Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
37a2b872 by Moritz Mühlenhoff at 2026-10-19T23:46:01+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -257,7 +257,7 @@ CVE-2026-11828 (IBM MQ could allow a remote attacker with
queue manager control
CVE-2026-11319 (TickTick Android application (com.ticktick.task) 8.2.2.0
contains a pa ...)
NOT-FOR-US: TickTick Android application (com.ticktick.task)
CVE-2026-112377 (CCC Attestation SIG attested-tls-poc through commit 731ca82
fails to b ...)
- TODO: check
+ NOT-FOR-US: CCC Attestation SIG attested-tls-poc
CVE-2026-112368 (An uncontrolled recursion weakness in the BSON decoding logic
of the M ...)
- php-mongodb <unfixed>
NOTE: https://jira.mongodb.org/browse/PHPC-276
@@ -286,7 +286,7 @@ CVE-2026-112306 (NocoBase @nocobase/plugin-collection-sql
through 2.2.28 contain
CVE-2026-112305 (Semaphore UI through 2.19.16 contains a remote code execution
vulnerab ...)
NOT-FOR-US: Semaphore UI
CVE-2026-112304 (docTR through 1.1.0 contains an unsafe deserialization
vulnerability i ...)
- TODO: check
+ NOT-FOR-US: docTR
CVE-2026-112303 (GDevelop desktop app through 5.6.284 contains a credential
leak vulner ...)
NOT-FOR-US: GDevelop
CVE-2026-112296 (FlyCms through commit edfdf724 contains a default credentials
vulnerab ...)
@@ -402,61 +402,61 @@ CVE-2026-112178 (MISP contains an access control flaw in
the proposal (shadow at
CVE-2026-112161 (MobaXterm Personal Edition (Portable) 26.4 GA extracts the
CygUtils64. ...)
NOT-FOR-US: MobaXterm
CVE-2026-112159 (A security vulnerability has been detected in JumpServer up
to 4.10.19 ...)
- TODO: check
+ NOT-FOR-US: JumpServer
CVE-2026-112158 (A weakness has been identified in MikroTik RouterOS up to
6.40.5/6.44/ ...)
NOT-FOR-US: MikroTik
CVE-2026-112157 (A weakness has been identified in MemTensor memmy-agent up to
1.0.9/1. ...)
- TODO: check
+ NOT-FOR-US: memmy-agent
CVE-2026-112153 (A vulnerability was detected in vraj404
Criminal-Management-System up ...)
- TODO: check
+ NOT-FOR-US: Criminal-Management-System
CVE-2026-112152 (A security vulnerability has been detected in vraj404
Criminal-Managem ...)
- TODO: check
+ NOT-FOR-US: Criminal-Management-System
CVE-2026-112151 (A weakness has been identified in vraj404 Criminal Management
System u ...)
- TODO: check
+ NOT-FOR-US: Criminal-Management-System
CVE-2026-112150 (A security flaw has been discovered in vraj404
Criminal-Management-Sys ...)
- TODO: check
+ NOT-FOR-US: Criminal-Management-System
CVE-2026-112149 (A vulnerability was identified in vraj404
Criminal-Management-System u ...)
- TODO: check
+ NOT-FOR-US: Criminal-Management-System
CVE-2026-112147 (A vulnerability was found in ai-genius-automations octoally
up to 1.0. ...)
- TODO: check
+ NOT-FOR-US: ai-genius-automations
CVE-2026-112146 (A vulnerability was detected in D-Link E15, M32, R15 and R32.
This iss ...)
NOT-FOR-US: D-Link
CVE-2026-112145 (A security vulnerability has been detected in speaches-ai
speaches up ...)
- TODO: check
+ NOT-FOR-US: speaches-ai
CVE-2026-112144 (A weakness has been identified in satya-vinay
Events-Management-System ...)
- TODO: check
+ NOT-FOR-US: Events-Management-System
CVE-2026-112143 (A security flaw has been discovered in satya-vinay
Events-Management-S ...)
- TODO: check
+ NOT-FOR-US: Events-Management-System
CVE-2026-112142 (A vulnerability was identified in satya-vinay
Events-Management-System ...)
- TODO: check
+ NOT-FOR-US: Events-Management-System
CVE-2026-112141 (A vulnerability was determined in satya-vinay
Events-Management-System ...)
