Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
565bf7ea by security tracker role at 2026-10-20T19:15:54+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3,63 +3,63 @@ CVE-2026-9589 (Missing authorization in the configuration
cascade operations of
CVE-2026-97406 (XERJ Console API bearer tokens can bypass the
passkey\u2011only authen ...)
TODO: check
CVE-2026-97400 (In Eclipse OpenJ9 versions up to 0.63, opening a supplied
diagnostic d ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-96582 (A HID report descriptor is a sequence of items, each declaring
in its ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-96406 (A VideoStreaming interface reports the size of its whole
class-specifi ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-96402 (A malicious USB MTP/PTP device can cause the USBX host to read
past a ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-95168 (An issue in nvbn thefuck v.3.32 allows a local attacker to
execute arb ...)
TODO: check
CVE-2026-95111 (A memory-protected ThreadX module's queue request reaches the
Module M ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-95109 (The Cortex-A7 MMU Modules port validates a caller-supplied
buffer by t ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-95108 (One logical thread of a user-mode ThreadX module costs the
Module Mana ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-95107 (A ThreadX module chooses `object_size` when it calls
`txm_module_objec ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-94202 (The Module Manager's block-pool create dispatcher proved that
two `ALI ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-94192 (A ThreadX module allocates the control blocks of its kernel
objects fr ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-94024 (The Module Manager's object lookup validated one byte of a
memory-prot ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-94023 (A ThreadX module reaches a kernel object's delete service
through the ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-94018 (The Web add-on's HTTP server dereferences and releases an
uninitialize ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-93475 (The X.509 parser in NetX Secure accepts an RSA public key of
any size, ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-93446 (Incomplete cleanup vulnerability in Apache Tomcat could cause
TLS 1.3 ...)
TODO: check
CVE-2026-93003 (The Web add-on's HTTP server searches the entire request
packet for he ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-92853 (The TLS 1.3 Certificate-message parser in NetX Secure
decrements the m ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-92843 (A missing bounds check in the TLS 1.3 Certificate-message
parser of Ne ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-92539 (A service account with user-management permissions in one
organization ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-92454 (The GUIX software JPEG decoder reads four kinds of marker
segment with ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-92449 (`_gx_binres_pixelmap_table_load()` in the GUIX binary resource
(theme) ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-92446 (`gx_binres_theme_load()` and `gx_binres_font_load()` take the
resource ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-92287 (Pass-through of unvalidated KMS URLs to KMS clients in Apache
C++ Parq ...)
TODO: check
CVE-2026-91189 (The GUIX binary resource loader never checks that a font
page's glyph ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-91186 (The PNG chunk reader has no notion of chunk ordering. It
records wheth ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-91059 (The GUIX JPEG software decoder enforces no ordering on JPEG
markers. A ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-91057 (`_gx_multi_line_text_view_display_info_get()` reads one byte
past the ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-91041 (Mounting an attacker-controlled FAT image with fault tolerance
enabled ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-90800 (Missing authorisation checks in chttpd in Apache CouchDB 3.5.2
and bel ...)
TODO: check
CVE-2026-90799 (Unsafe binary deserialisation in chttpd in Apache CouchDB
3.5.2 and be ...)
@@ -139,17 +139,17 @@ CVE-2026-43835 (A vulnerability in the firmware upgrade
functionality could allo
CVE-2026-43834 (A stack-based buffer overflow vulnerability in the logs
settings funct ...)
TODO: check
CVE-2026-34485 (Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL
Bypass vulne ...)
- TODO: check
+ NOT-FOR-US: Nokia
CVE-2026-34484 (Nokia 1830 Global Express GX is vulnerable to a local
privilege escala ...)
- TODO: check
+ NOT-FOR-US: Nokia
CVE-2026-28331 (SolarWinds Patch Manager exposes sensitive information
accessible to l ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2026-28330 (SolarWinds Observability Self-Hosted was found to be affected
by a sto ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2026-28329 (SolarWinds Observability Self-Hosted was found to be affected
by a Ser ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2026-28328 (SolarWinds Observability Self-Hosted was found to be affected
by a bro ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2026-21356
REJECTED
CVE-2026-21270
@@ -169,15 +169,15 @@ CVE-2026-113810 (A Stored Cross-Site Scripting
vulnerability exists in the SNS e
CVE-2026-113808 (A Stored Cross-Site Scripting vulnerability exists in the SNS
enrollme ...)
TODO: check
CVE-2026-113802 (Wavlink WL-WN530BE1-A firmware through M30BE1_V251117
contains an OS c ...)
- TODO: check
+ NOT-FOR-US: Wavlink
CVE-2026-113711 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
TODO: check
CVE-2026-113710 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
TODO: check
CVE-2026-113709 (Argo CD is a declarative, GitOps continuous delivery tool for
Kubernet ...)
- TODO: check
+ NOT-FOR-US: Argo CD
CVE-2026-113708 (Argo CD is a declarative, GitOps continuous delivery tool for
Kubernet ...)
- TODO: check
+ NOT-FOR-US: Argo CD
CVE-2026-113703 (SuggestArr before 3.0.0 contains an authentication bypass
vulnerabilit ...)
TODO: check
CVE-2026-113683 (VPL (Virtual Programming Lab) for Moodle before 5.0.0
contains a refle ...)
@@ -197,7 +197,7 @@ CVE-2026-113677 (Froxlor from 0.10.0 before 2.3.15 contains
a missing authorizat
CVE-2026-113676 (Froxlor from 0.10.0 before 2.3.15 contains an authorization
bypass vul ...)
TODO: check
CVE-2026-113672 (Argo CD is a declarative, GitOps continuous delivery tool for
Kubernet ...)
- TODO: check
+ NOT-FOR-US: Argo CD
CVE-2026-113671 (ApostropheCMS is an open-source Node.js content management
system. Fro ...)
