Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
dc259f7e by security tracker role at 2026-10-29T19:14:35+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -7,23 +7,23 @@ CVE-2026-97860 (YMS-VPN8 and YMS-VPN8-CP provided by Yamaha
Corporation register
CVE-2026-97854 (Yamaha wireless LAN router NWR100 provided by Yamaha
Corporation conta ...)
TODO: check
CVE-2026-97073 (Missing Authorization vulnerability in myCred myCred mycred
allows Exp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96767 (The NEX-Forms \u2013 Ultimate Forms Plugin for WordPress
plugin for Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96203 (Use after free in Microsoft Edge (Chromium-based) allows an
unauthoriz ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-96199 (Heap-based buffer overflow in Microsoft Edge (Chromium-based)
allows a ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-96198 (Heap-based buffer overflow in Microsoft Edge (Chromium-based)
allows a ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-96196 (Incomplete list of disallowed inputs in Microsoft Edge
(Chromium-based ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-96192 (Use after free in Microsoft Edge for iOS allows an
unauthorized attack ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-96187 (Access of resource using incompatible type ('type confusion')
in Micro ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-93680 (IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote
attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93571 (Szafir is vulnerable to Path Traversal in the uploaded
filename. A man ...)
TODO: check
CVE-2026-93570 (Szafir and Szafir Weryfikuj\u0105ca are vulnerable to XML
External Ent ...)
@@ -41,37 +41,37 @@ CVE-2026-93007 (A flaw was found in dnsmasq. The TCP DNS
service uses a small fi
CVE-2026-93006 (A flaw was found in dnsmasq. The TFTP server can serve the
wrong file ...)
TODO: check
CVE-2026-92086 (The MW WP Form plugin for WordPress is vulnerable to Sensitive
Informa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91153 (The Everest Forms \u2013 Contact Form, Payment Form, Quiz,
Survey & Cu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91152 (The Everest Forms \u2013 Contact Form, Payment Form, Quiz,
Survey & Cu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90991 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-90872 (Improper neutralization of directives in dynamically evaluated
code in ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90871 (Improper limitation of a pathname to a restricted directory in
Progres ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90870 (A missing release of backend receiver sessions in the Ad Hoc
Transfer ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90869 (A remote attacker who knows a valid account's enrolled SSH
public key ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90868 (An OS command injection vulnerability in Progress Software
WS_FTP Serv ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90867 (Improper access control in the Web Admin console of Progress
Software ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90866 (A path traversal vulnerability in Progress Software WS_FTP
Server vers ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90865 (An OS command injection vulnerability in Progress Software
WS_FTP Serv ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90864 (A path traversal vulnerability in Progress Software WS_FTP
Server vers ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90863 (Missing authorization in the administrative interface of
Progress Soft ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90862 (Improper authentication in the Web Transfer Module of Progress
Softwar ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90861 (Progress Software WS_FTP Server versions prior to 2024.0.7 and
2025.0. ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-8824 (A memory corruption vulnerability exists in the vtkBMPReader
ExecuteDa ...)
TODO: check
CVE-2026-8822 (A memory corruption vulnerability exists in the vtkDEMReader
ReadProfi ...)
@@ -79,25 +79,25 @@ CVE-2026-8822 (A memory corruption vulnerability exists in
the vtkDEMReader Read
CVE-2026-88941 (Kaspersky has fixed a vulnerability in the Network Agent for
Windows m ...)
TODO: check
CVE-2026-88090 (Access of resource using incompatible type ('type confusion')
in Micro ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-88078 (Improper verification of cryptographic signature in Microsoft
Edge (Ch ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-88077 (Integer overflow or wraparound in Microsoft Edge
(Chromium-based) allo ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-85899 (Use after free in Microsoft Edge (Chromium-based) allows an
authorized ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-85897 (Heap-based buffer overflow in Microsoft Edge (Chromium-based)
allows a ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-85890 (Double free in Microsoft Edge (Chromium-based) allows an
unauthorized ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-85330 (Incorrect authorization in Microsoft Edge for Android allows
an unauth ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-84296 (Multi-Factor Authentication Bypass vulnerability in SSH
component in P ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-84295 (Improper authentication in Progress Software WS_FTP Server
versions pr ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-84294 (Improper limitation of pathname in the Ad Hoc Transfer
component of Pr ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-80069 (MasterStudy LMS plugin for WordPress before 3.7.50 contains a
missing ...)