- TODO: check
+ NOT-FOR-US: Events-Management-System
CVE-2026-112140 (A vulnerability was found in llSourcell Doctor-Dignity up to
3f2ffb6c8 ...)
- TODO: check
+ NOT-FOR-US: llSourcell Doctor-Dignity
CVE-2026-112139 (A vulnerability has been found in subhajitkhan
online-clinic-managemen ...)
- TODO: check
+ NOT-FOR-US: online-clinic-management
CVE-2026-112138 (A flaw has been found in diem-project diem up to 5.1.3. The
impacted e ...)
- TODO: check
+ NOT-FOR-US: diem-project diem
CVE-2026-112108 (A vulnerability was determined in ztxz16 fastllm up to
0.1.8.2. This i ...)
- TODO: check
+ NOT-FOR-US: fastllm
CVE-2026-112107 (A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected
by this ...)
- TODO: check
+ NOT-FOR-US: fastllm
CVE-2026-112106 (A security vulnerability has been detected in TufayelLUS
TikTok-Video- ...)
- TODO: check
+ NOT-FOR-US: TikTok-Video-Decoder-PHP
CVE-2026-112105 (A vulnerability has been found in GlitterWare Passy up to
1.10.1. The ...)
- TODO: check
+ NOT-FOR-US: GlitterWare Passy
CVE-2026-112104 (A flaw has been found in eremef bandcamp-player up to
1.8.33-beta. The ...)
- TODO: check
+ NOT-FOR-US: bandcamp-player
CVE-2026-112103 (A vulnerability has been found in f3-factory fatfree-core up
to 3.9.2. ...)
- TODO: check
+ NOT-FOR-US: fatfree-core
CVE-2026-112102 (A vulnerability was detected in AXA Group NLP.js 4.27.0. This
impacts ...)
- TODO: check
+ NOT-FOR-US: NLP.js
CVE-2026-112101 (A vulnerability was determined in BlackBeltTechnology
pi-agent-dashboa ...)
- TODO: check
+ NOT-FOR-US: pi-agent-dashboard
CVE-2026-112100 (A vulnerability was determined in DeepPavlov up to 1.7.0.
This affects ...)
- TODO: check
+ NOT-FOR-US: DeepPavlov
CVE-2026-112098 (A security flaw has been discovered in DeepPavlov up to
1.7.0. Impacte ...)
- TODO: check
+ NOT-FOR-US: DeepPavlov
CVE-2026-112097 (A vulnerability was found in SourceCodester Inventory System
1.0. This ...)
NOT-FOR-US: SourceCodester
CVE-2026-112096 (A vulnerability has been found in SourceCodester Inventory
System 1.0. ...)
@@ -466,13 +466,13 @@ CVE-2026-112095 (A flaw has been found in SourceCodester
Inventory System 1.0. T
CVE-2026-112094 (A security vulnerability has been detected in michaelrsweet
mxml 4.0.5 ...)
TODO: check
CVE-2026-112093 (A vulnerability has been found in subhajitkhan
online-clinic-managemen ...)
- TODO: check
+ NOT-FOR-US: online-clinic-management-system
CVE-2026-112092 (A flaw has been found in subhajitkhan
online-clinic-management-system ...)
- TODO: check
+ NOT-FOR-US: online-clinic-management-system
CVE-2026-112091 (A flaw has been found in Dav-ee dairy-management-system
31ace9692d1e1e ...)
- TODO: check
+ NOT-FOR-US: dairy-management-system
CVE-2026-112090 (A vulnerability was detected in Dav-ee
dairy-management-system 31ace96 ...)
- TODO: check
+ NOT-FOR-US: dairy-management-system
CVE-2026-111939 (Frappe Helpdesk before 1.26.0 contains an authorization
bypass vulnera ...)
NOT-FOR-US: Frappe
CVE-2026-111938 (Frappe CRM before 1.74.0 contains a missing authorization
vulnerabilit ...)
@@ -480,17 +480,17 @@ CVE-2026-111938 (Frappe CRM before 1.74.0 contains a
missing authorization vulne
CVE-2026-111937 (Frappe CRM before 1.81.2 contains a missing authorization
vulnerabilit ...)
NOT-FOR-US: Frappe
CVE-2026-111936 (Sigma File Manager through 2.2.0 contains a server-side
request forger ...)
