Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d928eb83 by security tracker role at 2026-10-16T19:16:15+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3,13 +3,13 @@ CVE-2026-97858 (An attacker can cause the server to unbind
the target device fro
CVE-2026-97851 (The storage status-change REST service allows location records
still a ...)
TODO: check
CVE-2026-97470 (The Tourfic \u2013 AI Powered Travel Booking, Hotel Booking &
Car Rent ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97380 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
TODO: check
CVE-2026-96870 (The SureDash \u2013 Community, Courses & Member Dashboard
plugin for W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96768 (The GoSMTP Pro plugin for WordPress is vulnerable to Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96425 (Incorrect DBus policy for lomiri-download-manager allows
arbitrary use ...)
TODO: check
CVE-2026-96424 (Incorrect DBus policy for lomiri-upload-manager (part of
lomiri-downlo ...)
@@ -21,9 +21,9 @@ CVE-2026-95183 (An issue in the context-compaction feature of
DeepSeek Harness (
CVE-2026-95182 (An untrusted search path in DeepSeek Harness (dsh) commit
c291e796 all ...)
TODO: check
CVE-2026-93681 (The Tutor LMS \u2013 eLearning and online course solution
plugin for W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92766 (The Vitepos \u2013 Point of Sale (POS) for WooCommerce plugin
for Word ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92263 (SparkyFitness is a self-hosted, AI-powered health and fitness
tracker ...)
TODO: check
CVE-2026-92262 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
@@ -35,7 +35,7 @@ CVE-2026-89098 (A flaw was found in nfs-utils. The fsidd
daemon improperly handl
CVE-2026-88755 (Z.ai ZCode v3.11.2.6792 was discovered to automatically
establish conn ...)
TODO: check
CVE-2026-87111 (The User Registration PRO \u2013 Custom Registration Form,
Login Form, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86047 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
TODO: check
CVE-2026-86009 (Mailu is a mail server distributed as a set of Docker images.
Prior to ...)
@@ -55,15 +55,15 @@ CVE-2026-85745 (MariaDB server is a community developed
fork of MySQL server. Fr
CVE-2026-85231 (A flaw was found in libtirpc. An authenticated remote attacker
could e ...)
TODO: check
CVE-2026-81452 (Dell Alienware Command Center (AWCC), versions prior to
6.14.54.0, con ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-80092 (Authentication bypass by assumed-immutable data in Microsoft
Identity ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-77630 (pupnp is an SDK for development of UPnP device and control
point appli ...)
TODO: check
CVE-2026-77474 (destructive_command_guard (dcg) is a command-line safety tool
that blo ...)
TODO: check
CVE-2026-75903 (The Vulnity Security plugin for WordPress is vulnerable to
authenticat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-68908 (libIEC61850 is an open-source implementation of IEC 61850
client and s ...)
TODO: check
CVE-2026-68907 (libIEC61850 is an open-source implementation of IEC 61850
client and s ...)
@@ -71,15 +71,15 @@ CVE-2026-68907 (libIEC61850 is an open-source
implementation of IEC 61850 client
CVE-2026-68906 (libIEC61850 is an open-source implementation of IEC 61850
client and s ...)
TODO: check
CVE-2026-68571 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-64959 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-64610 (Deserialization of Untrusted Data vulnerability in Apache
Kylin.Unsafe ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-63619 (Missing Authorization vulnerability in Apache Kylin. A backend
metadat ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-63618 (Exposure of Sensitive Information (system level configuration
info) to ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-62362 (PeerBanHelper automatically blocks unwanted, leeching, and
abnormal Bi ...)
TODO: check
CVE-2026-59967 (Tandoor Recipes is an application for managing recipes,
planning meals ...)
@@ -93,7 +93,7 @@ CVE-2026-57487 (pupnp is an SDK for development of UPnP
device and control point
CVE-2026-57486 (pupnp is an SDK for development of UPnP device and control
point appli ...)
TODO: check
CVE-2026-57447 (Discourse Doc Categories is a plugin for organizing Discourse
topics a ...)
- TODO: check
+ NOT-FOR-US: Discourse
CVE-2026-57446 (libIEC61850 is an open-source implementation of IEC 61850
client and s ...)
TODO: check
CVE-2026-57169 (Dockhand is a Docker management application. Prior to 1.0.34,
the in-b ...)
