Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b43a4c76 by Salvatore Bonaccorso at 2026-11-04T20:56:45+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3,75 +3,75 @@ CVE-2026-97705 (Moleculer is a progressive microservices
framework for Node.js.
CVE-2026-97701 (Zulip is an open-source team collaboration tool. In Zulip
Server versi ...)
TODO: check
CVE-2026-97397 (The Remove Google Fonts \u2013 Disable, Block, or Replace with
Bunny F ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95649 (IRISPowerscan insufficiently restrict the use of untrusted
scripts. An ...)
- TODO: check
+ NOT-FOR-US: Canon
CVE-2026-94460 (IRISPowerscan contain an insecure default configuration where
the buil ...)
- TODO: check
+ NOT-FOR-US: Canon
CVE-2026-94459 (IRISPowerscan contain default user accounts with predictable
credentia ...)
- TODO: check
+ NOT-FOR-US: Canon
CVE-2026-93900 (The Simple CAPTCHA with Cloudflare Turnstile plugin for
WordPress is v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92704 (SharpEmu is an experimental PlayStation 5 emulator for Windows
and Lin ...)
TODO: check
CVE-2026-91168 (Warpgate is an open source SSH, HTTPS, and MySQL bastion host
for Linu ...)
- TODO: check
+ NOT-FOR-US: Warpgate
CVE-2026-91163 (Warpgate is an open source SSH, HTTPS, and MySQL bastion host
for Linu ...)
- TODO: check
+ NOT-FOR-US: Warpgate
CVE-2026-90634 (An uncontrolled memory access in the PDF import code of Apache
OpenOff ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-90632 (Apache OpenOffice documents can include multimedia content
(audio, vid ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-90631 (Apache OpenOffice documents can contain links. A missing
Authorization ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-90629 (An uncontrolled memory access in the WMF import code of Apache
OpenOff ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-90628 (An uncontrolled memory access in the PDF export code of Apache
OpenOff ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-90627 (The flat file database driver in Apache Openoffice versions
through 4. ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-90626 (An uncontrolled memory access in the PDF import code of Apache
OpenOff ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-90624 (An unchecked memory access in the PDF import code of Apache
OpenOffice ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82033 (DeepSeek Harness prior to 0.1.2-alpha.2, and specifically
commit 3e240 ...)
TODO: check
CVE-2026-82029 (Invoice Ninja before 5.13.28 contains a broken access control
vulnerab ...)
TODO: check
CVE-2026-76506 (A vulnerability in the web-based management interface of Cisco
UCS Cen ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76419 (A vulnerability in the web-based management interface of Cisco
Unified ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-66736
REJECTED
CVE-2026-65555 (Incorrect Privilege Assignment vulnerability in Uncanny Owl
Uncanny To ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-63183 (OmniAuth is a flexible authentication system utilizing Rack
middleware ...)
TODO: check
CVE-2026-62126 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62007 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-59268 (An out-of-bounds Write vulnerability in Apache OpenOffice
versions thr ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-59267 (A crafted DXF document causes a heap buffer overflow in Draw
in Apache ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-59264 (The Windows installers of Apache OpenOffice 4.1.16 and earlier
allow a ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-59263 (A manipulated document opened in Apache OpenOffice 4.1.16 or
earlier m ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-57853 (DataGerry before 3.3.0 contains a server-side template
injection vulne ...)
TODO: check
CVE-2026-57775 (Authentication Bypass Using an Alternate Path or Channel
vulnerability ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57666 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57639 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56065 (Insertion of Sensitive Information into Externally-Accessible
File or ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54861 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39431 (On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the
API func ...)
TODO: check
CVE-2026-39430 (On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the
administrator a ...)
@@ -113,7 +113,7 @@ CVE-2026-121967 (Coder 2.28.0 before 2.29.22, 2.30.0 before
2.34.13, 2.35.0 befo
CVE-2026-121966 (Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends
ForwardAuth sub ...)
TODO: check
CVE-2026-121965 (Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5
contains a ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-121946 (zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6
contains a ...)
TODO: check
CVE-2026-121945 (CoopCycle coopcycle-web before 6.20.1 contains a broken
access control ...)