- TODO: check
+ NOT-FOR-US: Sigma File Manager
CVE-2026-111935 (NoteGen through 0.38.3 contains an external control of file
path vulne ...)
- TODO: check
+ NOT-FOR-US: NoteGen
CVE-2026-111925 (Mopidy before 4.0.5 contains a path traversal vulnerability
that allow ...)
TODO: check
CVE-2026-111915 (Yank Note before 3.93.1 contains a path traversal
vulnerability that a ...)
- TODO: check
+ NOT-FOR-US: Yank Note
CVE-2026-111899 (KitchenOwl through 0.7.10 contains a server-side request
forgery vulne ...)
- TODO: check
+ NOT-FOR-US: KitchenOwl
CVE-2026-111883 (Locust through 2.46.7 contains a cross-site request forgery
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Locust
CVE-2026-111862 (Rank Math SEO PRO for WordPress is affected by a supply-chain
compromi ...)
NOT-FOR-US: WordPress plugin
CVE-2026-111845 (Missing Authorization vulnerability in YITH YITH WooCommerce
Product B ...)
@@ -508,7 +508,7 @@ CVE-2026-111828 (Improper Validation of Specified Quantity
in Input vulnerabilit
CVE-2026-111759 (markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2,
when typ ...)
TODO: check
CVE-2026-111757 (Hono is a Web application framework that provides support for
any Java ...)
- TODO: check
+ NOT-FOR-US: Hono
CVE-2026-111755 (follow-redirects is a Node.js HTTP and HTTPS client wrapper
that autom ...)
TODO: check
CVE-2026-111750 (AIOHTTP is an asynchronous HTTP client/server framework for
asyncio an ...)
@@ -518,9 +518,9 @@ CVE-2026-111749 (AIOHTTP is an asynchronous HTTP
client/server framework for asy
CVE-2026-111748 (AIOHTTP is an asynchronous HTTP client/server framework for
asyncio an ...)
TODO: check
CVE-2026-111439 (\u5728 openGauss-server\u7684
src/common/backend/utils/adt/genfile.cpp ...)
- TODO: check
+ NOT-FOR-US: openGauss-server
CVE-2026-111438 (\u5728 openGauss-server \u7684
src/common/backend/libpq/hba.cpp \u4e2d ...)
- TODO: check
+ NOT-FOR-US: openGauss-server
CVE-2026-111414 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-111410 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -544,19 +544,19 @@ CVE-2026-111063 (AIOHTTP is an asynchronous HTTP
client/server framework for asy
CVE-2026-111061 (russh is a Rust SSH client and server library that includes
an SSH age ...)
TODO: check
CVE-2026-111059 (Mercury is a Python framework for sharing Jupyter notebooks
as web app ...)
- TODO: check
+ NOT-FOR-US: Mercury
CVE-2026-111058 (Mercury is a Python framework for sharing Jupyter notebooks
as web app ...)
- TODO: check
+ NOT-FOR-US: Mercury
CVE-2026-111057 (Mercury is a Python framework for sharing Jupyter notebooks
as web app ...)
- TODO: check
+ NOT-FOR-US: Mercury
CVE-2026-111056 (FOSSBilling is an open source billing and client-management
platform. ...)
- TODO: check
+ NOT-FOR-US: FOSSBilling
CVE-2026-111053 (FOSSBilling is an open source billing and client-management
platform. ...)
- TODO: check
+ NOT-FOR-US: FOSSBilling
CVE-2026-111046 (FOSSBilling is an open source billing and client-management
platform. ...)
- TODO: check
+ NOT-FOR-US: FOSSBilling
CVE-2026-111045 (CLI Bridge provides filesystem access within a workspace
root. Prior t ...)
- TODO: check
+ NOT-FOR-US: CLI Bridge
CVE-2026-110902 (Authorization Bypass Through User-Controlled Key
vulnerability in Liqu ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-110898 (Incorrect Privilege Assignment vulnerability in WPDeveloper
Essential ...)
@@ -568,7 +568,7 @@ CVE-2026-110379 (Improper Neutralization of Input During
Web Page Generation ('C
CVE-2026-110363 (Missing Authorization vulnerability in ThimPress LearnPress
learnpress ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-110008 (@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows.
In versio ...)
- TODO: check
+ NOT-FOR-US: @fastify/oauth2
CVE-2026-10743 (IBM MQ could allow an authenticated attacker to cause a denial
of serv ...)
