Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d8321572 by Salvatore Bonaccorso at 2026-11-05T10:30:38+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -195,23 +195,23 @@ CVE-2026-12538 (IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to
9.4.5.3, and 10.0.0.1 to
CVE-2026-12356 (IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42
LTS, 9.4 ...)
NOT-FOR-US: IBM
CVE-2026-123033 (Authentication bypass in the HA heartbeat origin check in
middlewared ...)
- TODO: check
+ NOT-FOR-US: TrueNAS SCALE
CVE-2026-123029 (Wowza Streaming Engine before 4.12.2 processes XML external
entities, ...)
- TODO: check
+ NOT-FOR-US: Wowza
CVE-2026-123025 (An OS Command Injection vulnerability was discovered in the
Google Clo ...)
- TODO: check
+ NOT-FOR-US: OPNsense os-acme-client plugin
CVE-2026-123017 (GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to
mean that ...)
- TODO: check
+ NOT-FOR-US: GodotSteam
CVE-2026-123014 (iTerm2 before 3.7.7beta2 has an argument injection
vulnerability in th ...)
- TODO: check
+ NOT-FOR-US: iTerm2
CVE-2026-123012 (In Gogs 0.14.3, the Git Smart HTTP authorization layer in
internal/rou ...)
- TODO: check
+ NOT-FOR-US: Go Git Service
CVE-2026-123011 (STMicroelectronics st-mems-android-linux-sensors-hal before
7bdf334 do ...)
- TODO: check
+ NOT-FOR-US: STMicroelectronics st-mems-android-linux-sensors-hal
CVE-2026-123010 (@twilio-labs/netlify-okta-auth through 1.0.2 relies on an
unverified i ...)
- TODO: check
+ NOT-FOR-US: twilio-labs/netlify-okta-auth
CVE-2026-122992 (In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6,
dstarCall ...)
- TODO: check
+ NOT-FOR-US: G4KLX DStarGateway and F4FXL DStarGateway
CVE-2026-122323 (Kyverno from 1.11.0 before 1.19.2 contains an unbounded
decompression ...)
NOT-FOR-US: Kyverno
CVE-2026-122322 (Kyverno from 1.11.0 before 1.19.2 contains an unbounded
decompression ...)
@@ -597,9 +597,9 @@ CVE-2026-39430 (On HP Poly EagleEye Cube USB 1.3.1-001267
devices, the administr
CVE-2026-20241 (A vulnerability in the authorization mechanism of Cisco
Identity Servi ...)
TODO: check
CVE-2026-19731 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Imzager
CVE-2026-19721 (Improper restriction of XML external entity reference
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Imzager
CVE-2026-122148 (In Yealink MeetingBoard Pro before 331.320.0.64, the Web
management mo ...)
NOT-FOR-US: Yealink
CVE-2026-122124 (On Yealink UVC40 E2 devices before 319.410.0.71, an attacker
with shor ...)
@@ -1231,7 +1231,7 @@ CVE-2026-54851 (Improper Neutralization of Input During
Web Page Generation ('Cr
CVE-2026-4052 (This issue only impacts deployments where WSO2 Identity Server
is conf ...)
NOT-FOR-US: WSO2
CVE-2026-46487 (GeoNetwork is a catalog application to manage spatially
referenced res ...)
- TODO: check
+ NOT-FOR-US: GeoNetwork
CVE-2026-45146 (Chamilo LMS is an open-source learning management system.
Prior to 1.1 ...)
NOT-FOR-US: Chamilo LMS
CVE-2026-44267 (Elo is a purely functional expression language for no-code
tools. Prio ...)
@@ -1243,23 +1243,23 @@ CVE-2026-44265 (Elo is a purely functional expression
language for no-code tools
CVE-2026-43603 (A NULL pointer dereference in the Linux GPU driver could
potentially l ...)
TODO: check
CVE-2026-40661 (An out-of-bounds write (OOW) condition in the AMD
Compressonator SDK c ...)
- TODO: check
+ NOT-FOR-US: AMD
CVE-2026-40660 (A heap-based out-of-bounds (OOB) read vulnerability in the AMD
Compres ...)
- TODO: check
+ NOT-FOR-US: AMD
CVE-2026-40659 (An integer overflow condition in the AMD Compressonator SDK
could allo ...)
- TODO: check
+ NOT-FOR-US: AMD
CVE-2026-40652 (An out-of-bounds read condition in the AMD Compressonator SDK
could al ...)
- TODO: check
+ NOT-FOR-US: AMD
CVE-2026-39777 (Missing Authorization vulnerability in WC Lovers WCFM
Membership wc-mu ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39743 (Missing Authorization vulnerability in WC Lovers WCFM
Membership wc-mu ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-39379 (GeoNetwork is a catalog application to manage spatially
referenced res ...)
- TODO: check
+ NOT-FOR-US: GeoNetwork
CVE-2026-38601 (A hardcoded session secret key in codeskyblue gohttpserver
through v1. ...)
- TODO: check
+ NOT-FOR-US: codeskyblue gohttpserver
CVE-2026-38600 (A Zip Slip vulnerability in the /upload endpoint of
codeskyblue gohttp ...)
- TODO: check
+ NOT-FOR-US: codeskyblue gohttpserver
CVE-2026-38595 (An issue in im3x Scriptables through v2-dev branch allows
attackers to ...)
NOT-FOR-US: im3x Scriptables
CVE-2026-28531
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d8321572267f4faa627884f63194aa1c34df9c26
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d8321572267f4faa627884f63194aa1c34df9c26
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
