Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
eec7cf1e by Moritz Muehlenhoff at 2026-10-16T23:29:35+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -112,9 +112,9 @@ CVE-2026-57486 (pupnp is an SDK for development of UPnP
device and control point
CVE-2026-57447 (Discourse Doc Categories is a plugin for organizing Discourse
topics a ...)
NOT-FOR-US: Discourse
CVE-2026-57446 (libIEC61850 is an open-source implementation of IEC 61850
client and s ...)
- TODO: check
+ NOT-FOR-US: libIEC61850
CVE-2026-57169 (Dockhand is a Docker management application. Prior to 1.0.34,
the in-b ...)
- TODO: check
+ NOT-FOR-US: Dockhand
CVE-2026-55862 (pupnp is an SDK for development of UPnP device and control
point appli ...)
- pupnp <unfixed> (bug #1151082)
NOTE:
https://github.com/pupnp/pupnp/security/advisories/GHSA-25cx-xv8x-j247
@@ -176,17 +176,17 @@ CVE-2026-16453 (Mattermost versions 11.10.x <= 11.10.0,
11.7.x <= 11.7.9, 11.9.x
CVE-2026-16251 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9,
11.9.x <= 11 ...)
- mattermost-server <itp> (bug #823556)
CVE-2026-15575 (Active debug code vulnerability in SFM Software Technologies
Inc. Cost ...)
- TODO: check
+ NOT-FOR-US: Costifier
CVE-2026-15219 (Authorization bypass through User-Controlled key vulnerability
in SFM ...)
- TODO: check
+ NOT-FOR-US: Costifier
CVE-2026-14452 (Improper validation of the reset_url parameter of the Setup
in-page se ...)
NOT-FOR-US: Checkmk
CVE-2026-14177 (Observable response discrepancy vulnerability in IKAS
Technology Inc. ...)
- TODO: check
+ NOT-FOR-US: ikas E-Commerce Infrastructure
CVE-2026-111793 (Openwave Webtop Media Transcoder does not enforce
administrator-define ...)
- TODO: check
+ NOT-FOR-US: Openwave Webtop Media Transcoder
CVE-2026-111728 (Seanime v3.7.0 to v3.10.3 contains an argument injection
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Seanime
CVE-2026-111723 (LingGuo-Drama through commit 8a6924a contains a missing
authorization ...)
NOT-FOR-US: LingGuo-Drama
CVE-2026-111722 (LingGuo-Drama through commit 8a6924a contains an insecure
direct objec ...)
@@ -282,51 +282,51 @@ CVE-2026-111678 (Antiword through 0.37 contains a stack
out-of-bounds read vulne
CVE-2026-111677 (Antiword through 0.37 contains a heap out-of-bounds read
vulnerability ...)
TODO: check
CVE-2026-111676 (Faveo Helpdesk through 2.0.3 contains a broken access control
vulnerab ...)
- TODO: check
+ NOT-FOR-US: Faveo Helpdesk
CVE-2026-111675 (Course-tencent-cloud through 2.0.1 contains an improper
restriction of ...)
- TODO: check
+ NOT-FOR-US: Course-tencent-cloud
CVE-2026-111674 (Tbed through 20240319 contains a missing authorization
vulnerability t ...)
- TODO: check
+ NOT-FOR-US: Tbed
CVE-2026-111673 (IceCMS through 4.1.5 contains a missing authentication
vulnerability t ...)
- TODO: check
+ NOT-FOR-US: IceCMS
CVE-2026-111672 (Cube-studio through 2026.09.01 contains a missing
authorization vulner ...)
- TODO: check
+ NOT-FOR-US: Cube-studio
CVE-2026-111671 (Cube-studio through 2026.09.01 contains an insecure direct
object refe ...)
- TODO: check
+ NOT-FOR-US: Cube-studio
CVE-2026-111670 (ClickVisual through 1.1.2 contains a missing authorization
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: ClickVisual
CVE-2026-111669 (ZR.Admin.NET through 3.8.2 contains an sql injection
vulnerability tha ...)
- TODO: check
+ NOT-FOR-US: ZR.Admin.NET
CVE-2026-111668 (AIHelms through 0.1.25 contains a missing authorization
vulnerability ...)