@@ -137,13 +137,13 @@ CVE-2026-121937 (loonflow before r3.2.3 contains a
missing authorization vulnera
CVE-2026-121936 (easyVoice before 0.0.23 contains a server-side request
forgery vulnera ...)
TODO: check
CVE-2026-121933 (A flaw has been found in Linksys E5350 1.0.00.037. This
impacts the fu ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2026-121932 (A vulnerability was detected in Linksys E5350 1.0.00.037.
This affects ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2026-121931 (A security vulnerability has been detected in Linksys WRT54GL
4.30.18. ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2026-121930 (A weakness has been identified in Linksys WRT54GL 4.30.18.
The affecte ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2026-121929 (A security flaw has been discovered in EmpireSoft EmpireCMS
up to 8.0. ...)
TODO: check
CVE-2026-121928 (A vulnerability was identified in InfiniFlow RAGFlow up to
0.27.2. Thi ...)
@@ -155,13 +155,13 @@ CVE-2026-121926 (A vulnerability was detected in yezhihao
jt808-server up to a07
CVE-2026-121925 (A stack-based buffer overflow in libsnowflakeclient and the
Snowflake ...)
TODO: check
CVE-2026-121640 (An Authentication Bypass by Capture-replay vulnerability in
WatchGuard ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-121639 (A Missing Authentication for Critical Function vulnerability
in WatchG ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-121638 (An Improper Certificate Validation vulnerability in
WatchGuard AuthPoi ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-121637 (An improper integrity validation vulnerability in WatchGuard
AuthPoint ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-121620 (CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a
missing authent ...)
TODO: check
CVE-2026-121373 (The Symfony HtmlSanitizer
componentMetaRefreshAttributeSanitizer, intr ...)
@@ -175,7 +175,7 @@ CVE-2026-121145 (This vulnerability exists in the iRA 2.0
and iRA.ev mobile appl
CVE-2026-121144 (This vulnerability exists in the iRA 2.0 and iRA.ev mobile
application ...)
TODO: check
CVE-2026-120554 (The Import and export users and customers plugin for
WordPress is vuln ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-120422 (Sogou Input Method for Windows contains a vulnerability in
the configu ...)
TODO: check
CVE-2026-120421 (In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0
through 4.1.19 ...)
@@ -193,13 +193,13 @@ CVE-2026-119746 (ProSoft Technology ICX35 devices
(X35-HWC-A and ICX35-HWC-E) co
CVE-2026-119745 (Sender plugin for WordPress before 2.11.3 contains a missing
authoriza ...)
TODO: check
CVE-2026-119481 (Incorrect Privilege Assignment vulnerability in Crocoblock
JetFormBuil ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119477 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119468 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119366 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118516 (The Symfony Routing componentsCompiledUrlMatcher and
UrlMatcherinterpr ...)
TODO: check
CVE-2026-118513 (Authentication bypass by spoofing
inX509AuthenticatorandX509Authentica ...)
@@ -209,7 +209,7 @@ CVE-2026-118391 (Allocation of Resources Without Limits or
Throttling vulnerabil
CVE-2026-115574 (Zulip is an open-source team collaboration tool. From 11.0
until 12.2, ...)
TODO: check
CVE-2026-115498 (The Slim Jetpack plugin for WordPress is vulnerable to Stored
Cross-Si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115474 (Zulip is an open-source team collaboration tool. From 8.0
until 12.2, ...)
TODO: check
CVE-2026-115448 (Uncontrolled recursion in Apache ZooKeeper. The server
serializes its ...)
@@ -265,7 +265,7 @@ CVE-2026-107479 (An integer truncation vulnerability in the
QTextCodec conversio
CVE-2026-106554 (One CBOR-parsing issue in jackson-dataformats-binary's CBOR
module: an ...)
TODO: check
CVE-2026-104799 (The Mobile builder plugin for WordPress is vulnerable to
Privilege Esc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103582 (Unbounded memory allocation and missing frame size validation
in Apach ...)
TODO: check
CVE-2026-102345 (Zammad is a web based open source helpdesk/customer support
system. Pr ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b43a4c762b1394d4b2402f4de0446a82ca9a7337
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b43a4c762b1394d4b2402f4de0446a82ca9a7337
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
