODO: check
CVE-2026-110102 (Powerlevel10k through 1.20.0 contains an insecure download
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Powerlevel10k
CVE-2026-110101 (Koillection through 1.8.4 contains a stored cross-site
scripting vulne ...)
- TODO: check
+ NOT-FOR-US: Koillection
CVE-2026-110100 (Jorani before 1.0.4 contains a missing authorization
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Jorani
CVE-2026-110099 (Jorani before 1.0.4 contains a missing authorization
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Jorani
CVE-2026-110098 (Jorani before 1.0.4 contains an insecure direct object
reference vulne ...)
- TODO: check
+ NOT-FOR-US: Jorani
CVE-2026-110097 (Ikaros 1.2.0 through 1.2.5 contains an authentication bypass
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Ikaros
CVE-2026-110036 (A flaw was found in device-mapper-persistent-data. A local
attacker ca ...)
TODO: check
CVE-2026-110025 (A flaw has been found in slackero phpwcms up to
1.9.49/1.12.3. This is ...)
- TODO: check
+ NOT-FOR-US: phpwcms
CVE-2026-10759 (A flaw in Portal for ArcGIS could allow LDAP injection through
adminis ...)
NOT-FOR-US: Esri
CVE-2026-109976 (A flaw was found in the clevis PKCS#11 pin. The
clevis-pkcs11-afunix-s ...)
TODO: check
CVE-2026-109967 (yt-dlp-web-ui through 4.0.0 contains a NULL pointer
dereference vulner ...)
- TODO: check
+ NOT-FOR-US: yt-dlp-web-ui
CVE-2026-109966 (yt-dlp-web-ui through 4.0.0 contains an argument injection
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: yt-dlp-web-ui
CVE-2026-109965 (Serena before 2.0.0 contains an improper link resolution
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Serena
CVE-2026-109964 (ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap
buffer under ...)
TODO: check
CVE-2026-109963 (Froxlor before 2.3.14 contains an insecure direct object
reference vul ...)
- TODO: check
+ - froxlor <itp> (bug #581792)
CVE-2026-109962 (Froxlor 0.10.0 before 2.3.14 contains a missing authorization
vulnerab ...)
- TODO: check
+ - froxlor <itp> (bug #581792)
CVE-2026-109961 (Froxlor 0.10.0 before 2.3.14 contains a newline injection
vulnerabilit ...)
- TODO: check
+ - froxlor <itp> (bug #581792)
CVE-2026-109960 (Froxlor 2.0.0 before 2.3.14 contains a stored cross-site
scripting vul ...)
- TODO: check
+ - froxlor <itp> (bug #581792)
CVE-2026-109959 (EspoCRM 4.0.0 before 10.0.7 contains an access control
vulnerability t ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-109958 (EspoCRM 4.0.0 before 10.0.7 contains an improper access
control vulner ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-109957 (EspoCRM before 10.0.7 contains an insecure direct object
reference vul ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-109956 (NLTK through 3.10.3 contains a path traversal vulnerability
in WekaCla ...)
TODO: check
CVE-2026-109955 (Hono from 4.12.4 before 4.13.11 contains a middleware bypass
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Hono
CVE-2026-109954 (Parse Server 5.4.0 before 8.6.96 and 9.0.0 before
9.10.2-alpha.5 share ...)
NOT-FOR-US: Parse Server
CVE-2026-109953 (FreeRDP 3.0.0 before 3.32.0 contains an insufficiently
protected crede ...)
@@ -569,7 +569,7 @@ CVE-2026-109832 (A flaw was found in gnome-remote-desktop
as shipped in Red Hat
CVE-2026-109828 (A vulnerability was found in libsndfile up to 1.2.2. This
issue affect ...)
TODO: check
CVE-2026-109827 (A vulnerability has been found in GPAC up to 26.07.0. This
vulnerabili ...)
- TODO: check
+ - gpac <removed>
CVE-2026-109703 (Missing Authorization vulnerability in WPGraphQL WPGraphQL
wp-graphql ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-109699 (Missing Authorization vulnerability in ThemeGrill User
Registration us ...)
@@ -603,59 +603,59 @@ CVE-2026-109606 (A vulnerability was detected in
SourceCodester Art Gallery Mana
CVE-2026-109605 (A security vulnerability has been detected in SourceCodester
Simple Ca ...)
