Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d09e4d8c by Salvatore Bonaccorso at 2026-11-06T09:08:30+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -9,7 +9,7 @@ CVE-2026-97848 (A flaw was found in the token sanitization
logic of Keycloak, an
CVE-2026-97847 (A flaw was found in the protocol mapper and identity
resolution compon ...)
- keycloak <itp> (bug #1088287)
CVE-2026-97377 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
- TODO: check
+ NOT-FOR-US: SuiteCRM
CVE-2026-97371 (ntopng is a web-based network traffic monitoring application.
Prior to ...)
- ntopng <removed>
NOTE:
https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7
@@ -25,7 +25,7 @@ CVE-2026-97175 (A flaw was found in the idp-auto-link
authenticator of the keycl
CVE-2026-97174 (A flaw was found in the Client-Initiated Backchannel
Authentication (C ...)
- keycloak <itp> (bug #1088287)
CVE-2026-96677 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-96547 (A flaw was found in the Dynamic Client Registration component
of Keycl ...)
- keycloak <itp> (bug #1088287)
CVE-2026-96460 (A flaw was found in the token exchange mechanism of Keycloak.
When usi ...)
@@ -35,9 +35,9 @@ CVE-2026-96453 (A flaw was found in the Keycloak Admin CLI
kcadm tool, which is
CVE-2026-96447 (A flaw was found in the TokenManager component of Keycloak, an
open-so ...)
- keycloak <itp> (bug #1088287)
CVE-2026-95652 (Execution with unnecessary privileges vulnerability in
T\xdcB\u0130TAK ...)
- TODO: check
+ NOT-FOR-US: pardus-usb-formatter
CVE-2026-94395 (A stack-based buffer overflow in Thales SafeNet Authentication
Client ...)
- TODO: check
+ NOT-FOR-US: Thales SafeNet Authentication Client (SAC) SIS
CVE-2026-93998 (A flaw was found in the SAML adapter component of Keycloak,
which is u ...)
- keycloak <itp> (bug #1088287)
CVE-2026-93424 (FastNetMon is a high-performance DDoS detector and sensor. In
version ...)
@@ -204,19 +204,19 @@ CVE-2026-73472 (A flaw was found in GStreamer
gst-plugins-good (avidemux). In th
CVE-2026-73471 (A flaw was found in GStreamer gst-plugins-good (avidemux). In
the Niko ...)
TODO: check
CVE-2026-73117 (Improper Neutralization of CRLF Sequences in HTTP Headers
('HTTP Respo ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73116 (Insufficiently Protected Credentials vulnerability in Apache
Juneau. ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73101 (Generation of Error Message Containing Sensitive Information
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73100 (Insertion of Sensitive Information into Log File vulnerability
in Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73099 (Cross-Site Request Forgery (CSRF) vulnerability in Apache
Juneau. The ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73098 (Improper control of dynamically-loaded code vulnerability in
Apache Ju ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73095 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71901 (Improper Control of Resource Identifiers ('Resource
Injection') vulner ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71550 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
@@ -446,7 +446,7 @@ CVE-2026-121949 (The Symfony HtmlSanitizer component does
not apply the media UR
CVE-2026-121837 (A flaw was found in the REST Data Panache component of
Quarkus. When a ...)
NOT-FOR-US: Red Hat software not packaged in Debian
CVE-2026-121489 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-121139 (The Rapid7 Metasploitmsf-wssuffers from a missing
authentication vulne ...)
TODO: check
CVE-2026-120859 (PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and
pymodaq_util ...)
@@ -760,21 +760,21 @@ CVE-2026-102615 (HeyForm is an open-source form builder.
Prior to 3.0.1, /api/up
CVE-2026-102523 (MariaDB server is a community developed fork of MySQL server.
From 10. ...)
TODO: check
CVE-2026-100365 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
- TODO: check
+ NOT-FOR-US: SuiteCRM
CVE-2026-100364 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
- TODO: check
+ NOT-FOR-US: SuiteCRM
CVE-2026-100363 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
- TODO: check
+ NOT-FOR-US: SuiteCRM
CVE-2026-100362 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
- TODO: check
+ NOT-FOR-US: SuiteCRM
CVE-2026-100361 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
- TODO: check
+ NOT-FOR-US: SuiteCRM
CVE-2026-100360 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
- TODO: check
+ NOT-FOR-US: SuiteCRM
CVE-2026-100359 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
- TODO: check
+ NOT-FOR-US: SuiteCRM
CVE-2026-100358 (SuiteCRM is an open-source, enterprise-ready Customer
Relationship Man ...)
- TODO: check
+ NOT-FOR-US: SuiteCRM
CVE-2026-100228 (Improper Input Validation in Order Returns in Apache OFBiz
24.09.07 on ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-100168 (Direct Request ('Forced Browsing') in the Content Manager
component in ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d09e4d8caf1f85b1723f125ef560e69f54b04d0f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d09e4d8caf1f85b1723f125ef560e69f54b04d0f
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
