Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d3aadb17 by security tracker role at 2026-10-15T07:14:59+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,61 +1,61 @@
CVE-2026-96540 (An improper access control vulnerability has been identified
in the So ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-96537 (The Tutor LMS WordPress plugin before 4.1.1 does not perform
a capabi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93484 (Znuny through 7.3.6 constructs a ticket-search database query
by direc ...)
TODO: check
CVE-2026-93483 (In Znuny through 7.3.6, an attacker can bypass specific
standard login ...)
TODO: check
CVE-2026-92429 (The Rede Ita\xfa for WooCommerce WordPress plugin before 5.5.3
does no ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92428 (The Rede Ita\xfa for WooCommerce WordPress plugin before 5.5.3
does no ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88043 (The Mang Board WP plugin for WordPress is vulnerable to Stored
Cross-S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86803 (The The Ocean Extra plugin for WordPress is vulnerable to
arbitrary sh ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81534 (The Email Customizer for WooCommerce (Pro) plugin for
WordPress is vul ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-79822 (A security vulnerability inHPE NonStop TNS/X Native Inspect
may cause ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79821 (A security vulnerability inHPE NonStop SOAP 4.0 may cause
memory corr ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-78087 (The VK Blocks plugin for WordPress is vulnerable to Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78001 (The Post and Page Builder by BoldGrid \u2013 Visual Drag and
Drop Edit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-77931 (MoviePilot through 3.1.5 contains a command injection
vulnerability th ...)
TODO: check
CVE-2026-77427 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
TODO: check
CVE-2026-76668 (A security vulnerability inHPE NonStop Kernel may allow user
space acc ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76667 (A security vulnerability inHPE NonStop EXPAND may result in
out-of-bou ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76666 (A security vulnerability inHPE NonStop EXPAND may result in
out-of-bou ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76665 (A security vulnerability inHPE NonStop EXPAND may cause
out-of-bounds ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76664 (A security vulnerability inHPE NonStop EXPAND may result in
out-of-bou ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76663 (A stack-based buffer overflow vulnerability inHPE NonStop
TELSERV can ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76662 (A buffer overflow vulnerability inHPE NonStop TELSERV can
cause memory ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76661 (A vulnerability in HPE NonStop QIOMON allows an out-of-bounds
write th ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76660 (A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds
write ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76659 (A vulnerability in the finger daemon of HPE NonStop TCP/IP
UTILITIES c ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76656 (A vulnerability in HPE NonStop TCP/IP UTILITIES could allow
an unaut ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76066 (IntentKit through 2.6.3 contains an authorization bypass
vulnerability ...)
TODO: check
CVE-2026-74920 (The Document Gallery WordPress plugin through 5.1.1 does not
properly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-73799 (A security vulnerability inHPE NonStop SNMP Trap Multiplexer
may cause ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-71854 (OpenAEV is an open source platform allowing organizations to
plan, sch ...)
TODO: check
CVE-2026-69194 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
@@ -89,17 +89,17 @@ CVE-2026-57490 (FileRise is a self-hosted web-based file
manager with multi-file
CVE-2026-57489 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
TODO: check
CVE-2026-55684 (WeGIA is a web manager for charitable institutions. Prior to
3.8.6, th ...)
- TODO: check
+ NOT-FOR-US: WeGIA
CVE-2026-55683 (WeGIA is a web manager for charitable institutions. Prior to
3.8.6, th ...)
- TODO: check
+ NOT-FOR-US: WeGIA
CVE-2026-55682 (WeGIA is a web manager for charitable institutions. Prior to
3.8.6, th ...)
- TODO: check
+ NOT-FOR-US: WeGIA
CVE-2026-55681 (WeGIA is a web manager for charitable institutions. Prior to
3.8.6, an ...)
- TODO: check
+ NOT-FOR-US: WeGIA
CVE-2026-55680 (WeGIA is a web manager for charitable institutions. Prior to
3.8.6, un ...)
- TODO: check
+ NOT-FOR-US: WeGIA
CVE-2026-55679 (WeGIA is a web manager for charitable institutions. Prior to
3.8.6, th ...)
- TODO: check
+ NOT-FOR-US: WeGIA
CVE-2026-55498 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
TODO: check
CVE-2026-55387 (InvoiceShelf is an open-source web & mobile app that helps
track expen ...)
