Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d5d493ea by Moritz Muehlenhoff at 2026-10-16T22:38:41+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,7 +1,7 @@
CVE-2026-97858 (An attacker can cause the server to unbind the target device
from its ...)
- TODO: check
+ NOT-FOR-US: EseeCloud App
CVE-2026-97851 (The storage status-change REST service allows location records
still a ...)
- TODO: check
+ NOT-FOR-US: dcm4chee-arc-light
CVE-2026-97470 (The Tourfic \u2013 AI Powered Travel Booking, Hotel Booking &
Car Rent ...)
NOT-FOR-US: WordPress plugin
CVE-2026-97380 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
@@ -15,17 +15,17 @@ CVE-2026-96425 (Incorrect DBus policy for
lomiri-download-manager allows arbitra
CVE-2026-96424 (Incorrect DBus policy for lomiri-upload-manager (part of
lomiri-downlo ...)
TODO: check
CVE-2026-95859 (libp2p-rust is the official Rust language implementation of
the libp2p ...)
- TODO: check
+ NOT-FOR-US: libp2p-rust
CVE-2026-95183 (An issue in the context-compaction feature of DeepSeek Harness
(dsh) c ...)
- TODO: check
+ NOT-FOR-US: DeepSeek Harness
CVE-2026-95182 (An untrusted search path in DeepSeek Harness (dsh) commit
c291e796 all ...)
- TODO: check
+ NOT-FOR-US: DeepSeek Harness
CVE-2026-93681 (The Tutor LMS \u2013 eLearning and online course solution
plugin for W ...)
NOT-FOR-US: WordPress plugin
CVE-2026-92766 (The Vitepos \u2013 Point of Sale (POS) for WooCommerce plugin
for Word ...)
NOT-FOR-US: WordPress plugin
CVE-2026-92263 (SparkyFitness is a self-hosted, AI-powered health and fitness
tracker ...)
- TODO: check
+ NOT-FOR-US: SparkyFitness
CVE-2026-92262 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
TODO: check
CVE-2026-90821 (An input neutralization vulnerability in the Webhook URL form
field co ...)
@@ -33,15 +33,15 @@ CVE-2026-90821 (An input neutralization vulnerability in
the Webhook URL form fi
CVE-2026-89098 (A flaw was found in nfs-utils. The fsidd daemon improperly
handles inp ...)
TODO: check
CVE-2026-88755 (Z.ai ZCode v3.11.2.6792 was discovered to automatically
establish conn ...)
- TODO: check
+ NOT-FOR-US: Z.ai ZCode
CVE-2026-87111 (The User Registration PRO \u2013 Custom Registration Form,
Login Form, ...)
NOT-FOR-US: WordPress plugin
CVE-2026-86047 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
TODO: check
CVE-2026-86009 (Mailu is a mail server distributed as a set of Docker images.
Prior to ...)
- TODO: check
+ NOT-FOR-US: Mailu
CVE-2026-86008 (Mailu is a mail server distributed as a set of Docker images.
Prior to ...)
- TODO: check
+ NOT-FOR-US: Mailu
CVE-2026-85985 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
TODO: check
CVE-2026-85977 (A flaw was found in libtirpc. A remote attacker can exploit
this vulne ...)
@@ -63,15 +63,15 @@ CVE-2026-77630 (pupnp is an SDK for development of UPnP
device and control point
NOTE:
https://github.com/pupnp/pupnp/security/advisories/GHSA-46ph-jff5-5h77
NOTE:
https://github.com/pupnp/pupnp/commit/5dba8070b4d64d976f8e6fc13f1f301befebe7d2
(release-22.0.4)
CVE-2026-77474 (destructive_command_guard (dcg) is a command-line safety tool
that blo ...)
- TODO: check
+ NOT-FOR-US: destructive_command_guard
CVE-2026-75903 (The Vulnity Security plugin for WordPress is vulnerable to
authenticat ...)
NOT-FOR-US: WordPress plugin
CVE-2026-68908 (libIEC61850 is an open-source implementation of IEC 61850
client and s ...)
- TODO: check
+ NOT-FOR-US: libIEC61850
CVE-2026-68907 (libIEC61850 is an open-source implementation of IEC 61850
client and s ...)
