[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Aug 7 08:46:21 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
c48fbdc4 by Salvatore Bonaccorso at 2026-08-07T09:45:58+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -5,11 +5,11 @@ CVE-2026-7406 (A maliciously crafted BMP file, when parsed through certain Autod
CVE-2026-7405 (A maliciously crafted TIF file, when parsed through certain Autodesk p ...)
NOT-FOR-US: Autodesk
CVE-2026-71555 (PILOS (Platform for Interactive Live-Online Seminars) is a frontend fo ...)
- TODO: check
+ NOT-FOR-US: PILOS (Platform for Interactive Live-Online Seminars)
CVE-2026-71554 (h2 is a pure-Python implementation of a HTTP/2 protocol stack. Version ...)
TODO: check
CVE-2026-71502 (CTI-Transmute contains a stored cross-site scripting vulnerability cau ...)
- TODO: check
+ NOT-FOR-US: CTI-Transmute
CVE-2026-71498 (node-re2 provides RE2 regular expression bindings for Node.js. Prior t ...)
TODO: check
CVE-2026-71497 (jsoup is a Java library for working with real-world HTML. From 1.14.3 ...)
@@ -21,11 +21,11 @@ CVE-2026-71478 (league/commonmark is a PHP library for parsing and rendering Com
CVE-2026-71476 (Nx is a monorepo solution for TypeScript and polyglot codebases. From ...)
TODO: check
CVE-2026-71447 (AIL Project contains a stored cross-site scripting vulnerability in th ...)
- TODO: check
+ NOT-FOR-US: AIL framework
CVE-2026-71446 (AIL Framework contains a stored cross-site scripting vulnerability in ...)
- TODO: check
+ NOT-FOR-US: AIL framework
CVE-2026-71445 (AIL Framework contained a reflected cross-site scripting vulnerability ...)
- TODO: check
+ NOT-FOR-US: AIL framework
CVE-2026-71439 (Mermaid is a JavaScript tool that uses Markdown-inspired text to creat ...)
TODO: check
CVE-2026-71438 (Mermaid is a JavaScript tool that uses Markdown-inspired text to creat ...)
@@ -35,11 +35,11 @@ CVE-2026-71437 (Mermaid is a JavaScript tool that uses Markdown-inspired text to
CVE-2026-71436 (Mermaid is a JavaScript tool that uses Markdown-inspired text to creat ...)
TODO: check
CVE-2026-71435 (Statamic is a Laravel and Git powered content management system (CMS). ...)
- TODO: check
+ NOT-FOR-US: Statamic CMS
CVE-2026-71434 (Statamic is a Laravel and Git powered content management system (CMS). ...)
- TODO: check
+ NOT-FOR-US: Statamic CMS
CVE-2026-71433 (LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres a ...)
- TODO: check
+ NOT-FOR-US: LangGraph Checkpoint
CVE-2026-71430 (node-re2 provides RE2 regular expression bindings for Node.js. Prior t ...)
TODO: check
CVE-2026-71327 (Traefik is an open source HTTP reverse proxy and load balancer. From 3 ...)
@@ -59,11 +59,11 @@ CVE-2026-70638 (llama.cpp builds b1886 through b7445 contain an integer overflow
CVE-2026-70636 (Flowise through 3.1.4 contains an authentication bypass vulnerability ...)
NOT-FOR-US: Flowise
CVE-2026-70635 (TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-o ...)
- TODO: check
+ NOT-FOR-US: Timescale TimescaleDB
CVE-2026-70634 (TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-o ...)
- TODO: check
+ NOT-FOR-US: Timescale TimescaleDB
CVE-2026-70633 (TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-o ...)
- TODO: check
+ NOT-FOR-US: Timescale TimescaleDB
CVE-2026-70632 (FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out- ...)
TODO: check
CVE-2026-70631 (FFmpeg versions from 0.5 up to, but not including, 9.0 contain an unin ...)
@@ -75,11 +75,11 @@ CVE-2026-70629 (FFmpeg versions from 3.0 up to, but not including, 9.0 contain a
CVE-2026-70628 (FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signe ...)
TODO: check
CVE-2026-70559 (Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/ge ...)
- TODO: check
+ NOT-FOR-US: dinky
CVE-2026-70558 (Dinky's POST /download/uploadFromRsByLocal handler passes the caller-s ...)
- TODO: check
+ NOT-FOR-US: dinky
CVE-2026-70557 (diboot-core's POST /common/load-related-data endpoint resolves caller- ...)
- TODO: check
+ NOT-FOR-US: diboot-core
CVE-2026-70332 (Server-side request forgery (ssrf) in Microsoft Office SharePoint allo ...)
NOT-FOR-US: Microsoft
CVE-2026-69125
@@ -105,17 +105,17 @@ CVE-2026-68941
CVE-2026-68823 (Exposed dangerous method or function in Azure Confidential Ledger allo ...)
NOT-FOR-US: Microsoft
CVE-2026-67689 (SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker ...)
- TODO: check
+ NOT-FOR-US: FineAdmin
CVE-2026-67688 (ICS-Park Smart Park Management System v2.0 contains an unrestricted fi ...)
- TODO: check
+ NOT-FOR-US: ICS-Park Smart Park Management System
CVE-2026-67687 (Insecure Permissions vulnerability in ics-park v.2.0 allows a remote a ...)
- TODO: check
+ NOT-FOR-US: ICS-Park Smart Park Management System
CVE-2026-67622 (Flowise through 3.1.4 contains an insecure direct object reference vul ...)
NOT-FOR-US: Flowise
CVE-2026-67621 (Flowise through 3.1.4 contains a missing authorization vulnerability t ...)
