Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
dee8492c by Salvatore Bonaccorso at 2026-10-22T13:30:59+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -291,39 +291,39 @@ CVE-2026-78058 (Uncontrolled resource consumption in the
HTTP/2 (h2) receive pat
CVE-2026-78048 (A reachable-assertion flaw in the HPACK header-compression
decoder of ...)
- brpc <itp> (bug #1060006)
CVE-2026-76531 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76530 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76529 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76528 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76527 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76526 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76524 (A vulnerability in the control channel socket implementation
of O ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76505 (A vulnerability in the IPv4 packet processing functionality of
Cisco I ...)
NOT-FOR-US: Cisco
CVE-2026-76497 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76496 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76495 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76494 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76493 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76492 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76491 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76490 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76489 (Multiple Cisco products are affected by a vulnerability in the
memory ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76487 (A vulnerability in Cisco Unified Communications Manager
(Unified CM) a ...)
NOT-FOR-US: Cisco
CVE-2026-76481 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
@@ -343,17 +343,17 @@ CVE-2026-76474 (As part of Cisco's ongoing commitment to
proactive security and
CVE-2026-76473 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
TODO: check
CVE-2026-76466 (A vulnerability in the database service feature of Cisco
Expressway Se ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76462 (A vulnerability in the interprocess communication (IPC)
channel of the ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76445 (Multiple Cisco products are affected by a vulnerability in the
Snort 3 ...)
TODO: check
CVE-2026-76435 (A vulnerability in Cisco Expressway Series could allow an
unauthentica ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76408 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76407 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76406 (In Splunk SOAR versions below 8.7.0, an unauthenticated user
with acce ...)
NOT-FOR-US: Cisco
CVE-2026-76308 (In Splunk SOAR versions below 8.7.0, an authenticated user
could chang ...)
@@ -369,13 +369,13 @@ CVE-2026-76304 (In Splunk SOAR versions below 8.7.0, an
authenticated user who d
CVE-2026-76303 (In Splunk SOAR versions below 8.7.0, a user that holds a role
with the ...)
NOT-FOR-US: Cisco
CVE-2026-76302 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76301 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76300 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76299 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76298 (In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user
who does ...)
NOT-FOR-US: Cisco
CVE-2026-76297 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11,
and 9.4.1 ...)
@@ -441,9 +441,9 @@ CVE-2026-53986 (Girafit camera app (Android and iOS)
version 1.9.1 and earlier,
CVE-2026-48830 (Improper authentication in Apache bRPC through 1.17.0 allows a
remote ...)
- brpc <itp> (bug #1060006)
CVE-2026-41114 (Uncontrolled Resource Consumption vulnerability in Apache
IoTDB JDBC d ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-29001 (TastyIgniter through 4.4.5 contain a PHP object injection
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: TastyIgniter
CVE-2026-20356 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
TODO: check
CVE-2026-20291 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
@@ -471,7 +471,7 @@ CVE-2026-19676 (The user-mode verifier for the
peci_transfer() system call, z_vr
CVE-2026-18748 (The Bluetooth Classic A2DP host stores a codec Information
Element (IE ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-17557 (A flaw was found in the `lm-evaluation-harness` component of
Red Hat O ...)
- TODO: check
+ NOT-FOR-US: Red Hat OpenShift AI
CVE-2026-16648 (Insertion of Sensitive Information into Log File vulnerability
in Drup ...)
NOT-FOR-US: Drupal core and addons
CVE-2026-16255 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
@@ -489,19 +489,19 @@ CVE-2026-12664 (GitLab has remediated an issue in GitLab
CE/EE affecting all ver
CVE-2026-114664 (Frappe Framework before 16.33.0 contains a blind SQL
injection vulnera ...)
NOT-FOR-US: Frappe
CVE-2026-114663 (Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable
constants and omi ...)
- TODO: check
+ NOT-FOR-US: Vyper
CVE-2026-114662 (Obot before 0.26.0 contains an authentication bypass
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Obot
CVE-2026-114661 (OpenRemote 1.2.0 before 1.31.0 contains a missing
authorization vulner ...)
- TODO: check
+ NOT-FOR-US: OpenRemote
CVE-2026-114660 (Grav from 2.0.0 before 2.2.5 contains an improper access
control vulne ...)
- TODO: check
+ NOT-FOR-US: Grav CMS
CVE-2026-114659 (Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an
authorization ...)
- TODO: check
+ NOT-FOR-US: Grav plugin
CVE-2026-114658 (Grav Login plugin from 3.6.0 before 3.9.13 contains a missing
authoriz ...)
- TODO: check
+ NOT-FOR-US: Grav plugin
CVE-2026-114657 (Grav from 2.0.0 before 2.2.5 contains an information
disclosure vulner ...)
- TODO: check
+ NOT-FOR-US: Grav CMS
CVE-2026-114656 (Traefik before 2.11.58 and 3.7.13 contains an authentication
bypass vu ...)
