Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
adf587f3 by security tracker role at 2026-11-06T07:14:56+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -11,9 +11,9 @@ CVE-2026-97371 (ntopng is a web-based network traffic
monitoring application. Pr
CVE-2026-97367 (A flaw was found in the Keycloak Account REST API where it
incorrectly ...)
TODO: check
CVE-2026-97356 (External Control of File Name or Path vulnerability in the
ViewFile co ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-97355 (Use of Hard-coded Password vulnerability in the AdminServer
component ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-97175 (A flaw was found in the idp-auto-link authenticator of the
keycloak-se ...)
TODO: check
CVE-2026-97174 (A flaw was found in the Client-Initiated Backchannel
Authentication (C ...)
@@ -37,7 +37,7 @@ CVE-2026-93998 (A flaw was found in the SAML adapter
component of Keycloak, whic
CVE-2026-93424 (FastNetMon is a high-performance DDoS detector and sensor. In
version ...)
TODO: check
CVE-2026-92887 (Incorrect default value in the REST API framework's .rest.xml
definiti ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-92857 (Keycloak provides a Dynamic Client Registration feature that
allows us ...)
TODO: check
CVE-2026-92856 (A flaw was found in the SAML brokering component of Keycloak,
an ident ...)
@@ -55,9 +55,9 @@ CVE-2026-92694 (FastNetMon is a high-performance DDoS
detector and sensor. In ve
CVE-2026-92693 (FastNetMon is a high-performance DDoS detector and sensor. In
version ...)
TODO: check
CVE-2026-92396 (The ShopEngine Gutenberg WooCommerce Builder Blocks Addon
WordPress p ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89142 (In the Wi-Fi NPU FW, there is a possible out-of-bounds write
due to an ...)
- TODO: check
+ NOT-FOR-US: Airoha
CVE-2026-88986 (Kubeflow Pipelines enables users to build and deploy portable,
scalabl ...)
TODO: check
CVE-2026-88985 (Kubeflow Pipelines enables users to build and deploy portable,
scalabl ...)
@@ -75,13 +75,13 @@ CVE-2026-88980 (Kubeflow Pipelines enables users to build
and deploy portable, s
CVE-2026-88979 (Kubeflow Pipelines enables users to build and deploy portable,
scalabl ...)
TODO: check
CVE-2026-87784 (The Cool Media Filter WordPress plugin through 1.0.1 does not
perform ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87008 (Code Graph RAG is an AI-powered knowledge graph and retrieval
system f ...)
TODO: check
CVE-2026-86606 (The iubenda | All-in-one Compliance for GDPR / CCPA Cookie
Consent + m ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85627 (Improper Neutralization of Special Elements Used in a Template
Engine ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85287 (HomeBox is a home inventory and organization system. Prior to
0.27.0, ...)
TODO: check
CVE-2026-85286 (HomeBox is a home inventory and organization system. Prior to
0.27.0, ...)
@@ -91,13 +91,13 @@ CVE-2026-85076 (Cronicle is a multi-server task scheduler
and runner, with a web
CVE-2026-85068 (Network UPS Tools is a collection of programs which provide a
common i ...)
TODO: check
CVE-2026-84728 (Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08
on all ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-84183 (Incorrect Authorization in the updateLayout simple-method in
applicati ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-83542 (Improper Control of Generation of Code ('Code Injection') in
Apache OF ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-83538 (Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on
all pla ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-83494 (A flaw was found in the training-operator. An incorrect object
casting ...)
TODO: check
CVE-2026-83493 (A flaw was found in distributed-workloads. A remote attacker
could exp ...)
@@ -105,35 +105,35 @@ CVE-2026-83493 (A flaw was found in
distributed-workloads. A remote attacker cou
CVE-2026-82965 (A flaw was found in the SAML implementation of Keycloak, an
open-sourc ...)