@@ -143,15 +143,15 @@ CVE-2026-18256 (Mattermost versions 11.10.x <= 11.10.0,
11.7.x <= 11.7.9, 11.9.x
CVE-2026-18223 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
TODO: check
CVE-2026-17491 (IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote
authenticated att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17488 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote
authenticated attack ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17275 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to
perform ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17073 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to
obtain se ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17068 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to
bypass NF ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16453 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
TODO: check
CVE-2026-16251 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
@@ -161,7 +161,7 @@ CVE-2026-15575 (Active debug code vulnerability in SFM
Software Technologies Inc
CVE-2026-15219 (Authorization bypass through User-Controlled key vulnerability
in SFM ...)
TODO: check
CVE-2026-14452 (Improper validation of the reset_url parameter of the Setup
in-page se ...)
- TODO: check
+ NOT-FOR-US: Checkmk
CVE-2026-14177 (Observable response discrepancy vulnerability in IKAS
Technology Inc. ...)
TODO: check
CVE-2026-111793 (Openwave Webtop Media Transcoder does not enforce
administrator-define ...)
@@ -191,11 +191,11 @@ CVE-2026-111714 (tarteaucitron.js before 1.37.0 contains
a regular expression de
CVE-2026-111713 (tarteaucitron.js before 1.37.0 contains a cross-site
scripting vulnera ...)
TODO: check
CVE-2026-111712 (Netcore NR256CN through 1.5.140116 contains an authentication
bypass v ...)
- TODO: check
+ NOT-FOR-US: Netcore
CVE-2026-111711 (Netcore NR256CN through 1.5.140116 contains a
pre-authentication stack ...)
- TODO: check
+ NOT-FOR-US: Netcore
CVE-2026-111710 (Netcore NR256CN through 1.5.140116 contains a NULL pointer
dereference ...)
- TODO: check
+ NOT-FOR-US: Netcore
CVE-2026-111709 (WhaTicket Community through commit cf04795 contains an
insecure direct ...)
TODO: check
CVE-2026-111708 (WhaTicket Community through commit cf04795 contains an
authentication ...)
@@ -367,7 +367,7 @@ CVE-2026-111626 (Webreaper Damselfly through 4.5.3 contains
an authentication by
CVE-2026-111625 (10up Distributor before 2.3.2 contains a missing
authorization vulnera ...)
TODO: check
CVE-2026-111624 (Umbraco CMS before 17.7.1 and 18.2.1 contains a missing
authorization ...)
- TODO: check
+ NOT-FOR-US: Umbraco CMS
CVE-2026-111623 (Xiaozhi-esp32-server-java through 6.1.0 contains an
authentication byp ...)
TODO: check
CVE-2026-111622 (smart-sso through 2.1.1 contains an open redirect
vulnerability in the ...)
@@ -419,19 +419,19 @@ CVE-2026-111555 (A flaw was found in luksmeta. Improper
boundary validation of m
CVE-2026-111472 (An SQL injection vulnerability has been discovered in TSG
Profleet. Th ...)
TODO: check
CVE-2026-111413 (Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt
aThemeArt ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111409 (Missing Authorization vulnerability in YITH YITH PayPal
Express Checko ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111405 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111400 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111399 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111397 (Missing Authorization vulnerability in PT Norther Lights
Production Ma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111396 (Missing Authorization vulnerability in Liquid Web / StellarWP
Advanced ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111392 (SGLang through 0.5.21 trusts caller-supplied mm_hashes values
as the m ...)
TODO: check
CVE-2026-111391 (SGLang 0.5.10 through 0.5.22 contains a code injection
vulnerability i ...)
@@ -439,43 +439,43 @@ CVE-2026-111391 (SGLang 0.5.10 through 0.5.22 contains a
code injection vulnerab
CVE-2026-111390 (Erupt through 2.3.0 contains an HQL injection vulnerability
that allow ...)