- TODO: check
+ NOT-FOR-US: libIEC61850
CVE-2026-68906 (libIEC61850 is an open-source implementation of IEC 61850
client and s ...)
- TODO: check
+ NOT-FOR-US: libIEC61850
CVE-2026-68571 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-64959 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
@@ -83,11 +83,11 @@ CVE-2026-63619 (Missing Authorization vulnerability in
Apache Kylin. A backend m
CVE-2026-63618 (Exposure of Sensitive Information (system level configuration
info) to ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-62362 (PeerBanHelper automatically blocks unwanted, leeching, and
abnormal Bi ...)
- TODO: check
+ NOT-FOR-US: PeerBanHelper
CVE-2026-59967 (Tandoor Recipes is an application for managing recipes,
planning meals ...)
- TODO: check
+ NOT-FOR-US: Tandoor Recipes
CVE-2026-59962 (Tandoor Recipes is an application for managing recipes,
planning meals ...)
- TODO: check
+ NOT-FOR-US: Tandoor Recipes
CVE-2026-57488 (pupnp is an SDK for development of UPnP device and control
point appli ...)
- pupnp <unfixed>
NOTE:
https://github.com/pupnp/pupnp/security/advisories/GHSA-g6c2-x4r9-352g
@@ -111,47 +111,47 @@ CVE-2026-55862 (pupnp is an SDK for development of UPnP
device and control point
NOTE:
https://github.com/pupnp/pupnp/security/advisories/GHSA-25cx-xv8x-j247
NOTE:
https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4
(release-2.0.0)
CVE-2026-55836 (Open Zaak is an open-source data and services layer for Dutch
case-ori ...)
- TODO: check
+ NOT-FOR-US: Open Zaak
CVE-2026-55543 (TuxGuitar is an open-source guitar tablature editor. Prior to
2.1.0, a ...)
TODO: check
CVE-2026-54657 (Open Zaak is an open-source data and services layer for Dutch
case-ori ...)
- TODO: check
+ NOT-FOR-US: Open Zaak
CVE-2026-49868 (RIOT is an open-source microcontroller operating system
designed for I ...)
TODO: check
CVE-2026-48741 (libIEC61850 is an open-source implementation of IEC 61850
client and s ...)
- TODO: check
+ NOT-FOR-US: libIEC61850
CVE-2026-48503 (libIEC61850 is an open-source implementation of IEC 61850
client and s ...)
- TODO: check
+ NOT-FOR-US: libIEC61850
CVE-2026-46472 (An issue was discovered in GStreamer gst-plugins-good before
1.28.2. W ...)
TODO: check
CVE-2026-46471 (An issue was discovered in GStreamer gst-plugins-good before
1.28.2. W ...)
TODO: check
CVE-2026-44977 (countly-server is the server-side part of Countly, a product
analytics ...)
- TODO: check
+ NOT-FOR-US: Countly
CVE-2026-42270 (countly-server is the server-side part of Countly, a product
analytics ...)
- TODO: check
+ NOT-FOR-US: Countly
CVE-2026-42269 (countly-server is the server-side part of Countly, a product
analytics ...)
- TODO: check
+ NOT-FOR-US: Countly
CVE-2026-41582 (countly-server is the server-side part of Countly, a product
analytics ...)
- TODO: check
+ NOT-FOR-US: Countly
CVE-2026-26846 (Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro
v.6.10.01.510_ ...)
- TODO: check
+ NOT-FOR-US: WEINVEIW
CVE-2026-19621 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
- TODO: check
+ - mattermost-server <itp> (bug #823556)
CVE-2026-19600 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x
<= 11.7 ...)
- TODO: check
+ - mattermost-server <itp> (bug #823556)
CVE-2026-19076 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
- TODO: check
+ - mattermost-server <itp> (bug #823556)
CVE-2026-18799 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
- TODO: check
+ - mattermost-server <itp> (bug #823556)
CVE-2026-18560 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
- TODO: check
+ - mattermost-server <itp> (bug #823556)
CVE-2026-18516 (An output escaping vulnerability in the Audit Logs component
of Crafty ...)
TODO: check
CVE-2026-18256 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
- TODO: check
+ - mattermost-server <itp> (bug #823556)
CVE-2026-18223 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
- TODO: check
+ - mattermost-server <itp> (bug #823556)
CVE-2026-17491 (IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote
authenticated att ...)
