Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
29487d62 by Salvatore Bonaccorso at 2026-10-16T08:04:03+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -501,7 +501,7 @@ CVE-2026-110874 (Dolibarr before 23.0.4 contains a PHP
object injection vulnerab
CVE-2026-110812 (Deserialization of untrusted data in the Gremlin graph data
import com ...)
NOT-FOR-US: Amazon
CVE-2026-110746 (A local privilege escalation vulnerability in TotalAV allows
an unpriv ...)
- TODO: check
+ NOT-FOR-US: TotalAV
CVE-2026-110726 (In `api-gateway` versions till `1.7.3`, The default
rate-limit key res ...)
TODO: check
CVE-2026-110724 (In `api-gateway` versions till `1.7.3`, The default
rate-limit key res ...)
@@ -1019,13 +1019,13 @@ CVE-2026-110816 (### Summary `qs.stringify` with
`arrayFormat: 'comma'` throw
CVE-2026-110810 (A vulnerability was detected in ggml-org whisper.cpp up to
1.9.4. This ...)
TODO: check
CVE-2026-110809 (A security vulnerability has been detected in sgl-project
SGLang up to ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-110807 (A weakness has been identified in sgl-project SGLang up to
0.5.19. Aff ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-110698 (A security vulnerability has been detected in Praat up to
7.0.02. Affe ...)
TODO: check
CVE-2026-110696 (A weakness has been identified in itsmeravitejak
Online-Examination-Sy ...)
- TODO: check
+ NOT-FOR-US: itsmeravitejak Online-Examination-System
CVE-2026-110695 (A vulnerability was detected in turboderp ExLlamaV2 up to
0.3.2. Affec ...)
TODO: check
CVE-2026-110694 (A vulnerability has been found in OAID Tengine up to 1.12.0.
This vuln ...)
@@ -1529,35 +1529,35 @@ CVE-2026-14851 (A vulnerability relating to the
exposure of confidential informa
CVE-2026-110777 (A flaw was found in evolution-data-server. Calendar events
containing ...)
TODO: check
CVE-2026-110775 (Nexent through 2.7.0 contains a missing authorization
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Nexent
CVE-2026-110774 (Blinko through 1.8.8 contains a broken access control
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Blinko
CVE-2026-110773 (GrowChief through 0.3.0 contains a missing authorization
vulnerability ...)
- TODO: check
+ NOT-FOR-US: GrowChief
CVE-2026-110772 (Sure 0.7.0 through 0.7.6-alpha.6 contains a missing
authorization vuln ...)
- TODO: check
+ NOT-FOR-US: Sure
CVE-2026-110771 (Shopizer through 3.2.5 contains an authorization bypass
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Shopizer
CVE-2026-110770 (Databasus 3.7.0 through 3.61.0 contains an authentication
bypass vulne ...)
- TODO: check
+ NOT-FOR-US: Databasus
CVE-2026-110769 (holaOS through 2026.822.1 contains a missing authorization
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: holaOS
CVE-2026-110768 (holaOS through 2026.822.1 contains an authorization bypass
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: holaOS
CVE-2026-110767 (Gitingest through 0.3.1 contains a symlink following
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Gitingest
CVE-2026-110766 (Colanode server through 0.4.7 contains a path traversal
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Colanode server
CVE-2026-110765 (FlexPrice through 2.1.38 contains an authentication bypass
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: FlexPrice
CVE-2026-110764 (AstronRPA through 1.1.6 contains an insecure direct object
reference v ...)
- TODO: check
+ NOT-FOR-US: AstronRPA
CVE-2026-110763 (lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an
insecure dir ...)
TODO: check
CVE-2026-110762 (bbPress before 2.6.19 contains an information disclosure
vulnerability ...)
- TODO: check
+ NOT-FOR-US: bbPress
CVE-2026-110761 (ILIAS before 9.24, 10.12, and 11.5 contains a PHP object
injection vul ...)
- TODO: check
+ NOT-FOR-US: ILIAS
CVE-2026-110736 (Godot Engine through 4.7.2 has an out-of-bounds read in the
optimized ...)
- godot <unfixed> (unimportant)
- godot3 <unfixed> (unimportant)
@@ -1574,7 +1574,7 @@ CVE-2026-110734 (Godot Engine through 4.7.2 has a heap
out-of-bounds write in th
NOTE: Not considered security issues by upstream
NOTE: https://github.com/godotengine/godot/issues/123608
CVE-2026-110719 (Portkey AI Gateway 1.14.0 through 1.15.2 contains a
server-side reques ...)
- TODO: check
+ NOT-FOR-US: Portkey AI Gateway
CVE-2026-110718 (TurboDocx html-to-docx through 1.23.1 contains a server-side
request f ...)
TODO: check
CVE-2026-110717 (Janus WebRTC Server through 1.4.3 contains a path traversal
vulnerabil ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/29487d62ccca35ecf4743d3c58ad6bf225b95a7e
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/29487d62ccca35ecf4743d3c58ad6bf225b95a7e
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
