Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
32b157bd by Moritz Muehlenhoff at 2026-09-16T15:23:36+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -806,11 +806,11 @@ CVE-2026-55301 (In Wave6VpuDecFlush of wave6.c, there is
a possible out-of-bound
CVE-2026-55211 (Surfio is a library for reading and writing surface files.
Prior to 0. ...)
TODO: check
CVE-2026-55178 (GeoLens is a self-hosted geospatial data catalog with semantic
search, ...)
- TODO: check
+ NOT-FOR-US: GeoLens
CVE-2026-55158 (Conflibot warns in advance when merging a pull request will
cause conf ...)
- TODO: check
+ NOT-FOR-US: Conflibot
CVE-2026-55149 (Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx
using th ...)
- TODO: check
+ NOT-FOR-US: Vouch Proxy
CVE-2026-54724 (Kiwi TCMS is an open source test management system. Prior to
16.1, the ...)
NOT-FOR-US: Kiwi TCMS
CVE-2026-54689 (mcp-searxng is a Model Context Protocol server that gives AI
assistant ...)
@@ -820,17 +820,17 @@ CVE-2026-54688 (mcp-searxng is a Model Context Protocol
server that gives AI ass
CVE-2026-54637 (Dragonfly is an open source P2P-based file distribution and
image acce ...)
NOT-FOR-US: Dragonfly
CVE-2026-54561 (MCP Memory Keeper is an MCP server for persistent context
management i ...)
- TODO: check
+ NOT-FOR-US: MCP Memory Keeper
CVE-2026-54549 (Meta Ads MCP is a Model Context Protocol (MCP) server that
lets AI ass ...)
- TODO: check
+ NOT-FOR-US: Meta Ads MCP
CVE-2026-54547 (Meta Ads MCP is a Model Context Protocol (MCP) server that
lets AI ass ...)
- TODO: check
+ NOT-FOR-US: Meta Ads MCP
CVE-2026-54450 (ToolHive is a utility designed to simplify the deployment and
manageme ...)
- TODO: check
+ NOT-FOR-US: ToolHive
CVE-2026-54254 (Cyberdrop-DL is a bulk asynchronous downloader for multiple
file hosts ...)
- TODO: check
+ NOT-FOR-US: Cyberdrop-DL
CVE-2026-54251 (netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP)
gateway ...)
- TODO: check
+ NOT-FOR-US: netty-incubator-codec-ohttp
CVE-2026-54168 (Pipelines-as-Code is a CI/CD system that lets users define
Tekton pipe ...)
NOT-FOR-US: Pipelines-as-Code
CVE-2026-54167 (Pipelines-as-Code is a CI/CD system that lets users define
Tekton pipe ...)
@@ -840,23 +840,23 @@ CVE-2026-54077 (ArcadeDB is a Multi-Model DBMS. Prior to
26.6.1, the IMPORT DATA
CVE-2026-54076 (ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for
CVE-2026- ...)
NOT-FOR-US: ArcadeDB
CVE-2026-54050 (Sakai is a Collaboration and Learning Environment (CLE). From
23.0 unt ...)
- TODO: check
+ NOT-FOR-US: Sakai
CVE-2026-53966 (XWiki Platform is a generic wiki platform. From 13.4-rc-1
until 16.10. ...)
NOT-FOR-US: XWiki
CVE-2026-53957 (Contentful MCP Server is a Model Context Protocol server for
the Conte ...)
- TODO: check
+ NOT-FOR-US: Contentful MCP Server
CVE-2026-53954 (Bugsink is a self-hosted error tracking tool. Prior to version
2.2.2, ...)
- TODO: check
+ NOT-FOR-US: Bugsink
CVE-2026-53941 (Inspektor Gadget is a set of tools and framework for data
collection a ...)
- TODO: check
+ NOT-FOR-US: Inspektor Gadget
CVE-2026-53710 (MCP Context Forge is an AI gateway, registry, and proxy for
MCP, A2A, ...)
- TODO: check
+ NOT-FOR-US: MCP Context Forge
CVE-2026-53660 (Open Access Management (OpenAM) is an access management
solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-53658 (Fabric CA is a Certificate Authority for Hyperledger Fabric.
Prior to ...)
- TODO: check
+ NOT-FOR-US: Fabric CA
CVE-2026-53459 (Bambuddy is a self-hosted print archive and management system
for Bamb ...)
- TODO: check
+ NOT-FOR-US: Bambuddy
CVE-2026-52828 (Kimai is an open-source time tracking application. Prior to
2.58.0, Ex ...)
NOT-FOR-US: Kimai
CVE-2026-52827 (Kimai is an open-source time tracking application. Prior to
2.59.0, th ...)
@@ -1866,7 +1866,7 @@ CVE-2026-78415 (IBM Sterling Secure Proxy 6.2.0.0 through
6.2.1.2 could allow a
CVE-2026-77191 (An authenticated supplicant on an adjacent network may bypass
intended ...)
NOT-FOR-US: Arista Networks
CVE-2026-76081 (ZITADEL is an open source identity management platform. Prior
to versi ...)
- TODO: check
+ NOT-FOR-US: ZITADEL
CVE-2026-75983 (The Eventin \u2013 Event Calendar, Tickets, Registration,
Booking & Wo ...)
NOT-FOR-US: WordPress plugin
CVE-2026-75945 (A race condition may cause a supplicant to remain in an
authorized sta ...)