TODO: check
CVE-2026-82960 (Improper Control of Generation of Code ('Code Injection') in
ModelForm ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82916 (Missing Authorization in XmlDsDump in Apache OFBiz 24.09
before 24.09. ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82912 (Improper Neutralization of Special Elements Used in an
Expression Lang ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82910 (Improper Neutralization of Special Elements Used in a Template
Engine ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82907 (Authentication Bypass by Capture-replay in
ExternalLoginKeysManager in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82904 (Uncontrolled Resource Consumption in ServiceMultiEventHandler
in Apach ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82902 (Server-Side Request Forgery in ViewDataFile in Apache OFBiz
24.09 befo ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82894 (Improper Authorization in ContentWorker in Apache OFBiz 24.09
before 2 ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-82413 (ntopng is a web-based network traffic monitoring application.
Prior to ...)
TODO: check
CVE-2026-81828 (Server-Side Request Forgery in SurveyWrapper in Apache OFBiz
24.09 bef ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-81816 (XML External Entity (XXE) Injection in ContentWorker in Apache
OFBiz 2 ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-81815 (SQL Injection in the entity engine's generic performFind
service in Ap ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-81808 (Missing Authorization in ProductSearchEvents in Apache OFBiz
24.09 bef ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-81744 (Incorrect Authorization in ContentPermissionServices in Apache
OFBiz 2 ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-81734 (Missing Authorization in ProductEvents in Apache OFBiz 24.09
before 24 ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-81190 (KurrentDB is a database engineered for modern software
applications an ...)
TODO: check
CVE-2026-77622 (Sliver is a command and control framework. Prior to 1.7.6, an
HTTP(S) ...)
@@ -149,15 +149,15 @@ CVE-2026-77439 (Immich is a self-hosted photo and video
management solution. Pri
CVE-2026-77299 (Regexp2 is a feature-rich RegExp engine for Go. Prior to
version 2.3.0 ...)
TODO: check
CVE-2026-76580 (Improper neutralization of input during web page generation
('cross-si ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2026-76563 (Improper neutralization of Script-Related HTML tags in a web
page (bas ...)
TODO: check
CVE-2026-76181 (LibreOffice includes a dBASE database driver, which reads
dBASE tables ...)
TODO: check
CVE-2026-76152 (Path traversal and missing authorization check in the
imageCrop and im ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-76150 (Path traversal and missing authorization check in the
replaceImageToEx ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-76077 (ASN1SCC is an open source ASN.1 compiler for embedded systems.
Prior t ...)
TODO: check
CVE-2026-75615 (ASN1SCC is an open source ASN.1 compiler for embedded systems.
Prior t ...)
@@ -167,13 +167,13 @@ CVE-2026-75614 (ASN1SCC is an open source ASN.1 compiler
for embedded systems. P
CVE-2026-75599 (HomeBox is a home inventory and organization system. Prior to
0.27.0, ...)
TODO: check
CVE-2026-74841 (In multitenant deployments, ContextFilter and LoginWorker
built a per- ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73580 (Missing authorization check in the getHRChild service in
Apache OFBiz ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73578 (Missing authorization enforcement in RequestHandler.renderView
in Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73577 (Incorrect authorization in RequestHandler in Apache OFBiz
24.09 before ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73473 (A flaw was found in GStreamer gst-plugins-good (avidemux). In
the subi ...)
TODO: check
CVE-2026-73472 (A flaw was found in GStreamer gst-plugins-good (avidemux). In
the supe ...)
@@ -195,7 +195,7 @@ CVE-2026-73098 (Improper control of dynamically-loaded code
vulnerability in Apa
CVE-2026-73095 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
TODO: check
CVE-2026-71901 (Improper Control of Resource Identifiers ('Resource
Injection') vulner ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71550 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
TODO: check
CVE-2026-71548 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
@@ -225,13 +225,13 @@ CVE-2026-69135 (SuiteCRM is an open-source,
enterprise-ready Customer Relationsh
CVE-2026-69134 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
TODO: check
CVE-2026-68524 (An unauthenticated attacker can exploit temporary-file
handling, acces ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-68509 (FairEmail is a fully featured, open source, privacy-friendly
email app ...)
TODO: check
CVE-2026-66903 (Authenticated Path Traversal in Catalog Image Management
allows writin ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-65983 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-63774 (Insufficient input validation in the PowerSYSTEM Center report
designe ...)
