[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Thu Aug 27 21:31:32 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
478cf312 by Salvatore Bonaccorso at 2026-08-27T22:31:02+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -37,127 +37,127 @@ CVE-2026-81722 (nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) conta
 	- nltk 3.10.3-1
 	NOTE: https://github.com/nltk/nltk/security/advisories/GHSA-ww6m-cw3f-q94g
 CVE-2026-81721 (openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in  ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81720 (openssl_encrypt before 1.4.9 fails to validate the memory_cost paramet ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81719 (openssl_encrypt before 1.4.9 executes untrusted third-party plugins wi ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81718 (openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-H ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81717 (openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains tw ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81716 (openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81715 (openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81714 (openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-to ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81707 (openssl_encrypt before 1.4.9 fails to sanitize the email field of impo ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81706 (openssl_encrypt before 1.4.9 fails to prevent namespace collisions bet ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81705 (openssl-encrypt before 1.4.9 fails to redact the file password in its  ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81704 (openssl_encrypt versions before 1.4.9 contain a weak key derivation vu ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81703 (openssl_encrypt versions before 1.4.9 fail to validate encryption stat ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81702 (openssl_encrypt before 1.4.9 fails to re-derive and validate fingerpri ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81701 (openssl_encrypt versions before 1.4.9 use a denylist to identify trust ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81700 (openssl_encrypt versions before 1.4.9 contain a signature verification ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81699 (openssl_encrypt versions before 1.4.9 fail to properly validate key de ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81698 (openssl_encrypt versions before 1.4.9 contain a shell injection vulner ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81697 (openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contai ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81696 (openssl_encrypt versions before 1.4.9 fail to sanitize terminal contro ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81695 (openssl_encrypt versions before 1.4.9 fail to escape attacker-controll ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81694 (openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize fil ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81693 (openssl_encrypt before 1.4.9 fails to validate the total field from QR ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81692 (openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81691 (openssl_encrypt versions before 1.4.9 fail to validate server URLs in  ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81690 (openssl-encrypt (pip package) before 1.4.9 contains a symlink-followin ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81689 (openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap ke ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81688 (openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81687 (openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling o ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81686 (openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto s ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81685 (openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot m ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81684 (In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, th ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81683 (openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earli ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81682 (openssl_encrypt versions before 1.4.9 contain an insecure file permiss ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81681 (openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advert ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81680 (openssl_encrypt versions before 1.4.9 fail to authenticate recovery-sl ...)
-	TODO: check
+	NOT-FOR-US: OpenSSL Encrypt
 CVE-2026-81679 (OpenRemote versions before 1.28.0 contain a cross-realm information di ...)
-	TODO: check
+	NOT-FOR-US: OpenRemote
 CVE-2026-81678 (AVideo before 24.0 contains a server-side request forgery vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: WWBN AVideo
 CVE-2026-81677 (The \u2018/ws/apiprensa/getVideo\u2019 endpoint is vulnerable to SQL i ...)
-	TODO: check
+	NOT-FOR-US: TOOOLS iSquad
 CVE-2026-81676 (A vulnerability in the endpoint \u2018/ws/apitribuna/ultimosVideos\u20 ...)
-	TODO: check
+	NOT-FOR-US: TOOOLS iSquad
 CVE-2026-81675 (The endpoint \u2018/ws/apiprensa/getVideoUltimasSeccion\u2019 contains ...)
-	TODO: check
+	NOT-FOR-US: TOOOLS iSquad
 CVE-2026-81674 (The endpoint \u2018/ws/apiprensa/getVideoNextPrev\u2019 is vulnerable  ...)
-	TODO: check
+	NOT-FOR-US: TOOOLS iSquad
 CVE-2026-81673 (The \u2018/ws/apitribuna/setVisita\u2019 endpoint is vulnerable to SQL ...)
-	TODO: check
+	NOT-FOR-US: TOOOLS iSquad
 CVE-2026-81672 (SQL injection vulnerability in the \u2018/ws/apiprensa/getVideoSubcana ...)
-	TODO: check
+	NOT-FOR-US: TOOOLS iSquad
 CVE-2026-81668 (A flaw was found in Katello where the Content View Filter Rules API do ...)