NOT-FOR-US: IBM
CVE-2026-17488 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote
authenticated attack ...)
@@ -163,9 +163,9 @@ CVE-2026-17073 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a
local attacker to obt
CVE-2026-17068 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to
bypass NF ...)
NOT-FOR-US: IBM
CVE-2026-16453 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
- TODO: check
+ - mattermost-server <itp> (bug #823556)
CVE-2026-16251 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
- TODO: check
+ - mattermost-server <itp> (bug #823556)
CVE-2026-15575 (Active debug code vulnerability in SFM Software Technologies
Inc. Cost ...)
TODO: check
CVE-2026-15219 (Authorization bypass through User-Controlled key vulnerability
in SFM ...)
@@ -179,27 +179,27 @@ CVE-2026-111793 (Openwave Webtop Media Transcoder does
not enforce administrator
CVE-2026-111728 (Seanime v3.7.0 to v3.10.3 contains an argument injection
vulnerability ...)
TODO: check
CVE-2026-111723 (LingGuo-Drama through commit 8a6924a contains a missing
authorization ...)
- TODO: check
+ NOT-FOR-US: LingGuo-Drama
CVE-2026-111722 (LingGuo-Drama through commit 8a6924a contains an insecure
direct objec ...)
- TODO: check
+ NOT-FOR-US: LingGuo-Drama
CVE-2026-111721 (Open WES through 1.0.0 contains an authorization bypass
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Open WES
CVE-2026-111720 (fish-island-backend through commit 7c61b78 contains an
unauthenticated ...)
- TODO: check
+ NOT-FOR-US: fish-island-backend
CVE-2026-111719 (Roncoo-pay through commit 9428382 contains a missing
authorization vul ...)
- TODO: check
+ NOT-FOR-US: Roncoo-pay
CVE-2026-111718 (AipexBase through commit 690adb9 contains a sql injection
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: AipexBase
CVE-2026-111717 (Arkon through 0.9.2 contains a missing authorization
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Arkon
CVE-2026-111716 (Arkon through 0.9.2 contains a broken access control
vulnerability tha ...)
- TODO: check
+ NOT-FOR-US: Arkon
CVE-2026-111715 (Arkon through 0.9.2 contains a missing authorization
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Arkon
CVE-2026-111714 (tarteaucitron.js before 1.37.0 contains a regular expression
denial of ...)
- TODO: check
+ NOT-FOR-US: tarteaucitron.js
CVE-2026-111713 (tarteaucitron.js before 1.37.0 contains a cross-site
scripting vulnera ...)
- TODO: check
+ NOT-FOR-US: tarteaucitron.js
CVE-2026-111712 (Netcore NR256CN through 1.5.140116 contains an authentication
bypass v ...)
NOT-FOR-US: Netcore
CVE-2026-111711 (Netcore NR256CN through 1.5.140116 contains a
pre-authentication stack ...)
@@ -207,67 +207,67 @@ CVE-2026-111711 (Netcore NR256CN through 1.5.140116
contains a pre-authenticatio
CVE-2026-111710 (Netcore NR256CN through 1.5.140116 contains a NULL pointer
dereference ...)
NOT-FOR-US: Netcore
CVE-2026-111709 (WhaTicket Community through commit cf04795 contains an
insecure direct ...)
- TODO: check
+ NOT-FOR-US: WhaTicket
CVE-2026-111708 (WhaTicket Community through commit cf04795 contains an
authentication ...)
- TODO: check
+ NOT-FOR-US: WhaTicket
CVE-2026-111707 (99AI through 4.3.0 contains an insecure direct object
reference vulner ...)
- TODO: check
+ NOT-FOR-US: 99AI
CVE-2026-111706 (99AI through 4.3.0 contains a missing authentication
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: 99AI
CVE-2026-111705 (Fuint through commit 57ec018 contains an insecure direct
object refere ...)
- TODO: check
+ NOT-FOR-US: Fuint
CVE-2026-111704 (LangChat through commit 2a6285a contains a missing
authentication vuln ...)
- TODO: check
+ NOT-FOR-US: LangChat
CVE-2026-111703 (yshop-crm through 2.1.3 contains an insecure direct object
reference v ...)
