Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
3d20bd1b by Salvatore Bonaccorso at 2026-10-30T05:30:52+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -320,7 +320,7 @@ CVE-2026-66912 (Zimbra is vulnerable to Stored Cross-Site
Scripting (XSS) via th
CVE-2026-66911 (Zimbra is vulnerable to stored cross-site scripting (XSS) via
the Cont ...)
NOT-FOR-US: Zimbra
CVE-2026-62374 (SD JWT JS is a JavaScript implementation of the Selective
Disclosure J ...)
- TODO: check
+ NOT-FOR-US: SD JWT JS
CVE-2026-62131 (Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5
versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-62018 (Unauthenticated PHP Object Injection in Gunslinger <= 1.11
versions.)
@@ -566,29 +566,29 @@ CVE-2026-119118 (Crawl4AI before 0.9.5 contains an
improper certificate validati
CVE-2026-119115 (Incorrect authorization in the issuer resolution logic in AWS
Private ...)
NOT-FOR-US: Amazon
CVE-2026-119054 (Multiple Pages Generator by Themeisle before 4.2.5 contains a
stored c ...)
- TODO: check
+ NOT-FOR-US: Multiple Pages Generator
CVE-2026-119053 (lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains
an out-of- ...)
TODO: check
CVE-2026-119052 (llama.cpp b2877 before b11935 contains an uncaught exception
vulnerabi ...)
TODO: check
CVE-2026-119051 (flat through 6.0.1 contains an uncontrolled resource
allocation vulner ...)
- TODO: check
+ NOT-FOR-US: flat Node.js module
CVE-2026-119050 (Agno through 3.1.11 contains an unsafe reflection
vulnerability in Pan ...)
- TODO: check
+ NOT-FOR-US: Agno
CVE-2026-119049 (FreeMail before 5.3.2 contains an authorization bypass
vulnerability t ...)
- TODO: check
+ NOT-FOR-US: FreeMail
CVE-2026-119048 (JeeSite 5.11.0 through 5.19.1 contains an insecure direct
object refer ...)
- TODO: check
+ NOT-FOR-US: JeeSite
CVE-2026-119028 (oapi-codegen 2.0.0 before 2.8.1 contains a code injection
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: oapi-codegen (not same as
golang-github-oapi-codegen-runtime, itp'ed)
CVE-2026-119027 (oapi-codegen 2.5.0 before 2.8.1 contains a code injection
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: oapi-codegen (not same as
golang-github-oapi-codegen-runtime, itp'ed)
CVE-2026-119025 (open 7.2.0 before 11.0.0 contains an OS command injection
vulnerabilit ...)
TODO: check
CVE-2026-118989 (WebToffee Product Import Export for WooCommerce 2.5.1 before
2.6.8 con ...)
- TODO: check
+ NOT-FOR-US: WooCommerce
CVE-2026-118984 (OmniRoute 3.8.0 before 3.8.52 contains an unverified password
change v ...)
- TODO: check
+ NOT-FOR-US: OmniRoute
CVE-2026-118782 (Forge (also called node-forge) is a native implementation of
Transport ...)
TODO: check
CVE-2026-118781 (Forge (also called node-forge) is a native implementation of
Transport ...)
@@ -610,7 +610,7 @@ CVE-2026-118774 (Forge (also called node-forge) is a native
implementation of Tr
CVE-2026-118773 (Glob matches files using patterns the shell uses. From 9.0.0
until 14. ...)
TODO: check
CVE-2026-118772 (joi is a schema description language and data validator for
JavaScript ...)
- TODO: check
+ NOT-FOR-US: Node joi
CVE-2026-118769 (Botan is a C++ cryptography library. From 2.1.0 until 3.13.0,
the Bota ...)
TODO: check
CVE-2026-118768 (Botan is a C++ cryptography library. From 1.11.34 until
3.13.0, the bo ...)
@@ -624,17 +624,17 @@ CVE-2026-118765 (Botan is a C++ cryptography library.
From 3.7.0 until 3.13.0, a
CVE-2026-118764 (minimatch is a minimal matching utility for converting glob
expression ...)
TODO: check
CVE-2026-118763 (sigstore-js provides JavaScript libraries for interacting
with Sigstor ...)
- TODO: check
+ NOT-FOR-US: sigstore-js
CVE-2026-118762 (Monkeytype is a minimalistic and customizable typing test.
Prior to 26 ...)
- TODO: check
+ NOT-FOR-US: Monkeytype
CVE-2026-118761 (Kubeflow Pipelines enables users to build and deploy
portable, scalabl ...)
- TODO: check
+ NOT-FOR-US: Kubeflow Pipelines
CVE-2026-118760 (Kubeflow Pipelines enables users to build and deploy
portable, scalabl ...)
- TODO: check
+ NOT-FOR-US: Kubeflow Pipelines
CVE-2026-118759 (Kubeflow Pipelines enables users to build and deploy
portable, scalabl ...)
- TODO: check
+ NOT-FOR-US: Kubeflow Pipelines
CVE-2026-118758 (Kubeflow Pipelines enables users to build and deploy
portable, scalabl ...)
