Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d9fb6af9 by security tracker role at 2026-10-22T07:14:35+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,5 +1,5 @@
CVE-2026-97328 (The WebP Express WordPress plugin before 0.25.16 does not
escape value ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96778 (Pillow is a Python imaging library. From 9.4.0 until 13.0.0,
ImagingJp ...)
TODO: check
CVE-2026-96644 (Pillow is a Python imaging library. Prior to 13.0.0 on
Windows, src/PI ...)
@@ -21,77 +21,77 @@ CVE-2026-96637 (Pillow is a Python imaging library. Prior
to 13.0.0, SpiderImage
CVE-2026-96636 (Pillow is a Python imaging library. Prior to 13.0.0,
MpoImageFile.seek ...)
TODO: check
CVE-2026-96398 (Incorrect Authorization vulnerability in Drupal Webform allows
Forcefu ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96392 (Improper Neutralization of Special Elements Used in a Template
Engine ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96391 (Missing Authorization vulnerability in Drupal Webform REST
allows Forc ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96390 (Privilege Defined With Unsafe Actions vulnerability in Drupal
Editoria ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96388 (Cross-Site Request Forgery (CSRF) vulnerability in Drupal
Tawk.to - Li ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96387 (Authentication Bypass Using an Alternate Path or Channel
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96386 (Missing Authorization vulnerability in Drupal Smart Content
allows For ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96385 (Authentication Bypass Using an Alternate Path or Channel
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96384 (Incorrect Authorization vulnerability in Drupal Mermaid
Diagram Field ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96382 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96380 (Missing Authorization vulnerability in Drupal CSS Usage
Analyzer allow ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96379 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96378 (Improperly Controlled Modification of Dynamically-Determined
Object At ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96377 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96376 (Improper Neutralization of Special Elements used in an OS
Command ("OS ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96375 (Improper Certificate Validation vulnerability in Drupal Cloud
allows A ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96374 (Cross-Site Request Forgery (CSRF) vulnerability in Drupal
Project Brow ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96373 (Incorrect Authorization vulnerability in Drupal Webform allows
Forcefu ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96372 (Insufficient Granularity of Access Control vulnerability in
Drupal Web ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96371 (Privilege Defined With Unsafe Actions vulnerability in Drupal
Webform ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96370 (Incorrect Authorization vulnerability in Drupal Webform allows
Server ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96369 (Use of Web Browser Cache Containing Sensitive Information
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96368 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96367 (Privilege Defined With Unsafe Actions vulnerability in Drupal
Webform ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96366 (Incorrect Authorization vulnerability in Drupal Webform allows
Forcefu ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96365 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96364 (Improper Control of Interaction Frequency vulnerability in
Drupal Webf ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96363 (Privilege Defined With Unsafe Actions vulnerability in Drupal
Webform ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96362 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96361 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96360 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96359 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96358 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96357 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96356 (Incorrect Authorization vulnerability in Drupal Webform allows
Forcefu ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96355 (Improper Neutralization of Special Elements Used in a Template
Engine ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-92210 (NoMachine nxhtd Server-Side Request Forgery Information
Disclosure Vul ...)
TODO: check
CVE-2026-92209 (NoMachine Redis Improper Authentication Local Privilege
Escalation Vul ...)
@@ -117,57 +117,57 @@ CVE-2026-91403 (Vulnerability in the Oracle Java SE,
Oracle GraalVM for JDK, Ora
CVE-2026-90484 (The MySQL client response parser in Apache bRPC dereferences a
null po ...)
TODO: check
CVE-2026-89052 (A hardcoded cryptographic key management vulnerability exists
in Arche ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-89035 (MikroTik RouterOS through 7.24.5 contains a session token
replay vulne ...)
- TODO: check
+ NOT-FOR-US: MikroTik
CVE-2026-88849 (The MasterStudy LMS WordPress Plugin WordPress plugin before
3.7.55 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87955 (Missing Authorization vulnerability in Drupal Ultimate Table
Field all ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87954 (Missing Authorization vulnerability in Drupal Taxonomy Term
Glossary a ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87953 (Server-Side Request Forgery (SSRF) vulnerability in Drupal
SAML SSO - ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87952 (Authentication Bypass by Capture-replay vulnerability in
Drupal SAML S ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87951 (Insecure Storage of Sensitive Information vulnerability in
Drupal SAML ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87950 (Use of Hard-coded Credentials vulnerability in Drupal SAML SSO
- Servi ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87949 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87948 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87947 (Improper Verification of Cryptographic Signature vulnerability
in Drup ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87946 (Observable Timing Discrepancy vulnerability in Drupal SAML SSO
- Servi ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87945 (URL Redirection to Untrusted Site ('Open Redirect')
vulnerability in D ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87944 (Improper Certificate Validation vulnerability in Drupal SAML
SSO - Ser ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87943 (Missing Authorization vulnerability in Drupal SAML SSO -
Service Provi ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87942 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87941 (Vulnerability in Drupal Patreon. This issue affects Patreon
versions: ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87940 (Use of Web Browser Cache Containing Sensitive Information
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87939 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87938 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87937 (URL Redirection to Untrusted Site ('Open Redirect')
vulnerability in D ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87936 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87849 (The Discovery naming-service reply parser in Apache bRPC
(versions < 1 ...)