- TODO: check
+ NOT-FOR-US: AIHelms
CVE-2026-111667 (REBUILD through 4.5.0 contains a missing authorization
vulnerability i ...)
- TODO: check
+ NOT-FOR-US: REBUILD
CVE-2026-111666 (Steedos Platform through 3.0.15-beta.51 contains an
authorization bypa ...)
- TODO: check
+ NOT-FOR-US: Steedos Platform
CVE-2026-111665 (Piranha CMS through 12.2 contains a missing authorization
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Piranha CMS
CVE-2026-111664 (Safing Portmaster before 2.2.5 contains a missing
authorization vulner ...)
- TODO: check
+ NOT-FOR-US: Safing Portmaster
CVE-2026-111663 (Chaskiq through 2.0.3 contains a server-side request forgery
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Chaskiq
CVE-2026-111662 (Chaskiq through 2.0.3 contains a server-side request forgery
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Chaskiq
CVE-2026-111661 (waynboot-mall through 2.0.0 contains a missing authentication
vulnerab ...)
- TODO: check
+ NOT-FOR-US: waynboot-mall
CVE-2026-111660 (waynboot-mall through 2.0.0 contains a missing authentication
vulnerab ...)
- TODO: check
+ NOT-FOR-US: waynboot-mall
CVE-2026-111659 (Waynboot-mall through 2.0.0 contains a missing authentication
vulnerab ...)
- TODO: check
+ NOT-FOR-US: waynboot-mall
CVE-2026-111658 (SiteServer SSCMS through 7.4.0 contains an authorization
bypass vulner ...)
- TODO: check
+ NOT-FOR-US: SiteServer SSCMS
CVE-2026-111657 (BeikeShop through 2.0.0.31 contains an insecure direct object
referenc ...)
- TODO: check
+ NOT-FOR-US: BeikeShop
CVE-2026-111656 (ChatWiki through 2.9.6 contains an insecure direct object
reference vu ...)
- TODO: check
+ NOT-FOR-US: ChatWiki
CVE-2026-111655 (ThinkAdmin think-plugs-admin through 1.0.81 contains an
insecure direc ...)
- TODO: check
+ NOT-FOR-US: ThinkAdmin
CVE-2026-111654 (FastBee through 2.1.0 contains an insecure direct object
reference vul ...)
- TODO: check
+ NOT-FOR-US: FastBee
CVE-2026-111653 (53AIHub through 0.5.3 contains a missing authentication
vulnerability ...)
TODO: check
CVE-2026-111652 (Engineercms through 2.0.5 contains a missing authorization
vulnerabili ...)
@@ -508,13 +508,13 @@ CVE-2026-107649 (The Events Made Easy plugin for
WordPress is vulnerable to Stor
CVE-2026-107648 (The WP Sessions Time Monitoring Full Automatic plugin for
WordPress is ...)
NOT-FOR-US: WordPress plugin
CVE-2026-107621 (JPEGParser can enter an infinite loop while parsing a
specially crafte ...)
- TODO: check
+ NOT-FOR-US: dcm4chee-arc-light
CVE-2026-107617 (An attacker can use a hard-coded credential to log in to
EseeCloud dev ...)
- TODO: check
+ NOT-FOR-US: EseeCloud
CVE-2026-107564 (An unauthenticated remote attacker may use an allocation of
resources ...)
TODO: check
CVE-2026-106705 (ELADMIN (eladmin-mp) up to 2.7 contains an improper access
control vul ...)
- TODO: check
+ NOT-FOR-US: ELADMIN
CVE-2026-106030 (NordVPN for Windows allows local attackers to stop
unprotected Windows ...)
NOT-FOR-US: NordVPN for Windows
CVE-2026-105959 (A flaw was found in spice-server. The GLZ encoder dictionary
restore p ...)
@@ -522,13 +522,13 @@ CVE-2026-105959 (A flaw was found in spice-server. The
GLZ encoder dictionary re
CVE-2026-105958 (A flaw was found in spice-server. Multiple migration data
handlers use ...)