TODO: check
CVE-2026-80067 (MasterStudy LMS plugin for WordPress before 3.7.50 contains a
path tra ...)
@@ -107,73 +107,73 @@ CVE-2026-7190 (A cross-site scripting (XSS) vulnerability
in the ICTBroadcast so
CVE-2026-79589 (The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed
contains an in ...)
TODO: check
CVE-2026-77819 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-77817 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-71569 (Server-Side Request Forgery (SSRF) vulnerability in Apache
Camel A2A c ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-6877 (ServiceNow has addressed a domain separation bypass security
issue tha ...)
- TODO: check
+ NOT-FOR-US: ServiceNow
CVE-2026-66912 (Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via
the From ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-66911 (Zimbra is vulnerable to stored cross-site scripting (XSS) via
the Cont ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-62374 (SD JWT JS is a JavaScript implementation of the Selective
Disclosure J ...)
TODO: check
CVE-2026-62131 (Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62018 (Unauthenticated PHP Object Injection in Gunslinger <= 1.11
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62017 (Unauthenticated PHP Object Injection in Good Homes <= 1.3.13
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62016 (Unauthenticated PHP Object Injection in Gamic <= 1.19
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62015 (Unauthenticated PHP Object Injection in Gamezone <= 1.1.11
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62014 (Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62013 (Unauthenticated PHP Object Injection in Edge Decor <= 2.9
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62012 (Unauthenticated PHP Object Injection in Coinpress <= 1.0.15
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62011 (Unauthenticated PHP Object Injection in Bonbon <= 1.11
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62010 (Unauthenticated PHP Object Injection in Avventure <= 1.1.12
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62009 (Unauthenticated PHP Object Injection in Filmax <= 1.1.11
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62008 (Unauthenticated PHP Object Injection in Orpheus <= 1.8
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62006 (Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62005 (Unauthenticated PHP Object Injection in Muzicon <= 1.15
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62004 (Unauthenticated PHP Object Injection in Motorix <= 1.11
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62003 (Unauthenticated PHP Object Injection in Mission <= 1.22
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62002 (Unauthenticated PHP Object Injection in Meals & Wheels <=
1.1.13 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62001 (Unauthenticated PHP Object Injection in Marcell <= 1.2.14
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61998 (Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61997 (Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61996 (Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61995 (Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase
<= 4.1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61993 (Unauthenticated Cross Site Scripting (XSS) in Blockonomics
3.11.0 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61992 (Unauthenticated PHP Object Injection in GEO my WordPress <=
4.5.5.3 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61991 (Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore
Cache <= 3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61989 (Unauthenticated Cross Site Scripting (XSS) in Easy Property
Listings < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61988 (Unauthenticated Cross Site Scripting (XSS) in Auction Nudge
\u2013 You ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-60111
REJECTED
CVE-2026-5702 (Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC
applicatio ...)
@@ -193,35 +193,35 @@ CVE-2026-58119
CVE-2026-58118
REJECTED
CVE-2026-56056 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54871 (Missing Authorization vulnerability in Mamunur Rashid
ShopBuilder \u20 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54866 (Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment
Button ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54865 (Subscriber Cross Site Scripting (XSS) in Podamibe Custom User
Gravatar ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54864 (Unauthenticated Cross Site Scripting (XSS) in Post Video
Players <= 1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54862 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54860 (Unauthenticated PHP Object Injection in Ozisti <= 1.1.10
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54859 (Unauthenticated PHP Object Injection in Preservation <= 1.15
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54858 (Unauthenticated PHP Object Injection in Printy <= 1.13.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54857 (Unauthenticated PHP Object Injection in Quirky <= 1.23
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54856 (Unauthenticated PHP Object Injection in RexCoin <= 1.2.6
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54853 (Missing Authorization vulnerability in Cozmoslabs Profile
Builder prof ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54852 (Missing Authorization vulnerability in miniOrange Page
Restriction Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-52709 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-52708 (Missing Authorization vulnerability in weDevs WP User Frontend
wp-user ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-51912 (OpenBMB XAgent v1.0.0 contains directory traversal
vulnerability in ma ...)