TODO: check
CVE-2026-87096 (Sensitive information disclosure and manipulation due to
improper auth ...)
- TODO: check
+ NOT-FOR-US: Acronis
CVE-2026-87095 (Sensitive information disclosure and manipulation due to
improper auth ...)
- TODO: check
+ NOT-FOR-US: Acronis
CVE-2026-86249 (On a brpc::Server that sets both ServerOptions.auth and
ServerOptions. ...)
TODO: check
CVE-2026-86147 (External control of file name or path and uncontrolled
resource consum ...)
@@ -175,37 +175,37 @@ CVE-2026-86147 (External control of file name or path and
uncontrolled resource
CVE-2026-86146 (Inconsistent interpretation of HTTP requests (HTTP
request/response sm ...)
TODO: check
CVE-2026-85683 (The Jane Menu WordPress plugin before 1.5.1 does not have any
capabili ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85518 (A flaw was found in OpenSCAP. When decomposing a Source
DataStream (SD ...)
TODO: check
CVE-2026-84924 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84923 (Authentication Bypass Using an Alternate Path or Channel
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84921 (Missing Authorization vulnerability in Drupal Webform
Submissions Dele ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84920 (Incorrect Authorization vulnerability in Drupal Unpublished
Node Permi ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84919 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84918 (Improper Verification of Cryptographic Signature vulnerability
in Drup ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84917 (Incorrect Authorization vulnerability in Drupal Jsonapi Role
Access a ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84916 (Missing Authorization vulnerability in Drupal Islandora
allows Forcef ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84915 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84914 (Missing Authorization vulnerability in Drupal Calculate
Working Days a ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84913 (Missing Authorization vulnerability in Drupal AI Translate
allows Forc ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84912 (Missing Authorization vulnerability in Drupal AI (Artificial
Intellige ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84911 (Improper Neutralization of Input During Web Page Generation
("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84910 (Missing Authorization vulnerability in Drupal Advanced Search
allows F ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84748 (Improper authorization in Apache bRPC (versions < 1.18.0) on
all platf ...)
TODO: check
CVE-2026-84747 (Interpretation conflict in the HTTP protocol implementation in
Apache ...)
@@ -229,25 +229,25 @@ CVE-2026-82210 (Enforceable assertion in the streaming
feature of Apache bRPC (v
CVE-2026-81755 (Uncontrolled resource consumption in the streaming RPC
component of Ap ...)
TODO: check
CVE-2026-81163 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-80463 (Unbounded memory accumulation in the stream message reassembly
path of ...)
TODO: check
CVE-2026-79976 (The MCTP-over-I2C+GPIO target binding in
subsys/pmci/mctp/mctp_i2c_gpi ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-79704 (An out-of-bounds read vulnerability exists in the streaming
RPC client ...)
TODO: check
CVE-2026-78392 (The Link Library WordPress plugin before 7.9.6 does not
sanitise and e ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78334 (Missing authentication in the streaming RPC path of Apache
bRPC (versi ...)
TODO: check
CVE-2026-78119 (The Nuvoton NPCX eSPI driver parses Target-Attached-Flash
(TAF) reques ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-78118 (The kernel helper z_waitq_head() (kernel/include/wait_q.h)
reads the h ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-78117 (The Infineon PSOC 6 BLESS HCI driver in
drivers/bluetooth/hci/hci_infi ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-78116 (The Broadcom AFBR-S50 time-of-flight sensor driver
double-completes an ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-78066 (Resource exhaustion in Apache bRPC (version < 1.18.0) on all
platforms ...)
TODO: check
CVE-2026-78058 (Uncontrolled resource consumption in the HTTP/2 (h2) receive
path of A ...)
@@ -269,7 +269,7 @@ CVE-2026-76526 (As part of Cisco's ongoing commitment to
proactive security and
CVE-2026-76524 (A vulnerability in the control channel socket implementation
of O ...)
