Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ea3bfe08 by security tracker role at 2026-10-31T07:14:35+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,17 +1,17 @@
CVE-2026-95673
REJECTED
CVE-2026-94361 (The Payable Payment Gateway for WooCommerce WordPress plugin
before 1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92294 (The Spectra Gutenberg Blocks \u2013 Website Builder for the
Block Edit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90960 (The Seraphinite Accelerator plugin for WordPress is vulnerable
to Sens ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89270 (The Popup Builder \u2013 Create highly converting, mobile
friendly mar ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88942 (The Product Filter for WooCommerce by WBW plugin for WordPress
is vuln ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82214 (The Quick Event Manager WordPress plugin before 9.19 does not
verify t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-7005 (WIT SynApps Runtime through 1.4.11 contains a browser-mediated
cross-o ...)
TODO: check
CVE-2026-78403 (Stack-based buffer overflow and missing authorization
vulnerability in ...)
@@ -19,7 +19,7 @@ CVE-2026-78403 (Stack-based buffer overflow and missing
authorization vulnerabil
CVE-2026-78402 (Stack-based buffer overflow and out-of-bounds write
vulnerability in T ...)
TODO: check
CVE-2026-77152 (Improper Authorization vulnerability in Drupal Field
Collection for Dr ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-63414 (Shopify App is a Rails engine for building Shopify
applications. From ...)
TODO: check
CVE-2026-63410 (secp256k1-native is a native C secp256k1 implementation for
Ruby. In a ...)
@@ -163,15 +163,15 @@ CVE-2026-40573 (NovumOS is a custom 32-bit operating
system written in Zig and x
CVE-2026-16760 (In Trail of Bits fickling through 0.1.12, the
_process_import() method ...)
TODO: check
CVE-2026-120040 (The Mail logging & Catcher plugin for WordPress is vulnerable
to Sensi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-120019 (The W3 Total Cache plugin for WordPress is vulnerable to
Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11396 (The Product Filter for WooCommerce by WBW plugin for WordPress
is vuln ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119980 (The UsersWP \u2013 Front-end login form, User Registration,
User Profi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119977 (WordPress Core is vulnerable to Remote Code Execution in
versions 4.7 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119730 (Maxthon Browser for Android before 7.5.8.103 contains an
address bar s ...)
TODO: check
CVE-2026-119343 (Stirling-PDF is a locally hosted web application that
facilitates vari ...)
@@ -207,33 +207,33 @@ CVE-2026-119329 (Immich is a high-performance self-hosted
photo and video manage
CVE-2026-119328 (Immich is a high-performance self-hosted photo and video
management so ...)
TODO: check
CVE-2026-119166 (The Welcart e-Commerce plugin for WordPress is vulnerable to
Insecure ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119163 (The FunnelKit Automations \u2013 Email Marketing Automation
and CRM fo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119162 (The User Submitted Posts \u2013 Enable Users to Submit Posts
from the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119089 (The ThirstyAffiliates \u2013 Affiliate Links, Link Branding,
Link Trac ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119065 (The Shipping Zones by Drawing for WooCommerce plugin for
WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118938 (In Trail of Bits fickling through 0.1.12, a pickle
STACK_GLOBAL operan ...)
TODO: check
CVE-2026-118638 (The Mapster WP Maps WordPress plugin before 2.0.6 does not
perform any ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118629 (The All-in-One Video Gallery WordPress plugin before 5.0.0
does not c ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118438 (The Firelight Lightbox WordPress plugin before 2.3.24 does
not properl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118437 (The BuddyForms WordPress plugin before 2.10.1 does not
properly verify ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118185 (The Security Optimizer WordPress plugin before 1.6.9 does
not limit t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118184 (The Premium Packages WordPress plugin before 7.2.2 does not
prevent u ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118070 (The Welcart e-Commerce plugin for WordPress is vulnerable to
Stored Cr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118043 (The Bulk Media Register WordPress plugin before 2.01 does not
properly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-117666 (Improper Validation of Certificate with Host Mismatch
vulnerability in ...)
TODO: check
CVE-2026-117656 (Acceptance of Extraneous Untrusted Data With Trusted Data
vulnerabilit ...)
@@ -243,17 +243,17 @@ CVE-2026-117645 (Improper Neutralization of Input During
Web Page Generation ('C
CVE-2026-116755 (Improper Neutralization of Special Elements used in a Command
('Comman ...)