TODO: check
CVE-2026-63218 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
@@ -297,23 +297,23 @@ CVE-2026-48705 (MONAI (Medical Open Network for AI) is an
AI toolkit for health
CVE-2026-46350 (dcmjs is a JavaScript implementation of DICOM manipulation.
Prior to 0 ...)
TODO: check
CVE-2026-44875 (In HPE Cray Programming Environment versions 25.03 and 25.09,
prior to ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-34157 (Wails is a framework for building desktop applications using
Go and we ...)
TODO: check
CVE-2026-33944 (Dolibarr is an open-source enterprise resource planning and
customer r ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-1339 (An Open Redirect vulnerability has been identified in
OpenText\u2122 U ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2026-19688 (A flaw was found in the Admin REST API of Keycloak, an
identity and ac ...)
TODO: check
CVE-2026-19134 (A vulnerability in OpenText OpenText Directory Services (OTDS)
allows ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2026-18159 (A vulnerability in OpenText OpenText Directory Services (OTDS)
on Wind ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2026-16579
REJECTED
CVE-2026-12967 (The WCFM Membership WordPress plugin before 2.12.1 does not
verify th ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-123273 (ImageMagick before 7.1.2-35 and 6.9.13-60 contains an
infinite loop vu ...)
TODO: check
CVE-2026-123272 (Mark3labs mcp-go before v1.2.1 contains an improper
validation vulnera ...)
@@ -351,7 +351,7 @@ CVE-2026-123197 (WPPConnect Server through 2.10.76 contains
a missing authentica
CVE-2026-123196 (Authorizer before 2.4.2 contains a password reset poisoning
vulnerabil ...)
TODO: check
CVE-2026-123184 (An incorrect authorization vulnerability exists in the Altium
365 Git ...)
- TODO: check
+ NOT-FOR-US: Altium
CVE-2026-123158 (sshd in OpenSSH before 10.6p2 on Linux, when musl libc is
used without ...)
TODO: check
CVE-2026-123151 (A flaw was found in the GNU debugger (GDB). When GDB connects
to a rem ...)
@@ -369,9 +369,9 @@ CVE-2026-123095 (mpv 0.29.0 before 0.42.0 contains a
playlist injection vulnerab
CVE-2026-123094 (Huginn before 2026.11.05 contains a stored cross-site
scripting vulner ...)
TODO: check
CVE-2026-123059 (In Eclipse BaSyx Helm Charts version 2.2.0 of the
`aas-basyx-v2-full` ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-123047 (In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of
the `bas ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-123037 (A flaw was found in the ansible-core user module. When
generate_ssh_ke ...)
TODO: check
CVE-2026-123036 (A flaw was found in ansible-core. When a task marked `no_log:
true` fa ...)
@@ -421,7 +421,7 @@ CVE-2026-121994 (A stack buffer overflow in the GDB
client's remote protocol han
CVE-2026-121949 (The Symfony HtmlSanitizer component does not apply the media
URL polic ...)
TODO: check
CVE-2026-121837 (A flaw was found in the REST Data Panache component of
Quarkus. When a ...)
- TODO: check
+ NOT-FOR-US: Red Hat software not packaged in Debian
CVE-2026-121489 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
TODO: check
CVE-2026-121139 (The Rapid7 Metasploitmsf-wssuffers from a missing
authentication vulne ...)
@@ -433,7 +433,7 @@ CVE-2026-120749 (A flaw was found in D-Bus. With a
privileged Monitoring client
CVE-2026-120499 (h5io before 0.2.6 contains a code injection vulnerability in
read_hdf5 ...)
TODO: check
CVE-2026-120408 (The All-in-One Video Gallery WordPress plugin before 5.1.0
does not e ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119757 (BTCPay Server before 2.4.2, including 2.4.2 release
candidates, contai ...)
TODO: check
CVE-2026-119751 (Content Egg plugin for WordPress before 12.1.0 contains a
broken acces ...)
@@ -443,37 +443,37 @@ CVE-2026-119744 (Cendio ThinLinc contains an improper
authentication vulnerabili
CVE-2026-119434 (Improper Handling of Highly Compressed Data (Data
Amplification) vulne ...)
