Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
976da517 by security tracker role at 2026-10-23T07:20:47+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,5 +1,5 @@
CVE-2026-97785 (Improper authentication in AAD App Proxy allows an
unauthorized attack ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-97635 (The Agent Zero Web UI before 1.15 does not correctly sanitize
user-pro ...)
TODO: check
CVE-2026-97631 (EDK2 contains a vulnerability in BIOS where a user may cause
\u201cOut ...)
@@ -7,57 +7,57 @@ CVE-2026-97631 (EDK2 contains a vulnerability in BIOS where a
user may cause \u2
CVE-2026-96616 (Authentication tokens issued by the E3's web management
interface on l ...)
TODO: check
CVE-2026-96293 (A cleartext storage of sensitive information vulnerability in
WatchGua ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-96185 (Stack-based buffer overflow in Microsoft Exchange Online
allows an aut ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-95721 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95720 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95719 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95718 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95717 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95716 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95715 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95714 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95713 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95712 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95711 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95710 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95709 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95708 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95707 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95706 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95705 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95704 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-94502 (In EmberZNet 9.1.1 and earlier, a malformed Publish Price
Matrix comma ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-94482 (Next.js is a React framework for building full-stack web
applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94268 (The Advanced Custom Fields: Extended WordPress plugin before
0.9.2.8, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94267 (The Advanced Custom Fields: Extended WordPress plugin before
0.9.2.8, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94264 (The Advanced Custom Fields: Extended WordPress plugin before
0.9.2.8, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94262 (The Advanced Custom Fields: Extended WordPress plugin before
0.9.2.8, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93471 (Improper Handling of Highly Compressed Data (Data
Amplification) in es ...)
TODO: check
CVE-2026-93336 (Missing authorization in the unit resources download route in
Canonica ...)
@@ -65,9 +65,9 @@ CVE-2026-93336 (Missing authorization in the unit resources
download route in Ca
CVE-2026-92450 (The authentication framework used by affected Kiloview E3 NDI
encoder ...)
TODO: check
CVE-2026-89410 (In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command
can trigg ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-89409 (In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices)
and 6.85. ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-86696 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
TODO: check
CVE-2026-86055 (Part-DB is an open source inventory management system for
electronic c ...)
@@ -79,117 +79,117 @@ CVE-2026-86019 (Part-DB is an open source inventory
management system for electr
CVE-2026-86018 (Part-DB is an open source inventory management system for
electronic c ...)
TODO: check
CVE-2026-85080 (In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership
message ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-85079 (In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req
response c ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-83938 (Missing authentication for critical function in Azure
Kubernetes Confi ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-79956 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79955 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79895 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79894 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79893 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79892 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79891 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79890 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79889 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79888 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79887 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79886 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79885 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79884 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79883 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79882 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79881 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79880 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79879 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79878 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79877 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79876 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79875 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79874 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79873 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79872 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79871 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79870 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79869 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79868 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79867 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79866 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79865 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79864 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79863 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79862 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79861 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79860 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79859 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79858 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79857 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79856 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79855 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79854 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79853 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79852 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79851 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79850 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79849 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79848 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79847 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79846 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79844 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-78846 (AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to
Buffer Overfl ...)
TODO: check
CVE-2026-78801 (An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6
Dual-Band Fib ...)
@@ -205,11 +205,11 @@ CVE-2026-75507 (GraphQL-core is a Python port of the
GraphQL.js reference implem
CVE-2026-67597
REJECTED
CVE-2026-66282 (In EmberZNet 9.1.1 and earlier, a malformed Publish Billing
Period com ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-66281 (In EmberZNet 9.1.1 and earlier, a malformed Discover
Attributes comman ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-66279 (In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and
earlier, a mes ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-63243 (An authentication vulnerability in the Bluetooth Low Energy
(BLE) impl ...)
TODO: check
CVE-2026-61791 (OCO-Server is a self-hosted endpoint management application
for comput ...)
@@ -235,9 +235,9 @@ CVE-2026-54238 (Supabase Realtime provides Broadcast,
Presence, and Postgres Cha
CVE-2026-51954 (An issue in Webasyst Framework 4.0.3 and before allows a
remote attack ...)