TODO: check
CVE-2026-105667 (In the default configuration, the HL7 listener accepts
ADT^A40 patient ...)
- TODO: check
+ NOT-FOR-US: dcm4chee-arc-light
CVE-2026-105664 (The endpoint exposes an observable response discrepancy when
processin ...)
- TODO: check
+ NOT-FOR-US: EseeCloud App
CVE-2026-105279 (In the default configuration, the archive accepts DICOM
associations f ...)
- TODO: check
+ NOT-FOR-US: dcm4chee-arc-light
CVE-2026-105273 (MP4Parser does not adequately validate MP4 box sizes. A
malformed box ...)
- TODO: check
+ NOT-FOR-US: dcm4chee-arc-light
CVE-2026-104726 (The Name Directory plugin for WordPress is vulnerable to
Stored Cross- ...)
NOT-FOR-US: WordPress plugin
CVE-2026-104003 (The WP User Avatar / ProfilePress plugin for WordPress is
vulnerable t ...)
@@ -707,31 +707,31 @@ CVE-2026-111384 (Nezha 1.0.0 before 2.3.15 contains a
memory exhaustion vulnerab
CVE-2026-111383 (Nezha from 2.0.13 before 2.3.15 contains a resource
exhaustion vulnera ...)
NOT-FOR-US: Nezha
CVE-2026-111369 (ClassroomIO through 1.0.0 contains an incorrect authorization
vulnerab ...)
- TODO: check
+ NOT-FOR-US: ClassroomIO
CVE-2026-111368 (ClassroomIO through 1.0.0 contains an insecure direct object
reference ...)
- TODO: check
+ NOT-FOR-US: ClassroomIO
CVE-2026-111367 (BillionMail through 4.9 contains a hard-coded cryptographic
key vulner ...)
- TODO: check
+ NOT-FOR-US: BillionMail
CVE-2026-111366 (cool-admin-midway through 8.0.0 contains an authorization
bypass vulne ...)
- TODO: check
+ NOT-FOR-US: cool-admin-midway
CVE-2026-111365 (cool-admin-midway through 8.0.0 contains an authorization
bypass vulne ...)
- TODO: check
+ NOT-FOR-US: cool-admin-midway
CVE-2026-111364 (MinDoc through 2.2-beta.2 contains an insecure direct object
reference ...)
- TODO: check
+ NOT-FOR-US: MinDoc
CVE-2026-111363 (BISHENG through 3.0.0-beta4 contains an insecure direct
object referen ...)
- TODO: check
+ NOT-FOR-US: BISHENG
CVE-2026-111359 (CRMEB 5.6.1 through 6.0.0 contains an insecure direct object
reference ...)
- TODO: check
+ NOT-FOR-US: CRMEB
CVE-2026-111358 (SendPortal sendportal-core through 4.0.1 contains an
authorization byp ...)
- TODO: check
+ NOT-FOR-US: SendPortal
CVE-2026-111357 (Ivanti Connect Secure 22.8R2.4 mishandles the manner in which
the dsin ...)
NOT-FOR-US: Ivanti
CVE-2026-111356 (MacCMS v10 through 2026.1000.4056 does not limit attempts on
the six-d ...)
- TODO: check
+ NOT-FOR-US: MacCMS
CVE-2026-111355 (zhontai Admin.Core through 10.1.0 contains an authorization
bypass vul ...)
- TODO: check
+ NOT-FOR-US: zhontai Admin.Core
CVE-2026-111354 (crmeb_java through 3.1 contains an authorization bypass
vulnerability ...)
- TODO: check
+ NOT-FOR-US: crmeb_java
CVE-2026-111353 (Peppermint through 0.5.5 contains a missing authorization
vulnerabilit ...)
TODO: check
CVE-2026-111352 (ThinkCMF through 8.0.1 contains an incorrect authorization
vulnerabili ...)
@@ -807,9 +807,9 @@ CVE-2026-111270 (libmodplug through 0.8.9.1 contains a
heap-based out-of-bounds
CVE-2026-111269 (libical through 4.0.6 contains a heap-based out-of-bounds
read in ical ...)
TODO: check
CVE-2026-111237 (A weakness has been identified in Ultralytics FastSAM up to
b4ed20c2fe ...)
