[Git][security-tracker-team/security-tracker][master] Process some NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
413cbc79 by Salvatore Bonaccorso at 2026-08-24T22:46:41+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -220,17 +220,17 @@ CVE-2026-76844 (webpack-dev-middleware resolves a request to a local file in get
 CVE-2026-76843 (The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/mo ...)
 	TODO: check
 CVE-2026-76842 (The Mercado Pago Node.js SDK interpolates caller-supplied identifiers  ...)
-	TODO: check
+	NOT-FOR-US: Mercado Pago Node.js SDK
 CVE-2026-76841 (Xinference loads models with Hugging Face remote code execution uncond ...)
-	TODO: check
+	NOT-FOR-US: Xinference
 CVE-2026-76840 (RustDesk's Windows clipboard redirection copies a peer-supplied length ...)
 	TODO: check
 CVE-2026-76838 (Hi.Events validates a webhook destination only when it is registered,  ...)
-	TODO: check
+	NOT-FOR-US: Hi.Events
 CVE-2026-76837 (Baserow interpolates a user's display name into the rich-text mention  ...)
-	TODO: check
+	NOT-FOR-US: Baserow
 CVE-2026-76836 (AzuraCast exposes the Liquidsoap custom configuration fields through a ...)
-	TODO: check
+	NOT-FOR-US: AzuraCast
 CVE-2026-76835 (OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when dec ...)
 	TODO: check
 CVE-2026-76831
@@ -242,13 +242,13 @@ CVE-2026-76829
 CVE-2026-76172 (fast-uri is a URI parser for Node.js. During parsing it runs a legacy  ...)
 	TODO: check
 CVE-2026-76073 (Label Studio does not scope the annotation detail endpoint to the requ ...)
-	TODO: check
+	NOT-FOR-US: Label Studio
 CVE-2026-76072 (The Continue CLI applies an incomplete denylist as its only barrier to ...)
-	TODO: check
+	NOT-FOR-US: Continue CLI
 CVE-2026-76071 (Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer  ...)
-	TODO: check
+	NOT-FOR-US: Netis NC63 firmware
 CVE-2026-76070 (Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer  ...)
-	TODO: check
+	NOT-FOR-US: Netis NC63 firmware
 CVE-2026-76055 (Improper Neutralization of Special Elements used in an OS Command in t ...)
 	NOT-FOR-US: Black Duck
 CVE-2026-76054 (Invocation of Process Using Visible Sensitive Information in Black Duc ...)
@@ -260,9 +260,9 @@ CVE-2026-75931 (fast-uri is a URI parser for Node.js. It canonicalizes a host to
 CVE-2026-75899 (fast-uri is a URI parser for Node.js. It decodes percent escapes in a  ...)
 	TODO: check
 CVE-2026-75371 (An integer handling flaw in the cobs_decode function of SpaceDot Acube ...)
-	TODO: check
+	NOT-FOR-US: SpaceDot AcubeSAT OBC software
 CVE-2026-75370 (An out-of-bounds read/write vulnerability in the MessageParser::parseE ...)
-	TODO: check
+	NOT-FOR-US: SpaceDot AcubeSAT OBC software
 CVE-2026-75099 (Unauthenticated REST disclosureof certain content items in Apache Allu ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-71982



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/413cbc79e4dccba0e3b445552805b1ad21e07980

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/413cbc79e4dccba0e3b445552805b1ad21e07980
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260824/39b98c0e/attachment-0001.htm>