Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ccd2e73e by Salvatore Bonaccorso at 2026-10-17T21:30:33+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,45 +1,45 @@
CVE-2026-111934 (Coder before 2.34.7 contains an IP spoofing vulnerability in
the Extra ...)
- TODO: check
+ NOT-FOR-US: Coder
CVE-2026-111933 (Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before
2.33.8, and ...)
- TODO: check
+ NOT-FOR-US: Coder
CVE-2026-111932 (Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before
2.33.8, and ...)
- TODO: check
+ NOT-FOR-US: Coder
CVE-2026-111931 (Coder from 2.0.0 before 2.34.8 contains an open redirect
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Coder
CVE-2026-111930 (Coder from 2.26.0 before 2.34.8 contains an incorrect
authorization fl ...)
- TODO: check
+ NOT-FOR-US: Coder
CVE-2026-111929 (Coder from 2.30.0 before 2.34.8 contains an authorization
bypass vulne ...)
- TODO: check
+ NOT-FOR-US: Coder
CVE-2026-111928 (Coder from 2.0.0 before 2.34.8 contains an incorrect
authorization vul ...)
- TODO: check
+ NOT-FOR-US: Coder
CVE-2026-111927 (Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before
2.34.8, and ...)
- TODO: check
+ NOT-FOR-US: Coder
CVE-2026-111926 (Coder from 2.10.0 before 2.34.8 has an unauthenticated agent
debug HTT ...)
- TODO: check
+ NOT-FOR-US: Coder
CVE-2026-111924 (Fleet before 4.83.0 contains a denial of service
vulnerability that al ...)
- TODO: check
+ NOT-FOR-US: Fleet
CVE-2026-111923 (Fleet before 4.89.0 contains an unbounded recursion
vulnerability in A ...)
- TODO: check
+ NOT-FOR-US: Fleet
CVE-2026-111922 (Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS
configurati ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-111921 (Vikunja 0.13.0 before 2.7.0 contains an incorrect
authorization vulner ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-111920 (Vikunja 2.6.0 contains a broken access control flaw in
getProjectAcces ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-111919 (Vikunja 0.22.0 before 2.7.0 contains an improper access
revocation vul ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-111918 (Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper
authorization ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-111917 (Vikunja 2.3.0 before 2.7.0 contains an improper session
validation vul ...)
- TODO: check
+ NOT-FOR-US: Vikunja
CVE-2026-111916 (Admidio before 5.0.16 contains an information disclosure
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Admidio
CVE-2026-111914 (Admidio from 5.0.11 before 5.0.16 contains a broken access
control vul ...)
- TODO: check
+ NOT-FOR-US: Admidio
CVE-2026-111913 (Admidio from 5.0.0 before 5.0.16 contains an authorization
bypass vuln ...)
- TODO: check
+ NOT-FOR-US: Admidio
CVE-2026-111912 (Admidio from 5.0.0 before 5.0.16 contains an insecure direct
object re ...)
- TODO: check
+ NOT-FOR-US: Admidio
CVE-2026-111911 (phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass
vulnerab ...)
NOT-FOR-US: phpMyFAQ
CVE-2026-111910 (phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta
contains an au ...)
@@ -288,7 +288,7 @@ CVE-2026-103899 (The EU VAT Assistant for WooCommerce
plugin for WordPress is vu
CVE-2026-103376 (The PeachPay \u2014 Payments & Express Checkout for
WooCommerce (suppo ...)
NOT-FOR-US: WordPress plugin
CVE-2026-102834 (JavaCV provides Java interfaces to OpenCV, FFmpeg, and other
multimedi ...)
- TODO: check
+ NOT-FOR-US: JavaCV
CVE-2026-102608 (ZoneMinder is a free, open source closed-circuit television
software a ...)
TODO: check
CVE-2026-102607 (ZoneMinder is a free, open source closed-circuit television
software a ...)
@@ -2231,17 +2231,17 @@ CVE-2026-101311 (The framebuffer device model's maximum
resolution constants wer
CVE-2026-101310 (The HDA audio device model did not check for zero-length
Buffer Descri ...)
NOT-FOR-US: FreeBSD
CVE-2026-101309 (The xHCI (USB 3) device model did not validate or save the
event ring ...)
- TODO: check
+ NOT-FOR-US: FreeBSD
CVE-2026-101308 (When an audio channel's buffer needs to be resized, the
sound(4) drive ...)
- TODO: check
+ NOT-FOR-US: FreeBSD
CVE-2026-101307 (When the PCM sample array needs to grow, the RACK stack
doubles a 16-b ...)
