Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
4c0ab5f3 by security tracker role at 2026-10-29T07:14:01+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,47 +1,47 @@
CVE-2026-96741 (The DSGVO All in one for WP plugin for WordPress is vulnerable
to Stor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96669 (The Food Store \u2013 Online Food Delivery & Pickup plugin for
WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96666 (The Schema App Structured Data plugin for WordPress is
vulnerable to S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96228 (SSL Wireless SMS Notification for WordPress is vulnerable to
Authentic ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93904 (The Social Web Suite \u2013 Social Media Auto Post, Social
Media Auto ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93855 (The SendPress Newsletters plugin for WordPress is vulnerable
to time-b ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93851 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x
<= 11.7 ...)
TODO: check
CVE-2026-93757 (The Wild Apricot Login plugin for WordPress is vulnerable to
Authentic ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93293 (The Password Protected plugin for WordPress is vulnerable to
Stored Cr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89216 (The vTables WordPress plugin before 0.3 does not properly
sanitise an ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88928 (The PAYCOMET for WooCommerce WordPress plugin before 5.46 does
not ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86983 (A remote attacker may be able to terminate a process that
passes attac ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86794 (The Community Events WordPress plugin before 1.6.0 does not
have autho ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85749 (MailWatch for MailScanner is a web-based front-end to
MailScanner. Pri ...)
TODO: check
CVE-2026-85007 (The Video Player for YouTube WordPress plugin before 2.1.4
does not p ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82411 (Open Object provides an API and admin interface to manage
objects and ...)
TODO: check
CVE-2026-78674 (The BPMN System REST APIs do not sufficiently validate input
parameter ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-78396 (The Link Library WordPress plugin before 7.10.0 does not
verify that a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78395 (The Link Library WordPress plugin before 7.10.0 does not
re-check the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-76418 (A vulnerability in the Remote Access SSL VPN service of Cisco
Secure F ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-75520 (Domoticz is a free, open source home automation system for
Linux, Wind ...)
TODO: check
CVE-2026-6647 (In deployments of WSO2 Identity Server configured with a
case-insensit ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-66092 (In openEQUELLA before 2026.2, the pre-login notice is stored
as HTML a ...)
TODO: check
CVE-2026-66091 (In openEQUELLA before 2026.1, the GET
/api/userquery/userinfobackup en ...)
@@ -55,19 +55,19 @@ CVE-2026-66088 (In openEQUELLA before 2026.1, the
system.execute() function avai
CVE-2026-63190 (FearlessCMS is a flat-file `content` management system
centered on sim ...)
TODO: check
CVE-2026-61575 (AVideo is a video-sharing Platform. Prior to 8.1.0,
`view/queue.php` u ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61573 (AVideo is a video-sharing Platform. Prior to 8.1.0, the
anonymous logi ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61572 (AVideo is a video-sharing Platform. Before the initial
remediation att ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61571 (AVideo is a video-sharing Platform. Prior to 8.1.0, the
encoder lacks ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61569 (AVideo is a video-sharing Platform. Prior to 8.1.0, the
unauthenticate ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61567 (AVideo is a video-sharing Platform. Prior to 8.1.0, the
live-streaming ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61564 (AVideo is a video-sharing Platform. Prior to 8.1.0, the
unauthenticate ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61546 (AnkiMCP is an Anki addon that implements an MCP server,
enabling AI as ...)
TODO: check
CVE-2026-61542 (Gearboy is a Game Boy, Game Boy Color, and Super Game Boy
emulator and ...)
@@ -91,9 +91,9 @@ CVE-2026-42922 (A authorization bypass vulnerability exists
in the /nodered func
CVE-2026-40063 (A information disclosure vulnerability exists in the
/nodered/fuxa/scr ...)
TODO: check
CVE-2026-3583 (When the `allowed_scopes` configuration is enabled, the OAuth2
token i ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-21157 (Improper input validation in Bixby prior to version 4.0.85.6
allows pr ...)
- TODO: check
+ NOT-FOR-US: Samsung Mobile
CVE-2026-19610 (A flaw was found in the platform-mbean component of JBoss EAP,
which p ...)
TODO: check
CVE-2026-16889 (In openEQUELLA before 2026.1, the pre-login notice image
upload endpoi ...)
@@ -103,7 +103,7 @@ CVE-2026-15564 (Wildfly's IIOP listener may permit
deserialization of input stre
CVE-2026-13451 (A flaw was found in KServe. A namespace-scoped user with
create/update ...)
TODO: check
CVE-2026-11854 (The authentication endpoint generates an error message that
includes r ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-118905 (Node Version Manager (nvm) is a POSIX-compliant shell
function for man ...)
TODO: check
CVE-2026-118804 (Bricks Builder 2.4.3 and before contains a broken access
control vulne ...)
