Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
72cf04ea by Moritz Muehlenhoff at 2026-09-20T23:17:57+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -100,7 +100,7 @@ CVE-2026-92253 (Improper link resolution before file access
in the quarantine re
CVE-2026-92252 (Incorrect default permissions in the installation directory of
WatchDo ...)
NOT-FOR-US: Watchdog
CVE-2026-90817 (An unauthenticated Remote Code Execution vulnerability was
found in th ...)
- TODO: check
+ NOT-FOR-US: REDCap
CVE-2026-88857 (Joomla Extension - OrdaSoft.com - Authenticated, Privileged
Remote Cod ...)
NOT-FOR-US: Joomla
CVE-2026-88856 (Joomla Extension - OrdaSoft.com - Authenticated, Privileged
Remote Cod ...)
@@ -1923,7 +1923,7 @@ CVE-2026-53554 (SQLBot is an intelligent Text-to-SQL
system based on large langu
CVE-2026-53534 (JabRef is a desktop application for managing BibTeX and
BibLaTeX libra ...)
TODO: check
CVE-2026-52483 (The ping diagnostics and other similar functions of the
MitraStar GPT- ...)
- TODO: check
+ NOT-FOR-US: MitraStar GPT-2741GNAC-N2-SV router
CVE-2026-50291 (OpenImageIO is a toolset for reading, writing, and
manipulating image ...)
TODO: check
CVE-2026-50285 (Pomerium is an identity and context-aware access proxy. Prior
to 0.32. ...)
@@ -1937,7 +1937,7 @@ CVE-2026-50158 (yutu is an AI-powered toolkit for
managing and growing YouTube c
CVE-2026-50125 (MKP is a Model Context Protocol server for Kubernetes. Prior
to 0.4.1, ...)
NOT-FOR-US: MKP
CVE-2026-50022 (Metacat is data repository software that helps researchers
preserve, s ...)
- TODO: check
+ NOT-FOR-US: Metacat
CVE-2026-49137
REJECTED
CVE-2026-45726 (Omni manages Kubernetes on bare metal, virtual machines, or in
a cloud ...)
@@ -2376,9 +2376,9 @@ CVE-2026-76781 (A flaw was found in libxml2. A local user
or an attacker providi
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/c63248941708bc1d2e3a4292954593312212f6ca
(master)
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/a34c084d7a576914c1424caabdaaf5e227bb39ef
(v2.15.4)
CVE-2026-75588 (Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate
the URL ...)
- TODO: check
+ NOT-FOR-US: Mattermost Desktop App
CVE-2026-75523 (Steeltoe is an open source project that provides a collection
of libra ...)
- TODO: check
+ NOT-FOR-US: Steeltoe
CVE-2026-74017 (Unauthenticated Broken Access Control in User Registration <=
5.2.7 ve ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-74005 (Unauthenticated Cross Site Request Forgery (CSRF) in
PublishPress Seri ...)
@@ -2390,9 +2390,9 @@ CVE-2026-74000 (Contributor Broken Access Control in
Simple Membership <= 4.8.2
CVE-2026-73999 (Contributor Insecure Direct Object References (IDOR) in Cooked
<= 1.16 ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-71568 (In BMCtest, Ironic is started without authentication and TLS
for the d ...)
- TODO: check
+ NOT-FOR-US: BMCtest
CVE-2026-71538 (@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of
Materials ...)
- TODO: check
+ NOT-FOR-US: Node cyclonedx/cyclonedx-npm
CVE-2026-69197 (Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and
18.0.2, the C ...)
NOT-FOR-US: Umbraco CMS
CVE-2026-66676 (Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8
version ...)
@@ -2440,13 +2440,13 @@ CVE-2026-66571 (Unauthenticated Cross Site Request
Forgery (CSRF) in Asset Clean
CVE-2026-66269 (Dell OpenManage Server Administrator, versions prior to
11.1.0.3, cont ...)
NOT-FOR-US: Dell / EMC
CVE-2026-63472 (Vendure is an open-source headless commerce platform. Prior to
3.7.0, ...)
- TODO: check
+ NOT-FOR-US: Vendure
CVE-2026-63461 (Vendure is an open-source headless commerce platform. Prior to
3.6.5, ...)