TODO: check
CVE-2026-119433 (A server-side request forgery (SSRF) vulnerability exists in
an undocu ...)
- TODO: check
+ NOT-FOR-US: Foxit
CVE-2026-119432 (A stored cross-site scripting (XSS) vulnerability exists in
the Foxit ...)
- TODO: check
+ NOT-FOR-US: Foxit
CVE-2026-119431 (A server-side request forgery (SSRF) vulnerability exists in
Foxit Wor ...)
- TODO: check
+ NOT-FOR-US: Foxit
CVE-2026-119345 (Cocos AI is a confidential computing system for AI. Prior to
0.9.0, Co ...)
TODO: check
CVE-2026-119344 (Cocos AI is a confidential computing system for AI. In
version 0.8.2 a ...)
TODO: check
CVE-2026-119259 (The All-in-One Video Gallery WordPress plugin before 5.1.0
does not c ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119083 (Path traversal in the archive extraction utility in GluonTS
before 0.1 ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-118869 (An OS command injection vulnerability exists in SHIRASAGI,
which may a ...)
TODO: check
CVE-2026-118639 (The Surfer WordPress plugin before 1.8.1.759 discloses a
sensitive AP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118494 (Joomla Extension - jreviews.com - Secret configs cached in a
web-acces ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-118239 (The AutomatorWP WordPress plugin before 6.0.7 does not check
that the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118188 (The PublishPress Revisions: Duplicate Posts, Submit, Approve
and Sched ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118187 (The PublishPress Revisions: Duplicate Posts, Submit, Approve
and Sched ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118186 (The PublishPress Revisions: Duplicate Posts, Submit, Approve
and Sched ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118167 (The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does
not valid ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118045 (The Ever Accounting WordPress plugin before 2.3.3 does not
restrict t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-117691 (A flaw was found in the SAML HTTP-Redirect binding
implementation of K ...)
TODO: check
CVE-2026-117679 (A cross-site scripting vulnerability exists in SHIRASAGI,
which may al ...)
@@ -519,7 +519,7 @@ CVE-2026-116568 (FreeSWITCH is a Software Defined Telecom
Stack enabling the dig
CVE-2026-116567 (FreeSWITCH is a Software Defined Telecom Stack enabling the
digital tr ...)
TODO: check
CVE-2026-116533 (The Static Snapshot WordPress plugin through 0.2.1 does not
sanitise s ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116472 (A security issue was discovered in ingress-nginx where a user
with per ...)
TODO: check
CVE-2026-115928 (FreeSWITCH is a Software Defined Telecom Stack enabling the
digital tr ...)
@@ -531,43 +531,43 @@ CVE-2026-115739 (Hard-coded Cryptographic Key
vulnerability exists in the DLP on
CVE-2026-115738 (SQL injection vulnerability in DLP on-prem extensions version
11.13.1 ...)
TODO: check
CVE-2026-115673 (The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin
before 6.91 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115573 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-115452 (Joomla Extension - tassos.gr - Privileged stored XSS in
Advanced Custo ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-115451 (Joomla Extension - tassos.gr - File deletion through improper
access c ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-115230 (The WHIZZ WordPress plugin through 1.1.8 does not validate
the passwor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114604 (GraphQL Tools provides utilities for building, stitching, and
mocking ...)
TODO: check
CVE-2026-114427 (The GutenKit WordPress plugin before 2.5.5 does not properly
sanitize ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114366 (An information disclosure vulnerability in the Qt Framework
QWebSocket ...)
TODO: check
CVE-2026-114277 (Authentication bypass by Assumed-Immutable data vulnerability
in Apach ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-114272 (Authorization Bypass Through User-Controlled Key in the
content viewin ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-114271 (Authorization Bypass Through User-Controlled Key in the
shopping list ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-114235 (Direct Request ('Forced Browsing') in the Order component in
Apache OF ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-114233 (Incorrect Privilege Assignment in the Order Manager in Apache
OFBiz24. ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-114232 (A flaw was found in the UserManagedPermissionService of the
Keycloak a ...)