@@ -1878,15 +1878,15 @@ CVE-2026-75943 (A brief (milliseconds to seconds)
traffic leak may occur when an
CVE-2026-75792 (IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow
a remote ...)
NOT-FOR-US: IBM
CVE-2026-73497 (MCP Atlassian is a Model Context Protocol (MCP) server for
Atlassian p ...)
- TODO: check
+ NOT-FOR-US: MCP Atlassian
CVE-2026-73496 (MCP Atlassian is a Model Context Protocol (MCP) server for
Atlassian p ...)
- TODO: check
+ NOT-FOR-US: MCP Atlassian
CVE-2026-73449 (On affected platforms running Arista EOS with both 802.1X port
authent ...)
NOT-FOR-US: Arista Networks
CVE-2026-68489 (Static Code Injection in Plesk extensions "Ruby" before 1.6.6
and "Nod ...)
- TODO: check
+ NOT-FOR-US: Plesk extension
CVE-2026-67399 (Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8
and 8.0. ...)
- TODO: check
+ NOT-FOR-US: WHMCS
CVE-2026-65838 (Skipper is an HTTP router and reverse proxy for service
composition. P ...)
TODO: check
CVE-2026-65415 (A race condition was addressed with additional validation.
This issue ...)
@@ -2030,19 +2030,19 @@ CVE-2026-54247 (Skipper is an HTTP router and reverse
proxy for service composit
CVE-2026-54246 (Skipper is an HTTP router and reverse proxy for service
composition. P ...)
TODO: check
CVE-2026-53719 (Envoy Gateway is an open source project for managing Envoy
Proxy as a ...)
- TODO: check
+ - envoyproxy <itp> (bug #987544)
CVE-2026-53718 (Envoy Gateway is an open source project for managing Envoy
Proxy as a ...)
- TODO: check
+ - envoyproxy <itp> (bug #987544)
CVE-2026-53717 (Envoy Gateway is an open source project for managing Envoy
Proxy as a ...)
- TODO: check
+ - envoyproxy <itp> (bug #987544)
CVE-2026-53716 (Envoy Gateway is an open source project for managing Envoy
Proxy as a ...)
- TODO: check
+ - envoyproxy <itp> (bug #987544)
CVE-2026-53715 (Envoy Gateway is an open source project for managing Envoy
Proxy as a ...)
- TODO: check
+ - envoyproxy <itp> (bug #987544)
CVE-2026-53714 (Envoy Gateway is an open source project for managing Envoy
Proxy as a ...)
- TODO: check
+ - envoyproxy <itp> (bug #987544)
CVE-2026-53713 (Envoy Gateway is an open source project for managing Envoy
Proxy as a ...)
- TODO: check
+ - envoyproxy <itp> (bug #987544)
CVE-2026-50006 (Anyquery is an SQL query engine built on top of SQLite. Prior
to 0.4.5 ...)
TODO: check
CVE-2026-47253 (Anyquery is an SQL query engine built on top of SQLite. Prior
to 0.4.5 ...)
@@ -2756,19 +2756,19 @@ CVE-2026-54529 (SQLAdmin is a flexible Admin interface
for SQLAlchemy models. Pr
CVE-2026-54452 (safeurl is a server-side request forgery protection library.
Prior to ...)
TODO: check
CVE-2026-54182 (backpack/crud provides Create, Read, Update & Delete (CRUD)
functions ...)
- TODO: check
+ NOT-FOR-US: backpack/crud
CVE-2026-54181 (backpack/crud provides Create, Read, Update & Delete (CRUD)
functions ...)
- TODO: check
+ NOT-FOR-US: backpack/crud
CVE-2026-54180 (backpack/crud provides Create, Read, Update & Delete (CRUD)
functions ...)
- TODO: check
+ NOT-FOR-US: backpack/crud
CVE-2026-54178 (backpack/crud provides Create, Read, Update & Delete (CRUD)
functions ...)
- TODO: check
+ NOT-FOR-US: backpack/crud
CVE-2026-54177 (backpack/crud provides Create, Read, Update & Delete (CRUD)
functions ...)
- TODO: check
+ NOT-FOR-US: backpack/crud
CVE-2026-54176 (backpack/crud provides Create, Read, Update & Delete (CRUD)
functions ...)
- TODO: check
+ NOT-FOR-US: backpack/crud
CVE-2026-54175 (backpack/crud provides Create, Read, Update & Delete (CRUD)
functions ...)
- TODO: check
+ NOT-FOR-US: backpack/crud
CVE-2026-54156 (node-opcua is an OPC UA implementation for TypeScript and
Node.js. Pri ...)
TODO: check
CVE-2026-54155 (node-opcua is an OPC UA implementation for TypeScript and
Node.js. Pri ...)
@@ -2810,7 +2810,7 @@ CVE-2026-47256 (OpenTelemetry, also known as OTel, is a
vendor-neutral open sour
CVE-2026-46696 (October System provides the system module for October Content
Manageme ...)
TODO: check
CVE-2026-44162 (fluent-plugin-s3 is an Amazon S3 input and output plugin for
Fluentd. ...)
- TODO: check
+ NOT-FOR-US: fluent-plugin-s3
CVE-2026-34151 (XWiki Platform is a generic wiki platform. Prior to 17.10.5
and 18.2.0 ...)
NOT-FOR-US: XWiki
CVE-2026-25687 (A race condition in the ZPA tunnel handler of affected
versions of Zsc ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/32b157bd5f3d32ce936056e30bf4a7d4144174dc
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/32b157bd5f3d32ce936056e30bf4a7d4144174dc
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
