Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
38232ee8 by Moritz Muehlenhoff at 2026-10-17T13:49:54+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3678,13 +3678,13 @@ CVE-2026-101019 (Description NGINX JavaScript (njs) has
a vulnerability where th
- libnginx-mod-js 1.0.2-1
NOTE: https://my.f5.com/manage/s/article/K000162615
CVE-2026-100413 (SeaweedFS is a distributed storage system for files and
blobs. From 4. ...)
- TODO: check
+ - seaweedfs <itp> (bug #956957)
CVE-2026-100406 (dbt enables data analysts and engineers to transform their
data using ...)
TODO: check
CVE-2026-100404 (Zulip is an open-source team collaboration tool. In Zulip
Server versi ...)
- TODO: check
+ - zulip-server <itp> (bug #800052)
CVE-2026-100394 (Nezha Monitoring is a self-hostable, lightweight, servers and
websites ...)
- TODO: check
+ NOT-FOR-US: Nezha Monitoring
CVE-2026-100236 (A flaw was found in the DPDK GSO library. When software GSO
copies pac ...)
- dpdk 25.11.4-1
NOTE: https://bugs.dpdk.org/show_bug.cgi?id=2047
@@ -3702,17 +3702,17 @@ CVE-2026-0322 (A remote code execution (RCE)
vulnerability in the management int
CVE-2025-9373 (The PeproDev Branches Map plugin for WordPress is vulnerable to
Stored ...)
NOT-FOR-US: WordPress plugin
CVE-2025-71433 (Kaneo before 2.1.6 contains a missing authorization
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: Kaneo
CVE-2024-58392 (PhysicsFS through 3.2.0 contains an out-of-bounds read
vulnerability i ...)
TODO: check
CVE-2020-37282 (office-converter through 1.0.2 contains an OS command
injection vulner ...)
- TODO: check
+ NOT-FOR-US: office-converter
CVE-2020-37281 (Gravitee API Management through 4.12.22 contains an
authentication byp ...)
- TODO: check
+ NOT-FOR-US: Gravitee
CVE-2017-20286 (DevIL through 1.8.0 contains a heap-based buffer overflow in
iGetPalet ...)
TODO: check
CVE-2016-20099 (L-SMASH through 2.14.5 contains an infinite loop vulnerability
in vc1_ ...)
- TODO: check
+ NOT-FOR-US: L-SMASH
CVE-2016-15060 (A vulnerability was found in PCMan FTP Server up to 2.0.7.
This affect ...)
NOT-FOR-US: PCMan FTP Server
CVE-2026-98418 (In the Linux kernel, the following vulnerability has been
resolved: s ...)
@@ -7075,7 +7075,7 @@ CVE-2026-104995 (The BP Profile Search plugin for
WordPress is vulnerable to Loc
CVE-2026-104922
REJECTED
CVE-2026-104875 (Ente provides end-to-end encrypted cloud services and
security tools. ...)
- TODO: check
+ NOT-FOR-US: Ente
CVE-2026-104800 (The AGE-GATE plugin for WordPress is vulnerable to Remote
Code Executi ...)
NOT-FOR-US: WordPress plugin
CVE-2026-104767 (The Membership & User Roles for WooCommerce (Automatic Role
Changer) p ...)
@@ -7087,11 +7087,11 @@ CVE-2026-104749 (The Bit integrations \u2013 Form
Integration, Webhook, Spreadsh
CVE-2026-104644 (The Image Photo Gallery Final Tiles Grid WordPress plugin
before 3.6.1 ...)
NOT-FOR-US: WordPress plugin
CVE-2026-104587 (blob42 gosuki through commit 6e2bf34 contains a Stored
Cross-Site Scri ...)
- TODO: check
+ NOT-FOR-US: blob42 gosuki
CVE-2026-104585 (Mobile Security Framework (MobSF) v4.5.2 is vulnerable to
Command Inje ...)
- TODO: check
+ NOT-FOR-US: Mobile Security Framework (MobSF)
CVE-2026-104584 (reNgine up to v2.2.0 and current master branch (commit
de4199222cca561 ...)
- TODO: check
+ NOT-FOR-US: reNgine
CVE-2026-104348 (Photoshop Desktop is affected by a Heap-based Buffer Overflow
vulnerab ...)
NOT-FOR-US: Adobe
CVE-2026-104347 (Photoshop Desktop is affected by an out-of-bounds write
vulnerability ...)
