Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
a019af30 by security tracker role at 2026-09-10T19:15:03+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,7 +1,7 @@
CVE-2026-9338 (IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to
a denia ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-9336 (IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to
a denia ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-9166 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
TODO: check
CVE-2026-9163 (Improper neutralization of special elements used in an SQL
command ('S ...)
@@ -11,7 +11,7 @@ CVE-2026-9161 (Observable response discrepancy vulnerability
in DernekPlus Websi
CVE-2026-8323 (URL redirection to untrusted site ('open redirect')
vulnerability in A ...)
TODO: check
CVE-2026-89049 (A server-side request forgery issue due to improper validation
of equi ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-89046 (zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an
out-of-bounds re ...)
TODO: check
CVE-2026-89045 (zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate
negative l ...)
@@ -127,51 +127,51 @@ CVE-2026-88770 (A flaw was found in the Device
Authorization Grant flow of Keycl
CVE-2026-88763 (A flaw was found in the skupper-router component of Red Hat
Service In ...)
TODO: check
CVE-2026-88290 (GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated
clients to ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88289 (GeoVision GV-LPC2211 V1.14 (260903) fails to validate
attacker-control ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88288 (GeoVision GV-LPC2211 V1.13 fails to restrict the filename
supplied to ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88287 (GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes
tokens ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88286 (GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection
state, al ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88285 (GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ
control se ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88284 (GeoVision GV-LPC2211 V1.13 fails to limit repeated User
elements in ON ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88283 (GeoVision GV-LPC2211 V1.13 fails to limit repeated User
elements in ON ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88282 (GeoVision GV-LPC2211 V1.13 allows an administrator-controlled
FTP user ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88281 (GeoVision GV-LPC2211 V1.13 fails to limit repeated Username
elements i ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88280 (GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser
password ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88279 (GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers
username ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88278 (GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security
UsernameToken ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88277 (GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user
to injec ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88276 (GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP
key val ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88275 (GeoVision GV-LPC2211 V1.13 allows an administrator-controlled
WPA-PSK ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88274 (GeoVision GV-LPC2211 V1.13 allows an administrator-controlled
wireless ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88273 (GeoVision GV-LPC2211 V1.13 allows an administrator-controlled
PPPoE us ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88272 (GeoVision GV-LPC2211 V1.13 allows an administrator-controlled
username ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88271 (GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite
device con ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88270 (GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR
firmware- ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88269 (GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve
persistent ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88268 (GeoVision GV-LPC2211 V1.13 contains an authenticated stack
buffer over ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-88265 (A flaw was found in crun. After pivot_root, reopening
/dev/null for st ...)
TODO: check
CVE-2026-88264 (A flaw was found in crun. When the container configuration
does not gi ...)
@@ -279,9 +279,9 @@ CVE-2026-87962 (t-digest versions 3.1 through 3.3 contain a
denial of service vu
CVE-2026-87961 (ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a
heap-based out-o ...)
TODO: check
CVE-2026-87913 (A missing S3 bucket ownership verification in the AWS Security
Agent M ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-87912 (A missing S3 bucket ownership verification in the AWS Security
Agent p ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-87803 (An authorization bypass vulnerability exists in the Countly
Server DBV ...)
TODO: check
CVE-2026-87107 (Consul and Consul Enterprise are vulnerable to an
authorization bypass ...)
@@ -291,107 +291,107 @@ CVE-2026-87106 (Consul and Consul Enterprise are
vulnerable to a denial of servi
CVE-2026-87090 (Consul and Consul Enterprise are vulnerable to an
authorization bypass ...)
TODO: check
CVE-2026-85545 (There is an Vulnerability in some HikCentral Access Control
versions. ...)
- TODO: check
+ NOT-FOR-US: Hikvision
CVE-2026-85544 (There is an Improper Encryption Configuration Vulnerability in
some Hi ...)
- TODO: check
+ NOT-FOR-US: Hikvision
CVE-2026-85543 (Some Wi-Fi series camera products have insufficient permission
validat ...)