TODO: check
CVE-2026-21812 (HCL AppScan Azure Boards Plugin is affected by a Cleartext
Transmissio ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-21811 (HCL AppScan Azure Boards Plugin is potentially affected by an
Informat ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-19678 (A server-side request forgery (SSRF) vulnerability in the
unauthentica ...)
TODO: check
CVE-2026-19677 (An authentication bypass vulnerability in the public onPhase/
frevvo r ...)
@@ -245,15 +245,15 @@ CVE-2026-19677 (An authentication bypass vulnerability in
the public onPhase/ fr
CVE-2026-16477 (CleanShot X for macOS insecurely deserializes untrusted data
embedded ...)
TODO: check
CVE-2026-13599 (Missing authentication for critical function vulnerability in
ABB Abil ...)
- TODO: check
+ NOT-FOR-US: ABB group
CVE-2026-13411 (Mattermost versions 11.7.x <= 11.7.11 fail to validate null
elements w ...)
TODO: check
CVE-2026-115638 (OpenStack Ironic through 39.0.1 allows a denial of service
via a confi ...)
TODO: check
CVE-2026-115547 (An input validation issue in the Okta Access Gateway (OAG)
Admin Conso ...)
- TODO: check
+ NOT-FOR-US: Okta
CVE-2026-115546 (Okta Access Gateway (OAG) does not validate the selected
authenticatio ...)
- TODO: check
+ NOT-FOR-US: Okta
CVE-2026-115537 (A weakness has been identified in gedelumbung
HospitalManagement up to ...)
TODO: check
CVE-2026-115536 (A security flaw has been discovered in gedelumbung
HospitalManagement ...)
@@ -287,7 +287,7 @@ CVE-2026-115503 (Ghidra before 12.2 contains an improper
handling of highly comp
CVE-2026-115502 (A missing authorization check allows anyone having access to
a "link w ...)
TODO: check
CVE-2026-115497 (The Music Store \u2013 WordPress eCommerce plugin for
WordPress is vul ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115496 (Overly informative error messages in the catalog
functionality of KNIM ...)
TODO: check
CVE-2026-115494 (A flaw in the cross-site request forgery (CSRF) prevention of
KNIME Bu ...)
@@ -309,15 +309,15 @@ CVE-2026-115450 (External Control of Assumed-Immutable
Web Parameter (CWE-472) i
CVE-2026-115449 (A flaw was found in libslirp. When handling ICMP echo
requests, the re ...)
TODO: check
CVE-2026-115424 (A flaw was found in the OpenShift client oc. When extracting
container ...)
- TODO: check
+ NOT-FOR-US: Red Hat software not packaged in Debian
CVE-2026-115419 (The A2A server component in Amazon Strands Agents SDK for
Python befor ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115417 (Memory allocation with excessive size value in the MQTT 3.1.1
compatib ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115416 (Incorrect authorization checks in Amazon Athena engine
version 3 query ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115414 (OS command injection in the Terraform hook in AWS SAM CLI
before 1.166 ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115411 (crawlseo before version 0.2.4 contains a server-side request
forgery v ...)
TODO: check
CVE-2026-115400 (crawlseo before version 0.2.5 contains a cleartext storage
vulnerabili ...)
@@ -453,7 +453,7 @@ CVE-2026-115321 (Bytebase before 3.16.0 contains an
authorization bypass vulnera
CVE-2026-115319 (fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic
complexi ...)
TODO: check
CVE-2026-115253 (An incorrect permission assignment vulnerability in the
WatchGuard Age ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-115249 (A flaw has been found in subhajitkhan
online-clinic-management-system ...)
TODO: check
CVE-2026-115248 (A vulnerability was detected in subhajitkhan
online-clinic-management- ...)
@@ -467,19 +467,19 @@ CVE-2026-115221 (A flaw was found in FreeIPA. An improper
authorization check al
CVE-2026-115207 (A flaw was found in GNU patch. An attacker can achieve
arbitrary file ...)
TODO: check
CVE-2026-114703 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114702 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114701 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114700 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114699 (Missing Authorization vulnerability in yoomoney \u042eKassa
\u0434\u04 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114698 (Authorization Bypass Through User-Controlled Key
vulnerability in myCr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114696 (Missing Authorization vulnerability in miniOrange Page
Restriction Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114665 (Goploy 1.18.0 before 1.18.1 contains a link following
vulnerability in ...)
