Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ddf5bbc4 by security tracker role at 2026-10-30T19:16:14+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,27 +1,27 @@
CVE-2026-9239 (The Meow Gallery plugin for WordPress is vulnerable to Stored
Cross-Si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97638 (The Forminator Forms \u2013 Contact Form, Payment Form &
Custom Form B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97209 (Insecure Temporary File vulnerability in Mix deps.partition in
Elixir ...)
TODO: check
CVE-2026-96894 (The ERP: Complete HR, Accounting & CRM Suite Built for
WooCommerce plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94175 (Unauthenticated Cross Site Scripting (XSS) in All In One Login
<= 2.4. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93327 (A Deserialization of Untrusted Data vulnerability in the
SubWorkflow t ...)
TODO: check
CVE-2026-91917 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-91915 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-91914 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Authe ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-91913 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-91912 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Use o ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-90888 (Unauthenticated PHP Object Injection in LeadSnap <= 1.25
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-87768 (DateTime::Lite versions before 0.8.1 for Perl allow CPU
exhaustion via ...)
TODO: check
CVE-2026-86715 (Plaintext storage of a password vulnerability in Crypttech
Crypto and ...)
@@ -31,37 +31,37 @@ CVE-2026-85268 (A Cross-Site Scripting (XSS) (CWE-79)
vulnerability in the auth/
CVE-2026-84243 (The gettext family of functions in the GNU C Library version
2.0 and l ...)
TODO: check
CVE-2026-82104 (In Teltonika Networks RUTOS devices running versions from 7.22
through ...)
- TODO: check
+ NOT-FOR-US: Teltonika Networks
CVE-2026-7004 (WIT SynApps Runtime through 1.4.11 contains a
pre-authentication refle ...)
TODO: check
CVE-2026-7003 (WIT SynApps Runtime through 1.4.11 contains a hardcoded
credentials vu ...)
TODO: check
CVE-2026-78527 (Contributor PHP Object Injection in GS Testimonial Slider <=
3.3.10 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-76012 (The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN
Gallery ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75882 (An improper access control vulnerability in ESET Endpoint
Encryption a ...)
TODO: check
CVE-2026-73322 (Incorrect Authorization vulnerability in the single-stage
query engine ...)
TODO: check
CVE-2026-73186 (Subscriber PHP Object Injection in Enable Media Replace <=
4.2.2 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-69446 (Incorrect authorization in Microsoft Edge (Chromium-based)
allows an a ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-66026
REJECTED
CVE-2026-66025
REJECTED
CVE-2026-65874 (This issue affects Apache Fineract versions up to and
including 1.15.0 ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-65566 (Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps
AI Engine ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-65444 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-64860
REJECTED
CVE-2026-64618 (Improper Neutralization of Special Elements used in an SQL
Command ("S ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-62303 (Pistache is a high-performance REST toolkit written in C++.
From 0.0.5 ...)
TODO: check
CVE-2026-62298 (mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN
TYPE` dec ...)
@@ -73,23 +73,23 @@ CVE-2026-62162 (Hydra is a layer-two scalability solution
for Cardano. Prior to
CVE-2026-62160 (Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26,
the globa ...)
TODO: check
CVE-2026-62141 (Missing Authorization vulnerability in WP ManageNinja LLC
Fluent CRM f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62122 (Missing Authorization vulnerability in Arraytics Booktics
booktics all ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62121 (Improper Control of Filename for Include/Require Statement in
PHP Prog ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62057 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62056 (Missing Authorization vulnerability in WP ManageNinja LLC
Fluent CRM f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62055 (Missing Authorization vulnerability in Liquid Web / StellarWP
Event Ti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62047 (Missing Authorization vulnerability in Liquid Web / StellarWP
Event Ti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62023 (Missing Authorization vulnerability in Unlimited Elements
Unlimited El ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62019 (Missing Authorization vulnerability in Liquid Web / StellarWP
BookIt b ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61854 (VoiceSentinel is a real-time voice moderation system for
Minecraft ser ...)
TODO: check
CVE-2026-61848 (Crass is a Ruby CSS parser that's fully compliant with the CSS
Syntax ...)
@@ -105,13 +105,13 @@ CVE-2026-61840 (Quest Bot is an opensource Discord Bot.
Prior to 1.1.9, the `ima
CVE-2026-61826 (Bazarr is a companion application to Sonarr and Radarr. Prior
to 1.5.7 ...)
TODO: check
CVE-2026-61806 (Frappe Learning Management System (LMS) is a learning system
that help ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-61805 (Frappe Learning Management System (LMS) is a learning system
that help ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-61804 (myTinyWMS is a free, open-source warehouse management system.