- traefik <itp> (bug #983289)
CVE-2026-114642 (Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores
its NTLM/ ...)
@@ -2550,7 +2550,7 @@ CVE-2026-83139 (Vulnerability in the Oracle Order
Management product of Oracle E
CVE-2026-82891 (IBM Guardium Data Protection 12.1, and 12.2 could allow a
remote attac ...)
NOT-FOR-US: IBM
CVE-2026-82819 (A vulnerability in Cerberus FTP Server allows an authenticated
remote ...)
- TODO: check
+ NOT-FOR-US: Cerberus FTP Server
CVE-2026-82814 (The Duplicator and Duplicator Pro plugins for WordPress are
vulnerable ...)
NOT-FOR-US: WordPress plugin
CVE-2026-81813 (The Elementor Website Builder WordPress plugin before 4.3.5
does not ...)
@@ -4856,55 +4856,55 @@ CVE-2026-74048 (Not Failing Securely ('Failing Open')
vulnerability in Apache To
CVE-2026-48279
REJECTED
CVE-2026-43858 (A stack-based buffer overflow vulnerability could allow a
remote authe ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43857 (A vulnerability could allow a remote authenticated attacker to
achieve ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43856 (A stack-based buffer overflow vulnerability in the
FileProcess::CheckD ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43855 (A heap-based buffer overflow vulnerability could allow a
remote authen ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43854 (A vulnerability could allow an attacker with access to an
encrypted pr ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43853 (A vulnerability could allow an attacker to send a crafted
message to t ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43852 (A vulnerability could allow an authenticated attacker to write
files t ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43851 (A path traversal vulnerability could allow an authenticated
attacker t ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43850 (A command injection vulnerability could allow an authenticated
attacke ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43849 (A heap memory read vulnerability could allow an attacker to
exfiltrate ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43848 (A vulnerability in the bulk port configuration functionality
could all ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43847 (A vulnerability in the proprietary protocol could allow an
attacker to ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43846 (A stack-based buffer overflow vulnerability in a
non-functional featur ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43845 (A vulnerability in the password reset mechanism could allow an
attacke ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43844 (A vulnerability in the proprietary protocol could allow an
attacker to ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43843 (An integer overflow vulnerability in the license manager
service could ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43842 (A NULL pointer dereference vulnerability in the license
manager servic ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43841 (A NULL pointer dereference vulnerability in the license
manager servic ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43840 (A NULL pointer dereference vulnerability in the license
manager servic ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43839 (A NULL pointer dereference vulnerability in the logs
management functi ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43838 (A stack-based buffer overflow vulnerability in the login
functionality ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43837 (A buffer overflow vulnerability in the password verification
functiona ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43836 (A vulnerability could allow an attacker to forge a packet to
execute a ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43835 (A vulnerability in the firmware upgrade functionality could
allow an a ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43834 (A stack-based buffer overflow vulnerability in the logs
settings funct ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-34485 (Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL
Bypass vulne ...)
NOT-FOR-US: Nokia
CVE-2026-34484 (Nokia 1830 Global Express GX is vulnerable to a local
privilege escala ...)
@@ -4924,13 +4924,13 @@ CVE-2026-21270
CVE-2026-21266
REJECTED
CVE-2026-18205 (Improper neutralization of input during web page generation
('cross-si ...)
- TODO: check
+ NOT-FOR-US: Ticimax E-Commerce Platform
CVE-2026-14933 (Cross-site scripting in the embedded co-browsing feature in
Unblu inc. ...)
- TODO: check
+ NOT-FOR-US: Unblu
CVE-2026-11960 (Enumeration of unauthenticated users in FacturaScripts,
version 2025.6 ...)
- TODO: check
+ NOT-FOR-US: FacturaScripts
CVE-2026-11959 (Stored Cross-Site Scripting (XSS) in FacturaScripts, version
2025.61, ...)
- TODO: check
+ NOT-FOR-US: FacturaScripts
CVE-2026-113810 (A Stored Cross-Site Scripting vulnerability exists in the SNS
enrollme ...)
TODO: check
CVE-2026-113808 (A Stored Cross-Site Scripting vulnerability exists in the SNS
enrollme ...)
@@ -106213,9 +106213,9 @@ CVE-2026-20339 (A vulnerability in the PESpin file
format parser of ClamAV could
[trixie] - clamav 1.4.6+dfsg-1~deb13u1
NOTE:
https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html
CVE-2026-20338 (A vulnerability in the zip archive parser of ClamAV could
allow an una ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20337 (A vulnerability in the zip archive parser of ClamAV could
allow an una ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-19264 (Postiz is an open-source social media scheduling tool. The
route that ...)
NOT-FOR-US: Postiz
CVE-2026-19231 (A security flaw has been discovered in SourceCodester Simple
Doctors A ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dee8492c605b12cac6ab43a77fbeab50b4ad30c0
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dee8492c605b12cac6ab43a77fbeab50b4ad30c0
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
