Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b5030938 by Moritz Muehlenhoff at 2026-06-26T17:46:05+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -75,7 +75,7 @@ CVE-2026-57521 (Bitwarden Server before 2026.5.0 contains a
broken access contro
CVE-2026-57520 (Bitwarden Server before 2026.5.0 contains a privilege
escalation vulne ...)
- bitwarden <itp> (bug #956836)
CVE-2026-56445 (The qrscp application's C-STORE handler uses a specific
instance from ...)
- TODO: check
+ NOT-FOR-US: pynetdicom (different from src:pydicom)
CVE-2026-55964 (Chain intermediate CA:TRUE without keyCertSign accepted as a
signing C ...)
- wolfssl <unfixed>
NOTE: https://github.com/wolfSSL/wolfssl/pull/10702 (v5.9.2-stable)
@@ -89,21 +89,21 @@ CVE-2026-55958 (Out-of-bounds write in the Renesas TSIP TLS
1.3 transcript buffe
- wolfssl <unfixed>
NOTE: https://github.com/wolfSSL/wolfssl/pull/10705 (v5.9.2-stable)
CVE-2026-54479 (The WebSocket backend uses charging station identifiers to
uniquely as ...)
- TODO: check
+ NOT-FOR-US: Evoke
CVE-2026-50745 (A missing sanitisation vulnerability exists with user input in
the sta ...)
- TODO: check
+ NOT-FOR-US: Revive Adserver
CVE-2026-50744 (A bypass to the admin\u2011only restriction of the
XML\u2011RPC API in ...)
- TODO: check
+ NOT-FOR-US: Revive Adserver
CVE-2026-50742 (A stored XSS vulnerabilities exists in the
`maintenance-acl-check.php` ...)
- TODO: check
+ NOT-FOR-US: Revive Adserver
CVE-2026-50741 (Bypass to the fix for CVE-2026-34916. Variants of such vectors
have be ...)
- TODO: check
+ NOT-FOR-US: Revive Adserver
CVE-2026-50740 (A missing sanitisation vulnerability of user input in the
zone-include ...)
- TODO: check
+ NOT-FOR-US: Revive Adserver
CVE-2026-50739 (A bypass for CVE\u20112026\u201134913 exists with proper
ownership val ...)
- TODO: check
+ NOT-FOR-US: Revive Adserver
CVE-2026-50176 (The WebSocket Application Programming Interface lacks
restrictions on ...)
- TODO: check
+ NOT-FOR-US: Evoke
CVE-2026-46602 (The TIFF decoder does not set a limit on the size of tiles in
tiled im ...)
TODO: check
CVE-2026-46601 (The webp decoder can panic when processing a VP8 chunk with
dimensions ...)
@@ -111,7 +111,7 @@ CVE-2026-46601 (The webp decoder can panic when processing
a VP8 chunk with dime
CVE-2026-44622 (Charging station authentication identifiers are publicly
accessible vi ...)
TODO: check
CVE-2026-43920 (FOSSBilling is a free, open-source billing and client
management syste ...)
- TODO: check
+ NOT-FOR-US: FOSSBilling
CVE-2026-40941 (Cacti is an open source performance and fault management
framework. Ve ...)
- cacti <unfixed>
NOTE:
https://github.com/Cacti/cacti/security/advisories/GHSA-274c-97hj-pv2v
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b50309389f9d527cf77e93acb5597fb2625bd77b
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b50309389f9d527cf77e93acb5597fb2625bd77b
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