Prior to ...)
TODO: check
CVE-2026-61803 (Frappe Learning Management System (LMS) is a learning system
that help ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-61789 (DBHub is a database MCP server for Postgres, MySQL, SQL
Server, Oracle ...)
TODO: check
CVE-2026-61739 (SOCFortress CoPilot focuses on providing a single pane of
glass for al ...)
@@ -123,7 +123,7 @@ CVE-2026-61737 (ng-antd-admin is an Angular and NestJS
administration system tem
CVE-2026-61730 (SOCFortress CoPilot focuses on providing a single pane of
glass for al ...)
TODO: check
CVE-2026-61729 (SOCFortress CoPilot focuses on providing a single pane of
glass for al ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-61728 (SOCFortress CoPilot focuses on providing a single pane of
glass for al ...)
TODO: check
CVE-2026-61708 (SOCFortress CoPilot focuses on providing a single pane of
glass for al ...)
@@ -145,13 +145,13 @@ CVE-2026-59385 (A user with SpaceDeveloper privileges
could modify the URL of a
CVE-2026-55551 (ZAC is an open-source, workflow-based Common Ground component
for Dutc ...)
TODO: check
CVE-2026-54855 (Unauthenticated Cross Site Scripting (XSS) in Profile Builder
<= 4.0.5 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54854 (Contributor Privilege Escalation in Profile Builder <= 4.0.5
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54850 (Subscriber Broken Access Control in Booking and Rental Manager
<= 2.8. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-52710 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-50000 (SecureDrop is an open-source whistleblower submission system
that medi ...)
TODO: check
CVE-2026-49116
@@ -159,7 +159,7 @@ CVE-2026-49116
CVE-2026-49115
REJECTED
CVE-2026-48201 (Unauthenticated Cross Site Scripting (XSS) in Fast Velocity
Minify <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48164 (Collabora Online is a collaborative online office suite based
on Libre ...)
TODO: check
CVE-2026-46560 (Open Access Management (OpenAM) is an access management
solution. Prio ...)
@@ -167,31 +167,31 @@ CVE-2026-46560 (Open Access Management (OpenAM) is an
access management solution
CVE-2026-46499 (Collabora Online is a collaborative online office suite based
on Libre ...)
TODO: check
CVE-2026-45145 (Chamilo LMS is an open-source learning management system.
Prior to 2.0 ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-45144 (Chamilo LMS is an open-source learning management system. From
2.0.0 u ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-45141 (Chamilo LMS is an open-source learning management system.
Prior to 2.0 ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-44344 (Chamilo LMS is an open-source learning management system. In
the 1.x l ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-39786 (Unauthenticated Cross Site Scripting (XSS) in BA Book
Everything <= 1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39739 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39738 (Unauthenticated PHP Object Injection in FunnelKit Automations
<= 3.8.6 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39734 (Unauthenticated Path Traversal in WP EasyPay <= 4.5.4
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39732 (Unauthenticated SQL Injection in Transliterator <= 2.5.13
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39375 (Frappe Learning Management System (LMS) is a learning system
that help ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-37468 (Cross Site Scripting vulnerability in BeeHome MyBeeHome before
2025-11 ...)
TODO: check
CVE-2026-28160 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <=
1.4.10 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27061 (Subscriber Cross Site Scripting (XSS) in User Registration <=
5.3.0 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-22114 (HTTP basic auth enforces no retry limit or backoff. Combined
with the ...)
TODO: check
CVE-2026-22110 (The web server does not check authentication on POST or PUT.
An unauth ...)
@@ -203,7 +203,7 @@ CVE-2026-22105 (Delta UFC500 charging stations derive the
default credentials of
CVE-2026-14467 (An information disclosure vulnerability in the Forocoches
comments edi ...)
TODO: check
CVE-2026-13747 (The Meow Gallery plugin for WordPress is vulnerable to
authorization b ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13576 (CallBackery versions before 0.62.0 for Perl store user
passwords as un ...)
TODO: check
CVE-2026-120046 (Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference
vulnerabi ...)
@@ -213,7 +213,7 @@ CVE-2026-120007 (NodeBB 1.18.0 through 4.16.5 contains an
authorization bypass v
CVE-2026-119979 (LM Studio before 0.4.22+1 contains a path traversal
vulnerability in t ...)
TODO: check
CVE-2026-119978 (Flowise through 3.1.4 contains a sandbox escape vulnerability
that all ...)
