Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
32f13c8d by Salvatore Bonaccorso at 2026-10-26T21:05:18+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -23,7 +23,7 @@ CVE-2026-95628 (Improper Limitation of a Pathname to a
Restricted Directory ('Pa
CVE-2026-94386 (Use of Cache Containing Sensitive Information vulnerability in
Apache ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-94380 (Weak Password Recovery Mechanism for Forgotten Password
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Liman MYS
CVE-2026-93850 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x
<= 11.7 ...)
- mattermost-server <itp> (bug #823556)
CVE-2026-93849 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x
<= 11.7 ...)
@@ -67,27 +67,27 @@ CVE-2026-81039 (The Bluetooth host pre-allocates a bt_conn
object (a "reservatio
CVE-2026-81038 (The Object Transfer Service server builds its Object Action
Control Po ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-77062 (The boneIO Black web interface lacks proper clickjacking
protections. ...)
- TODO: check
+ NOT-FOR-US: boneIO Black
CVE-2026-77061 (boneIO Black directly excludes several API endpoints from the
authenti ...)
- TODO: check
+ NOT-FOR-US: boneIO Black
CVE-2026-77060 (boneIO black_debian_images stores the Mosquitto MQTT broker
password f ...)
- TODO: check
+ NOT-FOR-US: boneIO Black
CVE-2026-77059 (boneIO Black contains a TOCTOU race condition in the
create_timedatect ...)
- TODO: check
+ NOT-FOR-US: boneIO Black
CVE-2026-77058 (boneIO Black is vulnerable to Cross-Site Request Forgery
(CSRF) on all ...)
- TODO: check
+ NOT-FOR-US: boneIO Black
CVE-2026-77057 (boneIO Black does not limit authentication attempts on its web
interfa ...)
- TODO: check
+ NOT-FOR-US: boneIO Black
CVE-2026-77056 (boneIO black_debian_images ships with a Mosquitto MQTT broker
that use ...)
- TODO: check
+ NOT-FOR-US: boneIO Black
CVE-2026-77055 (boneIO black_debian_images gives the boneio service account
excessive ...)
- TODO: check
+ NOT-FOR-US: boneIO Black
CVE-2026-77054 (boneIO Black stores passwords, including the MQTT broker and
web panel ...)
- TODO: check
+ NOT-FOR-US: boneIO Black
CVE-2026-77053 (boneIO Black firmware ships with authentication disabled by
default. I ...)
- TODO: check
+ NOT-FOR-US: boneIO Black
CVE-2026-77052 (boneIO Black exposes a Node-RED instance without
authentication at the ...)
- TODO: check
+ NOT-FOR-US: boneIO Black
CVE-2026-72758 (When parsing an AS range in Routinator, if the maximum value
of the ra ...)
TODO: check
CVE-2026-72757 (Routinator runs out of open connections on the HTTP server
when many c ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/32f13c8d77917a0f0e8df7aa619c0217ce12fa91
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/32f13c8d77917a0f0e8df7aa619c0217ce12fa91
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