TODO: check
CVE-2026-76505 (A vulnerability in the IPv4 packet processing functionality of
Cisco I ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76497 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
TODO: check
CVE-2026-76496 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
@@ -289,7 +289,7 @@ CVE-2026-76490 (As part of Cisco's ongoing commitment to
proactive security and
CVE-2026-76489 (Multiple Cisco products are affected by a vulnerability in the
memory ...)
TODO: check
CVE-2026-76487 (A vulnerability in Cisco Unified Communications Manager
(Unified CM) a ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76481 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
TODO: check
CVE-2026-76479 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
@@ -319,19 +319,19 @@ CVE-2026-76408 (As part of Cisco's ongoing commitment to
proactive security and
CVE-2026-76407 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
TODO: check
CVE-2026-76406 (In Splunk SOAR versions below 8.7.0, an unauthenticated user
with acce ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76308 (In Splunk SOAR versions below 8.7.0, an authenticated user
could chang ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76307 (In Splunk SOAR versions below 8.7.0, a user that holds a role
with the ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76306 (In Splunk SOAR versions below 8.7.0, a user that has the
"Observer" ro ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76305 (In Splunk SOAR versions below 8.7.0, an authenticated user who
does no ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76304 (In Splunk SOAR versions below 8.7.0, an authenticated user who
does no ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76303 (In Splunk SOAR versions below 8.7.0, a user that holds a role
with the ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76302 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
TODO: check
CVE-2026-76301 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
@@ -341,29 +341,29 @@ CVE-2026-76300 (As part of Cisco's ongoing commitment to
proactive security and
CVE-2026-76299 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
TODO: check
CVE-2026-76298 (In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user
who does ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76297 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11,
and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76296 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11,
and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76295 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11,
and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76294 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11,
and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76293 (In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11,
and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76292 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11,
and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76291 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11,
and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76290 (In Splunk Enterprise versions below 10.4.4, 10.2.8, and
10.0.11, an un ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76289 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11,
and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76288 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11,
and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76287 (In Splunk Enterprise versions below 10.4.4, a user that holds
a role w ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-74758 (A heap use-after-free in the RTMP protocol component of Apache
bRPC (v ...)
TODO: check
CVE-2026-74757 (Uncontrolled resource allocation in the mcpack2pb component in
Apache ...)
@@ -381,11 +381,11 @@ CVE-2026-61916 (Out-of-bounds reads in URL parsing and
case-insensitive header l
CVE-2026-61902 (Apache bRPC versions before 1.18.0 do not consistently enforce
the con ...)
TODO: check
CVE-2026-59562 (Missing authentication for critical function vulnerability in
Apache I ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-59229 (The Legacy Pipe receiver protocol (handshake / sendPipeData)
uses a ha ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-58663 (An authentication bypass vulnerability exists in Apache
IoTDB's Thrift ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-58064 (The Redis protocol implementation in Apache bRPC allowed
inline comman ...)
TODO: check
CVE-2026-56388 (The Redis server command parser in Apache bRPC accepts an
empty RESP a ...)
@@ -429,27 +429,27 @@ CVE-2026-20019 (Multiple Cisco products are affected by a
vulnerability in the S
CVE-2026-20011 (Multiple Cisco products are affected by a vulnerability in the
Snort 3 ...)
TODO: check
CVE-2026-19947 (The device multiplexer pseudo-driver in
drivers/misc/devmux/devmux.c e ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-19676 (The user-mode verifier for the peci_transfer() system call,
z_vrfy_pec ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-18748 (The Bluetooth Classic A2DP host stores a codec Information
Element (IE ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-17557 (A flaw was found in the `lm-evaluation-harness` component of
Red Hat O ...)
TODO: check
CVE-2026-16648 (Insertion of Sensitive Information into Log File vulnerability
in Drup ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-16255 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-15723 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-14556 (The HappyForms WordPress plugin before 1.26.15 does not
sanitise or es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14288 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-13319 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-12664 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-114732 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is
affected by ...)
TODO: check
CVE-2026-114731 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is
affected by ...)
@@ -489,7 +489,7 @@ CVE-2026-114715 (Roundcube Webmail before 1.6.20 and 1.7.x
before 1.7.5 is affec
CVE-2026-114714 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is
affected by ...)
TODO: check
CVE-2026-114664 (Frappe Framework before 16.33.0 contains a blind SQL
injection vulnera ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-114663 (Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable
constants and omi ...)
TODO: check
CVE-2026-114662 (Obot before 0.26.0 contains an authentication bypass
vulnerability in ...)
@@ -523,19 +523,19 @@ CVE-2026-114636 (Traefik v3.7.13 before v3.7.14 contains
an access-control bypas
CVE-2026-114635 (Traefik before v2.11.58 and v3.7.14 contains an
authentication bypass ...)