@@ -117,7 +117,7 @@ CVE-2026-118756 (gopass before 1.17.0 contains a path
traversal vulnerability in
CVE-2026-118755 (Volmarg Personal Management System through 2.1.0 contains an
OS comman ...)
TODO: check
CVE-2026-118754 (Dolibarr ERP CRM before 24.0.2 contains a missing
authorization vulner ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-118753 (FreeImage (danoli3 fork) before 3.19.25 contains a heap
buffer overflo ...)
TODO: check
CVE-2026-118752 (FreeImage (danoli3 fork) before 3.19.22 contains a heap
buffer overflo ...)
@@ -185,7 +185,7 @@ CVE-2026-118586 (A security flaw has been discovered in dfm
feedfinder2 up to 0.
CVE-2026-118585 (A vulnerability was identified in configuroweb
inventariobasico c9377c ...)
TODO: check
CVE-2026-118579 (A weakness has been identified in D-Link DIR-505 1.10B02. The
impacted ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2026-118578 (A security flaw has been discovered in maotoumao
MusicFreeDesktop 0.0. ...)
TODO: check
CVE-2026-118577 (A vulnerability was identified in maotoumao MusicFreeDesktop
0.0.6/0.0 ...)
@@ -195,7 +195,7 @@ CVE-2026-118538 (A vulnerability was determined in
a2ui-project a2ui up to 0.12.
CVE-2026-118537 (A vulnerability was found in a2ui up to 0.10.4. This
vulnerability aff ...)
TODO: check
CVE-2026-118426 (In affected versions of Octopus Server with the LDAP
authentication pr ...)
- TODO: check
+ NOT-FOR-US: Octopus Deploy
CVE-2026-118266 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's
MethodOv ...)
TODO: check
CVE-2026-118030 (A flaw was found in the HOTP authentication mechanism of the
keycloak- ...)
@@ -213,39 +213,39 @@ CVE-2026-117548 (A NULL pointer dereference flaw was
found in 389-ds-base. This
CVE-2026-116641 (The DB Tools rely on the TLS implementation in Golang\u2019s
standard ...)
TODO: check
CVE-2026-115415 (Improper neutralization of input used for LLM prompting in
the environ ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115302 (The Contact Form by Supsystic WordPress plugin before 1.11.1
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115301 (The Contact Form by Supsystic WordPress plugin before 1.11.1
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115300 (The Contact Form by Supsystic WordPress plugin before 1.11.1
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115299 (The Contact Form by Supsystic WordPress plugin before 1.11.1
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115282 (The Recipe Card Blocks Lite WordPress plugin before 3.6.4
does not per ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115259 (The Photo Engine (Media Organizer & Lightroom) WordPress
plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115245 (The Chat AI with Dispatcher WordPress plugin before 2.4 does
not prope ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114488 (A flaw was found in Wildfly. A remote attacker can bypass
authenticati ...)
TODO: check
CVE-2026-114270 (The GeoDirectory WordPress plugin before 2.8.197 does not
honour post ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114173 (The Ortto plugin for WordPress before 1.0.25 did not filter
the WooCom ...)
- TODO: check
+ NOT-FOR-US: Canva
CVE-2026-113957 (An attacker who controls the registry, a mirror, or the
network path t ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-113617 (The Automated Import Products to Cart WordPress plugin before
1.0.4 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113616 (The LogixFast Auth WordPress plugin before 1.0.4 does not
deliver its ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113409 (The Ortto plugin for WordPress before 1.0.25 did not escape
stored set ...)
- TODO: check
+ NOT-FOR-US: Canva
CVE-2026-113387 (The Ortto plugin for WordPress before 1.0.25 did not
authenticate conf ...)
- TODO: check
+ NOT-FOR-US: Canva
CVE-2026-111739 (The Two Factor Authentication WordPress plugin before 1.17.0,
All-In-O ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111575
REJECTED
CVE-2026-111486
@@ -253,29 +253,29 @@ CVE-2026-111486
CVE-2026-111478
REJECTED
CVE-2026-110983 (The WP Photo Album Plus WordPress plugin before 9.3.04.004
does not ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110505 (The Enable SVG, WebP, and ICO Upload WordPress plugin before
1.1.6 doe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110504 (The Enable SVG, WebP, and ICO Upload WordPress plugin before
1.1.6 doe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110030 (The Hide Price Until Login WordPress plugin before 1.1.2 does
not rest ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109516 (The Bot for Telegram on WooCommerce plugin for WordPress is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108763 (The Wallet System for WooCommerce WordPress plugin before
2.8.2 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108686 (The WP Post Author WordPress plugin before 4.2.0 does not
restrict th ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108685 (The WP Post Author WordPress plugin before 4.2.0 does not
check that ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105258 (The Appointment Booking Plugin WordPress plugin before 5.7.6
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103693 (The Frontend Dashboard WordPress plugin before 3.0.5,
ProfileGrid Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-14260 (Due to the improper implementation of access control rules,
the WSO2 p ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-3586 (The LetterPress WordPress plugin before 2.4.0 does not
sanitise and e ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-XXXX [GHSA-cp82-q55r-936c]
- amule 1:3.2.0-1
NOTE:
https://github.com/amule-org/amule/security/advisories/GHSA-cp82-q55r-936c
@@ -596,7 +596,7 @@ CVE-2026-118485 (Axel Download Accelerator 2.17.14 and
earlier performs URL perc
CVE-2026-118477 (The ei_git_repo_url parameter in the Git remote configuration
endpoint ...)
