Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
87804fd0 by security tracker role at 2026-08-25T07:13:26+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,5 +1,5 @@
CVE-2026-7455 (A maliciously crafted FLT file, when parsed through Autodesk
3ds Max, ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2026-78685 (Medical Practice Management System developed by Le-yan has a
Remote Co ...)
TODO: check
CVE-2026-78683 (NLTK before 3.10.0 (affected versions <=3.9.4) contains an
unsafe pick ...)
@@ -21,7 +21,7 @@ CVE-2026-78676 (GitPython before 3.1.59 fails to safely
re-serialize multi-line
CVE-2026-78675 (GitPython before 3.1.59 fails to disable merge_includes when
parsing . ...)
TODO: check
CVE-2026-78656 (A vulnerability was found in itsourcecode Sales and Inventory
System 1 ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-78654 (A vulnerability has been found in cleverbrush framework and
deep up to ...)
TODO: check
CVE-2026-78638 (A flaw has been found in peerigon unzip-crx and unzip-crx-3 up
to 0.2. ...)
@@ -35,15 +35,15 @@ CVE-2026-78553 (RansomLook created its Flask
session-signing key without explici
CVE-2026-78551 (RansomLook contains multiple weaknesses in its authentication
endpoint ...)
TODO: check
CVE-2026-78478 (The Mane theme for WordPress is vulnerable to Local File
Inclusion in ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78477 (The Jawn theme for WordPress is vulnerable to Privilege
Escalation in ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78470 (The WP Project Manager Pro plugin for WordPress is vulnerable
to SQL I ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78467 (The Fluent Support Pro plugin for WordPress is vulnerable to
unauthori ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78466 (The Fluent Boards Pro plugin for WordPress is vulnerable to
Insecure D ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78435 (A vulnerability has been found in Faveo Helpdesk up to 2.0.3.
Affected ...)
TODO: check
CVE-2026-78434 (A flaw has been found in Faveo Helpdesk up to 2.0.3. This
impacts the ...)
@@ -51,27 +51,27 @@ CVE-2026-78434 (A flaw has been found in Faveo Helpdesk up
to 2.0.3. This impact
CVE-2026-78430 (A vulnerability was detected in sworddut mcp-ffmpeg-helper
0.1.0/0.1.1 ...)
TODO: check
CVE-2026-78284 (Unauthenticated Arbitrary File Deletion in MasterStudy LMS <=
3.7.42 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78282 (Unauthenticated Cross Site Scripting (XSS) in Stripe Payments
<= 2.1.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78268 (Unauthenticated Sensitive Data Exposure in Lead Generation
Contact Wid ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78267 (Unauthenticated Privilege Escalation in TranslatePress <=
3.3.2 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78266 (Subscriber Broken Access Control in AutomatorWP <= 5.8.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78265 (Unauthenticated PHP Object Injection in The Events Calendar <=
6.17.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78264 (Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks
<= 1.6.26 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78263 (Unauthenticated Cross Site Scripting (XSS) in Event Tickets <=
5.29.2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78262 (Unauthenticated PHP Object Injection in WP Project Manager <=
4.0.6 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78259 (Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-77923 (Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass
vulnera ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-77635 (CakePHP is a rapid development framework for PHP. Prior to
versions 5. ...)
TODO: check
CVE-2026-77634 (CakePHP is a rapid development framework for PHP. Prior to
versions 4. ...)
@@ -93,11 +93,11 @@ CVE-2026-76816 (Netty is an asynchronous, event-driven
network application frame
CVE-2026-76098 (Mistune is a Python Markdown parser with renderers and
plugins. Versio ...)
TODO: check
CVE-2026-76063 (The FundEngine \u2013 Donation and Crowdfunding Platform
plugin for Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75982 (The LearnPress plugin for WordPress is vulnerable to
unauthorized modi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75930 (The FundEngine \u2013 Donation and Crowdfunding Platform
plugin for Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75575 (Rocket.Chat exposes the sendForgotPasswordEmail Meteor method
without ...)
TODO: check
CVE-2026-75574 (The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2
renders ...)
@@ -115,7 +115,7 @@ CVE-2026-75369 (An out-of-bounds read vulnerability in the
CAN::Application::par
CVE-2026-75368 (A stack overflow in the loadRawData function of SpaceDot
AcubeSAT OBC ...)
TODO: check
CVE-2026-75019 (The Cozy Blocks \u2013 Page Builder for Gutenberg Editor & FSE
with 70 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-72714 (Rocq Prover does not restore the universe graph's copy of the
universe ...)