NOT-FOR-US: Flowise
CVE-2026-67434 (PHP_CodeSniffer tokenizes PHP files and detects violations of a define ...)
- TODO: check
+ NOT-FOR-US: PHP_CodeSniffer
CVE-2026-67422 (pymdown-extensions is a collection of extensions for the Python Markdo ...)
TODO: check
CVE-2026-65668 (Improper access control in Microsoft Purview eDiscovery allows an auth ...)
@@ -127,13 +127,13 @@ CVE-2026-65400 (An authentication issue was addressed with improved state manage
CVE-2026-64677 (Anki is a program for creating and reviewing flashcards. Prior to 25.0 ...)
TODO: check
CVE-2026-64665 (Statamic is a Laravel and Git powered content management system (CMS). ...)
- TODO: check
+ NOT-FOR-US: Statamic CMS
CVE-2026-64664 (Statamic is a Laravel and Git powered content management system (CMS). ...)
- TODO: check
+ NOT-FOR-US: Statamic CMS
CVE-2026-64663 (Statamic is a Laravel and Git powered content management system (CMS). ...)
- TODO: check
+ NOT-FOR-US: Statamic CMS
CVE-2026-64662 (Statamic is a Laravel and Git powered content management system (CMS). ...)
- TODO: check
+ NOT-FOR-US: Statamic CMS
CVE-2026-64655 (GitHub CLI (gh) is GitHub\u2019s official command line tool. Prior to ...)
TODO: check
CVE-2026-64654 (GitHub CLI (gh) is GitHub's official command line tool. Prior to versi ...)
@@ -143,9 +143,9 @@ CVE-2026-64653 (GitHub CLI (gh) is GitHub\u2019s official command line tool. Pri
CVE-2026-64652 (GitHub CLI (gh) is GitHub's official command line tool. Prior to versi ...)
TODO: check
CVE-2026-63725 (sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup ...)
- TODO: check
+ NOT-FOR-US: sysPass
CVE-2026-63637 (Dgraph is an open source distributed GraphQL database. Prior to 25.3.8 ...)
- TODO: check
+ NOT-FOR-US: Dgraph
CVE-2026-63508 (Missing authentication for critical function in Microsoft Planetary Co ...)
NOT-FOR-US: Microsoft
CVE-2026-62918 (Improper verification of cryptographic signature in Microsoft Teams al ...)
@@ -155,7 +155,7 @@ CVE-2026-62896 (Improper authentication in Microsoft Teams allows an authorized
CVE-2026-62873 (Improper verification of cryptographic signature in Microsoft 365 Admi ...)
NOT-FOR-US: Microsoft
CVE-2026-62857 (Fedify is a TypeScript library for building federated server apps powe ...)
- TODO: check
+ NOT-FOR-US: Fedify
CVE-2026-62836 (Improper restriction of communication channel to intended endpoints in ...)
NOT-FOR-US: Microsoft
CVE-2026-62830 (Missing authorization in Azure SRE Agent allows an authorized attacker ...)
@@ -163,11 +163,11 @@ CVE-2026-62830 (Missing authorization in Azure SRE Agent allows an authorized at
CVE-2026-61632 (PyMdown Extensions is a set of extensions for the Python-Markdown mark ...)
TODO: check
CVE-2026-5857 (Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt ...)
- TODO: check
+ NOT-FOR-US: Contiki-NG
CVE-2026-5856 (Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resol ...)
- TODO: check
+ NOT-FOR-US: Contiki-NG
CVE-2026-5855 (Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lw ...)
- TODO: check
+ NOT-FOR-US: Contiki-NG
CVE-2026-5336 (The DataPress (Dataverse Integration) WordPress plugin before 2.91 doe ...)
NOT-FOR-US: WordPress plugin
CVE-2026-59118 (Improper authorization in Microsoft Power Apps allows an unauthorized ...)
@@ -179,11 +179,11 @@ CVE-2026-56162 (Improper authentication in Azure SQL Database allows an unauthor
CVE-2026-56161 (Improper access control in Azure Logic Apps allows an authorized attac ...)
NOT-FOR-US: Microsoft
CVE-2026-54717 (Silverstripe CMS is an open source content management system. Prior to ...)
- TODO: check
+ NOT-FOR-US: Silverstripe CMS
CVE-2026-53984 (Ground Station prior to0.6.0 contains an unauthenticated database-dest ...)
- TODO: check
+ NOT-FOR-US: Ground Station
CVE-2026-53983 (Ground Station prior to0.6.0contains an unauthenticated blind server-s ...)
- TODO: check
+ NOT-FOR-US: Ground Station
CVE-2026-50515 (Deserialization of untrusted data in Azure Service Bus allows an autho ...)
NOT-FOR-US: Microsoft
CVE-2026-50481 (Modification of assumed-immutable data (maid) in Azure Active Director ...)
@@ -193,7 +193,7 @@ CVE-2026-50159 (Mermaid is a JavaScript tool that uses Markdown-inspired text to
CVE-2026-49746 (Software installed and run as a non-privileged user may conduct improp ...)
NOT-FOR-US: Imagination Technologies
CVE-2026-49391 (Frappe is a full-stack web application framework. Prior to 16.19.0 and ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-49163 (Improper limitation of a pathname to a restricted directory ('path tra ...)
NOT-FOR-US: Microsoft
CVE-2026-49005 (The root password hash of the device can be obtained through unencrypt ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c48fbdc42c97d20f1951187f9f025853050f3c74
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c48fbdc42c97d20f1951187f9f025853050f3c74
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260807/4b26a35c/attachment.htm>
More information about the debian-security-tracker-commits
mailing list