- TODO: check
+ NOT-FOR-US: Hikvision
CVE-2026-85310 (import_contacts Path Traversal in Groundhogg <= 4.7.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-85228 (An integer overflow in the tensor buffer validation component
in Amazo ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-85217 (A maliciously crafted add-in, when installed and executed in
Autodesk ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2026-84828 (A flaw was found in PCS (Pacemaker Configuration System). A
local atta ...)
TODO: check
CVE-2026-84821 (Unauthenticated Broken Access Control in WP Fast Total Search
<= 1.82. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84819 (Unauthenticated Cross Site Scripting (XSS) in WPAdverts <=
2.3.3 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84816 (Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84042 (A flaw was found in crun. When crun is built with libkrun and
a contai ...)
TODO: check
CVE-2026-81805 (Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81804 (Unauthenticated Sensitive Data Exposure in ZHBackup \u2013
Backup, Res ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81803 (Subscriber Remote Code Execution (RCE) in RepairBuddy <=
4.1224 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81801 (Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81800 (Unauthenticated SQL Injection in Verified Reviews (Avis
V\xe9rifi\xe9s ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81799 (Unauthenticated Broken Access Control in Return Refund and
Exchange Fo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81796 (Unauthenticated Broken Authentication in WP Travel <= 12.0.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81795 (Unauthenticated Cross Site Scripting (XSS) in Page Visits
Counter R ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81794 (Unauthenticated Broken Access Control in Shirt Product
Designer for Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81793 (Unauthenticated Broken Access Control in Salon booking system
<= 10.31 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81791 (Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81789 (Unauthenticated Arbitrary File Deletion in Advanced Product
Fields Ext ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81788 (Subscriber Broken Access Control in IMPress for IDX Broker <=
3.3.0 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81787 (Unauthenticated Broken Authentication in IMPress for IDX
Broker <= 3.3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81786 (Unauthenticated Broken Access Control in Thank You Page
Customizer for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81785 (Unauthenticated Broken Access Control in BuddyForms <= 2.9.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81784 (Unauthenticated PHP Object Injection in Wise Chat <= 3.4
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81783 (Subscriber Broken Authentication in MailMunch \u2013 Grow your
Email L ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81782 (Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81468 (Dell ThinOS 10, versions prior to 2605_10. 2616, contains an
Improper ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-81467 (Dell ThinOS 10, versions prior to 2605_10. 2616, contains an
Improper ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-81275 (Subscriber Arbitrary File Download in Youzify <= 1.3.7
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81052 (Dell ThinOS 10, versions prior to 2605_10.2616, contain a
Download of ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-81051 (Dell ThinOS 10, versions prior to 2605_10.2616, contain a
Security Ver ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-81049 (Dell ThinOS 10, versions prior to 2605_10.2616, contain a
Missing Supp ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-81048 (Dell ThinOS 10, versions prior to 2605_10.2616, contain an
Improper Ne ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-81046 (Dell ThinOS 10, versions prior to 2605_10.2616, contain a
Protection M ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-80354 (Authorization bypass through User-Controlled key vulnerability
in Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-80352 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-80351 (Improper neutralization of directives in dynamically evaluated
code (' ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-7188 (Improper neutralization of special elements used in an SQL
command ('S ...)
TODO: check
CVE-2026-79987 (A remote, authenticated, non-admin Craft CMS Control Panel
user with o ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-78536 (Unauthenticated Broken Access Control in Robokassa payment
gateway for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78374 (Joomla Extension - joomlart.com - Open mail relay via contact
AJAX end ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-78303 (Joomla Extension - joomshaper.com - Unvalidated Email
Destination & Fo ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-78302 (Joomla Extension - joomshaper.com - Unauthenticated Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-78085 (Joomla Extension - joomshaper.com - Path Traversal in Gallery
Image Ma ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-78084 (Joomla Extension - joomshaper.com - Missing Access Control in
Gallery ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-78083 (Joomla Extension - joomshaper.com - Missing CSRF Token
Verification in ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-78082 (Joomla Extension - joomshaper.com - Unauthenticated SQL
Injection in P ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-75584 (ION-DTN before 4.2.1-a.1 contains a denial of service
vulnerability th ...)
TODO: check
CVE-2026-73699 (FileRun before 2026.3.0 contains a PHP object injection
vulnerability ...)
