Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
fc94c7fa by security tracker role at 2026-10-24T07:14:17+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,35 +1,35 @@
CVE-2026-97353 (The News Kit Addons For Elementor WordPress plugin through
1.4.7 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97352 (The News Kit Addons For Elementor WordPress plugin before
1.4.9 does n ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95620 (A use-after-free vulnerability in the Qt QNetworkAccessManager
HTTP/2 ...)
TODO: check
CVE-2026-94263 (The Advanced Custom Fields: Extended and Advanced Custom
Fields: Exten ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93640 (A local privilege escalation vulnerability in the optional
dnscache pa ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93639 (A missing authorization vulnerability in Zimbra Collaboration
Suite (Z ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93638 (A reflected cross-site scripting vulnerability in the login
page of Zi ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93636 (An LDAP filter injection vulnerability in Zimbra Collaboration
Suite ( ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93634 (A cross-account authorization vulnerability in Zimbra
Collaboration Su ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93633 (A CSS sanitization vulnerability in Zimbra Collaboration Suite
(ZCS) a ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93631 (A cross-site request forgery vulnerability in the OAuth
extension of Z ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93630 (A hostname canonicalization vulnerability in the email HTML
sanitizers ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93629 (An organizer authentication vulnerability in Zimbra
Collaboration Suit ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93628 (An attendee authentication vulnerability in the email calendar
process ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93627 (An organizer authentication vulnerability in the email
calendar proces ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93489 (Improper Authentication in ASUS router modules allows an
unauthenticat ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-91093 (A potential security vulnerability has been identified in HP
One Agent ...)
TODO: check
CVE-2026-89320 (`HmacShaCryptor.Hash` never hashed its input. For any input it
returne ...)
@@ -53,25 +53,25 @@ CVE-2026-89312 (`AesGcmCryptor.Open` passed a
caller-supplied nonce straight to
CVE-2026-87901 (Improper sanitization in the registration module allows
reflected Cros ...)
TODO: check
CVE-2026-87835 (The Front End Users WordPress plugin through 3.2.35 does not
restrict ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-83813 (Twisted is an event-based framework for internet applications,
support ...)
TODO: check
CVE-2026-79982 (The Bluetooth HCI USB transport class of the new USB device
stack, sub ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-79981 (The DNS stub resolver in subsys/net/lib/dns/resolve.c binds
one UDP so ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-79980 (The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained
its tra ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-79979 (The arm64 MMU backend invalidates a single virtual address
from the TL ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-79978 (The RTIO streaming completion callback
adxl345_process_fifo_samples_cb ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-79977 (The WireGuard VPN service in subsys/net/lib/wireguard/wg.c
updated the ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-75779 (Improper Neutralization of Special Elements used in an OS
Command (\u2 ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-75775 (Improper Neutralization of Special Elements used in an OS
Command in c ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-75525 (OpenReception's appointment booking software provides an
end-to-end en ...)
TODO: check
CVE-2026-75524 (OpenReception's appointment booking software provides an
end-to-end en ...)
@@ -101,37 +101,37 @@ CVE-2026-57208 (Entire CLI hooks into Git workflows to
capture AI agent sessions
CVE-2026-57207 (NetBox MCP Server is a simple read-only Model Context Protocol
server ...)
TODO: check
CVE-2026-57146 (PraisonAI is a multi-agent teams system. From version 4.5.115
to befor ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57144 (PraisonAI is a multi-agent teams system. From version 4.5.110
to befor ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57142 (PraisonAI is a multi-agent teams system. From version 4.5.87
to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57121 (PraisonAI is a multi-agent teams system. From version 0.1.4 to
before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57117 (PraisonAI is a multi-agent teams system. From version 4.6.10
to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57116 (PraisonAI is a multi-agent teams system. From version 4.2.1 to
before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57114 (PraisonAI is a multi-agent teams system. From version 4.5.126
to befor ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57113 (PraisonAI is a multi-agent teams system. From version 2.6.0 to
before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56840 (PraisonAI is a multi-agent teams system. From version 4.5.2 to
before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56838 (PraisonAI is a multi-agent teams system. From version 4.5.87
to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56837 (PraisonAI is a multi-agent teams system. From version 4.6.56
to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56836 (PraisonAI is a multi-agent teams system. From version 4.5.112
to befor ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56835 (PraisonAI is a multi-agent teams system. From version 3.11.0
to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56834 (PraisonAI is a multi-agent teams system. From version 3.8.1 to
before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56833 (PraisonAI is a multi-agent teams system. From version 3.8.1 to
before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56832 (PraisonAI is a multi-agent teams system. From version 4.5.2 to
before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-55889 (XDG Desktop Portal is a desktop integration portal. Prior to
version 1 ...)
