Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
4a181998 by security tracker role at 2026-11-06T19:17:10+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,7 +1,7 @@
CVE-2026-97642 (The Wp Parsidate plugin for WordPress is vulnerable to Stored
Cross-Si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92895 (The Live2DWebCanvas plugin for WordPress is vulnerable to
Arbitrary Fi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92080 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
TODO: check
CVE-2026-90975 (A vulnerability in Realtek's RtUsbA64.sys USB audio driver
allows a lo ...)
@@ -9,19 +9,19 @@ CVE-2026-90975 (A vulnerability in Realtek's RtUsbA64.sys USB
audio driver allow
CVE-2026-90436 (** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound
SOAP fau ...)
TODO: check
CVE-2026-89101 (The Everest Forms \u2013 Contact Form, Payment Form, Quiz,
Survey & Cu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89017 (Skyline DataMiner BrokerGateway contains an embedded API key
vulnerabi ...)
TODO: check
CVE-2026-88801 (The MDJM Event Management and Mobile Events Manager WordPress
plugins ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88800 (The MDJM Event Management and Mobile Events Manager WordPress
plugins ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88799 (The MDJM Event Management and Mobile Events Manager WordPress
plugins ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87964 (The Product Feed Manager for WooCommerce \u2013 CTX Feed
\u2013 Suppor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87045 (The HTTP/2 server in subsys/net/lib/http/http_server_http2.c
clears th ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-85744 (FreeScout is a self-hosted help desk and shared mailbox. Prior
to 1.8. ...)
TODO: check
CVE-2026-85743 (FreeScout is a self-hosted help desk and shared mailbox. Prior
to 1.8. ...)
@@ -35,13 +35,13 @@ CVE-2026-85108 (Allocation of Resources Without Limits or
Throttling in Apache J
CVE-2026-84473 (Authentication Bypass / Missing Brute-Force Protection in
remote.php/w ...)
TODO: check
CVE-2026-84164 (The HTML report that plist-to-html, CodeChecker parse --export
html an ...)
- TODO: check
+ NOT-FOR-US: Ericsson
CVE-2026-84161 (When an operator enables store.analysis_statistics_dir, a
network clie ...)
- TODO: check
+ NOT-FOR-US: Ericsson
CVE-2026-84155 (CodeChecker's web server fails to fully invalidate a session
token on ...)
- TODO: check
+ NOT-FOR-US: Ericsson
CVE-2026-82308 (A pre-authentication heap-based buffer overflow vulnerability
has been ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-80303 (An integer underflow vulnerability in the Avast Windows
Filtering Plat ...)
TODO: check
CVE-2026-80302 (Insufficient isolation in the Avast sandbox file
virtualization layer ...)
@@ -59,15 +59,15 @@ CVE-2026-74756 (Some docker-compose shipped by the project
exposes by default We
CVE-2026-71495 (Wanderer is a self-hosted trail database for saving and
sharing advent ...)
TODO: check
CVE-2026-66987 (HCL AION is affected by a vulnerability where the account
lockout mech ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66986 (HCL AION is affected by a vulnerability where user sessions
did not ex ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66984 (HCL AION is affected by a vulnerability where certain
application resp ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66982 (HCL AION is affected by a vulnerability where browser
autocomplete was ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66981 (HCL AION is affected by a vulnerability where the application
trusted ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66295 (Saxy's XML encoder writes the target and the content of a
processing i ...)
TODO: check
CVE-2026-66294 (XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1
serializes ...)
@@ -75,9 +75,9 @@ CVE-2026-66294 (XML injection in the Saxy XML encoder.
Saxy.Encoder.cdata/1 seri
CVE-2026-66293 (XML injection in the encoder of Saxy. Saxy.Encoder does not
neutralize ...)
TODO: check
CVE-2026-65022 (The MDM App Catalog / App Store preview does not properly
sanitize or ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-64894 (Inclusion of functionality from untrusted control sphere
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-62856 (FreeScout is a self-hosted help desk and shared mailbox
application. P ...)
TODO: check
CVE-2026-62855 (FreeScout is a self-hosted help desk and shared mailbox. Prior
to 1.8. ...)
