Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ef6bcbdc by security tracker role at 2026-07-30T07:13:12+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,7 +1,7 @@
CVE-2026-6336 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-6267 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-6102 (MSI Center NTIOLib_X64 Origin Validation Error Local Privilege
Escalat ...)
TODO: check
CVE-2026-67595 (VaahCMS versions 2.0.0 through 2.3.4 contain a malicious
obfuscated Ja ...)
@@ -25,15 +25,15 @@ CVE-2026-67431 (MCP Ruby SDK is the official Ruby SDK for
Model Context Protocol
CVE-2026-67430 (MCP Ruby SDK is the official Ruby SDK for Model Context
Protocol serve ...)
TODO: check
CVE-2026-67248 (A stack-based buffer overflow vulnerability was found in the
File Expl ...)
- TODO: check
+ NOT-FOR-US: Asustor
CVE-2026-67247 (A path traversal vulnerability was found in the IHM Log
handling of AD ...)
- TODO: check
+ NOT-FOR-US: Asustor
CVE-2026-67246 (A path traversal vulnerability was found in the Wallpaper
component of ...)
- TODO: check
+ NOT-FOR-US: Asustor
CVE-2026-67245 (A path traversal vulnerability was found in the VPN Clients on
the ADM ...)
- TODO: check
+ NOT-FOR-US: Asustor
CVE-2026-67244 (A format string vulnerability was found in the Notification
OAuth sett ...)
- TODO: check
+ NOT-FOR-US: Asustor
CVE-2026-65975 (Pydantic AI is a Python agent framework for building
applications and ...)
TODO: check
CVE-2026-64685 (ImageMagick is free and open-source software used for editing
and mani ...)
@@ -87,11 +87,11 @@ CVE-2026-54249 (Pydantic AI is a Python agent framework for
building Generative
CVE-2026-50782 (Jinher OA C6 contains an XML External Entity (XXE) injection
vulnerabi ...)
TODO: check
CVE-2026-4672 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-48449 (Adobe Campaign Classic (ACC) is affected by an Incorrect
Authorization ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-48448 (Adobe Campaign Classic (ACC) is affected by an Improper
Neutralization ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-47882 (When enabling Spring Boot DevTools support for a remote
application ta ...)
TODO: check
CVE-2026-47873 (The Boot Dashboard Docker integration in Spring Tools
publishes contai ...)
@@ -101,19 +101,19 @@ CVE-2026-47858 (Starting Spring Boot applications in the
Spring Tools with the l
CVE-2026-46678 (Pydantic AI is a Python agent framework for building
Generative AI app ...)
TODO: check
CVE-2026-3093 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-1982 (The Persian Elementor
(\u0627\u0644\u0645\u0646\u062a\u0648\u0631 \u06 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-1360 (The BuddyPress plugin for WordPress is vulnerable to
Deserialization o ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18266 (Dify AI Workflow oauth_redirect_url Open Redirect
Vulnerability. This ...)
TODO: check
CVE-2026-18188 (A format string vulnerability was found in the Rsync Backup on
the ADM ...)
- TODO: check
+ NOT-FOR-US: Asustor
CVE-2026-18187 (A format string vulnerability was found in the Internal Backup
on the ...)
- TODO: check
+ NOT-FOR-US: Asustor
CVE-2026-18186 (A stored format string vulnerability was found in the FTP
Backup on th ...)
- TODO: check
+ NOT-FOR-US: Asustor
CVE-2026-18060
REJECTED
CVE-2026-18022 (Integer wraparound in IVFFlat index build in pgvector before
0.8.6 all ...)
@@ -861,11 +861,11 @@ CVE-2026-17650 (Use after free in Compositing in Google
Chrome prior to 151.0.79
CVE-2026-16728 (undici's retry interceptor can deliver a response whose body
length do ...)
TODO: check
CVE-2026-16727 (Concurrent Execution using Shared Resource with Improper
Synchronizati ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-16610 (The Admin and Site Enhancements (ASE) Pro plugin for WordPress
is vuln ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-16553 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-16531 (An unauthenticated remote attacker can exploit a path
traversal vulner ...)
TODO: check
CVE-2026-16530 (A flaw was found in the PCP (Performance Co-Pilot) `pmproxy`
service. ...)
@@ -881,79 +881,79 @@ CVE-2026-16524 (A command injection flaw in PCP's
linux_sockets PMDA allows mali
CVE-2026-16339
REJECTED
CVE-2026-16092 (The Improved Save Button plugin for WordPress is vulnerable to
second- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15975 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-15929 (Improper neutralization of special elements used in an SQL
command ('S ...)
TODO: check
CVE-2026-15831 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-15382 (The Ultimate Addons for WPBakery Page Builder WordPress plugin
before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15257 (The RegistrationMagic WordPress plugin before 6.0.9.4 does
not perfor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15255 (The RegistrationMagic WordPress plugin before 6.0.9.4 does
not proper ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15252 (The Search Atlas SEO WordPress plugin before 2.6.12 does not
perform ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15250 (The Appointment Booking Plugin WordPress plugin before 5.6.8
does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15240 (The Customer Switching WordPress plugin before 2.1.3 does not
securely ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15235 (The MotoPress Hotel Booking WordPress plugin before 6.0.4 does
not per ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15157 (undici does not validate the type property of a duck-typed
blob-like r ...)