TODO: check
CVE-2026-114655 (libmongocrypt builds requests to external key management
services (AWS ...)
@@ -509,7 +509,7 @@ CVE-2026-114644 (The MongoDB C# Driver's BSON library
contains an uncontrolled r
CVE-2026-114643 (The MongoDB C# Driver writes GeoJSON extra members without
checking wh ...)
TODO: check
CVE-2026-114625 (VeloCloud Orchestrator (VCO) on-prem has a security issue
where this i ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-114620 (Authlib is a Python library which builds OAuth and OpenID
Connect serv ...)
TODO: check
CVE-2026-114619 (Authlib is a Python library which builds OAuth and OpenID
Connect serv ...)
@@ -553,15 +553,15 @@ CVE-2026-114515 (OCO-Server is a self-hosted endpoint
management application for
CVE-2026-114510 (Flexible GraphRAG is a Python framework for building graph
and retriev ...)
TODO: check
CVE-2026-114487 (Missing authorization in the PAM AD computer import endpoint
in Devolu ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-114486 (Incorrect authorization in the Devolutions Gateway token
generation in ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-114485 (Insufficient protection of sensitive information in the user
list endp ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-114348 (webpack-dev-server is a development server that provides live
reloadin ...)
TODO: check
CVE-2026-114195 (Insertion of Sensitive Information into Externally-Accessible
File or ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-113876 (SmileCDR HAPI FHIR does not correctly check authorization for
conditio ...)
TODO: check
CVE-2026-113875 (On a SmileCDR HAPI FHIR server with REST-hook subscriptions
enabled, i ...)
@@ -575,25 +575,25 @@ CVE-2026-113872 (multer is a middleware for Node.js that
handles multipart/form-
CVE-2026-113582 (UNSUPPORTED WHEN ASSIGNED Improper restriction of XML
external entity ...)
TODO: check
CVE-2026-113501 (The LiteSpeed Cache WordPress plugin before 7.9.2 does not
perform a c ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113500 (The LiteSpeed Cache WordPress plugin before 7.9.2 does not
limit one o ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113499 (The LiteSpeed Cache WordPress plugin before 7.9.2 does not
restrict on ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113472 (The Depicter \u2014 Popup & Slider Builder WordPress plugin
before 4.8 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112845 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112842 (Missing Authorization vulnerability in Cozmoslabs Paid Member
Subscrip ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112832 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112822 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112820 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112379 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112332 (Motor.NET before 0.19.0 contains an uncaught exception
vulnerability i ...)
TODO: check
CVE-2026-112331 (Motor.NET before 0.19.0 contains a denial-of-service
vulnerability tha ...)
@@ -601,39 +601,39 @@ CVE-2026-112331 (Motor.NET before 0.19.0 contains a
denial-of-service vulnerabil
CVE-2026-112330 (Motor.NET before 0.19.0 contains a denial of service
vulnerability tha ...)
TODO: check
CVE-2026-112327 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112313 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112312 (Missing Authorization vulnerability in ACF Extended ACF
Extended acf-e ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112311 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112242 (Incorrect Privilege Assignment vulnerability in Cozmoslabs
Profile Bui ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112241 (Authentication Bypass by Spoofing vulnerability in Brainstorm
Force Su ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112230 (The Popup Builder WordPress plugin before 4.4.6 does not
perform auth ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112219 (The Download Monitor WordPress plugin before 5.3.5 does not
correctly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112218 (Missing Authorization vulnerability in Ahmad Majestic Support
majestic ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112085 (webpack-dev-server is a development server that provides live
reloadin ...)
TODO: check
CVE-2026-111982 (The User Profile Builder WordPress plugin before 4.0.5 does
not verif ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111966 (The User Profile Builder WordPress plugin before 4.0.5 does
not sanit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111851 (Use of Externally-Controlled Input to Select Classes or Code
('Unsafe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111842 (Missing Authorization vulnerability in WP Sunshine Sunshine
Photo Cart ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111830 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111738 (The Speed Optimizer WordPress plugin before 7.8.5 does not
verify net ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111737 (The Speed Optimizer WordPress plugin before 7.8.5 does not
sanitise o ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111594 (InterSystems IRIS for Health has TLS/SSL encryption turned
off by defa ...)