- TODO: check
+ NOT-FOR-US: yshop-crm
CVE-2026-111702 (ChatOllama through commit 96c3ce5 contains an insecure direct
object r ...)
- TODO: check
+ NOT-FOR-US: ChatOllama
CVE-2026-111701 (OtterMind Nubase through 0.1.4 contains a missing
authentication vulne ...)
- TODO: check
+ NOT-FOR-US: OtterMind Nubase
CVE-2026-111700 (WebVella ERP through 1.8.8 contains an sql injection
vulnerability tha ...)
- TODO: check
+ NOT-FOR-US: WebVella ERP
CVE-2026-111699 (Niefy wx-api through 0.8.2 contains an authentication bypass
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Niefy wx-api
CVE-2026-111698 (HUIZHI ChargeOS cloud through 3.0.9 contains a missing
authorization v ...)
- TODO: check
+ NOT-FOR-US: HUIZHI ChargeOS
CVE-2026-111697 (HUIZHI ChargeOS cloud through 3.0.9 contains an insecure
direct object ...)
- TODO: check
+ NOT-FOR-US: HUIZHI ChargeOS
CVE-2026-111696 (data-platform-open through commit efeacd3 uses a hardcoded,
publicly k ...)
- TODO: check
+ NOT-FOR-US: data-platform-open
CVE-2026-111695 (Shaiwz data-platform-open through commit efeacd3 contains an
insecure ...)
- TODO: check
+ NOT-FOR-US: Shaiwz
CVE-2026-111694 (qKnow through 2.4.3 contains a missing authentication
vulnerability th ...)
- TODO: check
+ NOT-FOR-US: qKnow
CVE-2026-111693 (DataBuff ai-apm-web through 0.1.10 contains a hard-coded
default crede ...)
- TODO: check
+ NOT-FOR-US: DataBuff ai-apm-web
CVE-2026-111692 (DataBuff ai-apm-web through 0.1.10 contains an authentication
bypass v ...)
- TODO: check
+ NOT-FOR-US: DataBuff ai-apm-web
CVE-2026-111691 (WIMOOR through commit ec86736 contains an authentication
bypass vulner ...)
- TODO: check
+ NOT-FOR-US: WIMOOR
CVE-2026-111690 (Simple Admin Core through 1.8.7 contains an authentication
bypass vuln ...)
- TODO: check
+ NOT-FOR-US: Simple Admin Core
CVE-2026-111689 (Exrick XBoot through 3.3.4 contains an authorization bypass
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Exrick XBoot
CVE-2026-111688 (Exrick XBoot through 3.3.4 contains an authorization bypass
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Exrick XBoot
CVE-2026-111687 (WeRSS (we-mp-rss) through 1.5.3 contains a remote code
execution vulne ...)
- TODO: check
+ NOT-FOR-US: WeRSS
CVE-2026-111686 (IceCMS through 4.1.5 contains an unauthenticated sql
injection vulnera ...)
- TODO: check
+ NOT-FOR-US: IceCMS
CVE-2026-111685 (IceCMS through 4.1.5 contains an unauthenticated sql
injection vulnera ...)
- TODO: check
+ NOT-FOR-US: IceCMS
CVE-2026-111684 (Magistrala through 1.0.0 contains an authorization bypass
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Magistrala
CVE-2026-111683 (Allegro Ralph through 20260902.1 contains a missing
authorization vuln ...)
- TODO: check
+ NOT-FOR-US: Allegro Ralph
CVE-2026-111682 (EFAK 5.0.0 through 5.1.0 contains a missing authorization
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: EFAK
CVE-2026-111681 (EFAK through 5.1.0 contains a missing authorization
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: EFAK
CVE-2026-111680 (APIPark through 1.9.7-beta contains an authorization bypass
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: APIPar
CVE-2026-111679 (Ekko Studio through 0.7.36 contains a missing authorization
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Ekko Studio
CVE-2026-111678 (Antiword through 0.37 contains a stack out-of-bounds read
vulnerabilit ...)
TODO: check
CVE-2026-111677 (Antiword through 0.37 contains a heap out-of-bounds read
vulnerability ...)