- TODO: check
+ NOT-FOR-US: Kubeflow Pipelines
CVE-2026-118673 (KeePassXC is a cross-platform community-driven port of the
Windows app ...)
TODO: check
CVE-2026-118425 (A flaw was found in the secure-redirect-uris-enforcer client
policy of ...)
@@ -1201,57 +1201,57 @@ CVE-2026-11854 (The authentication endpoint generates
an error message that incl
CVE-2026-118905 (Node Version Manager (nvm) is a POSIX-compliant shell
function for man ...)
TODO: check
CVE-2026-118804 (Bricks Builder 2.4.3 and before contains a broken access
control vulne ...)
- TODO: check
+ NOT-FOR-US: Bricks Builder
CVE-2026-118803 (Bricks Theme 2.4.3 and before contains an unauthenticated
dynamic-data ...)
- TODO: check
+ NOT-FOR-US: Bricks Theme
CVE-2026-118757 (PiWeb Disable payment method / Partial payment for
WooCommerce before ...)
- TODO: check
+ NOT-FOR-US: WooCommerce
CVE-2026-118756 (gopass before 1.17.0 contains a path traversal vulnerability
in the fi ...)
TODO: check
CVE-2026-118755 (Volmarg Personal Management System through 2.1.0 contains an
OS comman ...)
- TODO: check
+ NOT-FOR-US: Volmarg Personal Management System
CVE-2026-118754 (Dolibarr ERP CRM before 24.0.2 contains a missing
authorization vulner ...)
NOT-FOR-US: Dolibarr
CVE-2026-118753 (FreeImage (danoli3 fork) before 3.19.25 contains a heap
buffer overflo ...)
- TODO: check
+ NOT-FOR-US: FreeImage (danoli3 fork)
CVE-2026-118752 (FreeImage (danoli3 fork) before 3.19.22 contains a heap
buffer overflo ...)
- TODO: check
+ NOT-FOR-US: FreeImage (danoli3 fork)
CVE-2026-118694 (python-markdown2 through 2.5.5 contains a denial of service
vulnerabil ...)
TODO: check
CVE-2026-118693 (CherryTree through 1.7.2 contains a path traversal
vulnerability in Ct ...)
- TODO: check
+ NOT-FOR-US: CherryTree
CVE-2026-118692 (CherryTree through 1.7.2 contains an OS command injection
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: CherryTree
CVE-2026-118691 (xianyu-auto-reply-fix through 2.0.7 contains a missing
authorization v ...)
- TODO: check
+ NOT-FOR-US: xianyu-auto-reply-fix
CVE-2026-118690 (Signal K Server before 2.33.0 contains a missing
authentication vulner ...)
- TODO: check
+ NOT-FOR-US: Signal K Server
CVE-2026-118689 (OvenMediaEngine through 0.21.0 contains a denial of service
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: OvenMediaEngine
CVE-2026-118682 (KaringX ClashMi through 1.0.32.1801 disables TLS certificate
validatio ...)
- TODO: check
+ NOT-FOR-US: KaringX ClashMi
CVE-2026-118669 (OAuthLib is an implementation of the OAuth request-signing
logic for P ...)
TODO: check
CVE-2026-118668 (langgraph-api implements the LangGraph API for rapid
development and t ...)
- TODO: check
+ NOT-FOR-US: langgraph-api
CVE-2026-118667 (LangGraph Python SDK is used to connect to running LangGraph
API serve ...)
- TODO: check
+ NOT-FOR-US: LangGraph Python SDK
CVE-2026-118666 (GraphQL Tools provides utilities for building, stitching, and
mocking ...)
- TODO: check
+ NOT-FOR-US: GraphQL Tools
CVE-2026-118665 (GraphQL Tools provides utilities for building, stitching, and
mocking ...)
- TODO: check
+ NOT-FOR-US: GraphQL Tools
CVE-2026-118664 (decode-uri-component provides a more robust alternative to
decodeURICo ...)
- TODO: check
+ NOT-FOR-US: decode-uri-component
CVE-2026-118663 (@hono/node-server allows running the Hono application on
Node.js. From ...)
- TODO: check
+ NOT-FOR-US: Hono node-server
CVE-2026-118662 (Vite is a frontend tooling framework for JavaScript. From
6.4.4 until ...)
TODO: check
CVE-2026-118661 (Happy DOM is a JavaScript implementation of a web browser
without its ...)
- TODO: check
+ NOT-FOR-US: Happy DOM
CVE-2026-118660 (Happy DOM is a JavaScript implementation of a web browser
without its ...)
- TODO: check
+ NOT-FOR-US: Happy DOM
CVE-2026-118659 (Happy DOM is a JavaScript implementation of a web browser
without its ...)
- TODO: check
+ NOT-FOR-US: Happy DOM
CVE-2026-118658 (Echo is a Go web framework. Prior to 4.15.2 and 5.1.1,
Context.Scheme ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3d20bd1bf0809302f69a6e8b0048e7ca4644400a
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3d20bd1bf0809302f69a6e8b0048e7ca4644400a
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
