Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
4c445016 by security tracker role at 2026-10-19T19:15:39+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,97 +1,97 @@
CVE-2026-91858 (FopProducer transforms the incoming XSL-FO message body by
creating a ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-90910 (Missing authentication for critical function vulnerability in
Apache A ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-8168 (Uncontrolled recursion in the SVG parser and renderer of the Qt
SVG mo ...)
TODO: check
CVE-2026-88901 (Improper Restriction of XML External Entity Reference
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-88900 (Deserialization of Untrusted Data vulnerability in Apache
Camel Camel- ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-86589 (Incorrect implementation of authentication algorithm
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-86375 (Dell Application Installer, versions prior to 26.09.0.1,
contain a Mis ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-85317 (Use of Cache Containing Sensitive Information vulnerability in
Apache ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85316 (Insufficient Granularity of Access Control vulnerability in
Apache Cam ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85315 (Generation of Error Message Containing Sensitive Information
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85314 (Improper Input Validation vulnerability in Apache Camel Mail
component ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85313 (Permissive Cross-domain Policy with Untrusted Domains
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85312 (Improper Input Validation vulnerability in Apache Camel Core
component ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85301 (Improper Authentication vulnerability in Apache Camel Keycloak
compone ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85300 (Incorrect Default Permissions vulnerability in Apache Camel
PQC compon ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85296 (Exposure of Data Element to Wrong Session vulnerability in
Apache Came ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85260 (Insertion of Sensitive Information into Log File vulnerability
in Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85257 (Generation of Error Message Containing Sensitive Information
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85254 (Improper Handling of Case Sensitivity vulnerability in Apache
Camel Pl ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85251 (Exposure of Sensitive Information to an Unauthorized Actor
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85250 (Improper Restriction of XML External Entity Reference
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85249 (Improper Input Validation vulnerability in Apache Camel Tika
component ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85248 (Concurrent Execution using Shared Resource with Improper
Synchronizati ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85247 (Improper Certificate Validation vulnerability in Apache Camel
Knative ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85246 (Generation of Error Message Containing Sensitive Information
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85245 (Exposure of Data Element to Wrong Session vulnerability in
Apache Came ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85243 (Improper Validation of Integrity Check Value vulnerability in
Apache C ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-84181 (Improper Authentication vulnerability in Apache Camel Shiro
component. ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-84180 (Generation of Error Message Containing Sensitive Information
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-84178 (Cross-Site Request Forgery (CSRF) vulnerability in Apache
Camel OAuth ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-84176 (Permissive Cross-domain Policy with Untrusted Domains
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-83531 (Improper Control of Generation of Code ('Code Injection'),
Improper Ne ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-80344 (Server-Side Request Forgery (SSRF) vulnerability in Apache
Camel AS2 c ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-80343 (Improper Handling of Case Sensitivity vulnerability in Apache
Camel Ne ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-80312 (Improper Authentication vulnerability in Apache Camel OAuth
component. ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79986 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79985 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79984 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79983 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79633 (vulnerability in Apache Answer. This issue affects Apache
Answer: t ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79624 (Insufficient session expiration vulnerability in Apache
Answer. Thi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79620 (Exposure of sensitive information through data queries
vulnerability i ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79613 (vulnerability in Apache Answer. This issue affects Apache
Answer: t ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-78165 (Deserialization of Untrusted Data vulnerability in Apache
Camel Spring ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-78164 (Improper Neutralization of Special Elements Used in a Template
Engine ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-78163 (Server-Side Request Forgery (SSRF), Improper Limitation of a
Pathname ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-78162 (Deserialization of Untrusted Data vulnerability in Apache
Camel. Th ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-77228
REJECTED
CVE-2026-77227
@@ -99,79 +99,79 @@ CVE-2026-77227
CVE-2026-77225
REJECTED
CVE-2026-76994 (Exposure of Sensitive Information to an Unauthorized Actor
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71563 (Missing Authorization vulnerability in Apache Answer. This
issue af ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71253 (Use of Externally-Controlled Input to Select Classes or Code
('Unsafe ...)