@@ -97,7 +97,7 @@ CVE-2026-62345 (Wanderer is a self-hosted trail database for
saving and sharing
CVE-2026-62344 (Wanderer is a self-hosted trail database for saving and
sharing advent ...)
TODO: check
CVE-2026-5345 (HCL AION is affected by a missing encryption vulnerability in a
second ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-59105 (Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL
Server ...)
TODO: check
CVE-2026-58141 (Dify before 1.15.0 contains a server-side request forgery
vulnerabilit ...)
@@ -131,41 +131,41 @@ CVE-2026-47401
CVE-2026-47400
REJECTED
CVE-2026-39744 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-35115 (HCL AION is affected by a vulnerability where the HTTP
Strict-Transpor ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-35114 (HCL AION is affected by a vulnerability where the
X-Content-Type-Optio ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-35113 (HCL AION is affected by a vulnerability where the
Cross-Origin-Opener- ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-35112 (HCL AION is affected by a vulnerability where the
Cross-Origin-Embedde ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-35111 (HCL AION is affected by a vulnerability where the
Cross-Origin-Resourc ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-35110 (HCL AION is affected by a vulnerability where encrypted
(HTTPS) commun ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-35109 (HCL AION is affected by a vulnerability where pages served
over HTTPS ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-35107 (HCL AION is affected by an open redirect vulnerability in the
user men ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-35106 (HCL AION is affected by an open redirect vulnerability in the
session- ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-35105 (HCL AION is affected by an open redirect vulnerability in the
session- ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-35104 (HCL AION is affected by an open redirect vulnerability on the
user reg ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-35103 (HCL AION is affected by an open redirect vulnerability on the
role ass ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-35102 (HCL AION is affected by an open redirect vulnerability in the
navigati ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-33379 (A user with any role, including Viewer or a service account
with no pe ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-21850 (HCL AION is affected by a vulnerability where user-controlled
input co ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-21849 (HCL AION is affected by a missing encryption vulnerability in
the WebS ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-21834 (HCL AION is affected by a vulnerability where the
Content-Security-Pol ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-19877 (INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects
image-share ...)
TODO: check
CVE-2026-19876 (A reflected cross-site scripting (XSS) vulnerability in the
login/SSO ...)
@@ -193,23 +193,23 @@ CVE-2026-123876 (A flaw was found in the default seccomp
profile used by Podman
CVE-2026-123859 (When identifier escaping is disabled through a non-default
configurati ...)
TODO: check
CVE-2026-123858 (In JetBrains PhpStorm before 2026.3 project files could be
automatical ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123857 (In JetBrains PhpStorm before 2026.3 xXE was possible in
untrusted proj ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123856 (In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure
was possibl ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123855 (In JetBrains Toolbox App before 3.6.1 command injection was
possible v ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123854 (In JetBrains PyCharm before 2026.3 code execution was
possible in Safe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123853 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code
execution was ...)
TODO: check
CVE-2026-123852 (In JetBrains Junie GitHub Action before 1.8.0 code execution
with work ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123851 (In JetBrains Junie GitHub Action before 1.6.4 prompt
injection protect ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123850 (In JetBrains YouTrack before 2026.2.19422 cSS injection was
possible i ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123849 (In JetBrains IntelliJ IDEA before 2026.3 code execution was
possible i ...)
TODO: check
CVE-2026-123848 (In JetBrains IntelliJ IDEA before 2026.3 host name
verification was mi ...)
@@ -237,17 +237,17 @@ CVE-2026-123838 (In JetBrains IntelliJ IDEA before 2026.3
code execution was pos
CVE-2026-123837 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command
injection ...)
TODO: check
CVE-2026-123836 (In JetBrains Datalore before 2026.4 workspace collaborators
could obta ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123835 (In JetBrains Datalore before 2026.4 code execution was
possible in ano ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123834 (In JetBrains Datalore before 2026.4 improper scope validation
in datab ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123833 (In JetBrains IntelliJ IDEA before 2026.3 database connections
could be ...)
