Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ca0a0780 by security tracker role at 2026-10-18T19:14:26+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,7 +1,7 @@
CVE-2026-96534 (The Modern Events Calendar Lite WordPress plugin before
7.37.0, Modern ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87844 (The PickPlugins Product Designer for WooCommerce WordPress
plugin thro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112063 (libstrophe through 0.14.0 contains a stack-based buffer
overflow vulne ...)
TODO: check
CVE-2026-112062 (lwIP through 2.2.1 contains a stack out-of-bounds write
vulnerability ...)
@@ -47,9 +47,9 @@ CVE-2026-112019 (cgltf through 1.15 contains a heap
out-of-bounds read vulnerabi
CVE-2026-112018 (cgltf through 1.15 contains a heap out-of-bounds write
vulnerability i ...)
TODO: check
CVE-2026-112017 (JeecgBoot before 3.9.5 contains an sql injection
vulnerability that al ...)
- TODO: check
+ NOT-FOR-US: JeecgBoot
CVE-2026-112016 (Netcore NR256CN through 1.5.140116 contains an
unauthenticated file wr ...)
- TODO: check
+ NOT-FOR-US: Netcore
CVE-2026-112015 (Omnigent 0.3.0 before 0.14.0 contains a path traversal
vulnerability t ...)
TODO: check
CVE-2026-112014 (LobsterAI before 2026.10.16 contains a hardcoded password
vulnerabilit ...)
@@ -133,91 +133,91 @@ CVE-2026-111866 (A weakness has been identified in
nemoTyrant manong up to 7c9e5
CVE-2026-111865 (A security flaw has been discovered in THU-MIG yoloe up to
40cd606cabd ...)
TODO: check
CVE-2026-111041 (The AI Engine WordPress plugin before 3.7.9 does not verify
that the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110981 (The WP Photo Album Plus WordPress plugin before 9.2.11.002
does not pr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110976 (The AI Engine WordPress plugin before 3.7.9 does not check
that the i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110897 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110895 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110886 (Deserialization of Untrusted Data vulnerability in
QuantumCloud Conver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110885 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110883 (Authentication Bypass by Primary Weakness vulnerability in
VideoWhispe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110880 (Missing Authorization vulnerability in Kit Kit (formerly
ConvertKit) c ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110494 (Adding attachments to a release checked the repository and
release of ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-110383 (Authorization Bypass Through User-Controlled Key
vulnerability in WP E ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110382 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110373 (Incorrect Privilege Assignment vulnerability in Hamid Alinia
Login wit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110372 (Incorrect Privilege Assignment vulnerability in Brainstorm
Force OttoK ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110365 (Missing Authorization vulnerability in WPExperts Advanced
File Manager ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110324 (The visibility check of Gitea user profiles was applied to
GET request ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-110311 (Creating a draft release through the API returned an `assets`
list tha ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-110070 (The Modern Events Calendar Lite WordPress plugin before
7.36.4 does no ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110069 (The Modern Events Calendar Lite WordPress plugin before
7.37.0 does no ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110035 (The Salon Booking System WordPress plugin before 10.31.11
does not re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110033 (The Salon Booking System WordPress plugin before 10.31.11
does not va ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110032 (The Salon Booking System WordPress plugin before 10.31.11
does not re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110031 (The Salon Booking System WordPress plugin before 10.31.11
does not pr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110026 (The Tasty Recipes Lite WordPress plugin before 1.2.11 does
not correc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110024 (@fastify/jwt is a JWT utility plugin for Fastify. In versions
prior to ...)
TODO: check
CVE-2026-109937 (The Otter Blocks WordPress plugin before 3.2.3 does not
validate that ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109895 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109894 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109844 (`GET /api/v1/user/subscriptions` returned the metadata of
every reposi ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-109553 (Gitea resolved the principals of an SSH certificate by
searching the c ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-108485 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108117
REJECTED
CVE-2026-107772
REJECTED
CVE-2026-107686 (The Gitea web handlers for adding and removing reactions on
issues and ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-107618 (`POST /{owner}/{repo}/topics` was registered without the
sign-in middl ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-107436 (Deserialization of Untrusted Data vulnerability in WP Chill
Strong Tes ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-107345
REJECTED
CVE-2026-107274
REJECTED
CVE-2026-105964 (The Gitea Actions artifact v4 (Twirp) handlers read the whole
request ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-105661 (Requesting `/{username}/-/repositories` for an individual
user instead ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-105391
REJECTED
CVE-2026-104627 (The Gitea OpenID association callback in the security
settings accepte ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2024-4457 (The Management Console fails to properly validate input related
to the ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-78497 (JQ::Lite versions before 2.51 for Perl execute Perl code
embedded in a ...)
NOT-FOR-US: JQ::Lite Perl module
CVE-2026-98868 (In the Linux kernel, the following vulnerability has been
resolved: d ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ca0a078005bc80e095a40583f43f5eaa1ae862b5
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ca0a078005bc80e095a40583f43f5eaa1ae862b5
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