TODO: check
CVE-2026-111181 (body-parser is body parsing middleware for Node.js and
Express. In ver ...)
@@ -643,37 +643,37 @@ CVE-2026-111100 (The ONVIF device service on the E3
responds to certain informat
CVE-2026-111079 (A flaw was found in Goose. When the terminal integration
feature is en ...)
TODO: check
CVE-2026-110974 (The org.json parser in
com.vaadin.external.google:android-json recurse ...)
- TODO: check
+ NOT-FOR-US: Vaadin
CVE-2026-110894 (Missing Authorization vulnerability in Brainstorm Force
SureDash sured ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110893 (Missing Authorization vulnerability in Brainstorm Force
SureDash sured ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110825 (The ONVIF device service on affected Kiloview E3 NDI encoder
firmware ...)
TODO: check
CVE-2026-110537 (The Essential Addons for Elementor WordPress plugin before
6.8.7 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110510 (The Essential Addons for Elementor WordPress plugin before
6.8.7 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110491 (The ONVIF service on the E3 can be rendered unresponsive by
sending ma ...)
TODO: check
CVE-2026-110243 (The network management service on affected Kiloview E3 NDI
encoder fir ...)
TODO: check
CVE-2026-110063 (Improper link resolution before file access ('link
following') in VM I ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-109936 (The Otter Blocks WordPress plugin before 3.2.8 does not
correctly bou ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109935 (The Otter Blocks WordPress plugin before 3.2.8 does not
enforce its b ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109934 (The Otter Blocks WordPress plugin before 3.2.8 does not
correctly det ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109933 (The Otter Blocks WordPress plugin before 3.2.8 does not
properly sani ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109198 (The Anti-Spam by CleanTalk \u2013 Spam Protection Without
CAPTCHA plug ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109122 (The network management service on affected Kiloview E3 NDI
encoder fir ...)
TODO: check
CVE-2026-108456 (Server-side request forgery (ssrf) in Azure AI Foundry allows
an autho ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-108360 (PhpSpreadsheet is a pure PHP library for reading and writing
spreadshe ...)
TODO: check
CVE-2026-108359 (PhpSpreadsheet is a pure PHP library for reading and writing
spreadshe ...)
@@ -693,11 +693,11 @@ CVE-2026-106017 (Improper certificate validation in the
OpenVPN 3 Core library v
CVE-2026-105265 (A vulnerability exists in the the time zone parameter and
does not pro ...)
TODO: check
CVE-2026-105014 (Improper neutralization of special elements used in a command
('comman ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-104068 (JetBackup plugin for WordPress before 3.1.24.10 contains a
symlink-bas ...)
TODO: check
CVE-2026-102785 (Joomla Extension - yootheme.com - Unauthenticated remote code
executio ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2025-71434 (Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an
unauthen ...)
TODO: check
CVE-2025-69723 (A reflected cross-site scripting (XSS) vulnerability in
localstack v4. ...)
@@ -727,7 +727,7 @@ CVE-2022-51021 (NotificationX plugin for WordPress 2.0.0
before 2.3.12 contains
CVE-2021-48017 (OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4
contains an ...)
TODO: check
CVE-2021-48016 (DedeCMS through 5.8.1-beta contains a PHP code injection
vulnerability ...)
- TODO: check
+ NOT-FOR-US: DedeCMS
CVE-2021-48015 (JeeWMS before commit 0a610e8 contains an unauthenticated path
traversa ...)
TODO: check
CVE-2021-48014 (FineReport 9.0 contains a path traversal vulnerability in the
/WebRepo ...)
@@ -745,7 +745,7 @@ CVE-2018-25439 (MetInfo CMS 6.0.0 before 6.1.1 contains a
path traversal vulnera
CVE-2018-25438 (Intermesh Group-Office 3.3.0 before 3.5.5 contains an
unauthenticated ...)
TODO: check
CVE-2017-20290 (Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected
cross-s ...)
- TODO: check
+ NOT-FOR-US: Discourse
CVE-2017-20289 (Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0
contain ...)
TODO: check
CVE-2017-20288 (QCubed 2.2.0 through 3.1.1 contains a reflected cross-site
scripting v ...)