TODO: check
CVE-2026-6930 (IBM Concert 1.0 through 3.0.0 uses weaker than expected
cryptographic ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-6719 (IBM Concert 1.0 through 3.0.0 uses weaker than expected
cryptographic ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-68482 (Missing Authorization vulnerability in Apache Answer. This
issue af ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-67249 (A vulnerability in Apache Answer. This issue affects Apache
Answer: ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-64945 (A vulnerability in Apache Answer. This issue affects Apache
Answer: ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-64944 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-64943 (Insertion of Sensitive Information into Log File vulnerability
in Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-55644 (Element X iOS is a Matrix iOS Client provided by Element.
Element X iO ...)
TODO: check
CVE-2026-4418 (IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML
inject ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-4413 (IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site
scripting. T ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-4405 (IBM Concert 1.0 through 3.0.0 allows web page cache to be
stored local ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-3628 (IBM Concert 1.0 through 3.0.0 allows information disclosure
through ex ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-3303 (IBM Concert 1.0 through 3.0.0 uses cross-origin resource
sharing (CORS ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-3295 (IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to
cross site ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-3161 (IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than
expected cr ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-38671 (Cross Site Scripting vulnerability in Ellucian Banner Student
Registra ...)
TODO: check
CVE-2026-1510 (IBM Concert 1.0 through 3.0.0 is vulnerable to Information
Disclosure ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-1501 (IBM Concert 1.0 through 3.0.0 is vulnerable to Improper
Certificate Va ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15661 (IBM Concert 1.0 through 3.0.0 could allow an unauthorized user
to inje ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14511 (IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated
user to ca ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-13695 (SQL injection (SQLi) vulnerability\u2014specifically a
UNION-based vul ...)
TODO: check
CVE-2026-12727 (IBM MQ could allow an authenticated attacker to cause
potential proces ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12670 (IBM MQ could allow an authenticated attacker to cause a denial
of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12669 (IBM MQ could allow an authenticated attacker to trigger a
minor out-of ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12665 (IBM MQ could allow a remote attacker to execute arbitrary code
due to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12660 (IBM MQ Web Console could allow an authenticated administrator
to write ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12350 (IBM MQ could allow an authenticated attacker to cause a denial
of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12343 (IBM MQ could allow an authenticated attacker to cause a denial
of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12254 (Netskope is notified about a potential gap in its agent
(NSClient) whe ...)
- TODO: check
+ NOT-FOR-US: Netskope
CVE-2026-12155 (IBM MQ could allow an authenticated attacker to cause a denial
of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12148 (IBM MQ Operator could allow an authenticated attacker to cause
a denia ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11831 (IBM MQ could allow an authenticated attacker to cause a
limited denial ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11829 (IBM MQ could allow an authenticated attacker to cause a denial
of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11828 (IBM MQ could allow a remote attacker with queue manager
control or man ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11319 (TickTick Android application (com.ticktick.task) 8.2.2.0
contains a pa ...)
TODO: check
CVE-2026-112377 (CCC Attestation SIG attested-tls-poc through commit 731ca82
fails to b ...)
@@ -285,13 +285,13 @@ CVE-2026-112248 (A security vulnerability has been
detected in grandnode grandno
CVE-2026-112247 (A weakness has been identified in Wuxi Wubang Security
Software Five-i ...)
TODO: check
CVE-2026-112222 (Missing Authorization vulnerability in Surfer Surfer
surferseo allows ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112214 (A flaw was found in the GStreamer ASF demuxer in
gst-plugins-ugly. Whe ...)
TODO: check
CVE-2026-112210 (A flaw was found in the rhc-canonical-facts.service systemd
unit shipp ...)
TODO: check
CVE-2026-112199 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112195 (A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5.
The affect ...)
TODO: check
CVE-2026-112193 (A vulnerability was detected in Webkul Aureus ERP up to
1.6.0. Impacte ...)
@@ -317,7 +317,7 @@ CVE-2026-112161 (MobaXterm Personal Edition (Portable) 26.4
GA extracts the CygU
CVE-2026-112159 (A security vulnerability has been detected in JumpServer up
to 4.10.19 ...)
TODO: check
CVE-2026-112158 (A weakness has been identified in MikroTik RouterOS up to
6.40.5/6.44/ ...)
- TODO: check
+ NOT-FOR-US: MikroTik
CVE-2026-112157 (A weakness has been identified in MemTensor memmy-agent up to
1.0.9/1. ...)
TODO: check
CVE-2026-112153 (A vulnerability was detected in vraj404
Criminal-Management-System up ...)