@@ -447,7 +447,7 @@ CVE-2026-111392 (SGLang through 0.5.21 trusts
caller-supplied mm_hashes values a
CVE-2026-111391 (SGLang 0.5.10 through 0.5.22 contains a code injection
vulnerability i ...)
TODO: check
CVE-2026-111390 (Erupt through 2.3.0 contains an HQL injection vulnerability
that allow ...)
- TODO: check
+ NOT-FOR-US: Erupt
CVE-2026-111311 (The DoubleScale | All-in-One CRM \u2013 Sales, Multi-Channel
Marketing ...)
NOT-FOR-US: WordPress plugin
CVE-2026-110903 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -487,11 +487,11 @@ CVE-2026-109461 (Origin validation error in Microsoft
Authentication Library (MS
CVE-2026-109224 (The SureCart \u2013 Ecommerce Made Easy For Selling Physical
Products, ...)
NOT-FOR-US: WordPress plugin
CVE-2026-109119 (Improper Privilege Management in the user management API
endpoint (/ap ...)
- TODO: check
+ - rdiffweb <itp> (bug #969974)
CVE-2026-109118 (Improper path containment check in ikus060 rdiffweb 7.1.1
allows an au ...)
- TODO: check
+ - rdiffweb <itp> (bug #969974)
CVE-2026-107777 (Thermo Fisher Torrent Suite Softwareis vulnerable to a path
traversal, ...)
- TODO: check
+ NOT-FOR-US: Thermo Fisher Torrent Suite Software
CVE-2026-107674 (IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of
service to D ...)
NOT-FOR-US: IBM
CVE-2026-107649 (The Events Made Easy plugin for WordPress is vulnerable to
Stored Cros ...)
@@ -507,7 +507,7 @@ CVE-2026-107564 (An unauthenticated remote attacker may use
an allocation of res
CVE-2026-106705 (ELADMIN (eladmin-mp) up to 2.7 contains an improper access
control vul ...)
TODO: check
CVE-2026-106030 (NordVPN for Windows allows local attackers to stop
unprotected Windows ...)
- TODO: check
+ NOT-FOR-US: NordVPN for Windows
CVE-2026-105959 (A flaw was found in spice-server. The GLZ encoder dictionary
restore p ...)
TODO: check
CVE-2026-105958 (A flaw was found in spice-server. Multiple migration data
handlers use ...)
@@ -527,13 +527,13 @@ CVE-2026-104003 (The WP User Avatar / ProfilePress plugin
for WordPress is vulne
CVE-2026-102941 (The package github.com/gomarkdown/markdown is a Go library
for parsing ...)
TODO: check
CVE-2026-102923 (SparkyFitness is a self-hosted, AI-powered health and fitness
tracker ...)
- TODO: check
+ NOT-FOR-US: SparkyFitness
CVE-2026-102917 (IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an
authenticated attacke ...)
NOT-FOR-US: IBM
CVE-2026-102693 (RIOT is an open-source microcontroller operating system
designed for I ...)
- TODO: check
+ NOT-FOR-US: RIOT-OS
CVE-2026-102692 (RIOT is an open-source microcontroller operating system
designed for I ...)
- TODO: check
+ NOT-FOR-US: RIOT-OS
CVE-2026-102552 (Improper verification of the source of a communication
channel in the ...)
NOT-FOR-US: Amazon
CVE-2026-102551 (Improper verification of the source of a communication
channel in the ...)
@@ -549,9 +549,9 @@ CVE-2026-100106 (The FiboSearch \u2013 Ajax Search for
WooCommerce plugin for Wo
CVE-2025-66969 (Integer overflow in OpenModSim (<=1.11.0), leading to denial
of servic ...)
TODO: check
CVE-2025-55653 (GPAC MP4Box v2.4 was discovered to contain a floating point
exception ...)
- TODO: check
+ - gpac <removed>
CVE-2025-55640 (A heap buffer overflow in the stbl_AddSize function
(isomedia/stbl_wri ...)
- TODO: check
+ - gpac <removed>
CVE-2025-52097 (Cross Site Scripting vulnerability in InstantASP ltd,
InstantForum.NET ...)
TODO: check
CVE-2026-XXXX [ZSA-2026-16]
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d5d493eadc6cd871d4c1021afb10753996ec6739
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d5d493eadc6cd871d4c1021afb10753996ec6739
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