TODO: check
CVE-2026-114634 (WWBN AVideo before 29.4.0 contains a blind server-side
request forgery ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-114633 (WWBN AVideo before 29.4.0 contains an incorrect authorization
vulnerab ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-114577 (A vulnerability was found in oretnom23
php-travel-agency-system. This ...)
TODO: check
CVE-2026-114576 (A vulnerability has been found in Linksys RE6250 1.0.04.001.
This affe ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2026-114575 (A flaw has been found in TOTOLINK A950RG
4.1.2cu.5268_B20221104. Affec ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-114574 (A security vulnerability has been detected in massCodeIO
massCode 5.10 ...)
TODO: check
CVE-2026-114570 (WordPress Core is vulnerable to Stored Cross-Site Scripting
via Quick ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114509 (Laravel is a web application framework. Prior to 12.68.0 and
13.29.0, ...)
TODO: check
CVE-2026-114508 (Laravel is a web application framework. From 12.45.0 until
12.68.0 and ...)
@@ -595,7 +595,7 @@ CVE-2026-114438 (A flaw was found in the Update User Locale
required action of t
CVE-2026-114437 (In the Golang Chi web framework, the ClientIPFromXFF
middleware skips ...)
TODO: check
CVE-2026-114407 (e107 CMS before 2.3.13 contains a reflected cross-site
scripting vulne ...)
- TODO: check
+ NOT-FOR-US: e107 CMS
CVE-2026-114406 (The system certificate authority (CA) store in Red Hat
products, distr ...)
TODO: check
CVE-2026-114405 (Improper validation of array index vulnerability in Velneo
vServer.Thi ...)
@@ -629,29 +629,29 @@ CVE-2026-114392 (Trudesk through 1.2.11 contains an
authorization bypass vulnera
CVE-2026-114391 (ZenTao PMS before 22.3 contains an authorization bypass
vulnerability ...)
TODO: check
CVE-2026-114390 (Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a
missing au ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-114389 (Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a
missing au ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-114388 (Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before
2.0.0-RC.3 co ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-114387 (Shopper from 2.0.0 before 2.6.0 contains a missing
authorization vulne ...)
TODO: check
CVE-2026-114386 (Pydantic AI Harness before 0.59.0 fails to enforce
UsageLimits.tool_ca ...)
TODO: check
CVE-2026-114384 (A security vulnerability has been detected in itsourcecode
Online Cake ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-114383 (A weakness has been identified in TOTOLINK EX200 5.2.3c.7200.
This imp ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-114382 (A security flaw has been discovered in TOTOLINK EX200
5.2.3c.7200. Thi ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-114381 (A vulnerability was determined in itsourcecode Online Cake
Ordering Sy ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-114380 (A vulnerability was found in itsourcecode Online Cake
Ordering System ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-114379 (A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6.
This vul ...)
TODO: check
CVE-2026-114378 (A vulnerability was detected in itsourcecode Online Cake
Ordering Syst ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-114377 (A security vulnerability has been detected in leomoon-studios
wiki-go ...)
TODO: check
CVE-2026-114376 (A weakness has been identified in leomoon-studios wiki-go up
to 1.9.1. ...)
@@ -667,17 +667,17 @@ CVE-2026-114362 (A flaw has been found in HarnessRouter
up to 0.31.12. This impa
CVE-2026-114361 (A vulnerability was detected in HarnessRouter up to 0.31.10.
This affe ...)
TODO: check
CVE-2026-114268 (A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected
by this ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-114267 (A vulnerability was detected in SourceCodester Food Order
Management S ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-114266 (A security vulnerability has been detected in ProjectWorlds
Advanced L ...)
- TODO: check
+ NOT-FOR-US: Project Worlds
CVE-2026-114265 (A weakness has been identified in ProjectWorlds Advanced
Library Manag ...)
- TODO: check
+ NOT-FOR-US: Project Worlds
CVE-2026-114264 (A security flaw has been discovered in ProjectWorlds Advanced
Library ...)
- TODO: check
+ NOT-FOR-US: Project Worlds
CVE-2026-114263 (A vulnerability was identified in ProjectWorlds Advanced
Library Manag ...)
- TODO: check
+ NOT-FOR-US: Project Worlds
CVE-2026-114262 (A vulnerability was determined in file-management-system
dc9ce1bf27f94 ...)
TODO: check
CVE-2026-114261 (A vulnerability was found in MomoTommy file-management-system
dc9ce1bf ...)
@@ -727,17 +727,17 @@ CVE-2026-114220 (NT OneAPP developed by NewType Infortech
has an Improper Certif
CVE-2026-114219 (NT OneAPP developed by NewType Infortech has a Hard-coded
Credentials ...)
