Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
15692a61 by Salvatore Bonaccorso at 2026-10-26T20:42:38+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -5,9 +5,9 @@ CVE-2026-97255 (Authorization Bypass Through User-Controlled
Key vulnerability i
CVE-2026-97254 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-97200 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: benoitc hackney
CVE-2026-96581 (Authorization Bypass Through User-Controlled Key vulnerability
in ash- ...)
- TODO: check
+ NOT-FOR-US: ash-project
CVE-2026-96432 (A malicious or compromised HTTP/2 server withholding SETTINGS
ACK can ...)
TODO: check
CVE-2026-95664 (Improper Neutralization of Special Elements used in an
Expression Lang ...)
@@ -33,25 +33,25 @@ CVE-2026-93847 (Mattermost versions 11.7.x <= 11.7.10 fail
to validate reserved
CVE-2026-93846 (Mattermost versions 11.7.x <= 11.7.10 fail to restrict which
built-in ...)
- mattermost-server <itp> (bug #823556)
CVE-2026-93328 (Path Traversal and Missing Authorization in cloud-storage
source in Go ...)
- TODO: check
+ NOT-FOR-US: Google Cloud MCP Toolbox
CVE-2026-92171 (A flaw was found in the Infinispan Operator for Red Hat Data
Grid. Whe ...)
- TODO: check
+ NOT-FOR-US: Infinispan Operator for Red Hat Data Grid
CVE-2026-90885 (Improper Restriction of XML External Entity Reference
vulnerability in ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-89209 (A vulnerability has been identified in Mendix SAML (Mendix 10
compatib ...)
NOT-FOR-US: Siemens
CVE-2026-85297 (Bucket Squatting in Google Cloud Run MCP versions prior to
1.11.0 on G ...)
- TODO: check
+ NOT-FOR-US: Google Cloud Run MCP
CVE-2026-82947 (SOEM version 2.0.0 and earlier contains multiple
vulnerabilities in fr ...)
- TODO: check
+ NOT-FOR-US: SOEM
CVE-2026-82946 (SOEM version 2.0.0 and earlier contains a vulnerability where
a malici ...)
- TODO: check
+ NOT-FOR-US: SOEM
CVE-2026-82945 (SOEM version 2.0.0 and earlier contains a vulnerability during
device ...)
- TODO: check
+ NOT-FOR-US: SOEM
CVE-2026-82944 (SOEM version 2.0.0 and earlier contains a vulnerability in
multi-segme ...)
- TODO: check
+ NOT-FOR-US: SOEM
CVE-2026-82943 (SOEM version 2.0.0 and earlier contains vulnerabilities where
a malici ...)
- TODO: check
+ NOT-FOR-US: SOEM
CVE-2026-82390 (The Espressif AES driver drivers/crypto/crypto_esp32_aes.c
advertises ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-82389 (In the Bluetooth Classic Hands-Free Profile Audio Gateway
role, hfp_ag ...)
@@ -59,7 +59,7 @@ CVE-2026-82389 (In the Bluetooth Classic Hands-Free Profile
Audio Gateway role,
CVE-2026-82388 (bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c
allocate ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-81509 (nforwardauth is a forward auth service that allows the use of
a single ...)
- TODO: check
+ NOT-FOR-US: nforwardauth
CVE-2026-81039 (The Bluetooth host pre-allocates a bt_conn object (a
"reservation") fr ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-81038 (The Object Transfer Service server builds its Object Action
Control Po ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/15692a617dae96786fb2a1e0729ea513d0f646dc
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/15692a617dae96786fb2a1e0729ea513d0f646dc
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