TODO: check
CVE-2026-114229 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-114134 (Black is the uncompromising Python code formatter. Prior to
26.10.1, t ...)
TODO: check
CVE-2026-113663 (AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1,
and from a ...)
TODO: check
CVE-2026-113615 (The GS JWT Authentication for WP REST API WordPress plugin
through 1.0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113584 (The placester WordPress plugin through 1.4.3 does not perform
any capa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112938 (filelock is a platform-independent file lock for Python. From
3.30.0 u ...)
TODO: check
CVE-2026-112913 (filelock is a platform-independent file lock for Python. From
3.20.4 u ...)
@@ -619,51 +619,51 @@ CVE-2026-111253 (A flaw was found in dnf5daemon-server.
Session methods on dynam
CVE-2026-111062 (russh is a Rust SSH client and server library. From version
0.34.0-bet ...)
TODO: check
CVE-2026-110955 (The Wurdey WordPress plugin through 1.0.0 does not verify a
request si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110932 (A flaw was found in the theme resource endpoint of Keycloak,
an open-s ...)
TODO: check
CVE-2026-110931 (A flaw was found in the SAML 1.1 assertion parser of
Keycloak, a tool ...)
TODO: check
CVE-2026-110930 (Codex Desktop for Windows does not correctly check quotation
marks in ...)
- TODO: check
+ NOT-FOR-US: OpenAI
CVE-2026-110813 (The Advanced Custom Fields (ACF\xae) WordPress plugin before
6.8.11 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110802 (Altair is a GraphQL client for all platforms. From 7.2.4
until 8.5.8, ...)
TODO: check
CVE-2026-110532 (The Mail Mage WordPress plugin through 0.0.25 does not
properly saniti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110525 (The MCB WordPress plugin through 1.0.0 does not sanitise or
escape re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110390 (Missing authentication in the FlexNet Beacon component of
Flexera One ...)
- TODO: check
+ NOT-FOR-US: Flexera
CVE-2026-109928 (Incorrect Implementation of Authentication Algorithm in the
password-r ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-109856 (Direct Request ('Forced Browsing') to Financial Account
services in Ap ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-109837 (Authorization Bypass Through User-Controlled Key in Order
Returns in A ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-109408 (vault-java-driver, a Java client for HashiCorp Vault,
silently disable ...)
TODO: check
CVE-2026-109129 (Authorization Bypass Through User-Controlled Key in the Order
Manager ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-109081 (A flaw was found in Keycloak. The Dynamic Client Registration
(DCR) en ...)
TODO: check
CVE-2026-107912 (A flaw was found in the management interface of the Quarkus
framework, ...)
TODO: check
CVE-2026-107903 (Joomla Extension - balbooa.com - Stored XSS in reviews via
inconsisten ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-107776 (The Dokan WordPress plugin before 5.3.3 does not reconcile
the amount ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107602 (A flaw was found in the SAML 1.1 XML parsing logic of
Keycloak, an ope ...)
TODO: check
CVE-2026-107492
REJECTED
CVE-2026-107359 (Improper input validation in the beacon handler for WF200
firmware ver ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-107130 (Joomla Extension - balbooa.com - Unauthenticated deletion of
submissio ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-107129 (Joomla Extension - balbooa.com - Unauthenticated arbitrary
file deleti ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-107124 (A flaw was found in the OIDC logout endpoint of the
keycloak-services ...)
TODO: check
CVE-2026-107123 (A flaw was found in the SAML XML processing component of
Keycloak, an ...)
@@ -677,13 +677,13 @@ CVE-2026-106714 (Chewy for Android version 26.23.0 does
not adequately validate
CVE-2026-106713 (An issue in FreeReels for Android version 2.3.11 allows a
remote attac ...)
TODO: check
CVE-2026-105607 (Joomla Extension - balbooa.com - Unauthenticated stored XSS
in the "Re ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-105461 (Missing check forORDERMGR_UPDATEin ordermgr allows user with
only ORDE ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-105330 (Use of Hard-coded Cryptographic Key in JWT token
authentication in Apa ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-105325 (Missing check forACCOUNTING_UPDATE / ACCOUNTING_CREATEin
accounting in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-105321 (Improper neutralization of special elements used in an SQL
command ('S ...)