TODO: check
CVE-2026-72711 (The Lean 4 kernel does not check that the body of an opaque
declaratio ...)
@@ -143,9 +143,9 @@ CVE-2026-72696 (Grav CMS before 2.0.16 contains a symlink
following vulnerabilit
CVE-2026-72695 (Grav before 2.0.16 contains a path traversal vulnerability in
MediaUpl ...)
TODO: check
CVE-2026-71511 (Dolibarr before 24.0.0 contains a sensitive data exposure
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-71510 (Dolibarr before 24.0.0 contains a SQL injection vulnerability
in the u ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-69665 (SKYSEA Client View and SKYMEC IT Manager contain an issue with
incorre ...)
TODO: check
CVE-2026-68960 (A stack-based buffer overflow vulnerability exists in SKYSEA
Client Vi ...)
@@ -157,13 +157,13 @@ CVE-2026-68516 (OpenEXR is the reference implementation
and specification for th
CVE-2026-68062 (SKYSEA Client View and SKYMEC IT Manager contain a path
traversal vuln ...)
TODO: check
CVE-2026-66766 (SAP S/4HANA (Private Cloud) uses a third-party component that
contains ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-66109 (A missing authorization vulnerability exists in SKYSEA Client
View and ...)
TODO: check
CVE-2026-63693 (Dell Client BIOS contains an Improper Link Resolution Before
File Acce ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-61419 (Dell ThinOS 10, versions prior to 2605_10.2518, contain an
Improper Ac ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-5006 (A vulnerability was identified in HashiCorp Vault and Vault
Enterprise ...)
TODO: check
CVE-2026-59183 (OpenEXR is the reference implementation and specification for
the EXR ...)
@@ -213,57 +213,57 @@ CVE-2026-34964 (Adminer before 5.5.0 contains a
server-side request forgery vuln
CVE-2026-34959 (Adminer 4.6.0 before 5.5.0 prepends the client-supplied
X-Forwarded-Pr ...)
TODO: check
CVE-2026-32563 (Subscriber PHP Object Injection in ACPT (Pro) - Custom Post
Types Plug ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32561 (Subscriber Privilege Escalation in Booking Hub <= 1.3.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32560 (Subscriber Local File Inclusion in MagicAI for WordPress - AI
Text, Im ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32559 (Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32556 (Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32555 (Unauthenticated SQL Injection in Boost <= 2.0.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32554 (Unauthenticated SQL Injection in WooBeWoo Product Filter Pro
<= 3.1.8 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27364 (Subscriber Broken Access Control in Style Kits <= 2.6.5
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-19943 (The Gutenverse \u2013 WordPress Blocks, Page Builder & Site
Editor plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19892 (The InfusedWoo Pro plugin for WordPress is vulnerable to
Privilege Esc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19801 (The BetterLinks \u2013 Link Shortener, Link Cloaking,
Redirects, Affil ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19568 (A maliciously crafted SVG file, when parsed through Autodesk
3ds Max, ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2026-17113 (A flaw was found in CRI-O's container-creation
environment-variable ha ...)
TODO: check
CVE-2026-17089 (The Events Manager \u2013 Calendar, Bookings, Tickets, and
more! plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-16783 (A maliciously crafted ABC file, when parsed through Autodesk
3ds Max, ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2026-16782 (A maliciously crafted SVG file, when parsed through Autodesk
3ds Max, ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2026-16781 (A maliciously crafted SVG file, when parsed through Autodesk
3ds Max, ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2026-16434 (Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an
incomplete fi ...)
TODO: check
CVE-2026-15023 (The Events Manager \u2013 Calendar, Bookings, Tickets, and
more! plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14280 (The Events Manager \u2013 Calendar, Bookings, Tickets, and
more! plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13215 (The Zephyr ext2 filesystem driver fails to validate the
s_log_block_si ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-13214 (The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a
stack b ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-12561 (The tagDiv Composer plugin for WordPress is vulnerable to
Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-10630 (The WP Courses LMS \u2013 Online Courses Builder, eLearning
Courses, C ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-10627 (The Events Manager \u2013 Calendar, Bookings, Tickets, and
more! plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-9878 (The PPWP \u2013 Password Protect WordPress | #1 Most-Reviewed
Password ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-41741
REJECTED
CVE-2020-37268 (Print Assumptions does not report that a definition was
produced while ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/87804fd05b66c5115b0007074763bc2a69ad55c5
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/87804fd05b66c5115b0007074763bc2a69ad55c5
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