@@ -333,7 +333,7 @@ CVE-2026-112149 (A vulnerability was identified in vraj404
Criminal-Management-S
CVE-2026-112147 (A vulnerability was found in ai-genius-automations octoally
up to 1.0. ...)
TODO: check
CVE-2026-112146 (A vulnerability was detected in D-Link E15, M32, R15 and R32.
This iss ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2026-112145 (A security vulnerability has been detected in speaches-ai
speaches up ...)
TODO: check
CVE-2026-112144 (A weakness has been identified in satya-vinay
Events-Management-System ...)
@@ -371,11 +371,11 @@ CVE-2026-112100 (A vulnerability was determined in
DeepPavlov up to 1.7.0. This
CVE-2026-112098 (A security flaw has been discovered in DeepPavlov up to
1.7.0. Impacte ...)
TODO: check
CVE-2026-112097 (A vulnerability was found in SourceCodester Inventory System
1.0. This ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-112096 (A vulnerability has been found in SourceCodester Inventory
System 1.0. ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-112095 (A flaw has been found in SourceCodester Inventory System 1.0.
This aff ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-112094 (A security vulnerability has been detected in michaelrsweet
mxml 4.0.5 ...)
TODO: check
CVE-2026-112093 (A vulnerability has been found in subhajitkhan
online-clinic-managemen ...)
@@ -387,11 +387,11 @@ CVE-2026-112091 (A flaw has been found in Dav-ee
dairy-management-system 31ace96
CVE-2026-112090 (A vulnerability was detected in Dav-ee
dairy-management-system 31ace96 ...)
TODO: check
CVE-2026-111939 (Frappe Helpdesk before 1.26.0 contains an authorization
bypass vulnera ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-111938 (Frappe CRM before 1.74.0 contains a missing authorization
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-111937 (Frappe CRM before 1.81.2 contains a missing authorization
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-111936 (Sigma File Manager through 2.2.0 contains a server-side
request forger ...)
TODO: check
CVE-2026-111935 (NoteGen through 0.38.3 contains an external control of file
path vulne ...)
@@ -405,19 +405,19 @@ CVE-2026-111899 (KitchenOwl through 0.7.10 contains a
server-side request forger
CVE-2026-111883 (Locust through 2.46.7 contains a cross-site request forgery
vulnerabil ...)
TODO: check
CVE-2026-111862 (Rank Math SEO PRO for WordPress is affected by a supply-chain
compromi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111845 (Missing Authorization vulnerability in YITH YITH WooCommerce
Product B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111839 (Missing Authorization vulnerability in VideoWhisper.com
Broadcast Live ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111836 (Missing Authorization vulnerability in WP ManageNinja LLC
FluentCommun ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111831 (Missing Authorization vulnerability in WP ManageNinja LLC
FluentForm f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111829 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111828 (Improper Validation of Specified Quantity in Input
vulnerability in Ma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111759 (markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2,
when typ ...)
TODO: check
CVE-2026-111757 (Hono is a Web application framework that provides support for
any Java ...)
@@ -435,17 +435,17 @@ CVE-2026-111439 (\u5728 openGauss-server\u7684
src/common/backend/utils/adt/genf
CVE-2026-111438 (\u5728 openGauss-server \u7684
src/common/backend/libpq/hba.cpp \u4e2d ...)
TODO: check
CVE-2026-111414 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111410 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111408 (Deserialization of Untrusted Data vulnerability in
ExpressTech Quiz An ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111407 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111406 (Unrestricted Upload of File with Dangerous Type vulnerability
in PT No ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111398 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111066 (AIOHTTP is an asynchronous HTTP client/server framework for
asyncio an ...)
TODO: check
CVE-2026-111065 (AIOHTTP is an asynchronous HTTP client/server framework for
asyncio an ...)
@@ -471,23 +471,23 @@ CVE-2026-111046 (FOSSBilling is an open source billing
and client-management pla
CVE-2026-111045 (CLI Bridge provides filesystem access within a workspace
root. Prior t ...)
TODO: check
CVE-2026-110902 (Authorization Bypass Through User-Controlled Key
vulnerability in Liqu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110898 (Incorrect Privilege Assignment vulnerability in WPDeveloper
Essential ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110887 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110379 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110363 (Missing Authorization vulnerability in ThimPress LearnPress
learnpress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110008 (@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows.
In versio ...)