@@ -413,9 +413,9 @@ CVE-2026-68487 (Path traversal in Plesk's Backup Manager
causes arbitrary file w
CVE-2026-68006 (An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker
to exec ...)
TODO: check
CVE-2026-66674 (Unauthenticated Bypass Vulnerability in Simple Cloudflare
Turnstile <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66632 (Unauthenticated Content Injection in Simple Cloudflare
Turnstile <= 1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-65639 (OS command injection in the advanced-rule parser of
ConfigServer Secur ...)
TODO: check
CVE-2026-65638 (Improper escaping of a request URL in ConfigServer Security &
Firewal ...)
@@ -427,15 +427,15 @@ CVE-2026-64837 (ICEcoder through 8.1 passes an unescaped
filesystem path into a
CVE-2026-64836 (ICEcoder versions through 8.1 contain a path traversal
vulnerability i ...)
TODO: check
CVE-2026-5399 (The Redux Framework plugin for WordPress is vulnerable to
Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-52098 (An issue in Flowise 3.1.2 allows a remote attacker to execute
arbitrar ...)
- TODO: check
+ NOT-FOR-US: Flowise
CVE-2026-52097 (An issue in AppFlowy 0.11.8 allows a remote attacker to
execute arbitr ...)
TODO: check
CVE-2026-4130 (There is a storage of sensitive information in cleartext
vulnerability ...)
- TODO: check
+ NOT-FOR-US: National Instruments
CVE-2026-4129 (There is an improper access control vulnerability in NI
SystemLink tha ...)
- TODO: check
+ NOT-FOR-US: National Instruments
CVE-2026-46387 (Suricata is a network Intrusion Detection System, Intrusion
Prevention ...)
TODO: check
CVE-2026-45763 (Suricata is a network Intrusion Detection System, Intrusion
Prevention ...)
@@ -443,29 +443,29 @@ CVE-2026-45763 (Suricata is a network Intrusion Detection
System, Intrusion Prev
CVE-2026-45747 (Suricata is a network Intrusion Detection System, Intrusion
Prevention ...)
TODO: check
CVE-2026-42808 (An issue was discovered in Bosch Sensortec COINES_SDK versions
2.0 thr ...)
- TODO: check
+ NOT-FOR-US: Bosch
CVE-2026-42807 (A heap-based buffer overflow vulnerability in the PC bridge
protocol d ...)
- TODO: check
+ NOT-FOR-US: Bosch
CVE-2026-42806 (An out-of-bounds read vulnerability was discovered in the
Bosch BME690 ...)
- TODO: check
+ NOT-FOR-US: Bosch
CVE-2026-42805 (A stack-based buffer overflow vulnerability exists in the
Bosch Sensor ...)
- TODO: check
+ NOT-FOR-US: Bosch
CVE-2026-42804 (A stack-based buffer overflow vulnerability exists in the
Bosch Sensor ...)
- TODO: check
+ NOT-FOR-US: Bosch
CVE-2026-38626 (Garlic-Hub v1.0.1 is vulnerable to SQL Injection in
src/Modules/Items/ ...)
TODO: check
CVE-2026-17038 (DrEryk Gabinet before 11.5.0uses hard-coded API credentials in
its tic ...)
TODO: check
CVE-2026-15889 (The Aruba HiSpeed Cache plugin for WordPress is vulnerable to
Stored C ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15461 (The Sierra Wireless HL78xx modem GNSS driver
(drivers/modem/hl78xx/, l ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-15419 (In the silabser.sys driver for CP210x devices v11.5.0 and
earlier, a l ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-15418 (In the silabser.sys driver for CP210x devices v11.5.0 and
earlier, a l ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-15417 (In the silabser.sys Windows 8 driver for CP210x devices, a
local unpri ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-13745 (A vulnerability in the Gemini CLI and associated GitHub Action
allowed ...)
TODO: check
CVE-2026-12683 (Improper neutralization of input during web page generation
('cross-si ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a019af30c6c1363b2181c5f2ac5b1cfb8a3d9c4f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a019af30c6c1363b2181c5f2ac5b1cfb8a3d9c4f
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
