Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
5d574438 by Salvatore Bonaccorso at 2026-10-09T18:26:31+02:00
Process some more NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -677,23 +677,23 @@ CVE-2026-107386 (amqp091-go is a Go AMQP 0.9.1 client.
From 1.13.0 until 1.14.0,
NOTE: Fixed by:
https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3
(v1.14.0)
NOTE: Relates to the mitigation applied for GHSA-r9c8-gcjp-xfwh /
CVE-2026-77410
CVE-2026-107385 (MariaDB Connector/Node.js is used to connect applications
developed on ...)
- TODO: check
+ NOT-FOR-US: MariaDB Connector/Node.js
CVE-2026-107384 (MariaDB Connector/Node.js is used to connect applications
developed on ...)
- TODO: check
+ NOT-FOR-US: MariaDB Connector/Node.js
CVE-2026-107383 (MariaDB Connector/Node.js is used to connect applications
developed on ...)
- TODO: check
+ NOT-FOR-US: MariaDB Connector/Node.js
CVE-2026-107382 (MariaDB Connector/Node.js is used to connect applications
developed on ...)
- TODO: check
+ NOT-FOR-US: MariaDB Connector/Node.js
CVE-2026-107380 (savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0,
svg-sanitiz ...)
- TODO: check
+ NOT-FOR-US: darylldoyle svg-sanitizer
CVE-2026-107379 (savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0,
svg-sanitiz ...)
- TODO: check
+ NOT-FOR-US: darylldoyle svg-sanitizer
CVE-2026-107378 (CairoSVG is an SVG converter based on Cairo, a 2D graphics
library. Pr ...)
TODO: check
CVE-2026-107377 (datamodel-code-generator generates Python data models from
schema defi ...)
TODO: check
CVE-2026-107376 (webonyx graphql-php is a PHP implementation of the GraphQL
specificati ...)
- TODO: check
+ NOT-FOR-US: webonyx graphql-php
CVE-2026-107375 (JHipster is a development platform to quickly generate,
develop, and d ...)
TODO: check
CVE-2026-107362 (Malcolm file-upload component ships the upstream FilePond PHP
server ( ...)
@@ -812,11 +812,11 @@ CVE-2026-105886 (Missing Authorization vulnerability in
BdThemes Ultimate Post K
CVE-2026-105878 (Missing Authorization vulnerability in YITH YITH WooCommerce
Product B ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-105833 (EspoCRM before 10.0.5 contains an insecure direct object
reference vul ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-105832 (EspoCRM before 10.0.6 contains an authentication bypass
vulnerability ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-105831 (EspoCRM before 10.0.6 contains a stored HTML injection
vulnerability t ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-105830 (league/commonmark from 2.0.0 before 2.10.2 contains a
quadratic-time d ...)
TODO: check
CVE-2026-105829 (League CommonMark from 1.3.0 before 2.10.2 contains a
cross-site scrip ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5d5744383f24e07c0fb9bf35743e0b6cf0750cc5
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5d5744383f24e07c0fb9bf35743e0b6cf0750cc5
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