TODO: check
CVE-2026-51905 (TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect
Access ...)
@@ -235,87 +235,87 @@ CVE-2026-51863 (DB-GPT v0.7.5 and 0.8.0 contains
directory traversal in use_exam
CVE-2026-51851 (modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to
Directo ...)
TODO: check
CVE-2026-49142 (OpenEMR before 8.5.0 contains an authenticated SQL injection
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-48884 (Missing Authorization vulnerability in weDevs WP User Frontend
wp-user ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48202 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48200 (Insertion of Sensitive Information Into Sent Data
vulnerability in Bar ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48196 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48195 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42707 (Missing Authorization vulnerability in HivePress HivePress
Claim Listi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42703 (Missing Authorization vulnerability in Kaliforms Kali Forms
kali-forms ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42701 (Shop manager PHP Object Injection in YayMail <= 4.4.6
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42694 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42692 (Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding
<= 2.2.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42691 (Authorization Bypass Through User-Controlled Key vulnerability
in Even ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42690 (Subscriber Broken Access Control in LearnPress <= 4.4.10
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42057 (An invalid pointer dereference vulnerability exists in the
vtkPNGReade ...)
TODO: check
CVE-2026-41216 (An invalid pointer dereference vulnerability exists in the
vtkPNGReade ...)
TODO: check
CVE-2026-39782 (Missing Authorization vulnerability in Kaliforms Kali Forms
kali-forms ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39742 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39741 (Missing Authorization vulnerability in RelyWP Simple
Cloudflare Turnst ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39737 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39736 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39735 (Missing Authorization vulnerability in Crocoblock JetEngine
jet-engine ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-33924 (Two OS command injection vulnerabilities were discovered in
the update ...)
TODO: check
CVE-2026-33923 (A signature verification vulnerability was discovered in the
update in ...)
TODO: check
CVE-2026-27401 (Missing Authorization vulnerability in YITH YITH PayPal
Express Checko ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27394 (Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27063 (Missing Authorization vulnerability in Kit Kit (formerly
ConvertKit) c ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27062 (Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels
Team WPFu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-25467 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-25450 (Missing Authorization vulnerability in ThemeGrill User
Registration us ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-25448 (Missing Authorization vulnerability in weDevs WP ERP erp
allows Exploi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-24533 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-22386 (Missing Authorization vulnerability in Ahmad WP Job Portal
wp-job-port ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-20942 (Improper restriction of rendered ui layers or frames in
Microsoft Edge ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-18894 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote
attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11587 (SQL injection allowing an authenticated user with access to
ACL manage ...)
- TODO: check
+ NOT-FOR-US: Centreon
CVE-2026-119251 (A malicious actor with local access and high privileges could
exploit ...)
- TODO: check
+ NOT-FOR-US: Ubiquity
CVE-2026-119250 (A malicious actor with local access and low privileges could
exploit a ...)
- TODO: check
+ NOT-FOR-US: Ubiquity
CVE-2026-119249 (A malicious actor with access to the network could exploit a
Binding t ...)
- TODO: check
+ NOT-FOR-US: Ubiquity
CVE-2026-119168 (HashiCorp Nomad and Nomad Enterprise are vulnerable to
symlink followi ...)
TODO: check
CVE-2026-119145 (Frappe before 15.121.0 and 16.x before 16.34.0 contains a
path travers ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-119144 (Frappe Framework before 15.111.0 and 16.x before 16.21.0
contains a se ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-119143 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3
contains a deni ...)
TODO: check
CVE-2026-119142 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3
contains a deni ...)
@@ -351,9 +351,9 @@ CVE-2026-119128 (ZITADEL 4.0.0 before 4.19.5 contains an
authentication bypass v
CVE-2026-119127 (ZITADEL 4.0.0 before 4.19.5 contains a host header injection
vulnerabi ...)