TODO: check
CVE-2026-114184 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114182 (Missing Authorization vulnerability in IdeaBox Creations
PowerPack Add ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114180 (Missing Authorization vulnerability in Wpmet Metform metform
allows Ex ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114177 (Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro
Elementor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114176 (Missing Authorization vulnerability in DigitalME eRoom
eroom-zoom-meet ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114175 (Missing Authorization vulnerability in DigitalME eRoom
eroom-zoom-meet ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114145 (GitPython is a python library used to interact with Git
repositories. ...)
TODO: check
CVE-2026-114144 (toml-node is a TOML parser for Node.js and the browser. Prior
to 5.0.1 ...)
@@ -821,101 +821,101 @@ CVE-2026-113787 (odf-kit allows users to generate,
fill, read, and convert OpenD
CVE-2026-113786 (pypdf is a free and open-source pure-python PDF library.
Prior to 6.21 ...)
TODO: check
CVE-2026-113779 (The pfSense REST API package is an unofficial, open-source
REST and Gr ...)
- TODO: check
+ NOT-FOR-US: pfSense
CVE-2026-113461 (Local privilege escalation in Checkmk 2.5.0p14 allows a local
user wit ...)
- TODO: check
+ NOT-FOR-US: Checkmk
CVE-2026-112868 (Authorization Bypass Through User-Controlled Key
vulnerability in H5P ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112867 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112843 (Missing Authorization vulnerability in WP Chill Strong
Testimonials st ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112826 (Missing Authorization vulnerability in eLightUp Falcon \u2013
WordPres ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112408 (Missing verification of source of a communication channel in
the defau ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-112378 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-112326 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-112221 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112212 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-111972 (The Photo Engine (Media Organizer & Lightroom) WordPress
plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111971 (The Photo Engine (Media Organizer & Lightroom) WordPress
plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111958 (The Royal MCP WordPress plugin before 1.5.7 does not limit a
preview- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111852 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111849 (Missing Authorization vulnerability in Magepeople inc.
WpTravelly tour ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111848 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111847 (Missing Authorization vulnerability in Kings Plugins
MarketKing market ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111840 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111838 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111837 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111835 (Missing Authorization vulnerability in bjorntech BjornTech
Swish for W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111834 (Unrestricted Upload of File with Dangerous Type vulnerability
in Kitae ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111833 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111832 (Unrestricted Upload of File with Dangerous Type vulnerability
in WP Ma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111401 (Cross-Site Request Forgery (CSRF) vulnerability in Tailored
Media Tail ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111184 (NoMachine Named Pipe Incorrect Permission Assignment Local
Privilege E ...)
TODO: check
CVE-2026-111183 (GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code
Execution ...)
TODO: check
CVE-2026-111075 (In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer
component fa ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-111074 (In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer
component is ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-110938 (In Eclipse OpenJ9 versions up to 0.63.0, the JITServer
component is vu ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-110899 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110884 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110803 (VaadinService.requestEnd() in Vaadin Framework 8 locks the
session and ...)
TODO: check
CVE-2026-110744 (A flaw was found in multicluster-global-hub-operator-bundle.
The opera ...)
TODO: check
CVE-2026-110370 (Deserialization of Untrusted Data vulnerability in GS Plugins
GS Pins ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110369 (Deserialization of Untrusted Data vulnerability in GS Plugins
WordPres ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110354 (HAProxy 3 before 3.4.6 allows a remote unauthenticated
attacker to cau ...)
TODO: check
CVE-2026-110353 (HAProxy 3.2 before 3.4.6 allows a remote unauthenticated
attacker to c ...)
TODO: check
CVE-2026-110264 (An issue has been discovered in GitLab CE/EE affecting all
versions fr ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-110011 (The MB Custom Post Types & Custom Taxonomies WordPress plugin
before 2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110010 (The MB Custom Post Types & Custom Taxonomies WordPress plugin
before 2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109987 (The PixelYourSite WordPress plugin before 11.4.3,
PixelYourSite Pro W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109931 (The Infility Global WordPress plugin before 2.16.25 does not
perform a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109927 (The HIPAA Forms WordPress plugin before 3.3.2 does not
perform a capab ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107588 (Vaadin Charts renders charts with the Highcharts library and
pins an e ...)
TODO: check
CVE-2026-107447 (The Contest Gallery WordPress plugin before 34.0.1 does not
reliably v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107435 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106053
REJECTED
CVE-2026-105945 (The Pulsar Packages Management Service can be configured to
store pack ...)
@@ -951,13 +951,13 @@ CVE-2026-105923 (A malicious SVG can trigger an integer
overflow which in turn t
CVE-2026-105869 (Apache Pulsar's MultiRolesTokenAuthorizationProvider
authorizes a clie ...)
