Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
163c7c55 by Moritz Muehlenhoff at 2026-10-14T10:19:04+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -201,7 +201,7 @@ CVE-2026-97471 (The Avada (Fusion) Builder plugin for
WordPress is vulnerable to
CVE-2026-97398 (The FV Flowplayer Video Player plugin for WordPress is
vulnerable to S ...)
NOT-FOR-US: WordPress plugin
CVE-2026-97381 (Legacy Update is a tool for activating and installing updates
on legac ...)
- TODO: check
+ NOT-FOR-US: LegacyUpdate
CVE-2026-97312 (Photoshop Desktop is affected by an out-of-bounds write
vulnerability ...)
NOT-FOR-US: Adobe
CVE-2026-97020 (The PO/MO Editor plugin for WordPress is vulnerable to Stored
Cross-Si ...)
@@ -577,7 +577,7 @@ CVE-2026-94453 (Libreswan's pluto daemon has a
use-after-free vulnerability when
CVE-2026-94377 (The Verified Reviews (Avis V\xe9rifi\xe9s) plugin for
WordPress is vul ...)
NOT-FOR-US: WordPress plugin
CVE-2026-94370 (A defect in the Qt for MCUs core string handling causes heap
memory co ...)
- TODO: check
+ NOT-FOR-US: Qt for MCUs
CVE-2026-94360 (The Paymentfor Gateway for WooCommerce WordPress plugin before
1.0.6 d ...)
NOT-FOR-US: WordPress plugin
CVE-2026-94261 (The Sifalo Pay WordPress plugin before 2.5.3 does not verify
that a p ...)
@@ -597,7 +597,7 @@ CVE-2026-93885 (The Cryptocurrency Donation Box \u2013
Bitcoin & Crypto Donation
CVE-2026-93388 (The Printcart Store (PCDesigner / NB Designer) plugin for
WooCommerce ...)
NOT-FOR-US: WordPress plugin
CVE-2026-92817 (The Ignition Perspective module does not properly validate
session pri ...)
- TODO: check
+ NOT-FOR-US: Ignition
CVE-2026-92426 (The YITH WooCommerce Popup WordPress plugin before 1.60.0 does
not che ...)
NOT-FOR-US: WordPress plugin
CVE-2026-92409 (The Donation Thermometer WordPress plugin before 2.3.0 does
not escape ...)
@@ -615,7 +615,7 @@ CVE-2026-90531 (Adobe Experience Manager is affected by an
Improper Restriction
CVE-2026-90530 (ColdFusion RDS is affected by an Improper Limitation of a
Pathname to ...)
NOT-FOR-US: Adobe
CVE-2026-89310 (A parameter taken from the request body is inserted into a
T-SQL state ...)
- TODO: check
+ NOT-FOR-US: JTL-WMS
CVE-2026-89288 (The Fast Courier WordPress plugin before 5.2.4 does not
sanitize and ...)
NOT-FOR-US: WordPress plugin
CVE-2026-88927 (The rtMedia for WordPress, BuddyPress and bbPress WordPress
plugin bef ...)
@@ -937,11 +937,11 @@ CVE-2026-86607 (Internal Application Information Exposure
Vulnerability in Hitac
CVE-2026-86573 (Out-of-bounds write vulnerability in Hitachi Disk Array Driver
for AIX ...)
NOT-FOR-US: Hitachi
CVE-2026-86063 (Claude Code is an agentic coding tool. Prior to 2.1.179, the
Claude Co ...)
- TODO: check
+ NOT-FOR-US: Claude Code
CVE-2026-86022 (VNote is a note-taking platform. Prior to 4.3.0,
SessionConfig::Extern ...)
- TODO: check
+ NOT-FOR-US: VNote
CVE-2026-86016 (VNote is a note-taking platform. Prior to 4.3.0, VNote uses
the assign ...)
- TODO: check
+ NOT-FOR-US: VNote
CVE-2026-85945 (Use after free in Windows Kernel allows an authorized attacker
to elev ...)
NOT-FOR-US: Microsoft
CVE-2026-85943 (Time-of-check time-of-use (toctou) race condition in Reliable
Multicas ...)
@@ -1281,7 +1281,7 @@ CVE-2026-85318 (Heap-based buffer overflow in Servicing
Stack Updates allows an
CVE-2026-85000 (The EmbedPress WordPress plugin before 4.6.8 does not perform
any cap ...)
NOT-FOR-US: WordPress plugin
CVE-2026-84994 (Qwik is a performance-focused JavaScript framework. Prior to
@builder. ...)
- TODO: check
+ - qwik <removed>
CVE-2026-84420 (Out-of-bounds read vulnerability in Citirx Citrix Workspace
app for Wi ...)
NOT-FOR-US: Citrix
CVE-2026-84419 (Out-of-bounds write vulnerability in Citrix Workspace app for
Windows. ...)
@@ -2679,47 +2679,47 @@ CVE-2026-66822 (Insertion of sensitive information into
sent data in .NET allows
CVE-2026-65674 (Deserialization of untrusted data in SQL Server allows an
authorized a ...)