@@ -1722,7 +1722,7 @@ CVE-2026-110899 (Improper Neutralization of Input During
Web Page Generation ('C
CVE-2026-110884 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-110803 (VaadinService.requestEnd() in Vaadin Framework 8 locks the
session and ...)
- TODO: check
+ NOT-FOR-US: Vaadin
CVE-2026-110744 (A flaw was found in multicluster-global-hub-operator-bundle.
The opera ...)
NOT-FOR-US: multicluster-global-hub-operator-bundle
CVE-2026-110370 (Deserialization of Untrusted Data vulnerability in GS Plugins
GS Pins ...)
@@ -1746,7 +1746,7 @@ CVE-2026-109931 (The Infility Global WordPress plugin
before 2.16.25 does not pe
CVE-2026-109927 (The HIPAA Forms WordPress plugin before 3.3.2 does not
perform a capab ...)
NOT-FOR-US: WordPress plugin
CVE-2026-107588 (Vaadin Charts renders charts with the Highcharts library and
pins an e ...)
- TODO: check
+ NOT-FOR-US: Vaadin
CVE-2026-107447 (The Contest Gallery WordPress plugin before 34.0.1 does not
reliably v ...)
NOT-FOR-US: WordPress plugin
CVE-2026-107435 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -1798,11 +1798,11 @@ CVE-2026-105270 (Allocation of Resources Without Limits
or Throttling vulnerabil
CVE-2026-105256 (The LatePoint WordPress plugin before 5.7.5 does not validate
the clie ...)
NOT-FOR-US: WordPress plugin
CVE-2026-104949 (WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through
7.6.0 are a ...)
- TODO: check
+ NOT-FOR-US: EnterpriseDB
CVE-2026-104948 (WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through
7.6.0 are a ...)
- TODO: check
+ NOT-FOR-US: EnterpriseDB
CVE-2026-104947 (WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a
missing author ...)
- TODO: check
+ NOT-FOR-US: EnterpriseDB
CVE-2026-104642 (The Simple Shopping Cart WordPress plugin before 5.3.3 does
not verify ...)
NOT-FOR-US: WordPress plugin
CVE-2026-104641 (The Simple Shopping Cart WordPress plugin before 5.3.3 does
not verify ...)
@@ -4005,7 +4005,7 @@ CVE-2026-101844 (Vulnerability in the Oracle Concurrent
Processing product of Or
CVE-2026-101843 (Vulnerability in the Production Scheduling product of Oracle
E-Busines ...)
NOT-FOR-US: Oracle
CVE-2026-101842 (Vulnerability in the Strategic Network Optimization product
of Oracle ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101841 (Vulnerability in the Global Order Promising product of Oracle
E-Busine ...)
NOT-FOR-US: Oracle
CVE-2026-101840 (Vulnerability in the Oracle Contract Lifecycle Management for
Public S ...)
@@ -4297,19 +4297,19 @@ CVE-2026-101694 (Vulnerability in the Oracle Mobile
Field Service product of Ora
CVE-2026-101692 (Vulnerability in the Oracle Mobile Field Service product of
Oracle E-B ...)
NOT-FOR-US: Oracle
CVE-2026-101690 (Vulnerability in the Oracle E-Business Suite Integrated SOA
Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101689 (Vulnerability in the Oracle E-Business Suite Integrated SOA
Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101688 (Vulnerability in the Oracle E-Business Suite Integrated SOA
Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101687 (Vulnerability in the Oracle E-Business Suite Integrated SOA
Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101686 (Vulnerability in the Oracle E-Business Suite Integrated SOA
Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101685 (Vulnerability in the Oracle E-Business Suite Integrated SOA
Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101684 (Vulnerability in the Oracle E-Business Suite Integrated SOA
Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101683 (Vulnerability in the Applications DBA product of Oracle
E-Business Sui ...)
NOT-FOR-US: Oracle
CVE-2026-101682 (Vulnerability in the Applications DBA product of Oracle
E-Business Sui ...)
@@ -4335,17 +4335,17 @@ CVE-2026-101673 (Vulnerability in the Oracle US Federal
Human Resources product
CVE-2026-101672 (Vulnerability in the Oracle Call Center Technology product of
Oracle E ...)