NOT-FOR-US: SourceCodester
CVE-2026-109526 (A vulnerability has been found in HBAI-Ltd Toonflow-app up to
1.1.8. T ...)
- TODO: check
+ NOT-FOR-US: HBAI-Ltd Toonflow-app
CVE-2026-109525 (A vulnerability was identified in girishsaraf
Online-Appointment-Booki ...)
- TODO: check
+ NOT-FOR-US: Online-Appointment-Booking
CVE-2026-109524 (A vulnerability was determined in girishsaraf
Online-Appointment-Booki ...)
- TODO: check
+ NOT-FOR-US: Online-Appointment-Booking
CVE-2026-109523 (A vulnerability was found in girishsaraf
Online-Appointment-Booking-Sy ...)
- TODO: check
+ NOT-FOR-US: Online-Appointment-Booking
CVE-2026-109522 (A vulnerability has been found in girishsaraf
Online-Appointment-Booki ...)
- TODO: check
+ NOT-FOR-US: Online-Appointment-Booking
CVE-2026-109521 (A vulnerability was detected in girishsaraf
Online-Appointment-Booking ...)
- TODO: check
+ NOT-FOR-US: Online-Appointment-Booking
CVE-2026-109520 (A flaw has been found in Colorful iGameCenter 2.0.0.82.
Affected by th ...)
- TODO: check
+ NOT-FOR-US: iGameCenter
CVE-2026-109519 (A vulnerability was detected in YouTransfer up to
0.0.7/1.0.6/1.1.0. A ...)
- TODO: check
+ NOT-FOR-US: YouTransfer
CVE-2026-109429 (Mistral Vibe before 2.25.4 contains a command permission gate
bypass v ...)
- TODO: check
+ NOT-FOR-US: Mistral Vibe
CVE-2026-109428 (Mistral Vibe before 2.25.5 contains a permission validation
bypass vul ...)
- TODO: check
+ NOT-FOR-US: Mistral Vibe
CVE-2026-109412 (An exposed dangerous endpoint in Ivanti Neurons Patch for
Intune allow ...)
NOT-FOR-US: Ivanti
CVE-2026-109410 (A vulnerability has been found in macrozheng mall 1.0.3
dcaa93b. The i ...)
- TODO: check
+ NOT-FOR-US: macrozheng mall
CVE-2026-109409 (A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8.
The affect ...)
- TODO: check
+ NOT-FOR-US: HBAI-Ltd Toonflow-app
CVE-2026-109407 (A security vulnerability has been detected in macrozheng mall
up to 1. ...)
- TODO: check
+ NOT-FOR-US: macrozheng mall
CVE-2026-109406 (A weakness has been identified in macrozheng mall up to
1.0.3. This vu ...)
- TODO: check
+ NOT-FOR-US: macrozheng mall
CVE-2026-109405 (A security flaw has been discovered in conductor-oss
conductor up to 3 ...)
- TODO: check
+ NOT-FOR-US: conductor
CVE-2026-109404 (A vulnerability was identified in conductor-oss conductor up
to 3.33.0 ...)
- TODO: check
+ NOT-FOR-US: conductor
CVE-2026-109403 (A vulnerability was determined in conductor-oss conductor up
to 3.32.5 ...)
- TODO: check
+ NOT-FOR-US: conductor
CVE-2026-109402 (A vulnerability was found in conductor-oss conductor 3.22.0.
Affected ...)
- TODO: check
+ NOT-FOR-US: conductor
CVE-2026-109190 (A vulnerability has been found in conductor-oss conductor
3.31.2. This ...)
- TODO: check
+ NOT-FOR-US: conductor
CVE-2026-109189 (A vulnerability was detected in fit2cloud MeterSphere up to
3.6.9-lts. ...)
- TODO: check
+ NOT-FOR-US: MeterSphere
CVE-2026-109162 (Forms using FileUpload or ImageUpload elements with a custom
saveToFil ...)
NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-109160 (A vulnerability was determined in PublicCMS up to 5.202608.a.
Affected ...)
- TODO: check
+ NOT-FOR-US: PublicCMS
CVE-2026-109157 (A vulnerability was found in TRENDnet TEW-432BRP 3.10B20.
Affected by ...)
NOT-FOR-US: TRENDnet
CVE-2026-109156 (A vulnerability has been found in SeldonIO MLServer up to
1.6.1. Affec ...)
- TODO: check
+ NOT-FOR-US: SeldonIO MLServer
CVE-2026-109155 (A flaw has been found in DeepPavlov up to 1.7.0. This impacts
the func ...)