TODO: check
CVE-2026-116563 (The Photo Gallery, Sliders, Proofing and Themes \u2013
NextGEN Gallery ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116557 (The WP Booking System - Booking Calendar plugin for WordPress
is vulne ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116548 (The VikRentCar Car Rental Management System plugin for
WordPress is vu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116546 (The WP Job Portal \u2013 AI-Powered Recruitment System for
Company or ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116522 (The Relevanssi \u2013 A Better Search plugin for WordPress is
vulnerab ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116520 (The PPWP \u2013 Password Protect Pages plugin for WordPress
is vulnera ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116252 (pgAdmin 4's materialized view refresh passed the target
database's nam ...)
TODO: check
CVE-2026-116251 (pgAdmin 4 did not invalidate a user's existing sessions when
their pas ...)
@@ -285,51 +285,51 @@ CVE-2026-116239 (In server mode pgAdmin 4 keeps an
account per authentication so
CVE-2026-116238 (In server mode pgAdmin 4 locks an internal account after
MAX_LOGIN_ATT ...)
TODO: check
CVE-2026-115840 (The VikRentCar Car Rental Management System plugin for
WordPress is vu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115830 (In Secret Server versions earlier than 12.3.1, a user under
certain co ...)
- TODO: check
+ NOT-FOR-US: Delinea
CVE-2026-115829 (In Secret Server versions earlier than 12.3.1, a user could
bypass the ...)
- TODO: check
+ NOT-FOR-US: Delinea
CVE-2026-115828 (In Secret Server versions earlier than 12.3.1, Secret Server
did not a ...)
- TODO: check
+ NOT-FOR-US: Delinea
CVE-2026-111578 (The PDF Invoices & Packing Slips for WooCommerce WordPress
plugin from ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111477
REJECTED
CVE-2026-111254 (The W3 Total Cache plugin for WordPress is vulnerable to
Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111109 (The Webmention plugin for WordPress is vulnerable to Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110808 (The Essential Addons for Elementor WordPress plugin before
6.8.8 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110251 (The Photo Reviews for WooCommerce plugin for WordPress is
vulnerable t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110176 (The File Force Download module for Drupal 7 implements
hook_file_downl ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-110042 (The Payment Forms for Paystack WordPress plugin before 4.0.6
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109997 (The Ninja Forms \u2013 Contact Form Builder with Calculators,
Quizzes, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109386 (The Hustle \u2013 Email Marketing, Lead Generation, Optins,
Popups plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109234 (The Meow Lightbox plugin for WordPress is vulnerable to
Stored Cross-S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109220 (The PDF Invoice for WooCommerce + Drag and Drop Template
Builder plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109217 (The PDF Invoices & Packing Slips for WooCommerce plugin for
WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109213
REJECTED
CVE-2026-107765 (The Discussion Board \u2013 WordPress Forum Plugin plugin for
WordPres ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107750 (The PDF Invoices & Packing Slips for WooCommerce plugin for
WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107653 (The SureCart \u2013 Ecommerce Made Easy For Selling Physical
Products, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101326 (The The Ninja Forms \u2013 Contact Form Builder with
Calculators, Quiz ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100155 (The The Ninja Forms \u2013 Contact Form Builder with
Calculators, Quiz ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-XXXX [GHSA-6w3p-4pq7-j3mp: UEFI Secure Boot bypass via stack overflow
vulnerability in signed fwupd EFI application]
- fwupd-efi 1:1.9-1
NOTE:
https://github.com/fwupd/fwupd-efi/security/advisories/GHSA-6w3p-4pq7-j3mp
@@ -381,7 +381,7 @@ CVE-2026-76012 (The Photo Gallery, Sliders, Proofing and
Themes \u2013 NextGEN G
CVE-2026-75882 (An improper access control vulnerability in ESET Endpoint
Encryption a ...)
TODO: check
CVE-2026-73322 (Incorrect Authorization vulnerability in the single-stage
query engine ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73186 (Subscriber PHP Object Injection in Enable Media Replace <=
4.2.2 versi ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-69446 (Incorrect authorization in Microsoft Edge (Chromium-based)
allows an a ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ea3bfe08bbc9e854f913587f3fc84728705025fb
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ea3bfe08bbc9e854f913587f3fc84728705025fb
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