- TODO: check
+ NOT-FOR-US: Vendure
CVE-2026-63460 (Vendure is an open-source headless commerce platform. Prior to
3.6.5, ...)
- TODO: check
+ NOT-FOR-US: Vendure
CVE-2026-63459 (Vendure is an open-source headless commerce platform. Prior to
3.6.5, ...)
- TODO: check
+ NOT-FOR-US: Vendure
CVE-2026-62108 (Unauthenticated Broken Authentication in Headless Single Sign
On <= 1. ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-62104 (Unauthenticated Remote Code Execution (RCE) in Migratico Lite
<= 2.6.8 ...)
@@ -2454,23 +2454,23 @@ CVE-2026-62104 (Unauthenticated Remote Code Execution
(RCE) in Migratico Lite <=
CVE-2026-62101 (Unauthenticated Broken Authentication in EduAdmin Booking <=
5.4.2 ver ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-61793 (Nuxt OG Image generates OG Images with Vue templates in Nuxt.
From 6.0 ...)
- TODO: check
+ NOT-FOR-US: Nuxt OG Image
CVE-2026-61700 (MariaDB Connector/J is used to connect applications developed
in Java ...)
TODO: check
CVE-2026-56795 (Dell Server Update Utility, versions prior to 26.07.01,
contains an Un ...)
NOT-FOR-US: Dell / EMC
CVE-2026-55062 (uniget is a universal installer and updater for (container)
tools. Pri ...)
- TODO: check
+ NOT-FOR-US: uniget
CVE-2026-55061 (uniget is a universal installer and updater for (container)
tools. Pri ...)
- TODO: check
+ NOT-FOR-US: uniget
CVE-2026-54677 (Scoold is a Q&A and a knowledge sharing platform for teams.
Prior to 1 ...)
- TODO: check
+ NOT-FOR-US: Scoold
CVE-2026-54676 (Scoold is a Q&A and a knowledge sharing platform for teams.
Prior to 1 ...)
- TODO: check
+ NOT-FOR-US: Scoold
CVE-2026-54649 (punchin-email is a Cloudflare Email Worker that provides
two-way role ...)
- TODO: check
+ NOT-FOR-US: punchin-email
CVE-2026-54617 (GravitLauncher is an open-source Minecraft launcher based on
sashok724 ...)
- TODO: check
+ NOT-FOR-US: GravitLauncher
CVE-2026-54587 (mport is the MidnightBSD Package Manager. Prior to 2.7.8,
directory as ...)
NOT-FOR-US: mport
CVE-2026-54586 (mport is the MidnightBSD Package Manager. Prior to 2.7.8, the
mport_fe ...)
@@ -2496,35 +2496,35 @@ CVE-2026-54576 (mport is the MidnightBSD Package
Manager. Prior to 2.7.8, do_act
CVE-2026-54575 (mport is the MidnightBSD Package Manager. Prior to 2.7.8,
privileged p ...)
NOT-FOR-US: mport
CVE-2026-54571 (ESPAsyncWebServer is an asynchronous HTTP and WebSocket server
library ...)
- TODO: check
+ NOT-FOR-US: ESPAsyncWebServer
CVE-2026-54551 (WireGuard Portal, or wg-portal, is a web-based configuration
portal fo ...)
NOT-FOR-US: WireGuard Portal
CVE-2026-54546 (CloudTAK is a browser-based Common Operating Picture and
situational a ...)
- TODO: check
+ NOT-FOR-US: CloudTAK
CVE-2026-54524 (Frappe HR is an open-source human resources management
solution (HRMS) ...)
NOT-FOR-US: Frappe HR
CVE-2026-54504 (MCP Documentation Server is a local-first document management
and sema ...)
- TODO: check
+ NOT-FOR-US: MCP Documentation Server
CVE-2026-54471 (Dell SmartFabric Manager, versions prior to 2.2.1, contains an
Imprope ...)
NOT-FOR-US: Dell / EMC
CVE-2026-54451 (Elixir protobuf is a pure Elixir implementation of Google
Protobuf. Fr ...)
NOT-FOR-US: Elixir protobuf
CVE-2026-54446 (NetLicensing MCP Server is a natural-language interface that
enables a ...)