TODO: check
CVE-2026-119126 (Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7
mishandles ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-119125 (Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8
returns th ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-119124 (ImageMagick before 7.1.2-34 contains a heap-based buffer
overflow in i ...)
TODO: check
CVE-2026-119123 (ImageMagick before 7.1.2-34 contains a stack overflow
vulnerability in ...)
@@ -369,7 +369,7 @@ CVE-2026-119119 (Crawl4AI before 0.9.5 contains a denial of
service vulnerabilit
CVE-2026-119118 (Crawl4AI before 0.9.5 contains an improper certificate
validation vuln ...)
TODO: check
CVE-2026-119115 (Incorrect authorization in the issuer resolution logic in AWS
Private ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119054 (Multiple Pages Generator by Themeisle before 4.2.5 contains a
stored c ...)
TODO: check
CVE-2026-119053 (lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains
an out-of- ...)
@@ -445,149 +445,149 @@ CVE-2026-118673 (KeePassXC is a cross-platform
community-driven port of the Wind
CVE-2026-118425 (A flaw was found in the secure-redirect-uris-enforcer client
policy of ...)
TODO: check
CVE-2026-118192 (The JoomSport \u2013 for Sports: Team & League, Football,
Hockey & mor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118097 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118095 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118094 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118093 (Missing Authorization vulnerability in WPFunnels Team Product
Feed Man ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118092 (Missing Authorization vulnerability in StylemixThemes
MasterStudy LMS ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118091 (Missing Authorization vulnerability in WPFunnels Team
WPFunnels wpfunn ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118088 (Missing Authorization vulnerability in WPFunnels Team
WPFunnels wpfunn ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118087 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118085 (Unauthenticated Cross Site Scripting (XSS) in GlobalPayments
WooCommer ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118084 (Subscriber Insecure Direct Object References (IDOR) in Hotel
Booking < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118083 (Unauthenticated Sensitive Data Exposure in WP Crowdfunding <=
2.2.2 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118082 (Subscriber Privilege Escalation in Buddyboss Platform <=
3.5.0 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118081 (Contributor PHP Object Injection in 10Web Social Photo Feed
<= 1.5.6 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118080 (Contributor PHP Object Injection in Social Snap <= 1.5.4
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118079 (Shop manager PHP Object Injection in FV Flowplayer Video
Player <= 8.3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118078 (Shop manager PHP Object Injection in Product Catalog Feed by
PixelYour ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118077 (Author PHP Object Injection in Sastra Essential Addons for
Elementor < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118076 (Contributor PHP Object Injection in Frisbii Pay <= 1.8.19
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118075 (Contributor PHP Object Injection in WP Media folders <=
1.1.10 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118074 (Shop manager PHP Object Injection in Finale Lite <= 2.21.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118073 (Subscriber PHP Object Injection in News Kit Elementor Addons
<= 1.5.0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-117611 (Improper certificate validation in Checkmk <2.5.0p18,
<2.4.0p39, <2.3. ...)
- TODO: check
+ NOT-FOR-US: Checkmk
CVE-2026-117174
REJECTED
CVE-2026-116869 (Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116868 (Subscriber PHP Object Injection in BuddyPress Xprofile Custom
Field Ty ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116867 (Contributor PHP Object Injection in Dynamic QR Code –
generator ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116866 (Contributor PHP Object Injection in Extra Fees Plugin for
WooCommerce ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116865 (Editor PHP Object Injection in Zippy <= 1.7.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116864 (Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116857 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116856 (Missing Authorization vulnerability in WP Desk Flexible
Quantity \u201 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116850 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116849 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116848 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116846 (Missing Authorization vulnerability in WP User Manager WP
User Manager ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116763 (The LiteSpeed Cache plugin for WordPress is vulnerable to
Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116566 (socket.getaddrinfo() previously accepted null bytes within
*host* and ...)