@@ -125,25 +125,25 @@ CVE-2026-54701 (Markdown Preview Enhanced is a Markdown
preview extension for Vi
CVE-2026-54566 (Markdown Preview Enhanced is a Markdown preview extension for
Visual S ...)
TODO: check
CVE-2026-3712 (The PhastPress plugin for WordPress is vulnerable to
Server-Side Reque ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18586 (The Premium Packages \u2013 Sell Digital Products Securely
plugin for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18557 (The Photo Gallery by 10Web \u2013 Mobile-Friendly Image
Gallery plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18548 (The Groundhogg \u2014 CRM, Newsletters, and Marketing
Automation plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-17031 (The Checkout Field Manager (Checkout Manager) for WooCommerce
plugin f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-17001 (The Import and export users and customers plugin for WordPress
is vuln ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15180 (The Tracking Code Manager plugin for WordPress is vulnerable
to Reflec ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15090 (The Link Library plugin for WordPress is vulnerable to
time-based SQL ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14572 (The Kirki \u2013 Freeform Page Builder, Website Builder &
Customizer p ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11905 (The Elementor Website Builder \u2013 more than just a page
builder plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110934 (Improper validation of array index vulnerability in Samsung
Open Sourc ...)
TODO: check
CVE-2026-110933 (Uncaught exception vulnerability in Samsung Open Source Vyond
allows I ...)
@@ -205,35 +205,35 @@ CVE-2026-110856 (GitPython before 3.2.0 contains a
regular expression denial of
CVE-2026-110855 (GitPython before 3.2.0 contains an information disclosure
vulnerabilit ...)
TODO: check
CVE-2026-110854 (Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6
does not ha ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-110853 (n8n before 1.123.83 contains an authorization bypass
vulnerability tha ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110852 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before
2.42.1 conta ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110851 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an
authorization b ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110850 (n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate
credentia ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110849 (n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored
cross-site s ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110848 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before
2.42.1 conta ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110847 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before
2.42.1 conta ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110846 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains a
signature bypass ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110845 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before
2.42.1 conta ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110844 (n8n before 1.123.83 contains an authorization bypass
vulnerability tha ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110843 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an
uncontrolled re ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110842 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains a
prototype pollut ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110841 (n8n before 2.41.4 and 2.42.0 contains an authorization bypass
in the a ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110840 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL
injection v ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110839 (FreeRDP 3.3.0 before 3.32.0, when built with
WINPR_UTILS_IMAGE_JPEG=ON ...)
TODO: check
CVE-2026-110838 (FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches
input PDUs d ...)
@@ -273,7 +273,7 @@ CVE-2026-110695 (A vulnerability was detected in turboderp
ExLlamaV2 up to 0.3.2
CVE-2026-110694 (A vulnerability has been found in OAID Tengine up to 1.12.0.
This vuln ...)
TODO: check
CVE-2026-110689 (A security flaw has been discovered in OpenClaw ClawScan up
to 0.1.6. ...)
- TODO: check
+ NOT-FOR-US: OpenClaw
CVE-2026-110679 (A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1.
The impa ...)
TODO: check
CVE-2026-110670 (A vulnerability was found in cemtan sar2html 4.0.0. The
affected eleme ...)
@@ -283,33 +283,33 @@ CVE-2026-110669 (A security vulnerability has been
detected in cemtan sar2html 4
CVE-2026-110668 (A weakness has been identified in cemtan sar2html 4.0.0.
Affected by t ...)
TODO: check
CVE-2026-110310 (A remote user who can read encrypted objects in the S3 bucket
can forc ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-109430 (Ellucian WebAdvisor 3.2 contains an unauthenticated XML
External Entit ...)
TODO: check
CVE-2026-109145 (The User Rights Access Manager WordPress plugin through 1.1.3
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108587 (The 10Web Booster \u2013 Website speed optimization, Cache &
Page Spee ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108337 (An administrator could retrieve the password reset code for
any user a ...)
- TODO: check
+ NOT-FOR-US: Hitachi Vantana
CVE-2026-108336 (When the default self-signed certificate is used, an attacker
could ga ...)
- TODO: check
+ NOT-FOR-US: Hitachi Vantana
CVE-2026-108335 (When the password reset functionality is enabled, and email
is configu ...)