TODO: check
CVE-2026-105777 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-105711 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-105270 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
TODO: check
CVE-2026-105256 (The LatePoint WordPress plugin before 5.7.5 does not validate
the clie ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104949 (WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through
7.6.0 are a ...)
TODO: check
CVE-2026-104948 (WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through
7.6.0 are a ...)
@@ -965,27 +965,27 @@ CVE-2026-104948 (WarehousePG (WHPG) 6.27.1 through 6.27.6
and 7.2.1 through 7.6.
CVE-2026-104947 (WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a
missing author ...)
TODO: check
CVE-2026-104642 (The Simple Shopping Cart WordPress plugin before 5.3.3 does
not verify ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104641 (The Simple Shopping Cart WordPress plugin before 5.3.3 does
not verify ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103634 (Out-of-bounds read and write in the Count-Min sketch
deserialization o ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103515 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-103301 (The Payment Gateway for Telcell WordPress plugin before 2.0.5
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103234 (The WP Ultimate Review WordPress plugin before 2.4.5 does not
neutrali ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103090 (Missing Authentication for Critical Function (CWE-306) and
Insufficien ...)
TODO: check
CVE-2026-102536
REJECTED
CVE-2026-101138 (The CMP \u2013 Coming Soon & Maintenance WordPress plugin
before 4.1.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100420 (A sensitive information disclosure vulnerability in the
cloud-client d ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-100142 (The FluentCart A New Era of eCommerce WordPress plugin
before 2.2.0 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-71438 (An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1
(/odf/descriptors.c) in ...)
TODO: check
CVE-2025-60497 (A segmentation violation in the GetESD function
(/isomedia/track.c) of ...)
@@ -1011,17 +1011,17 @@ CVE-2025-60476 (A heap use-after-free in the
gf_odf_ac4_cfg_clean_list function
CVE-2025-60469 (A NULL pointer dereference in the gf_ac4_presentation_ch_mode
function ...)
TODO: check
CVE-2025-0326 (The system fails to invalidate existing access tokens
associated with ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-7478 (When a WSO2 product is configured to use an external user
store, the s ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-6423 (The product failed to enforce validation constraints on
user-supplied ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-5563 (Due to an incomplete implementation, reCaptcha is not applied
to certa ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-5139 (The Authentication Endpoint accepts user-supplied input without
suffic ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-4989 (The callback URL parameter in WSO2 API Manager fails to
validate user- ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-102486 (Out-of-bounds read in NTS extension field parsing in NTPsec
ntpd 1.1.4 ...)
- ntpsec <unfixed>
NOTE: https://blog.ntpsec.org/2026/10/20/version-1.2.6.html
@@ -2140,9 +2140,9 @@ CVE-2026-87422 (Vulnerability in the Oracle Solaris
product of Oracle Systems (c
CVE-2026-87421 (Vulnerability in the Oracle Solaris product of Oracle Systems
(compone ...)
NOT-FOR-US: Oracle
CVE-2026-87420 (Vulnerability in the Oracle Service Bus product of Oracle
Fusion Middl ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87419 (Vulnerability in the Oracle Service Bus product of Oracle
Fusion Middl ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87418 (Vulnerability in the PeopleSoft Enterprise PeopleTools product
of Orac ...)
NOT-FOR-US: Oracle
CVE-2026-87417 (Vulnerability in the Oracle Solaris product of Oracle Systems
(compone ...)
@@ -2168,7 +2168,7 @@ CVE-2026-87408 (Vulnerability in the Oracle Applications
Framework product of Or
CVE-2026-87407 (Vulnerability in the Oracle Applications Framework product of
Oracle E ...)
NOT-FOR-US: Oracle
CVE-2026-87404 (Vulnerability in the Pasta product of Oracle E-Business Suite
(compone ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87403 (Vulnerability in the Applications DBA product of Oracle
E-Business Sui ...)
NOT-FOR-US: Oracle
CVE-2026-87402 (Vulnerability in the Applications DBA product of Oracle
E-Business Sui ...)
@@ -2238,7 +2238,7 @@ CVE-2026-87371 (Vulnerability in the Oracle WebCenter
Content product of Oracle
CVE-2026-87370 (Vulnerability in the Oracle WebCenter Content product of
Oracle Fusion ...)
NOT-FOR-US: Oracle
CVE-2026-87369 (Vulnerability in the Oracle Service Bus product of Oracle
Fusion Middl ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87367 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
Oracle Gr ...)
- openjdk-8 <unfixed>
- openjdk-11 <unfixed>
@@ -2250,7 +2250,7 @@ CVE-2026-87366 (Vulnerability in the Oracle Applications
Framework product of Or
CVE-2026-87365 (Vulnerability in the Oracle WebCenter Content product of
Oracle Fusion ...)
