Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
c2e72bf1 by Moritz Mühlenhoff at 2026-10-19T23:31:12+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -217,7 +217,7 @@ CVE-2026-3295 (IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is
vulnerable to cross
CVE-2026-3161 (IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than
expected cr ...)
NOT-FOR-US: IBM
CVE-2026-38671 (Cross Site Scripting vulnerability in Ellucian Banner Student
Registra ...)
- TODO: check
+ NOT-FOR-US: Ellucian Banner Student Registration
CVE-2026-1510 (IBM Concert 1.0 through 3.0.0 is vulnerable to Information
Disclosure ...)
NOT-FOR-US: IBM
CVE-2026-1501 (IBM Concert 1.0 through 3.0.0 is vulnerable to Improper
Certificate Va ...)
@@ -268,53 +268,53 @@ CVE-2026-112366 (Picomatch through 4.0.7 contains a
regular expression denial of
NOTE: https://github.com/micromatch/picomatch/pull/194
NOTE: node-anymatch provides node-picomatch
CVE-2026-112363 (Crawl4AI from 0.8.7 through 0.9.5 contains a server-side
request forge ...)
- TODO: check
+ NOT-FOR-US: Crawl4AI
CVE-2026-112329 (The Sensei LMS WordPress plugin before 4.26.4 contains a
broken access ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112328 (The Sensei LMS WordPress plugin before 4.26.4 contains a
broken access ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112310 (docling-core through 2.102.0 contains a local file disclosure
vulnerab ...)
- TODO: check
+ NOT-FOR-US: docling-core
CVE-2026-112309 (@rvf/set-get before 7.0.4 contains a prototype pollution
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Node @rvf/set-get
CVE-2026-112308 (crewai-tools through 1.15.28 contains a server-side request
forgery vu ...)
- TODO: check
+ NOT-FOR-US: crewai-tools
CVE-2026-112307 (sqlparse through 0.6.0 contains a PHP code injection
vulnerability tha ...)
TODO: check
CVE-2026-112306 (NocoBase @nocobase/plugin-collection-sql through 2.2.28
contains an SQ ...)
- TODO: check
+ NOT-FOR-US: NocoBase
CVE-2026-112305 (Semaphore UI through 2.19.16 contains a remote code execution
vulnerab ...)
- TODO: check
+ NOT-FOR-US: Semaphore UI
CVE-2026-112304 (docTR through 1.1.0 contains an unsafe deserialization
vulnerability i ...)
TODO: check
CVE-2026-112303 (GDevelop desktop app through 5.6.284 contains a credential
leak vulner ...)
- TODO: check
+ NOT-FOR-US: GDevelop
CVE-2026-112296 (FlyCms through commit edfdf724 contains a default credentials
vulnerab ...)
- TODO: check
+ NOT-FOR-US: FlyCms
CVE-2026-112295 (FlyCms through commit edfdf724 contains a mass assignment
vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: FlyCms
CVE-2026-112294 (FlyCms through commit edfdf724 contains a missing
authorization vulner ...)
- TODO: check
+ NOT-FOR-US: FlyCms
CVE-2026-112293 (BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a
missing au ...)
- TODO: check
+ NOT-FOR-US: BoxyHQ
CVE-2026-112292 (CheckCle through 1.6.0 contains a missing authorization
vulnerability ...)
- TODO: check
+ NOT-FOR-US: CheckCle
CVE-2026-112291 (Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8
lacks authen ...)
- TODO: check
+ NOT-FOR-US: Flarum Extension Manager
CVE-2026-112290 (Intelligence Community UI Kit @ukic/canary-web-components
3.0.0-canary ...)
- TODO: check
+ NOT-FOR-US: Intelligence Community UI Kit
CVE-2026-112289 (Koalixcrm through 1.14.0 contains a stored cross-site
scripting vulner ...)
- TODO: check
+ NOT-FOR-US: Koalixcrm
CVE-2026-112288 (Krayin CRM 2.2.5 before 2.2.7 contains a server-side request
forgery f ...)
- TODO: check
+ NOT-FOR-US: Krayin CRM
CVE-2026-112287 (Krayin CRM before 2.2.7 contains a broken object level
authorization v ...)
- TODO: check
+ NOT-FOR-US: Krayin CRM
CVE-2026-112286 (Krayin CRM before 2.2.7 contains an insecure direct object
reference v ...)
- TODO: check
+ NOT-FOR-US: Krayin CRM
CVE-2026-112285 (Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a
business logic v ...)
- TODO: check
+ NOT-FOR-US: Thelia
CVE-2026-112284 (libaribcaption 1.1.0 through 1.1.2 contains a global
out-of-bounds rea ...)
- TODO: check
+ NOT-FOR-US: libaribcaption
CVE-2026-112283 (VideoLAN libbluray through 1.5.1 contains an uncontrolled
memory alloc ...)
- libbluray <undetermined>
CVE-2026-112282 (VideoLAN libbluray through 1.5.1 contains an out-of-bounds
read vulner ...)
@@ -338,69 +338,69 @@ CVE-2026-112274 (libtins through 4.6 contains an
out-of-bounds read vulnerabilit
CVE-2026-112273 (libtins through 4.6 contains a heap out-of-bounds read
vulnerability i ...)