NOT-FOR-US: IBM
CVE-2026-10574 (IBM MQ could allow an authenticated attacker to cause a denial
of serv ...)
@@ -576,15 +576,15 @@ CVE-2026-10574 (IBM MQ could allow an authenticated
attacker to cause a denial o
CVE-2026-10572 (IBM MQ could allow an authenticated attacker to cause a denial
of serv ...)
NOT-FOR-US: IBM
CVE-2026-109437 (Cognition before 0.13.0 contains an unauthenticated remote
code execut ...)
- TODO: check
+ NOT-FOR-US: Cognition
CVE-2026-109434 (Fenrir Sleipnir Browser for Android before 3.9.0 contains a
UI spoofin ...)
- TODO: check
+ NOT-FOR-US: Fenrir Sleipnir Browser
CVE-2026-109433 (Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17
contains an au ...)
- TODO: check
+ NOT-FOR-US: Camunda
CVE-2026-109432 (Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17
contains an ex ...)
- TODO: check
+ NOT-FOR-US: Camunda
CVE-2026-109431 (Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17
contains a mis ...)
- TODO: check
+ NOT-FOR-US: Camunda
CVE-2026-108837 (Allocation of resources without limits or throttling
vulnerability in ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108833 (Default startup profile miss security settingsin Apache
Kylin. Any dep ...)
@@ -604,37 +604,37 @@ CVE-2026-108764 (Server-Side request forgery (SSRF)
vulnerability in Apache Kyli
CVE-2026-108762 (Path-confinement bypassduring metadata backup deletion in
Apache Kylin ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-107571 (Incorrect default permissions in the Windows installer of
Progressive ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot
CVE-2026-107569 (Unchecked input for a loop condition in Progressive Robot
hMailServer ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot
CVE-2026-107568 (Missing authorization in the Sieve notify action (6.2.22
through 6.3.6 ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot
CVE-2026-107567 (Use of a less trusted source in the DKIM signing of
Progressive Robot ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot
CVE-2026-107566 (Missing authorization in the Sieve editheader action (6.2.22
through 6 ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot
CVE-2026-107188 (A user can upload export reports with any file contents and
specify an ...)
- TODO: check
+ NOT-FOR-US: Eptura Archibus
CVE-2026-107187 (A user can access any database details, such as usernames and
password ...)
- TODO: check
+ NOT-FOR-US: Eptura Archibus
CVE-2026-107186 (An unauthenticated user can send a DWR request with
isPasswordUppercas ...)
- TODO: check
+ NOT-FOR-US: Eptura Archibus
CVE-2026-107084 (Slims (Senayan Library Management Systems) 9 Bulian 9.8.0
allows cross ...)
- TODO: check
+ NOT-FOR-US: Senayan Library Management Systems
CVE-2026-107083 (SENAYAN Library Management System (SLiMS) Bulian
(slims9_bulian) 9.8.0 ...)
- TODO: check
+ NOT-FOR-US: Senayan Library Management Systems
CVE-2026-107082 (Slims (Senayan Library Management Systems) 9 Bulian 9.8.0
allows an au ...)
- TODO: check
+ NOT-FOR-US: Senayan Library Management Systems
CVE-2026-107081 (SQL injection via identifier injection in the tableName and
tableField ...)
- TODO: check
+ NOT-FOR-US: Senayan Library Management Systems
CVE-2026-105810 (Tapo C320WS V2.0 contains an authenticated stack-based buffer
overflow ...)
NOT-FOR-US: TPLink
CVE-2026-104679 (VOCALOID6 Editor provided by Yamaha Corporation improperly
restricts X ...)
- TODO: check
+ NOT-FOR-US: VOCALOID6
CVE-2026-103314 (A flaw was found in Red Hat Advanced Cluster Security for
Kubernetes ( ...)
- TODO: check
+ NOT-FOR-US: Red Hat
CVE-2026-103038 (PingTools Network Utilities 4.64 Free accepts an arbitrary
value in th ...)
- TODO: check
+ NOT-FOR-US: PingTools Network Utilities
CVE-2025-7203 (The Management Console and product files expose sensitive data,
includ ...)
NOT-FOR-US: WSO2
CVE-2025-7043 (The ForgeRock client fails to correctly validate refresh
tokens. This ...)