TODO: check
CVE-2026-123832 (In JetBrains CLion before 2026.2 code execution was possible
in Safe M ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123831 (In JetBrains CLion before 2026.2, 2026.1.4 code execution
was possibl ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123824 (The Symfony Config componentXmlUtils::parse()enables DTD
validation be ...)
TODO: check
CVE-2026-123792 (The Symfony Yaml componentsInlineandParser, parse some YAML
documents ...)
@@ -299,19 +299,19 @@ CVE-2026-123618 (ABP Framework before 10.7.1 contains an
authentication bypass v
CVE-2026-123617 (Openwhyd before 1.65.1 contains a NoSQL injection
vulnerability that a ...)
TODO: check
CVE-2026-123492 (SiYuan before 3.8.9 contains a nil pointer dereference
vulnerability i ...)
- TODO: check
+ NOT-FOR-US: SiYuan
CVE-2026-123491 (Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2
contains an SQL ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-123490 (Craft CMS from 5.8.17 before 5.11.2 contains a privilege
escalation vu ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-123489 (Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2
contains a blind ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-123488 (Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2
contains an unau ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-123487 (Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1
validates ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-123486 (WWBN AVideo 29.0 through 29.4.0 contains a race condition
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-123485 (Ground Station from 0.6.0 before 0.8.20 does not restrict the
get-orbi ...)
TODO: check
CVE-2026-123357 (GROBID is machine learning software for extracting
information from sc ...)
@@ -321,51 +321,51 @@ CVE-2026-123356 (GROBID is machine learning software for
extracting information
CVE-2026-123339 (Improper trust of forwarded headers
inRouterListener::onKernelFinishRe ...)
TODO: check
CVE-2026-123337 (In JetBrains YouTrack before 2026.2.19656 users without
update permiss ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123336 (In JetBrains YouTrack before 2026.2.19728 the attachment size
limit co ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123335 (In JetBrains YouTrack before 2026.2.19562, 2026.1.14137,
2025.3.1690 ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123334 (In JetBrains YouTrack before 2026.2.19562 project admins of a
related ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123333 (In JetBrains YouTrack before 2026.2.19562 sprint creation
allowed movi ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123332 (In JetBrains YouTrack before 2026.2.19562 missing
authorization allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123331 (In JetBrains YouTrack before 2026.2.19197 article editors
could change ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123330 (In JetBrains YouTrack before 2026.2.19562 missing
authorization allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123329 (In JetBrains YouTrack before 2026.2.19562 missing
authorization in Tea ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123328 (In JetBrains YouTrack before 2026.2.19656 app permission
bypass allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123327 (In JetBrains YouTrack before 2026.2.19562 missing
authorization in the ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123326 (In JetBrains YouTrack before 2026.2.19197 incorrect
authorisation in t ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123325 (In JetBrains YouTrack before 2025.3.170763, 2026.1.14150,
2026.2.196 ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123324 (In JetBrains YouTrack before 2026.2.19562 information
disclosure via s ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123323 (In JetBrains YouTrack before 2025.3.170763, 2026.1.14150,
2026.2.196 ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123322 (In JetBrains WebStorm before 2026.3, 2026.2.4 code execution
was poss ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123321 (In JetBrains WebStorm before 2026.3, 2026.2.3 code execution
via Grun ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123320 (In JetBrains Toolbox App before 3.9 insufficient warning in
the login ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123319 (In JetBrains Ktor before 3.6.1 missing Domain attribute
validation in ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123318 (In JetBrains Ktor before 3.6.1 hTTP request smuggling was
possible in ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123317 (In JetBrains Ktor before 3.6.1 session forgery was possible
via tamper ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123316 (In JetBrains Junie CLI before 26.6.29 sensitive environment
variables ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123315 (In JetBrains Junie CLI before 26.8.24 command execution was
possible v ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123314 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE
attack was pos ...)
TODO: check
CVE-2026-123313 (In JetBrains IntelliJ IDEA before 2026.3 improper checks
could enable ...)
@@ -393,61 +393,61 @@ CVE-2026-123302 (In JetBrains IntelliJ IDEA before
2026.3, 2026.2.4, 2026.1.5.
CVE-2026-123301 (In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the
OpenAPI ...)