TODO: check
CVE-2026-55888 (XDG Desktop Portal is a desktop integration portal. Prior to
version 1 ...)
@@ -173,15 +173,15 @@ CVE-2026-53920 (odhcpd is the DHCPv6, DHCPv4, and
router-advertisement server us
CVE-2026-53918 (odhcpd is the DHCPv6, DHCPv4, and router-advertisement server
used by ...)
TODO: check
CVE-2026-52356 (An OS command injection vulnerability in the
/htdocs/web/diagnostic.ph ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2026-50787 (e-SIC Livre (esiclivre) v0.2.2 and earlier contains an
uncontrolled re ...)
TODO: check
CVE-2026-50057 (A local privilege escalation vulnerability in the Zimbra
Collaboration ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-50056 (A local privilege escalation vulnerability in the
zmmailboxdmgr launch ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-50053 (A request attribute override vulnerability in Zimbra
Collaboration Sui ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-4952 (The "ASMobile" web interface, which is part of the VertiGIS
software p ...)
TODO: check
CVE-2026-4951 (The CustomerAdministration portal (KundenManager) of VertiGIS
WebOrder ...)
@@ -207,11 +207,11 @@ CVE-2026-25784 (Initialization of a Resource with an
Insecure Default vulnerabil
CVE-2026-25716 (Missing Authorization vulnerability in Hallo Welt! GmbH
BlueSpice (Ext ...)
TODO: check
CVE-2026-19741 (Zephyr's OpenThread integration defined
CONFIG_OPENTHREAD_JOINER_PSKD ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-16762 (An attacker able to supply a crafted XML document to an
application us ...)
TODO: check
CVE-2026-115938 (Craft CMS allows any authenticated control panel user to
submit an ele ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-115937 (The Mollie webhook endpoint accepts two independent,
attacker-controll ...)
TODO: check
CVE-2026-115935 (Theapp/process-api-response-headersaction accepts fake Craft
API respo ...)
@@ -229,7 +229,7 @@ CVE-2026-115893 (Wasmtime is a runtime for WebAssembly.
Prior to 36.0.19, 48.0.7
CVE-2026-115887 (GraphQL Scalars is a library of custom GraphQL scalars for
creating pr ...)
TODO: check
CVE-2026-115886 (MLflow is an open source AI engineering platform for agents,
large lan ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-115885 (The LangGraph CLI is the official command-line interface for
LangGraph ...)
TODO: check
CVE-2026-115883 (LangGraph checkpoint savers provide Postgres- and
SQLite-backed state ...)
@@ -239,17 +239,17 @@ CVE-2026-115877 (Twisted is an event-based framework for
internet applications,
CVE-2026-115863 (ConnMan through 2.0 has a stack-based buffer overflow via a
DHCPv6 Rep ...)
TODO: check
CVE-2026-115845 (An incomplete list of disallowed inputs in the Python code
validator o ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115813 (Server-side request forgery in the model download path in
Amazon Web S ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115812 (Relative path traversal during model archive extraction in
Amazon Web ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115810 (Tandoor Recipes before 2.7.0 contains a server-side request
forgery vu ...)
TODO: check
CVE-2026-115807 (The User Profile Builder \u2013 Beautiful User Registration
Forms, Use ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115806 (The Prime Mover \u2013 Backup and Migration plugin for
WordPress is vu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115803 (A flaw has been found in Scada-LTS 2.8.0. Affected by this
vulnerabili ...)
TODO: check
CVE-2026-115802 (A weakness has been identified in InternScience InternAgent
1.5.0. Thi ...)
@@ -259,13 +259,13 @@ CVE-2026-115801 (A security flaw has been discovered in
Kakao khaiii up to 0.4.
CVE-2026-115800 (A vulnerability was identified in UbiquitousLearning mllm up
to 2.0.2. ...)
TODO: check
CVE-2026-115797 (A weakness has been identified in Tenda F6 12.02.01.73.
Affected is an ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-115796 (A security flaw has been discovered in Tenda F6 12.02.01.73.
This impa ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-115786 (A mailbox quota-accounting vulnerability in Zimbra
Collaboration Suite ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-115785 (An SMTP command injection vulnerability in the data-source
testing fun ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-115778 (Twisted is an event-based framework for internet
applications, support ...)
TODO: check
CVE-2026-115776 (Twisted is an event-based framework for internet
applications, support ...)
@@ -339,7 +339,7 @@ CVE-2026-114622 (baserCMS is a website development
framework. In versions 5.2.3
CVE-2026-114621 (baserCMS is a website development framework. In versions
5.0.0 before ...)
