Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
c1a05da2 by Salvatore Bonaccorso at 2026-10-24T10:27:09+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -39,25 +39,25 @@ CVE-2026-93627 (An organizer authentication vulnerability
in the email calendar
CVE-2026-93489 (Improper Authentication in ASUS router modules allows an
unauthenticat ...)
NOT-FOR-US: ASUS
CVE-2026-91093 (A potential security vulnerability has been identified in HP
One Agent ...)
- TODO: check
+ NOT-FOR-US: HP
CVE-2026-89320 (`HmacShaCryptor.Hash` never hashed its input. For any input it
returne ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-89319 (`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext
length from ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-89318 (`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's
initializa ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-89317 (gose parsed the JWS `crit` header into `JwsHeader.Crit` and
then never ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-89316 (`LoadPublicKey` resolved an EC key's curve with an unchecked
type asse ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-89315 (`JwtClaims.MarshalJSON` built a Go struct at runtime with
`reflect.Str ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-89314 (`jwkFields.CheckConsistency` detected duplicate `key_ops`
entries with ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-89313 (`JwksTrustStore.Get` assigned each parsed key to the
function's **name ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-89312 (`AesGcmCryptor.Open` passed a caller-supplied nonce straight
to `ciphe ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-87901 (Improper sanitization in the registration module allows
reflected Cros ...)
TODO: check
CVE-2026-87835 (The Front End Users WordPress plugin through 3.2.35 does not
restrict ...)
@@ -81,33 +81,33 @@ CVE-2026-75779 (Improper Neutralization of Special Elements
used in an OS Comman
CVE-2026-75775 (Improper Neutralization of Special Elements used in an OS
Command in c ...)
NOT-FOR-US: ASUS
CVE-2026-75525 (OpenReception's appointment booking software provides an
end-to-end en ...)
- TODO: check
+ NOT-FOR-US: OpenReception appointment booking software
CVE-2026-75524 (OpenReception's appointment booking software provides an
end-to-end en ...)
- TODO: check
+ NOT-FOR-US: OpenReception appointment booking software
CVE-2026-65825 (OpenReception's appointment booking software provides an
end-to-end en ...)
- TODO: check
+ NOT-FOR-US: OpenReception appointment booking software
CVE-2026-65824 (OpenReception's appointment booking software provides an
end-to-end en ...)
- TODO: check
+ NOT-FOR-US: OpenReception appointment booking software
CVE-2026-63244 (An authentication bypass vulnerability in WizLearn
Technologies' Learn ...)
- TODO: check
+ NOT-FOR-US: WizLearn Technologies Learning Management System (LMS)
CVE-2026-63120 (pghoard is a PostgreSQL backup daemon and restore tooling that
stores ...)
- TODO: check
+ NOT-FOR-US: pghoard
CVE-2026-58497 (Uni-CLI gives people and agents one command interface for
websites, br ...)
- TODO: check
+ NOT-FOR-US: Uni-CLI
CVE-2026-58202 (OpenReception's appointment booking software provides an
end-to-end en ...)
- TODO: check
+ NOT-FOR-US: OpenReception appointment booking software
CVE-2026-57849
REJECTED
CVE-2026-57845 (Hugging Face Datasets through 5.1.0 contains an insecure
deserializati ...)
- TODO: check
+ NOT-FOR-US: Hugging Face Datasets
CVE-2026-57210 (Heimdall is a cloud native Identity Aware Proxy and Access
Control Dec ...)
- TODO: check
+ NOT-FOR-US: Heimdall
CVE-2026-57209 (Heimdall is a cloud native Identity Aware Proxy and Access
Control Dec ...)
- TODO: check
+ NOT-FOR-US: Heimdall
CVE-2026-57208 (Entire CLI hooks into Git workflows to capture AI agent
sessions. Prio ...)
- TODO: check
+ NOT-FOR-US: Entire CLI hooks
CVE-2026-57207 (NetBox MCP Server is a simple read-only Model Context Protocol
server ...)
- TODO: check
+ NOT-FOR-US: NetBox MCP Server
CVE-2026-57146 (PraisonAI is a multi-agent teams system. From version 4.5.115
to befor ...)
NOT-FOR-US: PraisonAI
CVE-2026-57144 (PraisonAI is a multi-agent teams system. From version 4.5.110
to befor ...)
@@ -145,7 +145,7 @@ CVE-2026-55889 (XDG Desktop Portal is a desktop integration
portal. Prior to ver
CVE-2026-55888 (XDG Desktop Portal is a desktop integration portal. Prior to
version 1 ...)
TODO: check
CVE-2026-55826 (The GTM Server Side plugin by stape.io implements server-side
tracking ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-55606 (odhcpd is the DHCPv6, DHCPv4, and router-advertisement server
used by ...)
TODO: check
CVE-2026-55486 (The Goobi viewer is a web application that allows digitised
material t ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c1a05da255a40b7c34f1d992c96de6a5b42310f2
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c1a05da255a40b7c34f1d992c96de6a5b42310f2
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
