[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Aug 25 08:13:33 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
87804fd0 by security tracker role at 2026-08-25T07:13:26+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,5 +1,5 @@
CVE-2026-7455 (A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2026-78685 (Medical Practice Management System developed by Le-yan has a Remote Co ...)
TODO: check
CVE-2026-78683 (NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pick ...)
@@ -21,7 +21,7 @@ CVE-2026-78676 (GitPython before 3.1.59 fails to safely re-serialize multi-line
CVE-2026-78675 (GitPython before 3.1.59 fails to disable merge_includes when parsing . ...)
TODO: check
CVE-2026-78656 (A vulnerability was found in itsourcecode Sales and Inventory System 1 ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-78654 (A vulnerability has been found in cleverbrush framework and deep up to ...)
TODO: check
CVE-2026-78638 (A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2. ...)
@@ -35,15 +35,15 @@ CVE-2026-78553 (RansomLook created its Flask session-signing key without explici
CVE-2026-78551 (RansomLook contains multiple weaknesses in its authentication endpoint ...)
TODO: check
CVE-2026-78478 (The Mane theme for WordPress is vulnerable to Local File Inclusion in ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78477 (The Jawn theme for WordPress is vulnerable to Privilege Escalation in ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78470 (The WP Project Manager Pro plugin for WordPress is vulnerable to SQL I ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78467 (The Fluent Support Pro plugin for WordPress is vulnerable to unauthori ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78466 (The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure D ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78435 (A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected ...)
TODO: check
CVE-2026-78434 (A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the ...)
@@ -51,27 +51,27 @@ CVE-2026-78434 (A flaw has been found in Faveo Helpdesk up to 2.0.3. This impact
CVE-2026-78430 (A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1 ...)
TODO: check
CVE-2026-78284 (Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78282 (Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78268 (Unauthenticated Sensitive Data Exposure in Lead Generation Contact Wid ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78267 (Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78266 (Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78265 (Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78264 (Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78263 (Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78262 (Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78259 (Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-77923 (Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnera ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-77635 (CakePHP is a rapid development framework for PHP. Prior to versions 5. ...)
TODO: check
CVE-2026-77634 (CakePHP is a rapid development framework for PHP. Prior to versions 4. ...)
@@ -93,11 +93,11 @@ CVE-2026-76816 (Netty is an asynchronous, event-driven network application frame
CVE-2026-76098 (Mistune is a Python Markdown parser with renderers and plugins. Versio ...)
TODO: check
CVE-2026-76063 (The FundEngine \u2013 Donation and Crowdfunding Platform plugin for Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75982 (The LearnPress plugin for WordPress is vulnerable to unauthorized modi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75930 (The FundEngine \u2013 Donation and Crowdfunding Platform plugin for Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75575 (Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without ...)
TODO: check
CVE-2026-75574 (The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders ...)
@@ -115,7 +115,7 @@ CVE-2026-75369 (An out-of-bounds read vulnerability in the CAN::Application::par
CVE-2026-75368 (A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC ...)
TODO: check
CVE-2026-75019 (The Cozy Blocks \u2013 Page Builder for Gutenberg Editor & FSE with 70 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-72714 (Rocq Prover does not restore the universe graph's copy of the universe ...)
TODO: check
CVE-2026-72711 (The Lean 4 kernel does not check that the body of an opaque declaratio ...)
@@ -143,9 +143,9 @@ CVE-2026-72696 (Grav CMS before 2.0.16 contains a symlink following vulnerabilit
CVE-2026-72695 (Grav before 2.0.16 contains a path traversal vulnerability in MediaUpl ...)
TODO: check
CVE-2026-71511 (Dolibarr before 24.0.0 contains a sensitive data exposure vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-71510 (Dolibarr before 24.0.0 contains a SQL injection vulnerability in the u ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-69665 (SKYSEA Client View and SKYMEC IT Manager contain an issue with incorre ...)
TODO: check
CVE-2026-68960 (A stack-based buffer overflow vulnerability exists in SKYSEA Client Vi ...)
@@ -157,13 +157,13 @@ CVE-2026-68516 (OpenEXR is the reference implementation and specification for th
CVE-2026-68062 (SKYSEA Client View and SKYMEC IT Manager contain a path traversal vuln ...)
TODO: check
CVE-2026-66766 (SAP S/4HANA (Private Cloud) uses a third-party component that contains ...)
- TODO: check
+ NOT-FOR-US: SAP
CVE-2026-66109 (A missing authorization vulnerability exists in SKYSEA Client View and ...)
TODO: check
CVE-2026-63693 (Dell Client BIOS contains an Improper Link Resolution Before File Acce ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-61419 (Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Ac ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-5006 (A vulnerability was identified in HashiCorp Vault and Vault Enterprise ...)
TODO: check
CVE-2026-59183 (OpenEXR is the reference implementation and specification for the EXR ...)
@@ -213,57 +213,57 @@ CVE-2026-34964 (Adminer before 5.5.0 contains a server-side request forgery vuln
CVE-2026-34959 (Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Pr ...)
TODO: check
CVE-2026-32563 (Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plug ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32561 (Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32560 (Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Im ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32559 (Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32556 (Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32555 (Unauthenticated SQL Injection in Boost <= 2.0.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32554 (Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27364 (Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-19943 (The Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19892 (The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Esc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19801 (The BetterLinks \u2013 Link Shortener, Link Cloaking, Redirects, Affil ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19568 (A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2026-17113 (A flaw was found in CRI-O's container-creation environment-variable ha ...)
TODO: check
CVE-2026-17089 (The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-16783 (A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2026-16782 (A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2026-16781 (A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2026-16434 (Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fi ...)
TODO: check
CVE-2026-15023 (The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14280 (The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13215 (The Zephyr ext2 filesystem driver fails to validate the s_log_block_si ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-13214 (The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack b ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-12561 (The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-10630 (The WP Courses LMS \u2013 Online Courses Builder, eLearning Courses, C ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-10627 (The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-9878 (The PPWP \u2013 Password Protect WordPress | #1 Most-Reviewed Password ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-41741
REJECTED
CVE-2020-37268 (Print Assumptions does not report that a definition was produced while ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/87804fd05b66c5115b0007074763bc2a69ad55c5
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/87804fd05b66c5115b0007074763bc2a69ad55c5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260825/56e28ddd/attachment.htm>
More information about the debian-security-tracker-commits
mailing list