@@ -7101,7 +7101,7 @@ CVE-2026-104346 (Photoshop Desktop is affected by an
out-of-bounds write vulnera
CVE-2026-104345 (CAI Content Credentials is affected by an Improper Input
Validation vu ...)
NOT-FOR-US: Adobe
CVE-2026-104252 (Vitess is a database clustering system for horizontal scaling
of MySQL ...)
- TODO: check
+ NOT-FOR-US: Vitess
CVE-2026-103855 (Dimension is affected by a NULL Pointer Dereference
vulnerability that ...)
NOT-FOR-US: Adobe
CVE-2026-103854 (Dimension is affected by a Stack-based Buffer Overflow
vulnerability t ...)
@@ -8118,7 +8118,7 @@ CVE-2026-110219 (QloApps through 1.7.0 contains a
reflected cross-site scripting
CVE-2026-110218 (Aureus ERP through 1.6.0 contains an authorization bypass
vulnerabilit ...)
NOT-FOR-US: Aureus ERP
CVE-2026-110217 (Lenve vhr through commit 03abbd3 contains an information
disclosure vu ...)
- TODO: check
+ NOT-FOR-US: Lenve vhr
CVE-2026-110216 (youlai-boot through 2.21.1 contains a missing authorization
vulnerabil ...)
NOT-FOR-US: youlai-boot
CVE-2026-110215 (youlai-boot through 2.21.1 contains a missing authorization
vulnerabil ...)
@@ -8604,7 +8604,7 @@ CVE-2026-103965 (An issue in MongoDB Server's aggregation
framework can cause ce
- mongodb <removed>
NOTE: https://jira.mongodb.org/browse/SERVER-134618
CVE-2026-103937 (Misskey is an open source, federated social media platform.
From 13.0. ...)
- TODO: check
+ NOT-FOR-US: Misskey
CVE-2026-103928 (Metabase is an open source business intelligence and
analytics platfor ...)
TODO: check
CVE-2026-103857 (Adobe Framemaker is affected by an out-of-bounds read
vulnerability th ...)
@@ -8618,9 +8618,9 @@ CVE-2026-103572 (Improper control of generation of code
('code injection') in Vi
CVE-2026-103499 (IBM WebSphere Application Server - Liberty 17.0.0.3 through
26.0.0.10 ...)
NOT-FOR-US: IBM
CVE-2026-103418 (Firefox for iOS directly interpolated the page\u2019s HTML
language at ...)
- TODO: check
+ NOT-FOR-US: Firefox for iOS
CVE-2026-103417 (Firefox for iOS could autofill saved credentials into a new
page if cr ...)
- TODO: check
+ NOT-FOR-US: Firefox for iOS
CVE-2026-103076 (Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill
User Reg ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-103030 (Dio is a powerful HTTP client for Dart and Flutter. From
1.0.0 until 2 ...)
@@ -8648,9 +8648,9 @@ CVE-2026-102734 (asteval is a Python expression evaluator
designed for restricte
NOTE: https://github.com/lmfit/asteval/pull/153
NOTE: Fixed by (merge):
https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4
(1.0.9)
CVE-2026-102672 (Electron is a framework for writing cross-platform desktop
application ...)
- TODO: check
+ - electron <itp> (bug #842420)
CVE-2026-102603 (Gotify server is a simple server for sending and receiving
messages in ...)
- TODO: check
+ NOT-FOR-US: Gotify
CVE-2026-102562 (The AcyMailing plugin for WordPress is vulnerable to Stored
Cross-Site ...)
NOT-FOR-US: WordPress plugin
CVE-2026-102250 (CWE-345: Insufficient Verification of Data Authenticity
vulnerability ...)
@@ -8673,7 +8673,7 @@ CVE-2026-101899 (Axios is a promise-based HTTP client for
the browser and Node.j
NOTE: https://github.com/axios/axios/pull/11141
NOTE:
https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a
(v1.20.0)
CVE-2026-101020 (An incorrect permission assignment for critical resource
issue exists ...)
- TODO: check
+ NOT-FOR-US: AssetView
CVE-2026-100133 (Adobe Commerce is affected by a stored Cross-Site Scripting
(XSS) vuln ...)
NOT-FOR-US: Adobe
CVE-2026-0893 (AMI APTIOV contains a vulnerability in BIOS where an attacker
may caus ...)