- TODO: check
+ NOT-FOR-US: Flowise
CVE-2026-119842 (A flaw was found in GStreamer's gst-plugins-base MicroDVD
subtitle par ...)
TODO: check
CVE-2026-119777 (A flaw was found in GStreamer's gst-plugins-bad H.266/VVC
parser. When ...)
@@ -367,11 +367,11 @@ CVE-2026-119573 (Traefik 3.7.11 before 3.7.15 contains an
authorization bypass i
CVE-2026-119572 (Traefik from 3.7.0-ea.1 before 3.7.15 contains an
authentication bypas ...)
TODO: check
CVE-2026-119571 (Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an
authorizati ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-119570 (Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an
information ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-119569 (Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9
contains a ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-119568 (vsftpd through 3.0.5 contains an authentication bypass
vulnerability i ...)
TODO: check
CVE-2026-119567 (vsftpd through 3.0.5 contains an access control bypass
vulnerability t ...)
@@ -395,7 +395,7 @@ CVE-2026-119559 (OpenLiteSpeed through 1.9.4 contains an
authentication bypass v
CVE-2026-119558 (OpenCart through 4.1.0.4 contains a business logic
vulnerability that ...)
TODO: check
CVE-2026-119557 (n8n from 2.14.0 through 2.46.3 contains a path traversal
vulnerability ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-119556 (Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0
through 5.1.8 ...)
TODO: check
CVE-2026-119555 (Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0
through 5.1.8 ...)
@@ -425,13 +425,13 @@ CVE-2026-119542 (A flaw was found in the Ickle query
parser in Infinispan. A que
CVE-2026-119528 (A flaw was found in GIMP. The PSD plug-in\u2019s image
resource header ...)
TODO: check
CVE-2026-119526 (Deserialization of Untrusted Data vulnerability in ThemeREX
Royal Even ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119482 (Missing Authorization vulnerability in Crocoblock
JetFormBuilder jetfo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119479 (Improper Neutralization of Script-Related HTML Tags in a Web
Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119466 (Cross-Site Request Forgery (CSRF) vulnerability in WPExperts
APIExpert ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119429 (phpMyAdmin through 5.2.3 contains a missing re-authentication
vulnerab ...)
TODO: check
CVE-2026-119428 (phpMyAdmin through 5.2.3 contains a server-side request
forgery vulner ...)
@@ -467,7 +467,7 @@ CVE-2026-119414 (Bitwarden Server before 2026.10.1 on
Entity Framework backends
CVE-2026-119409 (OPNsense before 26.7.8 contains a command injection
vulnerability that ...)
TODO: check
CVE-2026-119408 (n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1
contains ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-119407 (Element Web and Element Desktop before 1.12.32 accept guest
credential ...)
TODO: check
CVE-2026-119379 (SQLite before 3.54.0 built with the session extension
contains a heap ...)
@@ -489,15 +489,15 @@ CVE-2026-119372 (SQLite before 3.54.0 built with
FTS3/FTS4 and SQLITE_ENABLE_FTS
CVE-2026-119371 (SQLite before 3.54.0 contains a stack exhaustion
vulnerability that al ...)
TODO: check
CVE-2026-119370 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119369 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119368 (Missing Authorization vulnerability in Liquid Web / StellarWP
The Even ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119367 (Missing Authorization vulnerability in Liquid Web / StellarWP
The Even ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119365 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119364 (ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4
contains a link ...)
TODO: check
CVE-2026-119300 (Wekan is open source kanban built with Meteor. Prior to
11.11, the use ...)
@@ -517,21 +517,21 @@ CVE-2026-119288 (Zuke is a code-first, strongly typed
build automation system fo
CVE-2026-119287 (Zuke is a code-first, strongly typed build automation system
for Deno. ...)
TODO: check
CVE-2026-119176 (The CP Multi View Events Calendar plugin for WordPress is
vulnerable t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119148 (Incomplete string validation in AWS aws-nitro-enclaves-sdk-c
before 0. ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119147 (ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization
bypass i ...)
TODO: check
CVE-2026-119146 (ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer
overflow vulnera ...)
TODO: check
CVE-2026-119117 (Insertion of sensitive information into a log file in Amazon
Kinesis P ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119116 (A use-after-free and double-free issue in the SetClient
command handle ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119113 (The GeoDirectory \u2013 WP Business Directory Plugin and
Classified Li ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119086 (Missing queue-set type validation in the queue-set selection
system ca ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119038 (Business::GoCardless versions before 1.01 for Perl complete
redirect f ...)
TODO: check
CVE-2026-119037 (Business::GoCardless versions before 1.01 for Perl accept
forged webho ...)