NOT-FOR-US: Oracle
CVE-2026-101671 (Vulnerability in the Oracle Email Center product of Oracle
E-Business ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101670 (Vulnerability in the Oracle Email Center product of Oracle
E-Business ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101669 (Vulnerability in the Oracle Public Sector Human Resources
product of O ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101668 (Vulnerability in the Oracle Customer Care product of Oracle
E-Business ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101667 (Vulnerability in the Oracle Trade Management product of
Oracle E-Busin ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101666 (Vulnerability in the Oracle Trade Management product of
Oracle E-Busin ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101665 (Vulnerability in the Oracle Mobile Field Service product of
Oracle E-B ...)
NOT-FOR-US: Oracle
CVE-2026-101664 (Vulnerability in the Oracle Mobile Field Service product of
Oracle E-B ...)
@@ -4573,17 +4573,17 @@ CVE-2026-101547 (Vulnerability in the Oracle Demand
Planning product of Oracle S
CVE-2026-101546 (Vulnerability in the Oracle Materials Requirement Planning
product of ...)
TODO: check
CVE-2026-101545 (Vulnerability in the Oracle Inventory Management product of
Oracle E-B ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101544 (Vulnerability in the Oracle Payroll product of Oracle
E-Business Suite ...)
NOT-FOR-US: Oracle
CVE-2026-101543 (Vulnerability in the Oracle Capacity product of Oracle
E-Business Suit ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101542 (Vulnerability in the Oracle Capacity product of Oracle
E-Business Suit ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101541 (Vulnerability in the Oracle Capacity product of Oracle
E-Business Suit ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101540 (Vulnerability in the Oracle Capacity product of Oracle
E-Business Suit ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101539 (Vulnerability in the Oracle Payroll product of Oracle
E-Business Suite ...)
NOT-FOR-US: Oracle
CVE-2026-101538 (Vulnerability in the Oracle Order Management product of
Oracle E-Busin ...)
@@ -4595,11 +4595,11 @@ CVE-2026-101536 (Vulnerability in the Oracle Cost
Management product of Oracle E
CVE-2026-101535 (Vulnerability in the Oracle Sales Foundation product of
Oracle E-Busin ...)
NOT-FOR-US: Oracle
CVE-2026-101534 (Vulnerability in the Oracle EDI Gateway product of Oracle
E-Business S ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101533 (Vulnerability in the Oracle EDI Gateway product of Oracle
E-Business S ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101532 (Vulnerability in the Oracle EDI Gateway product of Oracle
E-Business S ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101531 (Vulnerability in the Oracle Business Intelligence Enterprise
Edition p ...)
NOT-FOR-US: Oracle
CVE-2026-101529 (Vulnerability in the Oracle Enterprise Manager for Oracle
Database pro ...)
@@ -4617,11 +4617,11 @@ CVE-2026-101524 (Vulnerability in the Oracle Enterprise
Manager Base Platform pr
CVE-2026-101522 (Vulnerability in Oracle TimesTen In-Memory Database
(component: TimesT ...)
NOT-FOR-US: Oracle
CVE-2026-101521 (Vulnerability in Oracle APEX (component: General). Supported
versions ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101520 (Vulnerability in the Oracle Global Lifecycle Management
NextGen OUI Fr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101519 (Vulnerability in the Oracle EDI Gateway product of Oracle
E-Business S ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101518 (Vulnerability in the Oracle Enterprise Manager Base Platform
product o ...)
NOT-FOR-US: Oracle
CVE-2026-101517 (Vulnerability in the Oracle Utilities Network Management
System produc ...)
@@ -4646,25 +4646,25 @@ CVE-2026-101510 (Vulnerability in the Oracle Net
Services component of Oracle Da
CVE-2026-101508 (Vulnerability in the Siebel CRM Integration product of Oracle
Siebel C ...)
NOT-FOR-US: Oracle
CVE-2026-101507 (Vulnerability in Oracle Trusted Answer Search (component:
PLSQL packag ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101506 (Vulnerability in Oracle Trusted Answer Search (component:
Application ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101505 (Vulnerability in Oracle Trusted Answer Search (component:
Application ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101504 (Vulnerability in Oracle Trusted Answer Search (component:
Application ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101503 (Vulnerability in Oracle Trusted Answer Search (component:
PLSQL packag ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101502 (Vulnerability in Oracle Trusted Answer Search (component:
PLSQL packag ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101501 (Vulnerability in Oracle Trusted Answer Search (component:
PLSQL packag ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101500 (Vulnerability in the Oracle Global Lifecycle Management
OPatchAuto pro ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101499 (Vulnerability in the Oracle WebCenter Sites product of Oracle
Fusion M ...)