-	TODO: check
+	NOT-FOR-US: Katello
 CVE-2026-81664 (The OpenFaaS gateway registers GET /system/telemetry in gateway/main.g ...)
-	TODO: check
+	NOT-FOR-US: OpenFaaS gateway
 CVE-2026-81662 (Affected versions of Flowintel improperly trust configuration keys sup ...)
-	TODO: check
+	NOT-FOR-US: Flowintel
 CVE-2026-81659 (Affected versions of Flowintel allow attacker-controlled note content  ...)
-	TODO: check
+	NOT-FOR-US: Flowintel
 CVE-2026-81658 (A flaw was found in Foreman. The template revision endpoint does not e ...)
 	TODO: check
 CVE-2026-81625 (A remote attacker with user privileges may use a malicious or compromi ...)
-	TODO: check
+	NOT-FOR-US: Greenbone
 CVE-2026-81581 (Improper validation of memory boundaries in WibuKey64.sys of WibuKey u ...)
-	TODO: check
+	NOT-FOR-US: WibuKey
 CVE-2026-81579 (In WibuKey for Windows before version 6.71, an untrusted pointer deref ...)
-	TODO: check
+	NOT-FOR-US: WibuKey
 CVE-2026-81576 (If configured as a server, CodeMeter Runtime before versions 8.41a and ...)
-	TODO: check
+	NOT-FOR-US: CodeMeter Runtime
 CVE-2026-81575 (If configured as a server, CodeMeter Runtime before versions 8.41a and ...)
-	TODO: check
+	NOT-FOR-US: CodeMeter Runtime
 CVE-2026-81574 (In CodeMeter Runtime before versions 8.41a and 9.10, the logger does n ...)
-	TODO: check
+	NOT-FOR-US: CodeMeter Runtime
 CVE-2026-81573 (If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, t ...)
-	TODO: check
+	NOT-FOR-US: CodeMeter Runtime
 CVE-2026-81572 (cmu.exe --create-io --file C: creates a predictable temporary file und ...)
-	TODO: check
+	NOT-FOR-US: Wibu
 CVE-2026-81562 (A security flaw has been discovered in AlexGladkov claude-in-mobile 3. ...)
-	TODO: check
+	NOT-FOR-US: AlexGladkov claude-in-mobile
 CVE-2026-81560 (A vulnerability was identified in blackms aistack up to 1.6.1. Affecte ...)
-	TODO: check
+	NOT-FOR-US: blackms aistack
 CVE-2026-81335 (Baserow dispatches an Application Builder data source without acting o ...)
-	TODO: check
+	NOT-FOR-US: Baserow
 CVE-2026-81334 (darknet subscripts its layer array with an index taken from a configur ...)
-	TODO: check
+	NOT-FOR-US: darknet
 CVE-2026-81279 (Subscriber Broken Access Control in Push Notification for Post and Bud ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-81277 (Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0. ...)
@@ -173,15 +173,15 @@ CVE-2026-81272 (Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versio
 CVE-2026-81271 (Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2 ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-81102 (The Dash MCP server bound its listener to the loopback address but nev ...)
-	TODO: check
+	NOT-FOR-US: Dash MCP server
 CVE-2026-81101 (The configure command accepted any endpoint URL and stored it beside t ...)
-	TODO: check
+	NOT-FOR-US: Airtable
 CVE-2026-81100 (tiger-gh-mcp-server started its MCP HTTP transport without enabling th ...)
-	TODO: check
+	NOT-FOR-US: tiger-gh-mcp-server
 CVE-2026-81099 (tiger-slack started its MCP HTTP transport without enabling the host a ...)
-	TODO: check
+	NOT-FOR-US: tiger-slack
 CVE-2026-81098 (The Telnyx MCP server exposed its HTTP transport on every interface an ...)
-	TODO: check
+	NOT-FOR-US: Telnyx MCP server
 CVE-2026-81097 (The execute_ruby tool is documented as a read-only Ruby sandbox and is ...)
 	TODO: check
 CVE-2026-81096 (ToolUniverse ran caller-supplied Python inside a sandbox that could be ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/478cf312f038366a565ae4d04fb6ff542a5ad5b6

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/478cf312f038366a565ae4d04fb6ff542a5ad5b6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260827/66b21e8f/attachment.htm>

More information about the debian-security-tracker-commits mailing list