- TODO: check
+ NOT-FOR-US: Ultralytics FastSAM
CVE-2026-111212 (A security flaw has been discovered in ImprintLab
Medical-SAM-Adapter ...)
- TODO: check
+ NOT-FOR-US: Medical-SAM-Adapter
CVE-2026-111210 (A vulnerability was determined in bitcoinj up to 0.17.
Affected is the ...)
TODO: check
CVE-2026-111178 (The WP Booking System \u2013 Booking Calendar plugin for
WordPress is ...)
@@ -1001,9 +1001,9 @@ CVE-2026-107316
CVE-2026-107172
REJECTED
CVE-2026-106708 (XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site
Request Forge ...)
- TODO: check
+ NOT-FOR-US: XXL-JOB
CVE-2026-106700 (ELADMIN v2.7 and earlier contains an improper access control
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: ELADMIN
CVE-2026-105974 (The Visual Form Builder WordPress plugin through 3.1 does not
perform ...)
NOT-FOR-US: WordPress plugin
CVE-2026-105973 (The Visual Form Builder WordPress plugin through 3.1 does not
perform ...)
@@ -1118,7 +1118,7 @@ CVE-2026-95155 (FasterXML Jackson 1.x, confirmed in
jackson-mapper-asl versions
CVE-2026-94621 (AliasVault is a privacy-first password manager with built-in
email ali ...)
NOT-FOR-US: AliasVault
CVE-2026-93649 (In the Eclipse Adoptium website (adoptium.net), in every
deployment bu ...)
- TODO: check
+ NOT-FOR-US: Eclipse Adoptium website
CVE-2026-92982 (A flaw was found in Ansible Operator Plugins. A low-privileged
Kuberne ...)
NOT-FOR-US: Red Hat Ansible Operator Plugins
CVE-2026-92707 (MessagePack for C# is a MessagePack serializer for C#. Prior
to 2.5.30 ...)
@@ -1731,9 +1731,9 @@ CVE-2026-105882 (Improper Neutralization of Input During
Web Page Generation ('C
CVE-2026-105660 (Improper Validation of Syntactic Correctness of Input
vulnerability in ...)
TODO: check
CVE-2026-105474 (A server-side template injection exists in SolusVM 2 up to
version 2.0 ...)
- TODO: check
+ NOT-FOR-US: SolusVM
CVE-2026-105271 ("\u30b2\u30aa\u30a2\u30d7\u30ea" provided by GEO CORPORATION
contains ...)
- TODO: check
+ NOT-FOR-US: GEO CORPORATION
CVE-2026-105065 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-104828 (HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to
5.4.0, H ...)
@@ -1778,7 +1778,7 @@ CVE-2026-102740 (The AsyncHttpClient library allows Java
applications to execute
CVE-2026-102631 (In authd before 0.7.1, the user identity matching in
UpdateUser (inter ...)
TODO: check
CVE-2026-102527 (Nuxt OG Image generates OG Images with Vue templates in Nuxt.
From 6.2 ...)
- TODO: check
+ NOT-FOR-US: Nuxt OG Image
CVE-2026-102477 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
NOT-FOR-US: Eclipse
CVE-2026-102475 (In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or
[5.2.0, ...)
@@ -1802,9 +1802,9 @@ CVE-2026-102461 (In Eclipse Vert.x versions [4.0.0,
4.5.34] or [5.0.0,5.0.12] or
CVE-2026-102389 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-101311 (The framebuffer device model's maximum resolution constants
were dupli ...)
- TODO: check
+ NOT-FOR-US: FreeBSD
CVE-2026-101310 (The HDA audio device model did not check for zero-length
Buffer Descri ...)
- TODO: check
+ NOT-FOR-US: FreeBSD
CVE-2026-101309 (The xHCI (USB 3) device model did not validate or save the
event ring ...)
TODO: check
CVE-2026-101308 (When an audio channel's buffer needs to be resized, the
sound(4) drive ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/eec7cf1e31c02b1f2100ea382cae56fed0d68274
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/eec7cf1e31c02b1f2100ea382cae56fed0d68274
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