- libtins <undetermined>
CVE-2026-112272 (Libdisplay-info 0.4.0 contains a heap out-of-bounds read
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Libdisplay-info
CVE-2026-112271 (libdisplay-info through 0.4.0 contains a heap out-of-bounds
read vulne ...)
- TODO: check
+ NOT-FOR-US: Libdisplay-info
CVE-2026-112270 (SGLang through 0.5.22 with the Mooncake disaggregation
backend contain ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-112269 (SGLang through 0.5.22 with the Mooncake disaggregation
backend accepts ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-112268 (sglang-router (sgl-model-gateway) through 0.3.2 contains an
authorizat ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-112267 (SGLang through 0.5.22 in prefill/decode disaggregation mode
contains a ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-112266 (SGLang through 0.5.22 contains a denial of service
vulnerability that ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-112265 (LangBot through 4.11.0 contains a missing authenticity
verification vu ...)
- TODO: check
+ NOT-FOR-US: LangBot
CVE-2026-112264 (BentoML through 1.4.39 contains a Dockerfile instruction
injection vul ...)
- TODO: check
+ NOT-FOR-US: BentoML
CVE-2026-112263 (Television (tv) 0.15.0 through 0.15.9 contains an OS command
injection ...)
- TODO: check
+ NOT-FOR-US: Television (tv)
CVE-2026-112262 (RisingWave before 3.1.0 contains a missing authorization
vulnerability ...)
- TODO: check
+ NOT-FOR-US: RisingWave
CVE-2026-112259 (A flaw was found in GIMP. Importing a crafted SBZ palette
without a co ...)
TODO: check
CVE-2026-112252 (A vulnerability has been found in Wuxi Wubang Security
Software Wubang ...)
- TODO: check
+ NOT-FOR-US: Wuxi Wubang Security Software
CVE-2026-112251 (A vulnerability was detected in antoinersx clawhost up to
0.0.45. This ...)
- TODO: check
+ NOT-FOR-US: clawhost
CVE-2026-112249 (A vulnerability was detected in grandnode grandnode2 up to
2.3.0. Affe ...)
- TODO: check
+ NOT-FOR-US: grandnote2
CVE-2026-112248 (A security vulnerability has been detected in grandnode
grandnode2 up ...)
- TODO: check
+ NOT-FOR-US: grandnote2
CVE-2026-112247 (A weakness has been identified in Wuxi Wubang Security
Software Five-i ...)
- TODO: check
+ NOT-FOR-US: Wuxi Wubang Security Software
CVE-2026-112222 (Missing Authorization vulnerability in Surfer Surfer
surferseo allows ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-112214 (A flaw was found in the GStreamer ASF demuxer in
gst-plugins-ugly. Whe ...)
TODO: check
CVE-2026-112210 (A flaw was found in the rhc-canonical-facts.service systemd
unit shipp ...)
- TODO: check
+ NOT-FOR-US: Red Hat
CVE-2026-112199 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-112195 (A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5.
The affect ...)
- TODO: check
+ NOT-FOR-US: FusionPBX
CVE-2026-112193 (A vulnerability was detected in Webkul Aureus ERP up to
1.6.0. Impacte ...)
- TODO: check
+ NOT-FOR-US: Webkul Aureus ERP
CVE-2026-112192 (MISP contains a vulnerability in the handling of module
plugin setting ...)
- TODO: check
+ - misp <itp> (bug #1144317)
CVE-2026-112190 (A security vulnerability has been detected in Webkul Aureus
ERP up to ...)
- TODO: check
+ - misp <itp> (bug #1144317)
CVE-2026-112188 (MISP contains a vulnerability in its server settings lookup
mechanism ...)
- TODO: check
+ - misp <itp> (bug #1144317)
CVE-2026-112184 (MISP contains a reflected cross-site scripting (XSS)
vulnerability in ...)
- TODO: check
+ - misp <itp> (bug #1144317)
CVE-2026-112183 (MISP contains a CSS injection vulnerability in the remote
event previe ...)
- TODO: check
+ - misp <itp> (bug #1144317)
CVE-2026-112180 (MISP contains a data integrity flaw in its event deletion
logic. When ...)
- TODO: check
+ - misp <itp> (bug #1144317)
CVE-2026-112179 (In MISP, the event synchronization process contained a logic
error in ...)
- TODO: check
+ - misp <itp> (bug #1144317)
CVE-2026-112178 (MISP contains an access control flaw in the proposal (shadow
attribute ...)
- TODO: check
+ - misp <itp> (bug #1144317)
CVE-2026-112161 (MobaXterm Personal Edition (Portable) 26.4 GA extracts the
CygUtils64. ...)
- TODO: check
+ NOT-FOR-US: MobaXterm
CVE-2026-112159 (A security vulnerability has been detected in JumpServer up
to 4.10.19 ...)
TODO: check
CVE-2026-112158 (A weakness has been identified in MikroTik RouterOS up to
6.40.5/6.44/ ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c2e72bf1f1ff5f01dcff5b82ed567488563a5145
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c2e72bf1f1ff5f01dcff5b82ed567488563a5145
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