TODO: check
CVE-2026-10743 (IBM MQ could allow an authenticated attacker to cause a denial
of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-10574 (IBM MQ could allow an authenticated attacker to cause a denial
of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-10572 (IBM MQ could allow an authenticated attacker to cause a denial
of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-109437 (Cognition before 0.13.0 contains an unauthenticated remote
code execut ...)
TODO: check
CVE-2026-109434 (Fenrir Sleipnir Browser for Android before 3.9.0 contains a
UI spoofin ...)
@@ -499,23 +499,23 @@ CVE-2026-109432 (Camunda 7.24.0 before 7.24.14 and 7.23.0
before 7.23.17 contain
CVE-2026-109431 (Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17
contains a mis ...)
TODO: check
CVE-2026-108837 (Allocation of resources without limits or throttling
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108833 (Default startup profile miss security settingsin Apache
Kylin. Any dep ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108823 (Exposure of Sensitive Information to an Unauthorized Actor
during job ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108780 (Potential JDBC source configuration validationvulnerability
in Apache ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108776 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108771 (Missing authentication for in-house broadcast andpolymorphic
deseriali ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108766 (Missing authorization on jdbc source config update in Apache
Kylin.Imp ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108764 (Server-Side request forgery (SSRF) vulnerability in Apache
Kylin.Impac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108762 (Path-confinement bypassduring metadata backup deletion in
Apache Kylin ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-107571 (Incorrect default permissions in the Windows installer of
Progressive ...)
TODO: check
CVE-2026-107569 (Unchecked input for a loop condition in Progressive Robot
hMailServer ...)
@@ -541,7 +541,7 @@ CVE-2026-107082 (Slims (Senayan Library Management Systems)
9 Bulian 9.8.0 allow
CVE-2026-107081 (SQL injection via identifier injection in the tableName and
tableField ...)
TODO: check
CVE-2026-105810 (Tapo C320WS V2.0 contains an authenticated stack-based buffer
overflow ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-104679 (VOCALOID6 Editor provided by Yamaha Corporation improperly
restricts X ...)
TODO: check
CVE-2026-103314 (A flaw was found in Red Hat Advanced Cluster Security for
Kubernetes ( ...)
@@ -549,11 +549,11 @@ CVE-2026-103314 (A flaw was found in Red Hat Advanced
Cluster Security for Kuber
CVE-2026-103038 (PingTools Network Utilities 4.64 Free accepts an arbitrary
value in th ...)
TODO: check
CVE-2025-7203 (The Management Console and product files expose sensitive data,
includ ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2025-7043 (The ForgeRock client fails to correctly validate refresh
tokens. This ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2025-6623 (The carbon console accepts user-supplied XML input without
sufficientl ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2025-60482 (A heap use-after-free in the gf_odf_ac4_cfg_clean_list
function (/odf/ ...)
TODO: check
CVE-2025-60480 (A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info
function ...)
@@ -565,15 +565,15 @@ CVE-2025-55654 (A use-after-free in the
gf_filter_pid_get_packet function (filte
CVE-2025-52290 (A NULL pointer dereference in the
avpriv_h264_has_num_reorder_frames f ...)
TODO: check
CVE-2025-13591 (The authentication endpoint of WSO2 Identity Server fails to
provide a ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2025-13173 (Tokens associated with user sessions are not revoked when the
correspo ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2025-10149 (The SCIM endpoint does not sufficiently validate authorization
for fed ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-4412 (The software accepts user-supplied data without sufficient
validation, ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2023-38375 (IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to
cross-site ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110688 (Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl
allow quadrat ...)
- libcpanel-json-xs-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44479935/
@@ -21653,7 +21653,7 @@ CVE-2026-25267 (Memory corruption when non-secure
loader rewrites page tables be
CVE-2026-25263 (Memory corruption while processing IOCTL command called from
user spac ...)
NOT-FOR-US: Qualcomm
CVE-2026-21589 (This is a vulnerability in Bitbucket Data Center, Confluence
Data Cent ...)
- TODO: check
+ NOT-FOR-US: Atlassian
CVE-2026-105786 (Joplin is an open source note-taking and to-do application
that organi ...)
- joplin <itp> (bug #931306)
CVE-2026-105785 (Joplin is an open source note-taking and to-do application
that organi ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4c445016974c744fd72ee1e56fe81c3eed41545a
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4c445016974c744fd72ee1e56fe81c3eed41545a
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
