Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
737332fe by security tracker role at 2026-10-20T07:14:15+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,97 +1,97 @@
CVE-2026-97627 (Hidden functionality issue exists in Multiple DVRs (Digital
Video Reco ...)
TODO: check
CVE-2026-96903 (The Easy Property Listings WordPress plugin before 3.5.27 does
not per ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96902 (The Easy Property Listings WordPress plugin before 3.5.28 does
not res ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93878 (The DiviGear Carousel plugin for WordPress is vulnerable to
Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93300 (The EventON - Subscriber plugin for WordPress is vulnerable to
generic ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-8355 (IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable
to a se ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-86981 (An out-of-bounds write issue was addressed with improved
bounds checki ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86979 (A privacy issue was addressed with improved checks. This issue
is fixe ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86977 (An authorization issue was addressed with improved network
restriction ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86976 (An authorization issue was addressed with improved state
management. T ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86975 (An out-of-bounds read was addressed with improved bounds
checking. Thi ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86963 (A denial-of-service issue was addressed with improved input
validation ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86962 (A double free issue was addressed with improved memory
management. Thi ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86961 (A race condition was addressed with additional validation.
This issue ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86959 (An input validation issue was addressed with improved input
validation ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86957 (An out-of-bounds read was addressed with improved bounds
checking. Thi ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86955 (An authorization issue was addressed with improved state
management. T ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86953 (An out-of-bounds write issue was addressed with improved
bounds checki ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86949 (This issue was addressed by enforcing library validation on
the affect ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86948 (This issue was addressed by enforcing library validation on
the affect ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86944 (An out-of-bounds write issue was addressed with improved
bounds checki ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86940 (This issue was addressed by removing the vulnerable code. This
issue i ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86935 (This issue was addressed by removing additional entitlements.
This iss ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86933 (A permissions issue was addressed with additional sandbox
restrictions ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86932 (An authorization issue was addressed with improved state
management. T ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86928 (A path handling issue was addressed with improved validation.
This iss ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86922 (A type confusion issue was addressed with improved state
management. T ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86921 (A permissions issue was addressed with improved validation.
This issue ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86919 (A stack overflow was addressed with improved input validation.
This is ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86918 (An out-of-bounds write issue was addressed with improved
bounds checki ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86915 (A race condition was addressed with improved locking. This
issue is fi ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86914 (An information disclosure issue was addressed with improved
state mana ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86913 (A use after free issue was addressed with improved memory
management. ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86907 (An authorization issue was addressed with improved entitlement
checks. ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86875 (An input validation issue was addressed with improved input
validation ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86874 (An out-of-bounds read was addressed with improved input
validation. Th ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86872 (A logic issue was addressed with improved state management.
This issue ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86871 (An integer underflow was addressed with improved input
validation. Thi ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86868 (An authentication issue was addressed with improved state
management. ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86467 (Apache Airflow Amazon provider: the AWS auth manager's SAML
login flow ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-84613 (An out-of-bounds write issue was addressed with improved
bounds checki ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-84582 (A privacy issue was addressed with improved access
restrictions. This ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-84579 (A logic issue was addressed with improved checks. This issue
is fixed ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-84547 (A memory corruption issue was addressed with improved input
validation ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-84508 (This issue was addressed with improved validation of the
caller's acce ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-84490 (This issue was addressed through improved state management.
This issue ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-82166 (Dell Application Store, versions prior to 26.05.0.7, contain a
Missing ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-77938 (Letta through 0.16.8 contains an information disclosure
vulnerability ...)
TODO: check
CVE-2026-77937 (Letta through 0.16.8 contains an authentication bypass
vulnerability t ...)
@@ -111,27 +111,27 @@ CVE-2026-77930 (EvoScientist 0.1.0 before 0.2.5 contains
an approval bypass vuln
CVE-2026-77926 (Aix-DB 1.2.4 contains a remote code execution vulnerability
that allow ...)
TODO: check
CVE-2026-77684 (The Bluetooth Classic Hands-Free Profile HF role in
subsys/bluetooth/h ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-76788 (The OSDP Control Panel reply parser cp_decode_response() in
subsys/mgm ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-76787 (The UpdateHub firmware-over-the-air client parses the CoAP
probe respo ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-75753 (Missing Authentication for a Critical Function in certain ASUS
routers ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-75128 (Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call
API endp ...)
TODO: check
CVE-2026-71170 (Dell Application Store, versions prior to 26.05.0.7, contains
an Uncon ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-71169 (Dell Application Store, versions prior to 26.05.0.7, contain
an Incorr ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-65396 (A buffer overflow was addressed with improved size validation.
This is ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-65379 (The issue was addressed with improved handling of secure input
state. ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-65372 (A race condition was addressed with additional validation.
This issue ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-65356 (An access issue was addressed with improved access controls.