- TODO: check
+ NOT-FOR-US: NetLicensing MCP Server
CVE-2026-54253 (TS3 Manager is modern web interface for maintaining Teamspeak3
servers ...)
- TODO: check
+ NOT-FOR-US: TS3 Manager
CVE-2026-54239 (Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the
FaustWP ...)
- TODO: check
+ NOT-FOR-US: Faust.js
CVE-2026-54053 (Many Notes is a Markdown note-taking web application designed
for simp ...)
- TODO: check
+ NOT-FOR-US: Many Notes
CVE-2026-53681
REJECTED
CVE-2026-53679
REJECTED
CVE-2026-52852 (Traccar is an open source GPS tracking system. Prior to
6.14.0, an aut ...)
- TODO: check
+ NOT-FOR-US: Traccar
CVE-2026-52851 (Traccar is an open source GPS tracking system. Prior to
6.14.0, an aut ...)
- TODO: check
+ NOT-FOR-US: Traccar
CVE-2026-52836 (OpenDDS is an open source C++ implementation of the Object
Management ...)
TODO: check
CVE-2026-52727 (lxc-ci contains continuous integration and image-build scripts
for LXC ...)
@@ -2542,7 +2542,7 @@ CVE-2026-50606 (A vulnerability has been identified in
the Acer System Monitorin
CVE-2026-50605 (A vulnerability has been identified in the Acer Agent Service
componen ...)
NOT-FOR-US: Acer
CVE-2026-49292 (Kiwi TCMS is an open source test management system. Prior to
16.0, the ...)
- TODO: check
+ NOT-FOR-US: Kiwi TCMS
CVE-2026-47252 (Anyquery is an SQL query engine built on top of SQLite. Prior
to 0.4.5 ...)
TODO: check
CVE-2026-28326 (SolarWinds Access Rights Manager was reported to be affected
by an una ...)
@@ -2554,9 +2554,9 @@ CVE-2026-19477 (There is stack-based buffer overflow
vulnerability recently disc
CVE-2026-15688 (Incorrect Implementation of Authentication Algorithm
Vulnerability in ...)
NOT-FOR-US: Mitsubishi
CVE-2026-14850 (The password reset funcionality is vulnerable to unauthorized
account ...)
- TODO: check
+ NOT-FOR-US: MobiAPParc
CVE-2026-12284 (Mattermost Desktop App versions <=6.2 6.2.2.0 fails to
validate the IP ...)
- TODO: check
+ NOT-FOR-US: Mattermost Desktop App
CVE-2026-11874
REJECTED
CVE-2026-8674 (Initializing the DNS stub resolver from an /etc/resolv.conf
file, or a ...)
@@ -5247,15 +5247,15 @@ CVE-2026-20192 (As part of Cisco's ongoing commitment
to proactive security and
CVE-2026-20176 (A vulnerability in Cisco ISE could allow an authenticated,
remote atta ...)
NOT-FOR-US: Cisco
CVE-2026-20154 (A vulnerability in the system rate-limiting process for syslog
message ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20135 (A vulnerability in the TLS 1.3 implementation in Cisco Secure
Firewall ...)
NOT-FOR-US: Cisco
CVE-2026-20130 (As part of Cisco's ongoing commitment to proactive security
and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20121 (A vulnerability in the access control list (ACL) Object Group
Search ( ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20120 (A vulnerability in the access control list (ACL) Object Group
Search ( ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20072 (A vulnerability in the web-based management interface of Cisco
ISE cou ...)
NOT-FOR-US: Cisco
CVE-2026-20071 (A vulnerability in the SSID bring-your-own-device (BYOD)
onboarding wo ...)
@@ -5267,7 +5267,7 @@ CVE-2025-56566 (MikroTik firmware 7.19.4 stores sensitive
authentication credent
CVE-2025-56565 (DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through
v4 hardwa ...)
NOT-FOR-US: TP-Link
CVE-2025-56563 (A Server-Side Request Forgery vulnerability exists in
sat_proxy.php in ...)
- TODO: check
+ NOT-FOR-US: Zenith Satellite Tracker
CVE-2025-15697 (The Dictionary WordPress plugin through 1.0 does not escape
user input ...)