@@ -563,17 +563,17 @@ CVE-2026-118697 (In JetBrains Toolbox App before 3.9.1
and 3.8.2; IntelliJ IDEA
CVE-2026-118696 (In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and
WebStorm b ...)
TODO: check
CVE-2026-118635 (The The GeoDirectory \u2013 WP Business Directory Plugin and
Classifie ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118238 (The Tenda W18E web management server is vulnerable to OS
command injec ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-118205 (The Essential Addons for Elementor \u2013 Popular Elementor
Templates ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118090 (Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118089 (Shop manager PHP Object Injection in Product Feed Manager <=
7.14.1 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118086 (Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-117350 (Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable
to an OO ...)
TODO: check
CVE-2026-117349 (Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable
to an OO ...)
@@ -589,33 +589,33 @@ CVE-2026-117182 (An authenticated cross-site scripting
(XSS) vulnerability in th
CVE-2026-117028 (Skuul School Management System through version 2.6.5 is
vulnerable to ...)
TODO: check
CVE-2026-116862 (Unauthenticated Broken Access Control in WP REST Cache <=
2026.3.1 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116861 (Unauthenticated Sensitive Data Exposure in Flexible Chat <=
1.1.0 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116860 (Missing Authorization vulnerability in Arraytics Timetics
timetics all ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116854 (Subscriber Cross Site Scripting (XSS) in WP Customer Area <=
8.4.0 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116853 (Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116852 (Author Remote Code Execution (RCE) in Widget Options <= 4.2.5
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116851 (Unauthenticated Cross Site Scripting (XSS) in eCommerce
Product Catalo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116847 (Unauthenticated Cross Site Scripting (XSS) in Mang Board WP
<= 2.4.6 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116552 (The Like Button Rating \u2665 LikeBtn plugin for WordPress is
vulnerab ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116410 (Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS
<= 3.4.3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116407 (Missing Authorization vulnerability in Webba Plugins Webba
Booking web ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116405 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <=
1.4.9 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116401 (Unauthenticated Broken Access Control in HUSKY <= 1.4.6
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116386 (Unauthenticated Privilege Escalation in SMS Alert Order
Notifications ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116366 (An issue has been discovered in ClickHouse Server that, under
certain ...)
TODO: check
CVE-2026-116130 (HTTP::Parser::XS versions before 0.18 for Perl truncate
PATH_INFO at a ...)
@@ -625,27 +625,27 @@ CVE-2026-116128 (Starlet versions from 0.20 before 0.33
for Perl allow memory ex
CVE-2026-116127 (Starlet versions before 0.33 for Perl send a body in
responses to HEAD ...)
TODO: check
CVE-2026-115947 (Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115869 (The Themify Builder plugin for WordPress is vulnerable to
Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115866 (Starlet versions from 0.20 before 0.33 for Perl allow CPU
exhaustion v ...)
TODO: check
CVE-2026-115865 (Starlet versions before 0.33 for Perl allow a request
declaring a larg ...)
TODO: check
CVE-2026-115820 (The Majestic Support \u2013 The Leading-Edge Help Desk &
Customer Supp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115604 (Subscriber Arbitrary File Deletion in SureDash <= 1.12.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115456 (A flaw was found in gcc. An attacker could cause a Denial of
Service ( ...)
TODO: check
CVE-2026-115455 (A flaw was found in GCC libstdc++. When an application
extracts data i ...)
TODO: check
CVE-2026-115346 (The Avada | Website Builder For WordPress & WooCommerce theme
for Word ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115274 (Improper Validation of Specified Quantity in Input
vulnerability in th ...)
TODO: check
CVE-2026-114711 (Subscriber Cross Site Scripting (XSS) in MultiVendorX <=
5.0.20 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114691 (A flaw was found in the libstdc++ component of GCC. An
attacker who ca ...)
TODO: check
CVE-2026-114690 (A flaw was found in GCC. An out-of-bounds memory access
vulnerability ...)
@@ -657,27 +657,27 @@ CVE-2026-112816 (Improper certificate validation in the
HTTPS listener in Canoni
CVE-2026-112374 (FOSSBilling before 0.8.9 contains a Cross-Site Request
Forgery vulnera ...)
TODO: check
CVE-2026-112365 (The easy.jobs \u2013 AI powered Job Listing, Job Board,
Career Page, R ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112348 (Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA
bypass vu ...)
TODO: check
CVE-2026-112347 (Kirki plugin for WordPress before 6.4.1 contains a broken
object-level ...)