- TODO: check
+ NOT-FOR-US: Hitachi Vantana
CVE-2026-107795 (Omada Controller's MSP and OpenAPI certificate/private-key
management ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-106485
REJECTED
CVE-2026-106068
REJECTED
CVE-2026-106031 (The Spin Wheel WordPress plugin before 2.2.1 does not verify
that a v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-106006
REJECTED
CVE-2026-105627
REJECTED
CVE-2026-104643 (The Easy HTTPS Redirection (SSL) WordPress plugin before
2.0.2 does no ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104110 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
TODO: check
CVE-2026-104109 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
@@ -327,9 +327,9 @@ CVE-2026-103988 (FileRise is a self-hosted web-based file
manager with multi-fil
CVE-2026-103977 (FileRise is a self-hosted web-based file manager with
multi-file uploa ...)
TODO: check
CVE-2026-103324 (The Cardinity Payment Gateway for WooCommerce WordPress
plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103304 (The eaSYNC Booking WordPress plugin before 1.3.31 does not
perform au ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102986 (Plane is an open-source project management tool. In 1.3.1 and
earlier, ...)
TODO: check
CVE-2026-102985 (Plane is an open-source project management tool. In 1.3.1 and
earlier, ...)
@@ -337,7 +337,7 @@ CVE-2026-102985 (Plane is an open-source project management
tool. In 1.3.1 and e
CVE-2026-102980 (Plane is an open-source project management tool. Prior to
1.4.0, PageV ...)
TODO: check
CVE-2026-102298 (In Omada Controller MSP mode, the user-confirmation endpoint
fails to ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-101306 (SCM_RIGHTS file descriptor passing did not preserve
FD_RESOLVE_BENEATH ...)
TODO: check
CVE-2026-101305 (renameat(2) did not enforce FD_RESOLVE_BENEATH on its
directory argume ...)
@@ -347,33 +347,33 @@ CVE-2026-101304 (When fdescfs(4) was mounted in a jail
with the "nodup" option,
CVE-2026-101302 (TLS 1.3 embeds the actual record type as the last non-zero
byte of the ...)
TODO: check
CVE-2026-100232 (Post-authentication Improper Neutralization of Special
Elements used i ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-0993 (SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a
buffer ove ...)
TODO: check
CVE-2026-0321 (Denial of service vulnerabilities in Palo Alto Networks
PAN-OS\xae sof ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0320 (A command injection vulnerability in Palo Alto Networks
PAN-OS\xae sof ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0319 (An improper input handling vulnerability in the
GlobalProtect\u2122 ga ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0318 (A stack-based buffer overflow vulnerability in the log
processing func ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0317 (A denial of service vulnerability in Palo Alto Networks PAN-OS
softwar ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0316 (A stored cross-site scripting (XSS) vulnerability in Palo Alto
Network ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0315 (A local privilege escalation vulnerability in the Palo Alto
Networks G ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0314 (A type confusion vulnerability in Palo Alto Networks
GlobalProtect\u21 ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0313 (A command injection vulnerability in Palo Alto Networks Cortex
XSOAR a ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0312 (Path traversal vulnerabilities in Palo Alto Networks Checkov by
Prisma ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0311 (A server-side request forgery vulnerability in Palo Alto
Networks Chec ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2025-29895 (A NULL pointer dereference vulnerability has been reported to
affect Q ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-XXXX [BUG/MAJOR: mux-h2: properly handle short reads on PING frames]
- haproxy 3.2.26-1
NOTE: Fixed by:
https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=dc338d875ec907f18143ee369552658b750b7297
(v3.2.16)
@@ -6240,7 +6240,7 @@ CVE-2026-107606 (SWIFI-SE2KIC firmware versions 2.0.22
and prior are vulnerable
CVE-2026-107605 (SWIFI-SE2KIC firmware versions 2.0.22 and prior are
vulnerable to a Mi ...)
NOT-FOR-US: SWIFI-SE2KIC
CVE-2026-107460 (Server-Side Request Forgery (SSRF) protection in the
UrlImageConverter ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-106625 (Adobe Framemaker is affected by an out-of-bounds write
vulnerability t ...)
NOT-FOR-US: Adobe
CVE-2026-106598 (Missing Authorization vulnerability in ThemeGrill User
Registration us ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d3aadb17cb30cbc1d043a2237db42836c94b425f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d3aadb17cb30cbc1d043a2237db42836c94b425f
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