TODO: check
CVE-2026-116409 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116406 (Missing Authorization vulnerability in Webba Plugins Webba
Booking web ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116402 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116399 (Cross-Site Request Forgery (CSRF) vulnerability in InstaWP
InstaWP Con ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116387 (Missing Authorization vulnerability in Brainstorm Force
SureForms sure ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115967 (Weak Authentication vulnerability in Hamid Alinia Login with
phone num ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115965 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115964 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115963 (Missing Authorization vulnerability in VideoWhisper.com
Broadcast Live ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115962 (Authentication Bypass by Spoofing vulnerability in myCred
myCred mycre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115821 (The NewsmanApp plugin for WordPress is vulnerable to Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115805 (Improper handling of local filesystem paths in Rapid7 Insight
Agent on ...)
TODO: check
CVE-2026-115795 (P-Net before 1.0.3 does not check that a complete block
header is pres ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-115794 (P-Net before 1.0.3 passes the application alarm callback a
data length ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-115793 (P-Net before 1.0.3 does not release the RPC session allocated
for an R ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-115713 (Improper Link Resolution Before File Access ('Link
Following') (CWE-59 ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115712 (Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise
(ECE) ca ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115711 (Insertion of Sensitive Information into Externally-Accessible
File or ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115709 (Improper Link Resolution Before File Access ('Link
Following') (CWE-59 ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115708 (Improper Link Resolution Before File Access ('Link
Following') (CWE-59 ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115707 (Insertion of Sensitive Information into Externally-Accessible
File or ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115706 (Authorization Bypass Through User-Controlled Key (CWE-639) in
Elastic ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115611 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115610 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115605 (Missing Authorization vulnerability in Brainstorm Force
SureDash sured ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115601 (Missing Authorization vulnerability in WP Desk Custom Price
for WooCom ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115599 (Missing Authorization vulnerability in ThimPress LearnPress
learnpress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115592 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115303 (The Contact Form by Supsystic WordPress plugin before 1.11.1
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114706 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114358 (This vulnerability exists in the Radius Xenia M2M Platform
due to insu ...)
TODO: check
CVE-2026-114193 (Missing Authorization vulnerability in Eyal Fitoussi GEO my
WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114181 (Missing Authorization vulnerability in Magepeople inc. Taxi
Booking Ma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114148 (Incorrect default permissions in ASP.NET Core allows an
authorized att ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-113697 (Reflected cross-site scripting in the agent query feature of
BMC Helix ...)
TODO: check
CVE-2026-113696 (Improper authorization in the SmartIT change approval feature
of BMC I ...)
@@ -609,87 +609,87 @@ CVE-2026-113689 (Stored cross-site scripting in the
SmartIT work-notes feature o
CVE-2026-113688 (Server-side request forgery in the SmartIT URL-based
attachment featur ...)
TODO: check
CVE-2026-113576 (Adobe Digital Editions is affected by an Improper Limitation
of a Path ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-112827 (Missing Authorization vulnerability in VillaTheme HANDMADE
\u2013 Drop ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112256 (Acceptance of extraneous untrusted data with trusted data
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2026-112255 (Initialization of a resource with an insecure default
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2026-112200 (P-Net before 1.0.3 does not release the Application
Relationship (AR) ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111736 (P-Net before 1.0.3 dereferences a NULL AR pointer in
pf_fspm_cm_read_i ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111735 (P-Net before 1.0.3 contains an integer underflow in
pf_cpm_c_data_ind( ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111734 (P-Net before 1.0.3 does not validate the length of a received
Ethernet ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111733 (P-Net before 1.0.3 dereferences a NULL AR pointer when
handling an imp ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111732 (P-Net before 1.0.3, when built with
PNET_OPTION_AR_VENDOR_BLOCKS enabl ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111731 (P-Net before 1.0.3 enters an infinite loop when handling a
read reques ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111730 (P-Net before 1.0.3 does not validate the
LengthPeerStationName field o ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111419 (A sensitive information exposure vulnerability exists on the
Foxit off ...)
- TODO: check
+ NOT-FOR-US: Foxit
CVE-2026-111418 (A server-side request forgery (SSRF) vulnerability exists in
the Foxit ...)
- TODO: check
+ NOT-FOR-US: Foxit
CVE-2026-111417 (A broken access control vulnerability exists in the Foxit
official web ...)