TODO: check
CVE-2026-111505 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111504 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111503 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111502 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Insuf ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111501 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111500 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
a Missin ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111499 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Incor ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111498 (OpenManage Enterprise, versions prior to 4.8.0, contains an
Improper R ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111487 (An out-of-bounds write vulnerability in the Qt Framework
assimp scene ...)
TODO: check
CVE-2026-110972 (P\u0142atnik performs client-side authentication. An attacker
with acc ...)
@@ -689,41 +689,41 @@ CVE-2026-110970 (P\u0142atnikuses HTTP protocol to
downloadupdates, libraries an
CVE-2026-110799 (Vvveb is a powerful and easy to use CMS with page builder to
build web ...)
TODO: check
CVE-2026-110533 (The FV Flowplayer Video Player plugin for WordPress is
vulnerable to S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110305 (The Advanced Custom Fields: Extended plugin for WordPress is
vulnerabl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110001 (The FV Flowplayer Video Player plugin for WordPress is
vulnerable to S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109984 (The FV Flowplayer Video Player plugin for WordPress is
vulnerable to S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109821 (Improper Validation of Specified Quantity in Input
vulnerability in th ...)
TODO: check
CVE-2026-109592 (The OpenStation: Desktop Windows, Dock & Virtual Desktops for
WP Admin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107868 (Unauthenticated Bypass Vulnerability in YITH WooCommerce
Product Add-O ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-107630 (The Email Templates Customizer and Designer for WordPress and
WooComme ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105924 (A NULL pointer dereference vulnerability in the Qt QCborValue
to JSON ...)
TODO: check
CVE-2026-105894 (The Ak Framework plugin for WordPress, included in the Newsy
- Viral N ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105456 (RTIR extends RT's HTML scrubber to allow an internal link
placeh ...)
TODO: check
CVE-2026-105455 (RTIR's ticket creation forms show the subject of the related
tic ...)
TODO: check
CVE-2026-105077 (Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <=
2.8.19 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104744 (The Independent Analytics Pro plugin for WordPress is
vulnerable to St ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104739 (The JS Help Desk \u2013 AI-Powered Support & Ticketing System
plugin f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104674 (Missing Authorization vulnerability in Arraytics Booktics
booktics all ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104623 (A security vulnerability exists in the authorization handling
for the ...)
- TODO: check
+ NOT-FOR-US: SuSE software not packaged in Debian
CVE-2026-104615 (A security vulnerability was discovered in SUSE Rancher
Fleet's cluste ...)
- TODO: check
+ NOT-FOR-US: SuSE software not packaged in Debian
CVE-2026-104067 (Scribus before 1.6.7 contains an out-of-bounds memory access
vulnerabi ...)
TODO: check
CVE-2026-104066 (Scribus before 1.6.7 contains a heap buffer overflow
vulnerability in ...)
@@ -739,21 +739,21 @@ CVE-2026-104062 (Scribus before 1.6.7 contains a heap
buffer overflow vulnerabil
CVE-2026-104061 (Scribus before 1.6.7 contains a heap out-of-bounds write
vulnerability ...)
TODO: check
CVE-2026-102918 (The Redux Framework plugin for WordPress is vulnerable to
Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102905 (The The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin
for WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101214 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-101213 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-101210 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-101209 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains
a Server ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-100355 (Campfire is a web-based chat application. In version 1.4.4
and earlier ...)
TODO: check
CVE-2025-8574 (The Database Cleaner plugin for WordPress is vulnerable to
arbitrary t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-68395 (ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a
note editor ...)
TODO: check
CVE-2025-68394 (ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable
to SQL ...)
@@ -767,11 +767,11 @@ CVE-2025-68391 (ARKETEAM Protectel modulesPROTECTELMAJ
andBDF are vulnerable to
CVE-2025-49602 (An issue was discovered in Keyfactor EJBCA 9. When an
administrator is ...)
TODO: check
CVE-2025-31704 (A vulnerability has been found in the Dahua Intelligent
Connection Cen ...)
- TODO: check
+ NOT-FOR-US: Dahua
CVE-2015-20130 (Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a
reflected c ...)
TODO: check
CVE-2010-20125 (DedeCMS before 5.7 contains a file inclusion vulnerability in
plus/car ...)
- TODO: check
+ NOT-FOR-US: DedeCMS
CVE-2026-97645 (The Gravity Forms plugin for WordPress is vulnerable to Stored
Cross-S ...)
NOT-FOR-US: WordPress plugin
CVE-2026-96389 (Missing Authorization vulnerability in Drupal Xray Audit
allows Forcef ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ddf5bbc44ce993c652580148d7a624614dfe5737
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ddf5bbc44ce993c652580148d7a624614dfe5737
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