TODO: check
CVE-2026-113670 (ApostropheCMS is an open-source Node.js content management
system. Pri ...)
@@ -305,15 +305,15 @@ CVE-2026-113495 (A flaw was found in cockpit-machines.
Red Hat Subscription Mana
CVE-2026-113469 (A failure has been identified in the SNS during dynamic data
files sig ...)
TODO: check
CVE-2026-113468 (The payment notification endpoint for PayPal accepts incoming
data wit ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-113466 (A security vulnerability has been detected in MinIO up to
RELEASE.2025 ...)
TODO: check
CVE-2026-113465 (It is possible to execute a DOM-based Cross-Site Scripting
attack agai ...)
TODO: check
CVE-2026-113459 (In versions running on TYPO3 10 and 11, the configured OpenAI
API key ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-113442 (Values entered by visitors were placed into the HTML summary
email wit ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-113411 (A vulnerability was found in Nerimity Desktop up to 2.2.2.
Affected by ...)
TODO: check
CVE-2026-113407 (BA-Workflow developed by YS-infoware has a SQL Injection
vulnerability ...)
@@ -439,21 +439,21 @@ CVE-2026-112909 (filelock is a platform-independent file
lock for Python. Prior
CVE-2026-112906 (filelock is a platform-independent file lock for Python. From
4.1.0 un ...)
TODO: check
CVE-2026-112861 (Authorization Bypass Through User-Controlled Key
vulnerability in xnau ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112840 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112836 (Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp
VikRentCar ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112834 (Missing Authorization vulnerability in Castos Seriously
Simple Podcast ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112833 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112829 (Missing Authorization vulnerability in Arraytics Booktics
booktics all ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112824 (Missing Authorization vulnerability in Magepeople inc. Bus
Ticket Book ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112823 (Missing Authorization vulnerability in WP User Manager WP
User Manager ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112787 (OpenCATS before 0.10.0 contains a missing authorization
vulnerability ...)
TODO: check
CVE-2026-112786 (OpenCATS before 0.10.0 contains a missing authorization
vulnerability ...)
@@ -465,35 +465,35 @@ CVE-2026-112784 (OpenCATS before 0.10.0 contains a
missing authorization vulnera
CVE-2026-112783 (OpenCATS before 0.10.0 contains a missing authorization
vulnerability ...)
TODO: check
CVE-2026-112240 (The download link for files uploaded through a form relied on
a token ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-112239 (The extension provides a backend endpoint that writes a
submitted valu ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-112238 (The file search of the extension builds its database
conditions by wra ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-112237 (The extension provides a public proxy endpoint that fetches a
URL on b ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-112177 (A flaw was found in Ghostscript as shipped with Red Hat
Enterprise Lin ...)
TODO: check
CVE-2026-112071 (The order cancellation function accepts an order identifier
from the r ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-112070 (The AJAX routes of the extension do not check whether a
backend user h ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-112069 (The extension no longer applied its access protection to
files in file ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-112068 (The backend module does not check whether a backend user has
access to ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-112067 (The extension hides the correct answer to each CAPTCHA inside
the imag ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-112066 (The JSON import of the cookie consent configuration did not
respect th ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-112065 (The routes that provide consent history and statistics data
did not ch ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-112064 (The backend module for reviewing the consent history accepted
sorting, ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-111844 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111843 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111767 (MCP TypeScript SDK is the official TypeScript SDK for Model
Context Pr ...)
TODO: check
CVE-2026-111765 (A2A Java SDK is the official Java SDK for the Agent2Agent
(A2A) Protoc ...)
@@ -519,7 +519,7 @@ CVE-2026-110306 (fast-uri is a dependency-free RFC 3986 URI
parser and serialize
CVE-2026-110180 (fast-uri is a dependency-free RFC 3986 URI parser and
serializer for N ...)
TODO: check
CVE-2026-109700 (Missing Authorization vulnerability in eLightUp Meta Box
\u2013 WordPr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108089 (** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system
informati ...)
TODO: check
CVE-2026-108088 (** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing
sensitive info ...)
@@ -529,11 +529,11 @@ CVE-2026-108087 (** UNSUPPORTED WHEN ASSIGNED ** Improper
neutralization of spec
CVE-2026-108086 (** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of
recursive enti ...)
TODO: check
CVE-2026-108062 (Pre-authentication OIDC discovery and JWKS fetches run
synchronously o ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-107755 (Insufficient filtering of credentials in the _replicator
database in A ...)
TODO: check
CVE-2026-107597 (PIA's token verification (`verify_token` in `pia/oidc.py`)
fetches the ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-105949 (Cruise Control's Jetty ConstraintSecurityHandler registers
security co ...)
TODO: check
CVE-2026-105941 (The Azure Key Vault KMS provider in Kroxylicious accepts an
untrusted ...)
@@ -553,13 +553,13 @@ CVE-2026-101296 (A missing critical step in
authentication vulnerability in Apac
CVE-2026-101201 (A malformed header in the binary file fed to
QBinaryJson::fromBinaryDa ...)
TODO: check
CVE-2026-100134 (Acrobat for Edge is affected by an out-of-bounds write
vulnerability t ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-100132 (Acrobat for Edge is affected by an out-of-bounds read
vulnerability th ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2025-71436 (Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains
a heap-b ...)
TODO: check
CVE-2024-2323 (The RemoteUserStoreManagerService does not sufficiently
validate passw ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-71195
- manila <unfixed> (bug #1151439)
NOTE: https://security.openstack.org/ossa/OSSA-2026-046.html
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/565bf7ea80eab57b684acaf81f97bd1446f7676e
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/565bf7ea80eab57b684acaf81f97bd1446f7676e
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