NOT-FOR-US: Oracle
CVE-2026-101498 (Vulnerability in Oracle Trusted Answer Search (component:
PLSQL packag ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101497 (Vulnerability in the Oracle Identity Manager product of
Oracle Fusion ...)
NOT-FOR-US: Oracle
CVE-2026-101495 (Vulnerability in the Siebel CRM Development product of Oracle
Siebel C ...)
@@ -4726,7 +4726,7 @@ CVE-2026-101468 (Vulnerability in the Siebel CRM
Deployment product of Oracle Si
CVE-2026-101467 (Vulnerability in the Siebel CRM End User product of Oracle
Siebel CRM ...)
NOT-FOR-US: Oracle
CVE-2026-101466 (Vulnerability in the Oracle EDI Gateway product of Oracle
E-Business S ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101465 (Vulnerability in the Siebel CRM Deployment product of Oracle
Siebel CR ...)
NOT-FOR-US: Oracle
CVE-2026-101464 (Vulnerability in the Siebel CRM Deployment product of Oracle
Siebel CR ...)
@@ -4862,7 +4862,7 @@ CVE-2026-101400 (Vulnerability in the Siebel Apps -
Marketing product of Oracle
CVE-2026-101399 (Vulnerability in the Siebel Apps - Marketing product of
Oracle Siebel ...)
NOT-FOR-US: Oracle
CVE-2026-101398 (Vulnerability in the Oracle Capacity product of Oracle
E-Business Suit ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101397 (Vulnerability in the Siebel Apps - Marketing product of
Oracle Siebel ...)
NOT-FOR-US: Oracle
CVE-2026-101396 (Vulnerability in the Siebel Apps - Marketing product of
Oracle Siebel ...)
@@ -4884,7 +4884,7 @@ CVE-2026-101389 (Vulnerability in the PeopleSoft
Enterprise PeopleTools product
CVE-2026-101388 (Vulnerability in the PeopleSoft Enterprise PeopleTools
product of Orac ...)
NOT-FOR-US: Oracle
CVE-2026-101387 (Vulnerability in the Oracle Capacity product of Oracle
E-Business Suit ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101386 (Vulnerability in Oracle REST Data Services (component: Core).
Support ...)
NOT-FOR-US: Oracle
CVE-2026-101385 (Vulnerability in Oracle REST Data Services (component: Core).
Support ...)
@@ -6352,9 +6352,9 @@ CVE-2026-113648 (ApostropheCMS is an open-source Node.js
content management syst
CVE-2026-113643 (A vulnerability was found in EspoCRM up to 9.3.10/10.0.10.
This affect ...)
NOT-FOR-US: EspoCRM
CVE-2026-113620 (In Eclipse ioFog Controller versions 3.8.0 through 3.9.1,
operator Web ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-113619 (In Eclipse ioFog Controller versions 3.8.0 through 3.9.1,
POST, PUT, a ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-113613 (FlexGet before 3.20.7 contains a path traversal vulnerability
in the d ...)
TODO: check
CVE-2026-113612 (SparkyFitness before 0.17.0 contains a missing authorization
vulnerabi ...)
@@ -6663,13 +6663,13 @@ CVE-2026-110180 (fast-uri is a dependency-free RFC 3986
URI parser and serialize
CVE-2026-109700 (Missing Authorization vulnerability in eLightUp Meta Box
\u2013 WordPr ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108089 (** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system
informati ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108088 (** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing
sensitive info ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108087 (** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of
special ele ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108086 (** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of
recursive enti ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108062 (Pre-authentication OIDC discovery and JWKS fetches run
synchronously o ...)
NOT-FOR-US: Eclipse
CVE-2026-107755 (Insufficient filtering of credentials in the _replicator
database in A ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/976da5174241a97b200723f20fc3816f2f95f853
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/976da5174241a97b200723f20fc3816f2f95f853
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