TODO: check
CVE-2026-111311 (The DoubleScale | All-in-One CRM \u2013 Sales, Multi-Channel
Marketing ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110903 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110901 (Authorization Bypass Through User-Controlled Key
vulnerability in WPMU ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110900 (Missing Authorization vulnerability in Liquid Web / StellarWP
BookIt b ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110896 (Missing Authorization vulnerability in WP Chill Passster
content-prote ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110806 (Incorrect authorization in add-on properties in Devolutions
Server 202 ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-110805 (Server-side request forgery in PingOne groups endpoint in
Devolutions ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-110804 (Improperly controlled modification of JIT elevation settings
in PAM ch ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-110703 (The GeoDirectory \u2013 WP Business Directory Plugin and
Classified Li ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110380 (Missing Authorization vulnerability in Arraytics WP Event
Solution wp- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110287 (Improper access control in asset contact password in
Devolutions Serve ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-110029 (The Squeeze WordPress plugin before 1.8.1 does not perform a
capabilit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109930 (The MAIO WordPress plugin before 7.3.22 does not properly
restrict acc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109839 (IBM Db2 Genius Hub 1.0 could allow a remote authenticated
attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-109838 (IBM Db2 Genius Hub1.0 could allow a local attacker to obtain
sensitive ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-109588 (Numeric truncation of the buffer length in the MPU buffer
authorizatio ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-109587 (Incorrect authorization in the Arm Cortex-R82 (Armv8-R
AArch64) MPU po ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-109461 (Origin validation error in Microsoft Authentication Library
(MSAL) for ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-109224 (The SureCart \u2013 Ecommerce Made Easy For Selling Physical
Products, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109119 (Improper Privilege Management in the user management API
endpoint (/ap ...)
TODO: check
CVE-2026-109118 (Improper path containment check in ikus060 rdiffweb 7.1.1
allows an au ...)
@@ -483,11 +483,11 @@ CVE-2026-109118 (Improper path containment check in
ikus060 rdiffweb 7.1.1 allow
CVE-2026-107777 (Thermo Fisher Torrent Suite Softwareis vulnerable to a path
traversal, ...)
TODO: check
CVE-2026-107674 (IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of
service to D ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107649 (The Events Made Easy plugin for WordPress is vulnerable to
Stored Cros ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107648 (The WP Sessions Time Monitoring Full Automatic plugin for
WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107621 (JPEGParser can enter an infinite loop while parsing a
specially crafte ...)
TODO: check
CVE-2026-107617 (An attacker can use a hard-coded credential to log in to
EseeCloud dev ...)
@@ -511,31 +511,31 @@ CVE-2026-105279 (In the default configuration, the
archive accepts DICOM associa
CVE-2026-105273 (MP4Parser does not adequately validate MP4 box sizes. A
malformed box ...)
TODO: check
CVE-2026-104726 (The Name Directory plugin for WordPress is vulnerable to
Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104003 (The WP User Avatar / ProfilePress plugin for WordPress is
vulnerable t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102941 (The package github.com/gomarkdown/markdown is a Go library
for parsing ...)
TODO: check
CVE-2026-102923 (SparkyFitness is a self-hosted, AI-powered health and fitness
tracker ...)
TODO: check
CVE-2026-102917 (IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an
authenticated attacke ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-102693 (RIOT is an open-source microcontroller operating system
designed for I ...)
TODO: check
CVE-2026-102692 (RIOT is an open-source microcontroller operating system
designed for I ...)
TODO: check
CVE-2026-102552 (Improper verification of the source of a communication
channel in the ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-102551 (Improper verification of the source of a communication
channel in the ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-101300 (Server-Side Request Forgery (SSRF) reported in the ticket
sales chart ...)
TODO: check
CVE-2026-101021 (MultipartInputStream performs inefficient boundary matching
and unnece ...)
TODO: check
CVE-2026-100108 (The Social Share Buttons plugin for WordPress is vulnerable
to Stored ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100106 (The FiboSearch \u2013 Ajax Search for WooCommerce plugin for
WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-66969 (Integer overflow in OpenModSim (<=1.11.0), leading to denial
of servic ...)
TODO: check
CVE-2025-55653 (GPAC MP4Box v2.4 was discovered to contain a floating point
exception ...)
@@ -1848,11 +1848,11 @@ CVE-2025-29897 (A buffer copy without checking size of
input vulnerability has b
CVE-2025-29896 (A NULL pointer dereference vulnerability has been reported to
affect Q ...)
NOT-FOR-US: QNAP
CVE-2025-23390 (A vulnerability has been identified within Fleet where, by
default, Fl ...)
- TODO: check
+ NOT-FOR-US: SUSE
CVE-2024-22031 (A vulnerability has been identified within Rancher where a
user with t ...)
NOT-FOR-US: SUSE
CVE-2023-32198 (A vulnerability has been identified in Steve where by default
it was u ...)
- TODO: check
+ NOT-FOR-US: SUSE
CVE-2026-99999 (In the Linux kernel, the following vulnerability has been
resolved: i ...)
{DSA-6568-1}
- linux 7.2.11-1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d928eb830afde49c6ed06ce48ed89a8e4b7d83c3
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d928eb830afde49c6ed06ce48ed89a8e4b7d83c3
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