NOT-FOR-US: Oracle
CVE-2026-87364 (Vulnerability in the Oracle Service Bus product of Oracle
Fusion Middl ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87363 (Vulnerability in the Oracle Payroll product of Oracle
E-Business Suite ...)
NOT-FOR-US: Oracle
CVE-2026-87362 (Vulnerability in the Oracle Agile PLM product of Oracle Supply
Chain ( ...)
@@ -2260,17 +2260,17 @@ CVE-2026-87361 (Vulnerability in the Oracle WebCenter
Content product of Oracle
CVE-2026-87360 (Vulnerability in the Oracle WebCenter Content product of
Oracle Fusion ...)
NOT-FOR-US: Oracle
CVE-2026-87359 (Vulnerability in the Oracle Service Bus product of Oracle
Fusion Middl ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87358 (Vulnerability in the Oracle General Ledger product of Oracle
E-Busines ...)
NOT-FOR-US: Oracle
CVE-2026-87357 (Vulnerability in the Order Capture product of Oracle
E-Business Suite ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87356 (Vulnerability in the Applications Platform Engineering product
of Orac ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87355 (Vulnerability in the PeopleSoft Enterprise PeopleTools product
of Orac ...)
NOT-FOR-US: Oracle
CVE-2026-87354 (Vulnerability in Oracle TimesTen In-Memory Database
(component: Kubern ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87353 (Vulnerability in the PeopleSoft Enterprise PeopleTools product
of Orac ...)
NOT-FOR-US: Oracle
CVE-2026-87352 (Vulnerability in the PeopleSoft Enterprise PeopleTools product
of Orac ...)
@@ -2528,11 +2528,11 @@ CVE-2026-83372 (Vulnerability in the PeopleSoft
Enterprise PeopleTools product o
CVE-2026-83371 (Vulnerability in the Oracle HRMS (UK) product of Oracle
E-Business Sui ...)
NOT-FOR-US: Oracle
CVE-2026-83370 (Vulnerability in the Sourcing product of Oracle E-Business
Suite (comp ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-83367 (Vulnerability in the Oracle Shipping Execution product of
Oracle E-Bus ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-83366 (Vulnerability in the Oracle Shipping Execution product of
Oracle E-Bus ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-83363 (Vulnerability in the Oracle Contract Lifecycle Management for
Public S ...)
NOT-FOR-US: Oracle
CVE-2026-83361 (Vulnerability in the Oracle Contract Lifecycle Management for
Public S ...)
@@ -3010,11 +3010,11 @@ CVE-2026-101853 (Vulnerability in the Oracle Product
Hub product of Oracle E-Bus
CVE-2026-101852 (Vulnerability in the Oracle Product Hub product of Oracle
E-Business S ...)
NOT-FOR-US: Oracle
CVE-2026-101851 (Vulnerability in the Installed Base product of Oracle
E-Business Suite ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101850 (Vulnerability in the Installed Base product of Oracle
E-Business Suite ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101849 (Vulnerability in the Installed Base product of Oracle
E-Business Suite ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101847 (Vulnerability in the Oracle Bills of Material product of
Oracle E-Busi ...)
NOT-FOR-US: Oracle
CVE-2026-101846 (Vulnerability in the Oracle Purchasing product of Oracle
E-Business Su ...)
@@ -3028,19 +3028,19 @@ CVE-2026-101843 (Vulnerability in the Production
Scheduling product of Oracle E-
CVE-2026-101842 (Vulnerability in the Strategic Network Optimization product
of Oracle ...)
TODO: check
CVE-2026-101841 (Vulnerability in the Global Order Promising product of Oracle
E-Busine ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101840 (Vulnerability in the Oracle Contract Lifecycle Management for
Public S ...)
NOT-FOR-US: Oracle
CVE-2026-101837 (Vulnerability in the Oracle Shipping Execution product of
Oracle E-Bus ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101836 (Vulnerability in the iSupplier Portal product of Oracle
E-Business Sui ...)
TODO: check
CVE-2026-101835 (Vulnerability in the Oracle Shipping Execution product of
Oracle E-Bus ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101834 (Vulnerability in the Oracle Shipping Execution product of
Oracle E-Bus ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101833 (Vulnerability in the Oracle Shipping Execution product of
Oracle E-Bus ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101832 (Vulnerability in the Oracle Order Management product of
Oracle E-Busin ...)
NOT-FOR-US: Oracle
CVE-2026-101831 (Vulnerability in the Oracle Quality product of Oracle
E-Business Suite ...)