TODO: check
CVE-2026-15153 (The WP Hotel Booking WordPress plugin before 2.3.2 does not
sanitise a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15077 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-15054 (The Bit Form WordPress plugin before 3.1.2 does not enforce a
form's ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14923 (The Sync Post With Other Site WordPress plugin before 1.9.3
does not c ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14643 (undici's cache interceptor mishandles optional whitespace
placed aroun ...)
TODO: check
CVE-2026-14602 (The Remote API WordPress plugin through 0.2 does not
authenticate a re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14592 (The WP Real IP-based Access Control WordPress plugin through
1.3.1 doe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14356 (The FleekDash V2 plugin for WordPress is vulnerable to
authorization b ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14351 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-14341 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-14318 (The GiveWP WordPress plugin before 4.16.3 does not escape a
donation- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14310 (The Tutor LMS WordPress plugin before 4.0.0 does not properly
verify ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14305 (The WP Delicious WordPress plugin before 1.10.2 does not
perform an a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14239 (The tourmaster WordPress plugin before 5.4.8 does not perform
a nonce ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14231 (The LifterLMS WordPress plugin before 10.0.10 does not
perform a capa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14226 (The Easy Appointments WordPress plugin through 3.12.26 does
not requir ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14223 (The Easy Appointments WordPress plugin through 3.12.26 does
not verify ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14222 (The Easy Appointments WordPress plugin through 3.12.26 does
not perfor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14221 (The Easy Appointments WordPress plugin through 3.12.26 does
not perfor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14207 (The LifterLMS WordPress plugin before 10.0.10 does not strip
event-ha ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14188 (The Easy Appointments WordPress plugin through 3.12.26 does
not perfor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13395 (The Online Scheduling and Appointment Booking System
WordPress plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13345 (The Essential Addons for Elementor WordPress plugin before
6.6.10 doe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13344 (The Essential Addons for Elementor WordPress plugin before
6.6.10 doe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13330 (The Animation Addons for Elementor WordPress plugin before
2.7.0 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13309 (Autel MaxiCharger AC Elite Home NFC Stack-based Buffer
Overflow Arbitr ...)
TODO: check
CVE-2026-13308 (Autel MaxiCharger AC Elite Home WebSockets Integer Underflow
Remote Co ...)
@@ -967,29 +967,29 @@ CVE-2026-13305 (Autel MaxiCharger AC Elite Home Software
Update Improper Verific
CVE-2026-13268 (G DATA Total Security Backup Service Link Following Local
Privilege Es ...)
TODO: check
CVE-2026-13178 (The Eventin WordPress plugin before 4.1.16 does not properly
authoriz ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13145 (The WP Travel WordPress plugin before 11.8.1 does not verify
that the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13143 (The WP Travel WordPress plugin before 11.8.1 does not verify
PayPal I ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13113 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-12687 (The ProfileGrid WordPress plugin before 5.9.9.8 does not
restrict whi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12500 (The WP Travel Engine WordPress plugin before 6.8.2 does not
perform a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12436 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-12357 (Heimdall Data Database Proxy generateFileContent CRLF
Injection Remote ...)
TODO: check
CVE-2026-11881 (The Fluent Forms WordPress plugin before 6.2.6 does not
sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11870 (The WP Ghost (Hide My WP Ghost) WordPress plugin before
7.0.05 does n ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11867 (The Frontend Admin by DynamiApps WordPress plugin before
3.29.7 does n ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11782 (The Points and Rewards for WooCommerce WordPress plugin before
2.10.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-69949 (kishan0725 Hospital Management System 4.0 is vulnerable to SQL
Injecti ...)
TODO: check
CVE-2025-69945 (kishan0725 Hospital Management System 4.0 is vulnerable to SQL
Injecti ...)
@@ -1001,23 +1001,23 @@ CVE-2025-69943 (kishan0725 Hospital Management System
4.0 is vulnerale to SQL In
CVE-2025-69942 (kishan0725 Hospital Management System 4.0 is vulnerable to SQL
Injecti ...)
TODO: check
CVE-2025-67408 (Sourcecodester CASAP Automated Enrollment System 1.0 is
vulnerable to ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2025-67407 (Sourcecodester CASAP Automated Enrollment System 1.0 is
vulnerable to ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2025-67406 (https://www.sourcecodester.com Advocate office management
system 1.0 i ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2025-67405 (Sourcecodester CASAP Automated Enrollment System 1.0 is
vulnerable to ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2025-67404 (Sourcecodester CASAP Automated Enrollment System 1.0 is
vulnerable to ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2025-67403 (Sourcecodester CASAP Automated Enrollment System 1.0 is
vulnerable to ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2025-65340 (kishan0725 Hospital Management System 4.0 is vulnerable to SQL
Injecti ...)
TODO: check
CVE-2025-65337 (Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross
Site Scri ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2025-14562 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-9720 (The Facturaci\xf3n Electr\xf3nica Costa Rica plugin for
WordPress is v ...)
NOT-FOR-US: WordPress plugin
CVE-2026-9177 (A Server-Side Template Injection (SSTI) vulnerability was
identified ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ef6bcbdce4804beea687ab8eb2c88b5e34898424
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ef6bcbdce4804beea687ab8eb2c88b5e34898424
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