TODO: check
CVE-2026-123300 (In JetBrains Hub before 2026.2.52519 missing authorisation
allowed use ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123299 (In JetBrains Hub before 2026.2.52519 information disclosure
via user s ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123298 (In JetBrains Hub before 2026.2.52556 sMTP command injection
via email ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123297 (In JetBrains Hub before 2026.2.52519 two-factor
authentication bypass ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123296 (In JetBrains Hub before 2026.2.52519 privilege escalation via
forged e ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123295 (In JetBrains Hub before 2026.2.52519 enforced two-factor
authenticatio ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123294 (In JetBrains Hub before 2026.2.52556 privilege escalation was
possible ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123293 (In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code
execution was ...)
TODO: check
CVE-2026-123292 (In JetBrains Datalore before 2026.4 aPI tokens and sessions
of removed ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123291 (In JetBrains Datalore before 2026.4 improper owner validation
allowed ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123290 (In JetBrains Datalore before 2026.4 hidden notebook code was
exposed t ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123289 (In JetBrains Datalore before 2026.4 improper authorisation
allowed not ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123288 (In JetBrains Datalore before 2026.4 stored XSS in notebook
charts was ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123287 (In JetBrains Datalore before 2026.4 private notebook files
could be do ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123286 (In JetBrains Datalore before 2026.4 improper authorisation
allowed rea ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123285 (In JetBrains Datalore before 2026.3 command execution was
possible in ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123284 (In JetBrains Datalore before 2026.4 improper authorisation on
workspac ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123283 (In JetBrains Datalore before 2026.4 account takeover was
possible via ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123282 (In JetBrains Datalore before 2026.4 missing expiration
validation of a ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123281 (In JetBrains Datalore before 2026.4 notebook code could
execute comman ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123280 (In JetBrains Datalore before 2026.2.4 unauthenticated users
could exec ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123279 (In JetBrains Datalore before 2026.4 code execution was
possible in a n ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123278 (In JetBrains IntelliJ IDEA before 2026.3 code execution was
possible v ...)
TODO: check
CVE-2026-123277 (In JetBrains CLion before 2026.3, 2026.2.4.1 missing
authentication a ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123276 (In JetBrains CLion before 2026.3, 2026.2.4.1 code execution
was possi ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-123087 (SQL injection vulnerability in Atmira\u2019s SIREC. The
server retriev ...)
TODO: check
CVE-2026-122222 (The Permalink Manager Lite plugin for WordPress is vulnerable
to Store ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-122193 (OS command injection in the example SSM document provisioning
script i ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-122113 (A vulnerability in Realtek's RtUsbA64.sys USB audio driver
allows a ph ...)
TODO: check
CVE-2026-122053 (The Symfony Serializer componentObjectNormalizertreats any
attribute n ...)
@@ -469,21 +469,21 @@ CVE-2026-121820 (A vulnerability has been identified in
armeria-saml versions pr
CVE-2026-121819 (A vulnerability has been identified in armeria-xds versions
1.40.0 thr ...)
TODO: check
CVE-2026-121794 (The Travelly \u2013 Tour & Travel Booking Manager for
WooCommerce plug ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-121636 (The Quick Event Manager WordPress plugin before 9.19 does not
verify t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-121633 (The Order Tracking WordPress plugin before 3.6.0 does not
verify that ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-121623 (The Symfony Serializer component
DataUriNormalizer::denormalize() matc ...)
TODO: check
CVE-2026-120844 (Incorrect Privilege Assignment vulnerability in miniOrange
OAuth Singl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-120671 (The UsersWP \u2013 Front-end login form, User Registration,
User Profi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-120659 (The Redirection for Contact Form 7 plugin for WordPress is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-120550 (The WP User Manager \u2013 Registration Form, Login Form,
User Profile ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-120474 (undici is an HTTP client for Node.js. In versions 7.0.0
through 7.30.1 ...)
TODO: check
CVE-2026-120423 (undici is an HTTP client for Node.js. In versions 7.15.0
through 7.30. ...)
@@ -493,149 +493,149 @@ CVE-2026-120415 (undici is an HTTP client for Node.js.
In versions 7.0.0 through
CVE-2026-120222 (undici is an HTTP client for Node.js. In versions 7.0.0
through 7.30.1 ...)