TODO: check
CVE-2026-104867 (Immich is a high-performance self-hosted photo and video
management so ...)
@@ -691,43 +691,43 @@ CVE-2026-104867 (Immich is a high-performance self-hosted
photo and video manage
CVE-2026-104720 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
TODO: check
CVE-2026-104139 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-104138 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-104137 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-104136 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-104135 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-104134 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-104133 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-103939 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-103938 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-103935 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-103866 (Inconsistent interpretation of HTTP requests ('HTTP
Request/Response s ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103864 (Improper output neutralization for logs in Apache Sling
Engine. Thi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103863 (Improper neutralization of input during web page generation
('cross-si ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103112 (A flaw was found in the authentication session handling of
the keycloa ...)
TODO: check
CVE-2026-103021 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-103020 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-103019 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-102943 (Dagu is a workflow engine with a built-in Web user interface.
Prior to ...)
TODO: check
CVE-2026-102940 (OpenEMR is a free and open source electronic health records
and medica ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-102927 (HedgeDoc is an open source, real-time collaborative markdown
notes app ...)
TODO: check
CVE-2026-102739 (ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior
to 3.0.0- ...)
@@ -753,11 +753,11 @@ CVE-2026-100359 (SuiteCRM is an open-source,
enterprise-ready Customer Relations
CVE-2026-100358 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
TODO: check
CVE-2026-100228 (Improper Input Validation in Order Returns in Apache OFBiz
24.09.07 on ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-100168 (Direct Request ('Forced Browsing') in the Content Manager
component in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-100109 (The Security For WooCommerce WordPress plugin from 1.0.10 to
1.0.16 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-71458 (FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through
3.13.2 an ...)
TODO: check
CVE-2023-51466
@@ -1301,7 +1301,7 @@ CVE-2026-102340 (Telepresence enables local development
against a remote Kuberne
CVE-2026-102339 (Telepresence enables local development against a remote
Kubernetes or ...)
TODO: check
CVE-2026-102337 (Webmin is a web-based system administration tool for
Unix-like servers ...)
- TODO: check
+ NOT-FOR-US: Webmin
CVE-2026-102280 (Sandboxie-Plus is an open source sandbox-based isolation
software for ...)
TODO: check
CVE-2026-100144 (The IVPAY payments WordPress plugin through 1.0.8 does not
sanitise a ...)
@@ -1618,7 +1618,7 @@ CVE-2026-106554 (One CBOR-parsing issue in
jackson-dataformats-binary's CBOR mod
CVE-2026-104799 (The Mobile builder plugin for WordPress is vulnerable to
Privilege Esc ...)
NOT-FOR-US: WordPress plugin
CVE-2026-103582 (Unbounded memory allocation and missing frame size validation
in Apach ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-102345 (Zammad is a web based open source helpdesk/customer support
system. Pr ...)
- zammad <itp> (bug #841355)
CVE-2026-100408 (Git for Windows is the Windows port of Git. From
2.43.0.windows.1 unti ...)
@@ -2848,7 +2848,7 @@ CVE-2026-101166 (The Mollie Payments for WooCommerce
WordPress plugin before 8.2
CVE-2026-101165 (The Mollie Payments for WooCommerce WordPress plugin before
8.2.0 does ...)
NOT-FOR-US: WordPress plugin
CVE-2026-100493 (An integer overflow in the DDS RGB888 loader of AMD
Compressonator SDK ...)
- TODO: check
+ NOT-FOR-US: AMD
CVE-2025-71452 (Vembu BDRSuite before 7.6.0 contains an unauthenticated
cross-site scr ...)
TODO: check
CVE-2025-71451 (Vembu BDRSuite before 7.6.0 contains an unauthenticated
cross-site scr ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/adf587f3323d33f0a7caebc0e2a8aa52953ed985
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/adf587f3323d33f0a7caebc0e2a8aa52953ed985
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