NOT-FOR-US: Kalifast
CVE-2026-118435 (Out-of-bounds write vulnerability in Samsung Open Source
escargot allo ...)
- TODO: check
+ NOT-FOR-US: Samsung
CVE-2026-118265 (Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's
ExtractI ...)
- golang-github-labstack-echo <not-affected> (Vulnerable code
introduced later)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg
@@ -1072,7 +1072,7 @@ CVE-2026-116390 (Deserialization of Untrusted Data
vulnerability in stepasyuk Fi
CVE-2026-116389 (Deserialization of Untrusted Data vulnerability in crossi72
Phoenix Me ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-116078 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Erlang Foundation software not packaged in Debian
CVE-2026-115968 (Deserialization of Untrusted Data vulnerability in Ultimate
Member Ult ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-115957 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -1142,11 +1142,11 @@ CVE-2026-110540 (Dell PowerProtect Data Domain
Management Center, Feature Releas
CVE-2026-110508 (The Essential Addons for Elementor WordPress plugin before
6.8.7 does ...)
NOT-FOR-US: WordPress plugin
CVE-2026-110183 (PostgreSQL Anonymizer contains a vulnerability related to
static maski ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-110182 (PostgreSQL Anonymizer contains a vulnerability related to the
anon.par ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-110181 (PostgreSQL Anonymizer contains a vulnerability related to
anonymizatio ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-106972 (An uncontrolled recursion in the
MessagePack\BufferUnpacker::unpack() ...)
TODO: check
CVE-2026-106971 (An integer overflow in the MessagePack\BufferUnpacker
component of ryb ...)
@@ -1158,23 +1158,23 @@ CVE-2026-106484 (Insufficient policy enforcement in
chrome-devtools-mcp in Googl
CVE-2026-106079 (An Improper Neutralization of Special Elements used in an OS
Command ( ...)
NOT-FOR-US: Juniper
CVE-2026-105620 (PostgreSQL Anonymizer doesn't mask data returned by a
sub-query in a r ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105619 (PostgreSQL Anonymizer doesn't mask data accessed thru a
security_invok ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105618 (PostgreSQL Anonymizer's documentation recommends applying
rules on par ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105617 (PostgreSQL Anonymizer doesn't invalidate plans prepared after
a rule w ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105616 (PostgreSQL restricts acces to the salt and shift via the
`SHOW` comman ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105615 (PostgreSQL's optimized statistics on a table are visible as
long as yo ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105614 (PostgreSQL Anonymizer's `anon.image_blur()` function doesn't
check the ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105613 (PostgreSQL Anonymizer's range-based dummy functions dont
constraint th ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105612 (PostgreSQL Anonymizer contains a vulnerability that
data-modifying CTE ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105457 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
NOT-FOR-US: Liman MYS
CVE-2026-105420 (Wing FTP Server does not verify user's base folder. An
attacker with a ...)
@@ -1234,11 +1234,11 @@ CVE-2026-102790 (Joomla Extension - icagenda.com -
Stored XSS via url-type even
CVE-2026-101935 (The Echo Knowledge Base \u2013 Documentation, FAQs, Chat &
Smart Searc ...)
NOT-FOR-US: WordPress plugin
CVE-2026-101274 (When pretix is used as the identity provider in a
Single-Sign-On (SSO) ...)
- TODO: check
+ NOT-FOR-US: pretix
CVE-2026-101273 (Some of our API endpoints allowed to create order payments
referencing ...)
- TODO: check
+ NOT-FOR-US: pretix
CVE-2026-101272 (The mechanism binding files generated during a shredding
process to th ...)
- TODO: check
+ NOT-FOR-US: pretix
CVE-2026-100105 (A user with permission to edit contact points but not their
protected ...)
NOT-FOR-US: Grafana
CVE-2025-30414 (Local privilege escalation due to improper authentication. The
followi ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4c0ab5f390e39b1fdca4f6ee5b1261c1a7a8ee57
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4c0ab5f390e39b1fdca4f6ee5b1261c1a7a8ee57
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