@@ -8691,17 +8691,17 @@ CVE-2025-57739 (An improper neutralization of special
elements used in an SQL Co
CVE-2025-46773 (An Improper Neutralization of Special Elements used in an SQL
Command ...)
NOT-FOR-US: Fortinet
CVE-2024-34326 (ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain
a reflec ...)
- TODO: check
+ NOT-FOR-US: ProPhoenix Law RMS
CVE-2024-34324 (An issue in ProPhoenix Law RMS v2022.2403.3.101 allows
attackers to ex ...)
- TODO: check
+ NOT-FOR-US: ProPhoenix Law RMS
CVE-2024-34323 (ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain
an Insec ...)
- TODO: check
+ NOT-FOR-US: ProPhoenix Law RMS
CVE-2024-34321 (ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain
a reflec ...)
- TODO: check
+ NOT-FOR-US: ProPhoenix Law RMS
CVE-2024-34320 (ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain
an incor ...)
- TODO: check
+ NOT-FOR-US: ProPhoenix Law RMS
CVE-2024-34319 (A Server-Side Request Forgery (SSRF) in the serviceURL
parameter of Pr ...)
- TODO: check
+ NOT-FOR-US: ProPhoenix Law RMS
CVE-2026-109783 (Mitigation bypass in the File Handling component. This
vulnerability w ...)
{DSA-6560-1 DLA-4836-1}
- firefox-esr 153.5.0esr-1
@@ -9875,13 +9875,13 @@ CVE-2026-104140 (QGIS is a free, open source,
cross-platform geographic informat
CVE-2026-103549 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-103316 (The macOS version of the DigiD app is not signed with
Hardened Runtime ...)
- TODO: check
+ NOT-FOR-US: macOS version of the DigiD app
CVE-2026-102627 (IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could
allow a rem ...)
NOT-FOR-US: IBM
CVE-2026-102596 (Nango is an open-source platform for connecting agents and
products to ...)
- TODO: check
+ NOT-FOR-US: Nango
CVE-2026-102539 (Super Productivity is an advanced todo list app with
integrated timebo ...)
- TODO: check
+ NOT-FOR-US: Super Productivity
CVE-2026-101168 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-100755 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
@@ -9895,7 +9895,7 @@ CVE-2025-71431 (Frappe before 14.99.2 and 15.x before
15.86.0 contains an LDAP i
CVE-2025-71430 (Frappe before 14.99.10 and 15.x before 15.91.1 contains a
stored cross ...)
NOT-FOR-US: Frappe
CVE-2025-71429 (GPT-SoVITS through 20250606v2pro contains an OS command
injection vuln ...)
- TODO: check
+ NOT-FOR-US: GPT-SoVITS
CVE-2025-27902 (IBM DB2 Recovery Expert for Linux, UNIX and Windows5.5 IF 2
uses a web ...)
NOT-FOR-US: IBM
CVE-2025-27897 (IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2
is vulner ...)
@@ -9909,7 +9909,7 @@ CVE-2024-58391 (Frappe before 14.58.0 and 15.x before
15.4.0 contains a cross-si
CVE-2024-58390 (Frappe before 14.81.4 and 15.x before 15.41.0 contains an
improper pri ...)
NOT-FOR-US: Frappe
CVE-2024-58389 (HoloViz Panel from 1.2.2 before 1.9.0 contains an open
redirect vulner ...)
- TODO: check
+ NOT-FOR-US: HoloViz Panel
CVE-2023-54412 (Frappe before 13.46.3 and 14.x before 14.21.1 contains an
improper acc ...)
NOT-FOR-US: Frappe
CVE-2023-54411 (Frappe framework before 13.32.0 uses weak authentication for
print vie ...)
@@ -9925,7 +9925,7 @@ CVE-2023-54407 (Frappe 14.x before 14.45.0 contains an
information disclosure vu
CVE-2023-54406 (Frappe before 14.59.0 and 15.x before 15.5.0 contains a
sandbox flaw w ...)
NOT-FOR-US: Frappe
CVE-2022-51020 (Flower before 2.2.0 contains a cross-site request forgery
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Flower
CVE-2021-48012 (fast-toml through 0.5.4 contains a prototype pollution
vulnerability t ...)
TODO: check
CVE-2021-48011 (Servor 1.0.0 through 4.0.2 contains a path traversal
vulnerability tha ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/38232ee851f99a651e094225c3582ed8a916f9d8
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/38232ee851f99a651e094225c3582ed8a916f9d8
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