- TODO: check
+ NOT-FOR-US: Foxit
CVE-2026-111318 (The HT Mega Addons for Elementor \u2013 Elementor Widgets &
Template B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110881 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110707 (The RSS Aggregator by Feedzy \u2013 Feed to Post,
Autoblogging, News & ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110309 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110245 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote
attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110244 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110200 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110196 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote
attacker wi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110193 (IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote
attacker wi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110192 (IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110190 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow an
authenticated use ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110186 (IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote
attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110184 (The Newsmatic theme for WordPress is vulnerable to blind SQL
Injection ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109891 (Missing Authorization vulnerability in weDevs Happy Addons
for Element ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109822 (Yamaha wireless LAN router NWR100 provided by Yamaha
Corporation conta ...)
TODO: check
CVE-2026-109216 (The Meta Box \u2013 A Framework for Dynamic Websites plugin
for WordPr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109215 (The LiteSpeed Cache plugin for WordPress is vulnerable to
Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108494 (Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <=
1.4.1 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-107743 (The Mapster WP Maps plugin for WordPress is vulnerable to
Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107629 (The Greenshift \u2013 animation and page builder blocks
plugin for Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107627 (The Greenshift \u2013 animation and page builder blocks
plugin for Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107347 (HashiCorp Nomad and Nomad Enterprise are vulnerable to
symlink followi ...)
TODO: check
CVE-2026-107329 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107328 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107327 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107326 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107060 (Insecure permissions in Tailscale versionCode 297862600
allows unautho ...)
TODO: check
CVE-2026-107059 (An issue in Nextcloud versionCode 30390190 allows attackers
to force v ...)
@@ -781,59 +781,59 @@ CVE-2026-107014 (Insecure permissions in Bander Notepad
(bander.notepad) version
CVE-2026-106036 (Szafir accepts any client or server certificate without
performing cer ...)
TODO: check
CVE-2026-104727 (The Sequential Order Numbers for WooCommerce plugin for
WordPress is v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104339 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote
attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104331 (IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to
server-side req ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104328 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104324 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104317 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote
attacker wh ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104316 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow an
authenticated att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104315 (IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to
server-side req ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104314 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow an
authenticated att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104312 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow an
authenticated att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104310 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104309 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104308 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-103875 (The Media Library Assistant plugin for WordPress is
vulnerable to Refl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103665 (The installer for Yamaha LAN Monitor for Windows provided by
Yamaha Co ...)
TODO: check
CVE-2026-103485 (The Extensions for Leaflet Map plugin for WordPress is
vulnerable to S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103094 (ServiceNow has remediated an information disclosure
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: ServiceNow
CVE-2026-103093 (ServiceNow has remediated a sandbox escape security issue
that was ide ...)
- TODO: check
+ NOT-FOR-US: ServiceNow
CVE-2026-103092 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-102590 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-102260 (HashiCorp Nomad and Nomad Enterprise are vulnerable to
cross-namespace ...)
TODO: check
CVE-2026-101288 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote
authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2025-62841 (An use of hard-coded cryptographic key vulnerability has been
reported ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2025-62839 (An use of hard-coded cryptographic key vulnerability has been
reported ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2025-13050 (Broken Function Level Authorization allows execution of poller
post-re ...)
- TODO: check
+ NOT-FOR-US: Centreon
CVE-2025-12523 (Broken Object Level Authorization in Users Configuration
Endpoint allo ...)
- TODO: check
+ NOT-FOR-US: Centreon
CVE-2023-7357 (A remote code execution (RCE) vulnerability was identified in
the Flex ...)
- TODO: check
+ NOT-FOR-US: Flexera
CVE-2019-25781 (Python-Markdown 3.0 through 3.11.2 contains an algorithmic
complexity ...)
TODO: check
CVE-2026-XXXX [GHSA-c968-33g3-wh7p: Package names in
vendor/composer/installed.json can escape the vendor directory during install
and reinstall]
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dc259f7efba9dc269f346d03328f7afd257b3c43
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dc259f7efba9dc269f346d03328f7afd257b3c43
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