TODO: check
CVE-2026-120035 (The RSS Aggregator by Feedzy \u2013 Feed to Post,
Autoblogging, News & ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119924 (An out-of-bounds read in the TDS RPC procedure-name parser in
the Babe ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119923 (A heap-based buffer overflow in the TDS prelogin parser in
the Babelfi ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119758 (ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a
missing au ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-119516 (Deserialization of Untrusted Data vulnerability in Mamunur
Rashid Radi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119499 (Insertion of Sensitive Information Into Sent Data
vulnerability in BAK ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119488 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119472 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119211 (The AAA Autoload Optimizer plugin for WordPress is vulnerable
to Store ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119178 (The Smart Cookie Kit plugin for WordPress is vulnerable to
Stored Cros ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119170 (There was a regression in how FIPS algorithms were enforced
for the ha ...)
TODO: check
CVE-2026-118670 (OHIF Viewers is a zero-footprint DICOM viewer with shared
extension pa ...)
TODO: check
CVE-2026-118423 (The WP Libre Form WordPress plugin 1.5.0.1 does not validate
the type ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118189 (The Posts Table with Search & Sort plugin for WordPress is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118166 (The MC4WP: Mailchimp for WordPress WordPress plugin before
4.15.0 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116630 (undici is an HTTP client for Node.js. In versions 7.0.0
through 7.30.1 ...)
TODO: check
CVE-2026-116624 (The Advanced Members for ACF plugin for WordPress is
vulnerable to Pri ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116592 (undici is an HTTP client for Node.js. In versions 7.30.1 and
8.12.2 th ...)
TODO: check
CVE-2026-116551 (The WP Customer Area plugin for WordPress is vulnerable to
Stored Cros ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116545 (The All-in-One Video Gallery \u2013 Video Player & Galleries
for YouTu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115952 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115831 (The VOD Infomaniak plugin for WordPress is vulnerable to
authorization ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115701 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
TODO: check
CVE-2026-115431 (Missing Authorization vulnerability in WP Swings Upsell Order
Bump Off ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114630 (The ELEX WordPress HelpDesk & Customer Ticketing System
plugin for Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113618 (The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable
to imprope ...)
TODO: check
CVE-2026-113431 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
TODO: check
CVE-2026-112341 (Wazuh versions from 4.0.0 before 4.14.9 contain a sql
injection vulner ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-112340 (Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an
authorizat ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-112339 (Wazuh from 3.9.0 before 4.14.9 contains a missing TLS
hostname verific ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-112338 (Wazuh from 4.3.0 before 4.14.9 contains a server-side request
forgery ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-112337 (Wazuh from 3.7.0 before 4.14.9 contains a server-side request
forgery ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-112336 (Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak
vulnerab ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-112335 (Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based
buffer ove ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-112334 (Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds
write vulnera ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-111573 (Incorrect permissions on the Checkmk Windows agent's data
directory, c ...)
- TODO: check
+ NOT-FOR-US: Checkmk
CVE-2026-110776 (The MDTF \u2013 Meta Data and Taxonomies Filter plugin for
WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110291 (The Graphina \u2013 Charts and Graphs For Elementor plugin
for WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-10147
REJECTED
CVE-2026-10146
REJECTED
CVE-2026-109994 (The Eventin \u2013 Events Calendar, Tickets, Registration,
Booking & W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109977 (The YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking &
Reports pl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109884 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109883 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108262 (DDEV is an open-source tool for running local web development
environm ...)