- TODO: check
+ NOT-FOR-US: FreeBSD
CVE-2026-101303 (The IPv6 UDP send path for unconnected sockets did not apply
the jail ...)
- TODO: check
+ NOT-FOR-US: FreeBSD
CVE-2026-101290 (A remote attacker may send a specially crafted network packet
that cau ...)
NOT-FOR-US: SICK AG
CVE-2026-101287 (Authentication bypass vulnerability in Stela, versions prior
to 1.60.1 ...)
- TODO: check
+ NOT-FOR-US: Stela
CVE-2026-100409 (OpenNext Cloudflare is an open Next.js adapter for
Cloudflare. From 0. ...)
NOT-FOR-US: Next.js
CVE-2026-100354 (kin-openapi is a Go project for handling OpenAPI files. Prior
to 0.149 ...)
@@ -2646,13 +2646,13 @@ CVE-2026-102980 (Plane is an open-source project
management tool. Prior to 1.4.0
CVE-2026-102298 (In Omada Controller MSP mode, the user-confirmation endpoint
fails to ...)
NOT-FOR-US: TPLink
CVE-2026-101306 (SCM_RIGHTS file descriptor passing did not preserve
FD_RESOLVE_BENEATH ...)
- TODO: check
+ NOT-FOR-US: FreeBSD
CVE-2026-101305 (renameat(2) did not enforce FD_RESOLVE_BENEATH on its
directory argume ...)
- TODO: check
+ NOT-FOR-US: FreeBSD
CVE-2026-101304 (When fdescfs(4) was mounted in a jail with the "nodup"
option, opening ...)
- TODO: check
+ NOT-FOR-US: FreeBSD
CVE-2026-101302 (TLS 1.3 embeds the actual record type as the last non-zero
byte of the ...)
- TODO: check
+ NOT-FOR-US: FreeBSD
CVE-2026-100232 (Post-authentication Improper Neutralization of Special
Elements used i ...)
NOT-FOR-US: SonicWall
CVE-2026-0993 (SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a
buffer ove ...)
@@ -3536,7 +3536,7 @@ CVE-2026-102944 (cpp-httplib is a C++ header-only
HTTP/HTTPS library. Prior to 0
NOTE:
https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-22mf-w2v3-r2jv
NOTE: Fixed by:
https://github.com/yhirose/cpp-httplib/commit/0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585
(v0.51.0)
CVE-2026-102899 (Sentry is an application monitoring and error tracking
platform. From ...)
- TODO: check
+ NOT-FOR-US: Sentry
CVE-2026-102893 (Zulip is an open-source team collaboration tool. In Zulip
Server versi ...)
TODO: check
CVE-2026-102756 (DataEase is an open source data visualization and analysis
tool. Prior ...)
@@ -3544,11 +3544,11 @@ CVE-2026-102756 (DataEase is an open source data
visualization and analysis tool
CVE-2026-102755 (DataEase is an open source data visualization and analysis
tool. Prior ...)
NOT-FOR-US: DataEase
CVE-2026-102748 (Dgraph is an open source distributed GraphQL database. Prior
to 25.4.0 ...)
- TODO: check
+ NOT-FOR-US: Dgraph
CVE-2026-102695 (OmniFaces is a utility library for Faces. In OmniFaces
versions before ...)
- TODO: check
+ NOT-FOR-US: OmniFaces
CVE-2026-102682 (Pipecat is an open-source Python framework for building
real-time voic ...)
- TODO: check
+ NOT-FOR-US: Pipecat
CVE-2026-102479 (In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or
[5.2.0, ...)
NOT-FOR-US: Eclipse
CVE-2026-102476 (In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or
[5.2.0, ...)
@@ -3558,7 +3558,7 @@ CVE-2026-102471 (In Eclipse Vert.x versions [4.0.0,
4.5.34] or [5.0.0,5.0.12] or
CVE-2026-102460 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]
or [5.1.0 ...)
NOT-FOR-US: Eclipse
CVE-2026-102354 (BentoPDF is a privacy-focused PDF toolkit that runs in the
browser. In ...)
- TODO: check
+ NOT-FOR-US: BentoPDF
CVE-2026-102185 (A Loop with Unreachable Exit Condition ('Infinite Loop')
vulnerability ...)
NOT-FOR-US: Juniper
CVE-2026-102184 (AnImproper Validation of Specified Quantity in Input
vulnerability in ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ccd2e73ef44d95d93701b54d0d67676be6691810
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ccd2e73ef44d95d93701b54d0d67676be6691810
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
