[Git][security-tracker-team/security-tracker][master] Process some NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e2d1a78b by Salvatore Bonaccorso at 2026-08-14T08:23:42+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -229,21 +229,21 @@ CVE-2026-73569 (fast-xml-parser allows users to process XML from JS object witho
 	NOTE: https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f (v5.10.1)
 	NOTE: node-webfont provides node-fast-xml-parser
 CVE-2026-73568 (py-libp2p is the Python implementation of the libp2p networking stack. ...)
-	TODO: check
+	NOT-FOR-US: py-libp2p
 CVE-2026-73567 (sm-crypto provides JavaScript implementations of the Chinese cryptogra ...)
-	TODO: check
+	NOT-FOR-US: sm-crypto
 CVE-2026-73566 (node-tar is a tar archive manipulation library for Node.js. Prior to 7 ...)
 	TODO: check
 CVE-2026-73565 (@hono/node-server allows running the Hono application on Node.js. From ...)
-	TODO: check
+	NOT-FOR-US: Hono
 CVE-2026-73564 (frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional  ...)
 	TODO: check
 CVE-2026-73563 (Backstage is an open framework for building developer portals. Prior t ...)
-	TODO: check
+	NOT-FOR-US: Backstage
 CVE-2026-73562 (Mongoose is a MongoDB object modeling tool designed to work in an asyn ...)
 	TODO: check
 CVE-2026-73561 (Hub is a Node.js WebSocket server and client with added features. Prio ...)
-	TODO: check
+	NOT-FOR-US: Hub Node.js WebSocket server and client
 CVE-2026-73559 (vLLM is an inference and serving engine for large language models. Fro ...)
 	TODO: check
 CVE-2026-73558 (vLLM is an inference and serving engine for large language models. Pri ...)
@@ -255,23 +255,23 @@ CVE-2026-73556 (vLLM is an inference and serving engine for large language model
 CVE-2026-73555 (vLLM is an inference and serving engine for large language models. Pri ...)
 	TODO: check
 CVE-2026-73533 (Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: Ninja Tables Pro
 CVE-2026-73532 (Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: Fluent Forms Pro
 CVE-2026-73515 (PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability ...)
 	TODO: check
 CVE-2026-73514 (The address_standardizer extension for PostGIS through 3.7.0, fixed in ...)
-	TODO: check
+	NOT-FOR-US: address_standardizer extension for PostGIS
 CVE-2026-73509 (OpenList a file list program that supports multiple storage. Prior to  ...)
-	TODO: check
+	NOT-FOR-US: OpenList
 CVE-2026-73508 (Netty is an asynchronous, event-driven network application framework.  ...)
 	TODO: check
 CVE-2026-73507 (Netty is an asynchronous, event-driven network application framework.  ...)
 	TODO: check
 CVE-2026-73506 (Oh My Posh is the most customisable and low-latency cross platform/she ...)
-	TODO: check
+	NOT-FOR-US: Oh My Posh
 CVE-2026-73505 (Oh My Posh is the most customisable and low-latency cross platform/she ...)
-	TODO: check
+	NOT-FOR-US: Oh My Posh
 CVE-2026-73488 (Flowise versions before 3.1.3 contain an insecure direct object refere ...)
 	NOT-FOR-US: Flowise
 CVE-2026-73487 (Flowise before 3.1.3 contains a regex-based Python code validator bypa ...)
@@ -305,17 +305,17 @@ CVE-2026-73344 (Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 ve
 CVE-2026-73340 (Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5 ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-73266 (A flaw was found in the clusterclaims-controller component of Multiclu ...)
-	TODO: check
+	NOT-FOR-US: Red Hat Multicluster Engine for Kubernetes
 CVE-2026-73188 (Unauthenticated Sensitive Data Exposure in KiviCare <= 4.5.1 versions.)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-73038 (NodeBB before 4.15.0 contains a stored cross-site scripting vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: NodeBB
 CVE-2026-73037 (Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site s ...)
-	TODO: check
+	NOT-FOR-US: Next AI Draw.io
 CVE-2026-72777 (Next AI Draw.io through 0.4.16 contains a server-side request forgery  ...)
-	TODO: check
+	NOT-FOR-US: Next AI Draw.io
 CVE-2026-72741 (Rainbond through 6.9.7 contains a broken access control vulnerability  ...)
-	TODO: check
+	NOT-FOR-US: Rainbond
 CVE-2026-6387 (A potential authentication bypass vulnerability was reported in Lenovo ...)
 	NOT-FOR-US: Lenovo
 CVE-2026-67991 (crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 cont ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e2d1a78b7b153ac713b1e04bf2253b2a9e08062e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e2d1a78b7b153ac713b1e04bf2253b2a9e08062e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260814/0e426b34/attachment.htm>