Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
cce0386d by Salvatore Bonaccorso at 2026-11-06T21:49:20+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -31,7 +31,7 @@ CVE-2026-85742 (FreeScout is a self-hosted help desk and
shared mailbox. Prior t
CVE-2026-85111 (Allocation of Resources Without Limits or Throttling in Apache
James M ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85108 (Allocation of Resources Without Limits or Throttling in Apache
James M ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-84473 (Authentication Bypass / Missing Brute-Force Protection in
remote.php/w ...)
NOT-FOR-US: ownCloud
CVE-2026-84164 (The HTML report that plist-to-html, CodeChecker parse --export
html an ...)
@@ -57,7 +57,7 @@ CVE-2026-75598 (The Gradle Shadow plugin creates fat or uber
JARs and supports f
CVE-2026-74756 (Some docker-compose shipped by the project exposes by default
Webadmin ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71495 (Wanderer is a self-hosted trail database for saving and
sharing advent ...)
- TODO: check
+ NOT-FOR-US: Wanderer
CVE-2026-66987 (HCL AION is affected by a vulnerability where the account
lockout mech ...)
NOT-FOR-US: HCL
CVE-2026-66986 (HCL AION is affected by a vulnerability where user sessions
did not ex ...)
@@ -69,11 +69,11 @@ CVE-2026-66982 (HCL AION is affected by a vulnerability
where browser autocomple
CVE-2026-66981 (HCL AION is affected by a vulnerability where the application
trusted ...)
NOT-FOR-US: HCL
CVE-2026-66295 (Saxy's XML encoder writes the target and the content of a
processing i ...)
- TODO: check
+ NOT-FOR-US: Saxy XML encoder
CVE-2026-66294 (XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1
serializes ...)
- TODO: check
+ NOT-FOR-US: Saxy XML encoder
CVE-2026-66293 (XML injection in the encoder of Saxy. Saxy.Encoder does not
neutralize ...)
- TODO: check
+ NOT-FOR-US: Saxy XML encoder
CVE-2026-65022 (The MDM App Catalog / App Store preview does not properly
sanitize or ...)
NOT-FOR-US: HCL
CVE-2026-64894 (Inclusion of functionality from untrusted control sphere
vulnerability ...)
@@ -99,15 +99,15 @@ CVE-2026-62344 (Wanderer is a self-hosted trail database
for saving and sharing
CVE-2026-5345 (HCL AION is affected by a missing encryption vulnerability in a
second ...)
NOT-FOR-US: HCL
CVE-2026-59105 (Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL
Server ...)
- TODO: check
+ NOT-FOR-US: Jumis (formerly Tildes Jumis)
CVE-2026-58141 (Dify before 1.15.0 contains a server-side request forgery
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Dify
CVE-2026-56717
REJECTED
CVE-2026-53980 (Charmbracelet wish before 2.0.5 contains a path traversal
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Charmbracelet wish
CVE-2026-49951 (RAGFlow before 0.27.0 contains a server-side request forgery
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-49939 (In Apache James server prior version 3.9.1 improper Access
Control Lis ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-49126
@@ -167,23 +167,23 @@ CVE-2026-21849 (HCL AION is affected by a missing
encryption vulnerability in th
CVE-2026-21834 (HCL AION is affected by a vulnerability where the
Content-Security-Pol ...)
NOT-FOR-US: HCL
CVE-2026-19877 (INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects
image-share ...)
- TODO: check
+ NOT-FOR-US: INFINITT
CVE-2026-19876 (A reflected cross-site scripting (XSS) vulnerability in the
login/SSO ...)
TODO: check
CVE-2026-12067 (Missing exception handlers in AvastSvc native message
dispatcher (ashS ...)
NOT-FOR-US: Gen Digital Inc.
CVE-2026-123998 (Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains
an authent ...)
- TODO: check
+ NOT-FOR-US: Hisense VIDAA Smart TV firmware
CVE-2026-123997 (Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains
an unauthe ...)
- TODO: check
+ NOT-FOR-US: Hisense VIDAA Smart TV firmware
CVE-2026-123996 (Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains a
missing ...)
- TODO: check
+ NOT-FOR-US: Hisense VIDAA Smart TV firmware
CVE-2026-123995 (Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains
an input v ...)
- TODO: check
+ NOT-FOR-US: Hisense VIDAA Smart TV firmware
CVE-2026-123994 (Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains
an unauthe ...)
- TODO: check
+ NOT-FOR-US: Hisense VIDAA Smart TV firmware
CVE-2026-123993 (Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains
an unauthe ...)
- TODO: check
+ NOT-FOR-US: Hisense VIDAA Smart TV firmware
CVE-2026-123976 (EDFbrowser before 2.16 contains an out-of-bounds write
vulnerability i ...)
TODO: check
CVE-2026-123973 (SharePoint Products CopyMove before 2026-11-06 allows
traversal. An au ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cce0386d73ff38e33d18f92d8c59ce6e18aa3f9a
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cce0386d73ff38e33d18f92d8c59ce6e18aa3f9a
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