This issu ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-57529
REJECTED
CVE-2026-57528
@@ -151,21 +151,21 @@ CVE-2026-57512
CVE-2026-56714
REJECTED
CVE-2026-53995 (MLflow 3.17.1 and earlier contains a path traversal
vulnerability in t ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-28854 (The issue was addressed with additional app bundle integrity
checks. T ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-28853 (The issue was addressed with improved checks. This issue is
fixed in m ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-28850 (An authorization issue was addressed with improved state
management. T ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-19595 (The user-mode syscall verifier
z_vrfy_rtio_cqe_get_mempool_buffer() in ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-19178 (IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could
allow a remo ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17518 (Buffer Copy without Checking Size of Input in certain ASUS
router mode ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-12489 (An incorrect authorization vulnerability in the Data Access
Layer (DAL ...)
- TODO: check
+ NOT-FOR-US: Zyxel
CVE-2026-113404 (WebITR developed by Uniong has a Insecure Deserialization
vulnerabilit ...)
TODO: check
CVE-2026-113402 (ArmorX Spam developed by ArmorX Global Technology has a Local
File Inc ...)
@@ -207,25 +207,25 @@ CVE-2026-112779 (Grav API plugin (grav-plugin-api) 1.0.40
before 1.0.42 caches a
CVE-2026-112778 (Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack
namespace va ...)
TODO: check
CVE-2026-112777 (Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a
blocklist ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112776 (Craft CMS from 5.0.0 before 5.11.0 contains an authorization
bypass vu ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112775 (Craft CMS from 5.0.0 before 5.11.0 contains an authentication
bypass v ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112774 (Craft CMS from 5.8.0 before 5.11.0 contains a remote code
execution vu ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112773 (Craft CMS from 5.0.0 before 5.11.0 contains a remote code
execution vu ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112772 (Craft CMS from 5.0.0 before 5.11.0 contains a remote code
execution vu ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112771 (Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0
contains a Twig ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112770 (Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a
remote co ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112769 (Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1
does not en ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-112768 (Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2
evaluates c ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-112406 (Pillow is a Python imaging library. From 5.1.0 until 13.0.0,
Pillow ca ...)
TODO: check
CVE-2026-112405 (Pillow is a Python imaging library. From 12.0.0 until 13.0.0,
Pillow's ...)
@@ -269,7 +269,7 @@ CVE-2026-112371 (A vulnerability was determined in H3C
Magic NX15 NX15V100R017.
CVE-2026-112370 (A vulnerability was found in H3C Magic NX15 100R017. This
issue affect ...)
TODO: check
CVE-2026-112361 (A vulnerability has been found in Dolibarr up to 23.0.2. The
impacted ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-112360 (A security vulnerability has been detected in Netis EAP930
1.250905.11 ...)
TODO: check
CVE-2026-112358 (A weakness has been identified in TiBillet Lespass up to
10e87909c5d52 ...)
@@ -315,17 +315,17 @@ CVE-2026-109440 (LangAlpha through 2026.09.07 contains an
indirect prompt inject
CVE-2026-109395 (Ning compress-lzf before 1.2.0 contains an out-of-bounds
memory access ...)
TODO: check
CVE-2026-109126 (IBM Verify Identity Access 11.0.3.1 and IBM Security Verify
Access 10. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107400 (IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could
allow a rem ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107366 (IBM Langflow OSS 1.0.0 through 1.12.4 contains three message
endpoints ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-105815 (TP-Link Tapo C210 V3.60 may expose shared credential material
and cryp ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-105814 (TP-Link Tapo C210 V3.60 contains an authentication bypass
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-105453 (IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7
and6.4.0. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-105299 (Summary Before version 0.9.0, the HTTP/1 upstream path in
pingora-p ...)
TODO: check
CVE-2026-105298 (Summary Before version 0.9.0, Pingora accepted HTTP/2
requests whos ...)
@@ -333,15 +333,15 @@ CVE-2026-105298 (Summary Before version 0.9.0, Pingora
accepted HTTP/2 reques
CVE-2026-105297 (Summary Before version 0.8.1, Pingora's HTTP/2 server used
the h2 c ...)
TODO: check
CVE-2026-102438 (An uncontrolled search path element vulnerability in ASUS
Armoury Crat ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-100737 (Hidden functionality issue exists in Multiple DVRs (Digital
Video Reco ...)
TODO: check
CVE-2025-36252 (IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500
Tape Li ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2025-36069 (IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not
invalidat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2025-36061 (IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM
Diamondback Ta ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2024-54657
REJECTED
CVE-2024-54656
@@ -711,7 +711,7 @@ CVE-2026-76994 (Exposure of Sensitive Information to an
Unauthorized Actor vulne
CVE-2026-71563 (Missing Authorization vulnerability in Apache Answer. This
issue af ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71253 (Use of Externally-Controlled Input to Select Classes or Code
('Unsafe ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-6930 (IBM Concert 1.0 through 3.0.0 uses weaker than expected
cryptographic ...)
NOT-FOR-US: IBM
CVE-2026-6719 (IBM Concert 1.0 through 3.0.0 uses weaker than expected
cryptographic ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/737332fe14990b675a672f82e7f204ca4c66dac6
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/737332fe14990b675a672f82e7f204ca4c66dac6
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
