Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
57e2ac69 by Moritz Muehlenhoff at 2026-10-13T00:42:14+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -97,11 +97,11 @@ CVE-2026-81856 (Improper Neutralization of Escape, Meta, or
Control Sequences vu
CVE-2026-78404 (IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5is
vulnerable ...)
NOT-FOR-US: IBM
CVE-2026-77366 (obsidian-tc is a governed, agent-ready Model Context Protocol
server f ...)
- TODO: check
+ NOT-FOR-US: obsidian-tc
CVE-2026-77364 (obsidian-tc is a governed, agent-ready Model Context Protocol
server f ...)
- TODO: check
+ NOT-FOR-US: obsidian-tc
CVE-2026-77363 (obsidian-tc is a governed, agent-ready Model Context Protocol
server f ...)
- TODO: check
+ NOT-FOR-US: obsidian-tc
CVE-2026-75888 (A flaw was found in the OpenShift console. An authenticated
console us ...)
NOT-FOR-US: Red Hat software not packaged in Debian
CVE-2026-6232 (An out-of-bounds write vulnerability in the SPI host command
interface ...)
@@ -135,7 +135,7 @@ CVE-2026-109448 (Integer wraparound in psqlODBC
SQLBindParameter allows an appli
CVE-2026-109399 (SWUpdate through 2026.05.1 contains an improper certificate
validation ...)
TODO: check
CVE-2026-109398 (Gumlet php-image-resize before 3.0.1 contains a denial of
service vuln ...)
- TODO: check
+ NOT-FOR-US: php-image-resize
CVE-2026-109397 (Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an
unrestricted fi ...)
TODO: check
CVE-2026-109396 (Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV
formula inje ...)
@@ -149,33 +149,33 @@ CVE-2026-109392 (Pimcore through 2026.3.1 contains a
stored cross-site scripting
CVE-2026-109391 (Square Squash through commit e73f280 contains an insecure
deserializat ...)
TODO: check
CVE-2026-109390 (AnyDesk before 8.0.3 allows unauthenticated remote attackers
to execut ...)
- TODO: check
+ NOT-FOR-US: Anydesk
CVE-2026-109374 (ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: ZITADEL
CVE-2026-109373 (ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass
vulnerab ...)
- TODO: check
+ NOT-FOR-US: ZITADEL
CVE-2026-109372 (ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an
authentic ...)
- TODO: check
+ NOT-FOR-US: ZITADEL
CVE-2026-109371 (ZITADEL 3.0.0 before 4.18.0 contains a missing authentication
vulnerab ...)
- TODO: check
+ NOT-FOR-US: ZITADEL
CVE-2026-109366 (Zebra before 6.4.0 contains an improper integrity validation
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Zebra zcash
CVE-2026-109365 (Zebra before 6.4.0 contains an uncontrolled resource
consumption vulne ...)
- TODO: check
+ NOT-FOR-US: Zebra zcash
CVE-2026-109364 (Zebra 2.3.0 before 6.4.0 contains a protection mechanism
failure that ...)
- TODO: check
+ NOT-FOR-US: Zebra zcash
CVE-2026-109363 (ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6
transactions ...)
- TODO: check
+ NOT-FOR-US: Zebra zcash
CVE-2026-109362 (Heym v0.0.5 before v0.0.113 contains a broken access control
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Heym
CVE-2026-109361 (MONAI 1.2.0 before 1.6.1 contains an insecure deserialization
vulnerab ...)
- TODO: check
+ NOT-FOR-US: MONAI
CVE-2026-109360 (MONAI 0.4.0 before 1.6.1 contains a remote code execution
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: MONAI
CVE-2026-109359 (Contrast 1.8.0 before 1.24.1 contains an improper
verification vulnera ...)
- TODO: check
+ NOT-FOR-US: Edgeless Systems Contrast
CVE-2026-109358 (Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an
incorrect pe ...)
- TODO: check
+ NOT-FOR-US: Edgeless Systems Contrast
CVE-2026-109357 (LibreNMS before 26.9.0 contains an LDAP filter injection in
ldap-autho ...)
NOT-FOR-US: LibreNMS
CVE-2026-109356 (LibreNMS before 26.9.0 contains a missing authorization
vulnerability ...)
@@ -227,49 +227,49 @@ CVE-2026-109334 (SurrealDB before 3.3.0 does not check
the caller-selected names
CVE-2026-109333 (SurrealDB from 3.0.0 before 3.3.0 contains an authorization
bypass vul ...)
NOT-FOR-US: SurrealDB
CVE-2026-109332 (Network-AI (npm network-ai) before 5.15.2 contains an origin
validatio ...)
- TODO: check
+ NOT-FOR-US: Node network-ai
CVE-2026-109331 (Network-AI from 5.14.0 before 5.15.2 contains a security
control bypas ...)
- TODO: check
+ NOT-FOR-US: Node network-ai
CVE-2026-109330 (Network-AI 5.0.0 before 5.15.2 contains a cross-site
WebSocket hijacki ...)
- TODO: check
+ NOT-FOR-US: Node network-ai
CVE-2026-109329 (Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains
a broken ...)
- TODO: check
+ NOT-FOR-US: Admidio
CVE-2026-109328 (Admidio 5.0.0 before 5.0.15 contains an unauthenticated
stored cross-s ...)
- TODO: check
+ NOT-FOR-US: Admidio
CVE-2026-109327 (Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15
contains a refle ...)
- TODO: check
+ NOT-FOR-US: Admidio
CVE-2026-109326 (Grav before 2.1.7 contains an information disclosure
vulnerability bec ...)
- TODO: check
+ NOT-FOR-US: Grav
CVE-2026-109325 (Grav from 2.0.22 before 2.1.7 contains an authentication
bypass vulner ...)
- TODO: check
+ NOT-FOR-US: Grav
CVE-2026-109324 (Grav before 2.1.7 contains a denial of service vulnerability
that allo ...)
- TODO: check
+ NOT-FOR-US: Grav
CVE-2026-109323 (Grav Star Ratings 2.0.1 through 2.0.3 contains a missing
authorization ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109322 (Grav Guestbook plugin before 0.5.2 contains a stored
cross-site script ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109321 (Grav Login OAuth plugin (grav-plugin-login-oauth) before
1.4.3 provisi ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109320 (The Grav API plugin (grav-plugin-api) before 1.0.36 contains
an improp ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109319 (Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing
authorization a ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109318 (Grav Git Sync 1.0.2 through 3.4.12 contains a command
injection vulner ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109317 (Grav grav-plugin-api before 1.0.36 contains a privilege
escalation vul ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109316 (Grav Data Manager plugin 1.4.0 through 1.4.5 contains a
missing author ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109315 (Grav from 2.0.22 before 2.1.7 contains an information
disclosure vulne ...)
- TODO: check
+ NOT-FOR-US: Grav
CVE-2026-109314 (Grav Login plugin 1.2.0 before 3.9.9 contains an information
disclosur ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109313 (Grav Login plugin 2.7.0 before 3.9.9 contains an
authentication bypass ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109312 (Grav Login plugin 2.7.0 before 3.9.9 contains an
authentication bypass ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109311 (vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg
av.open() ...)
- TODO: check
+ - vllm <itp> (bug #1095237)
CVE-2026-109310 (SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig
template func ...)
NOT-FOR-US: SiYuan
CVE-2026-109309 (SiYuan v3.7.0 before v3.8.6 contains an absolute path
traversal vulner ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57e2ac692acb8100fe6dfaec84ca21b04e68930b
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57e2ac692acb8100fe6dfaec84ca21b04e68930b
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