@@ -3082,7 +3082,7 @@ CVE-2026-101813 (Vulnerability in the Oracle Engineering
product of Oracle E-Bus
CVE-2026-101812 (Vulnerability in the Oracle Complex Maintenance, Repair and
Overhaul p ...)
NOT-FOR-US: Oracle
CVE-2026-101810 (Vulnerability in the MySQL Router product of Oracle MySQL
(component: ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101809 (Vulnerability in the Workflow product of Oracle E-Business
Suite (comp ...)
NOT-FOR-US: Oracle
CVE-2026-101808 (Vulnerability in the Oracle Product Workbench product of
Oracle E-Busi ...)
@@ -3136,7 +3136,7 @@ CVE-2026-101785 (Vulnerability in the MySQL Server, MySQL
Cluster product of Ora
CVE-2026-101784 (Vulnerability in the MySQL Server, MySQL Cluster product of
Oracle MyS ...)
- mysql-9.7 <unfixed>
CVE-2026-101783 (Vulnerability in the MySQL Router product of Oracle MySQL
(component: ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101782 (Vulnerability in the Oracle Applications Manager product of
Oracle E-B ...)
NOT-FOR-US: Oracle
CVE-2026-101781 (Vulnerability in the MySQL Server, MySQL Cluster product of
Oracle MyS ...)
@@ -3296,7 +3296,7 @@ CVE-2026-101705 (Vulnerability in the Oracle Common
Applications product of Orac
CVE-2026-101704 (Vulnerability in the Oracle Concurrent Processing product of
Oracle E- ...)
NOT-FOR-US: Oracle
CVE-2026-101703 (Vulnerability in the Pasta product of Oracle E-Business Suite
(compone ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101701 (Vulnerability in the Oracle Concurrent Processing product of
Oracle E- ...)
NOT-FOR-US: Oracle
CVE-2026-101700 (Vulnerability in the Oracle Application Object Library
product of Orac ...)
@@ -3422,11 +3422,11 @@ CVE-2026-101635 (Vulnerability in the Oracle Mobile
Field Service product of Ora
CVE-2026-101634 (Vulnerability in the Oracle Mobile Field Service product of
Oracle E-B ...)
NOT-FOR-US: Oracle
CVE-2026-101633 (Vulnerability in the MySQL Router product of Oracle MySQL
(component: ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101632 (Vulnerability in the MySQL Router product of Oracle MySQL
(component: ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101631 (Vulnerability in the MySQL Router product of Oracle MySQL
(component: ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101630 (Vulnerability in the Oracle Advanced Outbound Telephony
product of Ora ...)
NOT-FOR-US: Oracle
CVE-2026-101629 (Vulnerability in the MySQL Server, MySQL Cluster product of
Oracle MyS ...)
@@ -3488,7 +3488,7 @@ CVE-2026-101602 (Vulnerability in the Oracle Agile
Product Lifecycle Management
CVE-2026-101601 (Vulnerability in Oracle GoldenGate (component: Vendor Access
Module). ...)
NOT-FOR-US: Oracle
CVE-2026-101600 (Vulnerability in Oracle TimesTen In-Memory Database
(component: TimesT ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101599 (Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualiza ...)
- virtualbox 7.2.22-dfsg-1
CVE-2026-101598 (Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualiza ...)
@@ -3634,7 +3634,7 @@ CVE-2026-101525 (Vulnerability in the Oracle Enterprise
Manager for Siebel produ
CVE-2026-101524 (Vulnerability in the Oracle Enterprise Manager Base Platform
product o ...)
NOT-FOR-US: Oracle
CVE-2026-101522 (Vulnerability in Oracle TimesTen In-Memory Database
(component: TimesT ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101521 (Vulnerability in Oracle APEX (component: General). Supported
versions ...)
TODO: check
CVE-2026-101520 (Vulnerability in the Oracle Global Lifecycle Management
NextGen OUI Fr ...)
@@ -5334,7 +5334,7 @@ CVE-2026-108086 (** UNSUPPORTED WHEN ASSIGNED ** Improper
restriction of recursi
CVE-2026-108062 (Pre-authentication OIDC discovery and JWKS fetches run
synchronously o ...)
NOT-FOR-US: Eclipse
CVE-2026-107755 (Insufficient filtering of credentials in the _replicator
database in A ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-107597 (PIA's token verification (`verify_token` in `pia/oidc.py`)
fetches the ...)
NOT-FOR-US: Eclipse
CVE-2026-105949 (Cruise Control's Jetty ConstraintSecurityHandler registers
security co ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d9fb6af9d325d448bb3357623b633fc47078d3a4
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d9fb6af9d325d448bb3357623b633fc47078d3a4
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