- TODO: check
+ NOT-FOR-US: DeepPavlov
CVE-2026-109153 (A vulnerability was detected in MosaicML Composer up to
0.32.1. This a ...)
- TODO: check
+ NOT-FOR-US: MosaicML Composer
CVE-2026-109152 (A security vulnerability has been detected in jbardin scp.py
up to 0.1 ...)
TODO: check
CVE-2026-109149 (A weakness has been identified in beautifier js-beautify up
to 1.15.1/ ...)
@@ -695,27 +695,27 @@ CVE-2026-108488 (Improper Neutralization of Input During
Web Page Generation ('C
CVE-2026-108487 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108385 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
- TODO: check
+ NOT-FOR-US: dataclasses-avroschema
CVE-2026-108384 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
- TODO: check
+ NOT-FOR-US: dataclasses-avroschema
CVE-2026-108383 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
- TODO: check
+ NOT-FOR-US: dataclasses-avroschema
CVE-2026-108382 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
- TODO: check
+ NOT-FOR-US: dataclasses-avroschema
CVE-2026-108381 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
- TODO: check
+ NOT-FOR-US: dataclasses-avroschema
CVE-2026-108380 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
- TODO: check
+ NOT-FOR-US: dataclasses-avroschema
CVE-2026-108379 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
- TODO: check
+ NOT-FOR-US: dataclasses-avroschema
CVE-2026-108378 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
- TODO: check
+ NOT-FOR-US: dataclasses-avroschema
CVE-2026-108377 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
- TODO: check
+ NOT-FOR-US: dataclasses-avroschema
CVE-2026-108376 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
- TODO: check
+ NOT-FOR-US: dataclasses-avroschema
CVE-2026-108375 (dataclasses-avroschema generates Avro schemas from Python
dataclasses, ...)
- TODO: check
+ NOT-FOR-US: dataclasses-avroschema
CVE-2026-108185 (Improper certificate validation in the My Notes feature of
certain Zoo ...)
NOT-FOR-US: Zoom
CVE-2026-108184 (Improper certificate validation in certain Zoom Clients for
Windows ma ...)
@@ -729,13 +729,13 @@ CVE-2026-107918 (Insufficient input validation
vulnerability in the LAN Setup fe
CVE-2026-107917 (Insufficient input validation vulnerability in the PPPoE
Setup feature ...)
NOT-FOR-US: Netgear
CVE-2026-107832 (fastify is a fast and low overhead web framework for Node.js.
In versi ...)
- TODO: check
+ NOT-FOR-US: Nod fastify
CVE-2026-107607 (SWIFI-SE2KIC firmware versions 2.0.22 and prior are
vulnerable to a Mi ...)
- TODO: check
+ NOT-FOR-US: SWIFI-SE2KIC
CVE-2026-107606 (SWIFI-SE2KIC firmware versions 2.0.22 and prior are
vulnerable to a Mi ...)
- TODO: check
+ NOT-FOR-US: SWIFI-SE2KIC
CVE-2026-107605 (SWIFI-SE2KIC firmware versions 2.0.22 and prior are
vulnerable to a Mi ...)
- TODO: check
+ NOT-FOR-US: SWIFI-SE2KIC
CVE-2026-107460 (Server-Side Request Forgery (SSRF) protection in the
UrlImageConverter ...)
TODO: check
CVE-2026-106625 (Adobe Framemaker is affected by an out-of-bounds write
vulnerability t ...)
@@ -779,9 +779,9 @@ CVE-2026-104937 (Shopware version 6.7 allows the upload of
attacker\u2011control
CVE-2026-104935 (Authentication bypass by spoofing in ICS before version
25.1.3.0 allow ...)
NOT-FOR-US: Ivanti
CVE-2026-104817 (Misskey is an open source, federated social media platform.
From 12.11 ...)
- TODO: check
+ NOT-FOR-US: Misskey
CVE-2026-104816 (Misskey is an open source, federated social media platform.
From 12.0. ...)
- TODO: check
+ NOT-FOR-US: Misskey
CVE-2026-104344 (Adobe Framemaker is affected by a Heap-based Buffer Overflow
vulnerabi ...)
NOT-FOR-US: Adobe
CVE-2026-104343 (Adobe Framemaker is affected by a NULL Pointer Dereference
vulnerabili ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/39c625ccf94551e278edab6d7e089309ddc2efb5
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/39c625ccf94551e278edab6d7e089309ddc2efb5
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
