Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f90a6c35 by Salvatore Bonaccorso at 2026-10-28T15:31:26+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1912,33 +1912,33 @@ CVE-2026-117601 (Electrum before 4.8.3 fails to verify
signatures of wallet-owne
NOTE: Fixed by:
https://github.com/spesmilo/electrum/commit/99131b132925fdc4803e77e45fd939cf8236749a
(4.8.3)
NOTE: Fixed by:
https://github.com/spesmilo/electrum/commit/9bbc139f7a5a33cf84cc73867172d5584a9ce2f1
(4.8.3)
CVE-2026-117573 (hagent through commit 761eec6 contains an OS command
injection vulnera ...)
- TODO: check
+ NOT-FOR-US: hagent
CVE-2026-117570 (Vorota-ai nmap-mcp through commit 3636afa contains an
improper allowli ...)
- TODO: check
+ NOT-FOR-US: nmap-mcp
CVE-2026-117569 (Kali-GPT through commit a608c74 contains an OS command
injection vulne ...)
- TODO: check
+ NOT-FOR-US: kali-gpt
CVE-2026-117568 (mcp-ffmpeg through 1.0.5 contains an OS command injection
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: mcp-ffmpeg
CVE-2026-117567 (esp-mcp through commit 28afddf contains an OS command
injection vulner ...)
- TODO: check
+ NOT-FOR-US: esp-mcp
CVE-2026-117566 (EasyImages2.0 through 2.8.6 contains an unauthenticated path
traversal ...)
- TODO: check
+ NOT-FOR-US: EasyImages2.0
CVE-2026-117565 (Artalk before 2.10.1 contains an unauthenticated server-side
request f ...)
- TODO: check
+ NOT-FOR-US: Artalkq
CVE-2026-117564 (nest-admin before 1.0.1 contains an authentication bypass
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: nest-admin
CVE-2026-117563 (MrDoc through 1.1.1 contains a broken access control
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: MrDoc
CVE-2026-117562 (rssant 1.9.0 through 1.9.1 contains an authorization bypass
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: rssant
CVE-2026-117561 (Codefriar sf-mcp through 1.3.2 contains an OS command
injection vulner ...)
- TODO: check
+ NOT-FOR-US: Codefriar sf-mcp
CVE-2026-117560 (ATXP Gemini CLI extension through 1.0.0 contains an OS
command injecti ...)
- TODO: check
+ NOT-FOR-US: ATXP Gemini CLI extension
CVE-2026-117559 (DroidMind through 0.4.0 contains a command injection
vulnerability tha ...)
- TODO: check
+ NOT-FOR-US: DroidMind
CVE-2026-117558 (The ai-sdlc plugin MCP server through 0.31.2 contains an OS
command in ...)
- TODO: check
+ NOT-FOR-US: ai-sdlc plugin MCP server
CVE-2026-117557 (SDL_image through 3.4.8 and through 2.8.12 contains a stack
out-of-bou ...)
TODO: check
CVE-2026-117556 (zchunk before 1.5.5 contains a heap out-of-bounds read
vulnerability i ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f90a6c35f0eb8055af5a02aed3e52162664362f2
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f90a6c35f0eb8055af5a02aed3e52162664362f2
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