TODO: check
CVE-2026-108018 (The BigFix MCM admin portal is directly accessible from the
internet w ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-107658 (The BuddyForms plugin for WordPress is vulnerable to Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107622 (The BuddyForms plugin for WordPress is vulnerable to
Privilege Escalat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107155 (A permissive cross-domain policy vulnerability has been
identified in ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-107154 (A session validation vulnerability has been identified in the
SonicOS ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-106144 (Prototype Pollution in the Scheduler component
(@progress/kendo-angula ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106143 (Cross-Site Scripting (XSS) in the Editor component
(@progress/kendo-vu ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106142 (Cross-Site Scripting (XSS) in the Editor component
(@progress/kendo-re ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106141 (Cross-Site Scripting (XSS) in the Editor component
(@progress/kendo-an ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106136 (Cross-Site Scripting (XSS) in the Chat component
(@progress/kendo-reac ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106135 (Cross-Site Scripting (XSS) in the Chat component
(@progress/kendo-angu ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106134 (Cross-Site Scripting (XSS) in the Menu component
(@progress/kendo-reac ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106128 (Prototype Pollution in @progress/kendo-vue-common in Progress
Software ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106127 (Prototype Pollution in the setter utility
(@progress/kendo-react-commo ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106022 (Cleartext storage of sensitive information in memory
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-106020 (Improper neutralization of input used for LLM prompting
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-106019 (Insertion of sensitive information into log file
vulnerability in John ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-105422 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
TODO: check
CVE-2026-104657 (Missing integrity verification in the Progress Software
Fiddler Downlo ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-104656 (Improper neutralization of input in the sessions grid in
Progress Tele ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-104010 (The WPSyncSheets For Contact Form 7 \u2013 CF7 Google Sheets
Connector ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103985 (FreeScout is a self-hosted help desk and shared mailbox.
Prior to 1.8. ...)
TODO: check
CVE-2026-103984 (FreeScout is a self-hosted help desk and shared mailbox.
Prior to 1.8. ...)
TODO: check
CVE-2026-103908 (The The AMP for WP \u2013 Accelerated Mobile Pages plugin for
WordPres ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103682 (Invocation of the Jolokia special agent with the login
password in the ...)
- TODO: check
+ NOT-FOR-US: Checkmk
CVE-2026-103674 (Invocation of the NetApp ONTAP special agent with the login
password i ...)
- TODO: check
+ NOT-FOR-US: Checkmk
CVE-2026-103479 (The Pubjet | \u067e\u0627\u0628\u062c\u062a plugin for
WordPress is vu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102650 (Nuxt Content is the file-based CMS for Nuxt applications,
powered by M ...)
TODO: check
CVE-2026-102359 (Kroki creates diagrams from textual descriptions. Prior to
0.31.2, the ...)
@@ -3345,7 +3345,7 @@ CVE-2026-119741 (rsync before 3.5.2 contains a denial of
service vulnerability i
NOTE: https://github.com/RsyncProject/rsync/pull/1132
NOTE: Fixed by:
https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04
(v3.5.2)
CVE-2026-119724 (** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of
recursive enti ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-119675 (MongoDB Database Tools mongorestore inconsistently handles
the system. ...)
- mongo-tools <removed>
CVE-2026-119674 (MongoDB Database Tools mongorestore incorrectly URL-decodes
an origina ...)
@@ -765715,7 +765715,7 @@ CVE-2020-9711 (Acrobat Reader versions
2020.009.20074, 2020.001.30002, 2017.011.
CVE-2020-9710 (Adobe Acrobat and Reader versions 2020.009.20074 and earlier,
2020.001 ...)
NOT-FOR-US: Adobe
CVE-2020-9709 (Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020
have a ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2020-9708 (The resolveRepositoryPath function doesn't properly validate
user inpu ...)
NOT-FOR-US: Adobe
CVE-2020-9707 (Adobe Acrobat and Reader versions 2020.009.20074 and earlier,
2020.001 ...)
@@ -798852,7 +798852,7 @@ CVE-2019-16449 (Adobe Acrobat and Reader versions ,
2019.021.20056 and earlier,
CVE-2019-16448 (Adobe Acrobat and Reader versions , 2019.021.20056 and
earlier, 2017.0 ...)
NOT-FOR-US: Adobe
CVE-2019-16447 (Adobe Illustrator CC versions 23.1 and earlier have a binary
planting ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2019-16446 (Adobe Acrobat and Reader versions , 2019.021.20056 and
earlier, 2017.0 ...)
NOT-FOR-US: Adobe
CVE-2019-16445 (Adobe Acrobat and Reader versions , 2019.021.20056 and
earlier, 2017.0 ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4a181998044099cda9e4744af99bd65e7f08d1bd
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4a181998044099cda9e4744af99bd65e7f08d1bd
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