NOT-FOR-US: WordPress plugin
CVE-2026-XXXX [SQUID-2026:8]
@@ -6968,7 +6968,7 @@ CVE-2026-81176 (Svelte devalue is a JavaScript library
that serializes values in
CVE-2026-7514 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-79994 (The guest-to-host Unix-domain socket relay in Docker Sandboxes
validat ...)
- TODO: check
+ NOT-FOR-US: Docker Sandboxes
CVE-2026-79993 (The `deleteContainer` opcode (0x14/20) is processed without
verifying ...)
- zookeeper 3.9.6-1 (bug #1148409)
NOTE: https://lists.apache.org/thread/9cw3rmrzhqpct26v8j18fy41bghlq8y5
@@ -7105,11 +7105,11 @@ CVE-2026-76825 (RestrictedPython is a tool that helps
define a subset of the Pyt
NOTE:
https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-hp3v-5vw7-fx9w
NOTE: Fixed by:
https://github.com/zopefoundation/RestrictedPython/commit/3b47440070b91f8807c2b2998aca99e94783639a
(8.4)
CVE-2026-76821 (OpenCTI is an open source platform for managing cyber threat
intellige ...)
- TODO: check
+ NOT-FOR-US: OpenCTI
CVE-2026-76820 (OpenCTI is an open source platform for managing cyber threat
intellige ...)
- TODO: check
+ NOT-FOR-US: OpenCTI
CVE-2026-76796 (The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO
Connect De ...)
- TODO: check
+ NOT-FOR-US: Newell Brands DYMO Connect Desktop local web service
CVE-2026-76707 (A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways
could al ...)
NOT-FOR-US: HPE
CVE-2026-76706 (A vulnerability in the API endpoint of HPE Networking
EdgeConnect SD-W ...)
@@ -7277,7 +7277,7 @@ CVE-2026-73940 (Vulnerability in the Oracle Access
Manager product of Oracle Fus
CVE-2026-73926 (Vulnerability in the Oracle Access Manager product of Oracle
Fusion Mi ...)
NOT-FOR-US: Oracle
CVE-2026-73807 (The mySCADA myPRO Manager command API does not properly
enforce authen ...)
- TODO: check
+ NOT-FOR-US: mySCADA myPRO Manager
CVE-2026-73469 (When specific platforms are using Arista EOS with a loose
Unicast Reve ...)
NOT-FOR-US: Arista Networks
CVE-2026-73468 (A specially crafted packet can cause the premature expiry of
multicast ...)
@@ -7654,9 +7654,9 @@ CVE-2026-10149
CVE-2026-10145
REJECTED
CVE-2026-10144 (Rsbuild before 2.0.9 contains a command injection
vulnerability that a ...)
- TODO: check
+ NOT-FOR-US: Rsbuild
CVE-2025-59953 (LMDeploy is a toolkit for compressing, deploying, and serving
large la ...)
- TODO: check
+ NOT-FOR-US: LMDeploy
CVE-2025-43936 (Dell ObjectScale, versions prior to ObjectScale 4.4.0.0,
contains an I ...)
NOT-FOR-US: Dell / EMC
CVE-2025-36591 (Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell
ObjectScale versio ...)
@@ -11019,9 +11019,9 @@ CVE-2026-54559 (PocketSphinx is a small speech
recognizer. Prior to 5.1.1, the t
CVE-2026-54447 (garminconnect is a Python 3 API wrapper for Garmin Connect
that retrie ...)
TODO: check
CVE-2026-54334 (UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware
structur ...)
- TODO: check
+ NOT-FOR-US: uefi-firmware-parser
CVE-2026-54333 (UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware
structur ...)
- TODO: check
+ NOT-FOR-US: uefi-firmware-parser
CVE-2026-54247 (Skipper is an HTTP router and reverse proxy for service
composition. P ...)
TODO: check
CVE-2026-54246 (Skipper is an HTTP router and reverse proxy for service
composition. P ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72cf04ea99b18d07a3e94f9f607d6969c70adcc0
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72cf04ea99b18d07a3e94f9f607d6969c70adcc0
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