TODO: check
CVE-2026-114429 (The WPVR WordPress plugin before 9.0.3 does not properly
sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114357 (Missing authentication for a critical function in the Android
Debug Br ...)
TODO: check
CVE-2026-114356 (Missing authorization in the system-privileged
'DJIUpdateService' bind ...)
@@ -351,97 +351,97 @@ CVE-2026-114354 (Missing authorization in the native
binder service 'android.dji
CVE-2026-114353 (Hidden functionality (undocumented backdoor) in the
root-privileged 'a ...)
TODO: check
CVE-2026-113951 (If an attacker can write to the filesystem of a container k8s
cluster ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-113877 (HTTP::Headers::ActionPack versions before 0.10 for Perl allow
CPU exha ...)
TODO: check
CVE-2026-113674 (The GeoDirectory WordPress plugin before 2.8.194 does not
correctly v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113673 (The GeoDirectory WordPress plugin before 2.8.194 does not
properly es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113493 (The GeoDirectory WordPress plugin before 2.8.194 does not
sanitise an ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113492 (The GeoDirectory WordPress plugin before 2.8.194 does not
perform sta ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113491 (The GeoDirectory WordPress plugin before 2.8.194 does not
validate a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113490 (The GeoDirectory WordPress plugin before 2.8.194 does not
perform any ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113489 (The GeoDirectory WordPress plugin before 2.8.194 does not
verify that ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112904 (Vvveb is a powerful and easy to use CMS with page builder to
build web ...)
TODO: check
CVE-2026-112863 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112862 (Deserialization of Untrusted Data vulnerability in xnau
webdesign Part ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112860 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112859 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Litt ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112858 (Deserialization of Untrusted Data vulnerability in
axiomthemes Rhodos ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112857 (Deserialization of Untrusted Data vulnerability in
axiomthemes Reprizo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112856 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Vaga ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112855 (Deserialization of Untrusted Data vulnerability in
axiomthemes Redy re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112854 (Deserialization of Untrusted Data vulnerability in
axiomthemes Holisti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112853 (Deserialization of Untrusted Data vulnerability in
axiomthemes Hallelu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112852 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Heli ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112851 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group HotL ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112850 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112849 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112848 (Deserialization of Untrusted Data vulnerability in
AivahThemes Hostme ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112847 (Deserialization of Untrusted Data vulnerability in ThemeREX
ZenSoul ze ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112846 (Deserialization of Untrusted Data vulnerability in ThemeREX
Group Save ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112838 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112837 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112835 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112825 (Missing Authorization vulnerability in Magepeople inc. Car
Rental Mana ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112821 (Missing Authorization vulnerability in Knit Pay Knit Pay
knit-pay allo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112359 (Missing Authorization vulnerability in Amauri.IO WPMobile.App
wpappnin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112342 (Tandoor Recipes before 2.7.0 contains an improper cache-key
design in ...)
TODO: check
CVE-2026-112333 (GFI Archiver before 15.14 contains a stored cross-site
scripting vulne ...)
TODO: check
CVE-2026-112207 (The Download Monitor WordPress plugin before 5.3.4 does not
properly v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111965 (The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does
not enfo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110975 (A flaw was found in Kruize Autotune. Its REST API ships
without an aut ...)
TODO: check
CVE-2026-110956 (The asVereinbase WordPress plugin before 1.1.8 does not
require a val ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110814
REJECTED
CVE-2026-10632 (A reflected cross-site scripting vulnerability in the Classic
Web Clie ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-108793
REJECTED
CVE-2026-108537
REJECTED
CVE-2026-108013 (BigFix Platform uses Mozilla CA certificate bundle (PEM).
Versions of ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-107907 (The MAS Videos WordPress plugin through 1.3.4 does not
perform any cap ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107887 (The Advanced Twenty Seventeen WordPress plugin through 1.3.1
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107685 (Improper Certificate Validation vulnerability in the
WebSocket streami ...)
TODO: check
CVE-2026-106765 (An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote
attacker to ...)
@@ -453,9 +453,9 @@ CVE-2026-106763 (An issue in
@justice8096/sagemath-mcp-server 1.0.1 allows a rem
CVE-2026-105963 (Externally-Generated Error Message Containing Sensitive
Information vu ...)
TODO: check
CVE-2026-105199 (The Pixel Tag Manager for WooCommerce WordPress plugin
before 2.2.3 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102786 (Joomla Extension - phoca.cz - Authenticated stored cross-site
scriptin ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2025-58403 (CGM CLININET is vulnerable to Reflected Cross-Site Scripting
(XSS) due ...)
TODO: check
CVE-2025-45528 (An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7
allows ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fc94c7fa43399966247a9d4b12af40c7648ba458
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fc94c7fa43399966247a9d4b12af40c7648ba458
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