@@ -642,13 +642,13 @@ CVE-2025-7043 (The ForgeRock client fails to correctly
validate refresh tokens.
CVE-2025-6623 (The carbon console accepts user-supplied XML input without
sufficientl ...)
NOT-FOR-US: WSO2
CVE-2025-60482 (A heap use-after-free in the gf_odf_ac4_cfg_clean_list
function (/odf/ ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60480 (A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info
function ...)
- TODO: check
+ - gpac <removed>
CVE-2025-55667 (A segmentation violation in the dump_isom_saps function
(/mp4box/filed ...)
- TODO: check
+ - gpac <removed>
CVE-2025-55654 (A use-after-free in the gf_filter_pid_get_packet function
(filter_core ...)
- TODO: check
+ - gpac <removed>
CVE-2025-52290 (A NULL pointer dereference in the
avpriv_h264_has_num_reorder_frames f ...)
TODO: check
CVE-2025-13591 (The authentication endpoint of WSO2 Identity Server fails to
provide a ...)
@@ -758,9 +758,9 @@ CVE-2026-74922 (The Document Gallery WordPress plugin
through 5.1.1 does not ver
CVE-2026-74921 (The Document Gallery WordPress plugin through 5.1.1 does not
sanitise ...)
NOT-FOR-US: WordPress plugin
CVE-2026-16487 (A flaw was found in bootc when operating with the default
containers s ...)
- TODO: check
+ NOT-FOR-US: bootc
CVE-2026-16460 (A flaw was found in bootc and ostree. Already-staged
deployments are f ...)
- TODO: check
+ NOT-FOR-US: bootc
CVE-2026-112112 (An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD
Internet Routing ...)
- bird3 <unfixed>
- bird2 <unfixed>
@@ -844,9 +844,9 @@ CVE-2026-112026 (A security vulnerability has been detected
in light0011 cms c77
CVE-2026-112025 (A weakness has been identified in light0011 cms
c774dce31c6df0055568a8 ...)
NOT-FOR-US: light0011 cms
CVE-2026-111441 (\u5728 openGauss-server \u7684
src/gausskernel/cbb/utils/hll/hll.cpp \ ...)
- TODO: check
+ NOT-FOR-US: openGauss-server
CVE-2026-111440 (\u5728 openGauss-connector-jdbc \u7684
pgjdbc/src/main/java/org/postgr ...)
- TODO: check
+ NOT-FOR-US: openGauss-server
CVE-2026-110034 (The Salon Booking System WordPress plugin before 10.31.11
does not enf ...)
NOT-FOR-US: WordPress plugin
CVE-2026-108984 (A vulnerability is in Web Server default connection ports
under the pr ...)
@@ -870,9 +870,9 @@ CVE-2026-106010 (The BDM Digital Payment Gateway WordPress
plugin through 1.3.12
CVE-2026-103311 (The Coinbase Commerce Payment Gateway for WooCommerce
WordPress plugin ...)
NOT-FOR-US: WordPress plugin
CVE-2026-103091 (Missing Authorization (CWE-862) and Initialization of a
Resource with ...)
- TODO: check
+ NOT-FOR-US: Google SAM
CVE-2026-102503 (Missing Authentication for Critical Function (CWE-306) and
Missing Aut ...)
- TODO: check
+ NOT-FOR-US: Google SAM
CVE-2026-110336
- libplack-perl 1.0055-1 (unimportant; bug #1151241)
NOTE: Fixed by:
https://github.com/plack/Plack/commit/92eba54ba698b4dad9009604064c9f9fe40e01eb
(1.0055)
@@ -1079,7 +1079,7 @@ CVE-2026-110031 (The Salon Booking System WordPress
plugin before 10.31.11 does
CVE-2026-110026 (The Tasty Recipes Lite WordPress plugin before 1.2.11 does
not correc ...)
NOT-FOR-US: WordPress plugin
CVE-2026-110024 (@fastify/jwt is a JWT utility plugin for Fastify. In versions
prior to ...)
- TODO: check
+ NOT-FOR-US: @fastify/jwt
CVE-2026-109937 (The Otter Blocks WordPress plugin before 3.2.3 does not
validate that ...)
NOT-FOR-US: WordPress plugin
CVE-2026-109895 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/37a2b872effa66cd30618a23d0b1d288450c86ff
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/37a2b872effa66cd30618a23d0b1d288450c86ff
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