NOT-FOR-US: Microsoft
CVE-2026-63174 (Omnispace Agora Project before 26.10.0 contains a broken
access contro ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63172 (Omnispace Agora Project before 26.10.0 contains a broken
access contro ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63171 (Omnispace Agora Project before 26.10.0 contains a stored
cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63169 (Omnispace Agora Project before 26.10.0 contains a stored
cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63168 (Omnispace Agora Project before 26.10.0 contains a stored
cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63165 (Omnispace Agora Project before 26.10.0 contains a SQL
injection vulner ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63163 (Omnispace Agora Project before 26.10.0 contains a broken
access contro ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63162 (Omnispace Agora Project before 26.10.0 contains a path
traversal vulne ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63161 (Omnispace Agora Project before 26.10.0 contains a session
fixation vul ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63160 (Omnispace Agora Project before 26.10.0 contains a
vulnerability where ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63159 (Omnispace Agora Project before 26.10.0 contains a predictable
password ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63158 (Omnispace Agora Project before 26.10.0 contains an
authentication bypa ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63157 (Omnispace Agora Project before 26.10.0 contains a stored
cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63156 (Omnispace Agora Project before 26.10.0 contains a reflected
cross-site ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63154 (Omnispace Agora Project before 26.10.0 contains a SQL
identifier injec ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63153 (Omnispace Agora Project before 26.10.0 contains a broken
access contro ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63152 (Omnispace Agora Project before 26.10.0 contains a second-order
SQL inj ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63149 (Omnispace Agora Project before 26.10.0 contains an insecure
randomness ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63148 (Omnispace Agora Project before 26.10.0 contains a stored
cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63147 (Omnispace Agora Project before 26.10.0 contains a stored
cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63146 (Omnispace Agora Project before 26.10.0 contains a code
injection vulne ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-62879 (Missing authentication for critical function in Windows
SmartScreen al ...)
NOT-FOR-US: Microsoft
CVE-2026-62840 (Time-of-check time-of-use (toctou) race condition in Linux
Kernel allo ...)
@@ -2733,21 +2733,21 @@ CVE-2026-59116 (Use of a broken or risky cryptographic
algorithm in Windows Remo
CVE-2026-58280 (Uncontrolled recursion in .NET allows an unauthorized attacker
to deny ...)
NOT-FOR-US: Microsoft
CVE-2026-56826 (Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until
2.9.2, ...)
- TODO: check
+ NOT-FOR-US: Shopper
CVE-2026-55601 (MultiTail is a utility for monitoring multiple log files in
one termin ...)
- TODO: check
+ NOT-FOR-US: MultiTail
CVE-2026-53564 (Vulnerability in Citrix UniconOS leading toArbitrary file read
and wri ...)
NOT-FOR-US: Citrix
CVE-2026-53563 (Vulnerability in Citrix UniconOS leading to Persistent Command
Executi ...)
NOT-FOR-US: Citrix
CVE-2026-50218 (Akamai GPA (Guardicore Platform Agent) client on all platforms
before ...)
- TODO: check
+ NOT-FOR-US: Akamai GPA
CVE-2026-50217 (A use-after-free vulnerability in the Windows WFP callout
driver of Ak ...)
- TODO: check
+ NOT-FOR-US: Akamai GPA
CVE-2026-50216 (An integer underflow exists in the DNS proxy component of the
macOS Ne ...)
- TODO: check
+ NOT-FOR-US: Akamai GPA
CVE-2026-50215 (A use-after-free exists in the Windows WFP packet-capture
driver shipp ...)
- TODO: check
+ NOT-FOR-US: Akamai GPA
CVE-2026-49950 (Xorbits Xoscar through 0.11.2 contains an unauthenticated
deserializat ...)
TODO: check
CVE-2026-49785 (Improper resource shutdown or release in Windows UEFI allows
an author ...)
@@ -2763,7 +2763,7 @@ CVE-2026-48378 (CAI Content Credentials is affected by an
Improper Input Validat
CVE-2026-48377 (CAI Content Credentials is affected by an Improper Input
Validation vu ...)
NOT-FOR-US: Adobe
CVE-2026-46449 (The Akamai Guardicore Platform Agent (GPA) before 7.4 for
macOS is aff ...)
- TODO: check
+ NOT-FOR-US: Akamai GPA
CVE-2026-34634 (ColdFusion is affected by a Server-Side Request Forgery (SSRF)
vulnera ...)
NOT-FOR-US: Adobe
CVE-2026-34633 (ColdFusion is affected by a Server-Side Request Forgery (SSRF)
vulnera ...)
@@ -2773,7 +2773,7 @@ CVE-2026-19810 (Symantec Endpoint Detection and Response
(SEDR) Console, prior t
CVE-2026-17092 (The Directorist: AI-Powered Business Directory, Listings &
Classified ...)
NOT-FOR-US: WordPress plugin
CVE-2026-16753 (Incorrect authorization in the library-query execution
endpoint in Low ...)
- TODO: check
+ NOT-FOR-US: lowcoder
CVE-2026-16495 (The Countdown Timer \u2013 Widget Countdown plugin for
WordPress is vu ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15468 (Authorization bypass through User-Controlled key vulnerability
in HYPR ...)
@@ -2781,7 +2781,7 @@ CVE-2026-15468 (Authorization bypass through
User-Controlled key vulnerability i
CVE-2026-14909 (IBM WebSphere Application Server - Liberty 17.0.0.3 through
26.0.0.9 i ...)
NOT-FOR-US: IBM
CVE-2026-14765 (Epic Games Unreal Engine versions up to and including 5.8.0
ship with ...)
- TODO: check
+ NOT-FOR-US: Epic Games Unreal Engine
CVE-2026-14532 (IBM WebSphere Application Server - Liberty 17.0.0.3 through
26.0.0.9 c ...)
NOT-FOR-US: IBM
CVE-2026-11713 (IBM WebSphere Application Server - Liberty 17.0.0.3 through
26.0.0.9 i ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/163c7c555d21947e7c55f06906ef0c7dd6b51928
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/163c7c555d21947e7c55f06906ef0c7dd6b51928
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
