[Git][security-tracker-team/security-tracker][master] Process some NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9ca4abf7 by Salvatore Bonaccorso at 2026-08-27T23:01:45+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -183,45 +183,45 @@ CVE-2026-81099 (tiger-slack started its MCP HTTP transport without enabling the
 CVE-2026-81098 (The Telnyx MCP server exposed its HTTP transport on every interface an ...)
 	NOT-FOR-US: Telnyx MCP server
 CVE-2026-81097 (The execute_ruby tool is documented as a read-only Ruby sandbox and is ...)
-	TODO: check
+	NOT-FOR-US: rails-mcp-server
 CVE-2026-81096 (ToolUniverse ran caller-supplied Python inside a sandbox that could be ...)
-	TODO: check
+	NOT-FOR-US: ToolUniverse
 CVE-2026-81095 (pg-aiguide started its MCP HTTP transport without enabling the host al ...)
-	TODO: check
+	NOT-FOR-US: pg-aiguide
 CVE-2026-81094 (The mcp-router CLI served its MCP aggregator on every interface and en ...)
-	TODO: check
+	NOT-FOR-US: mcp-router CLI
 CVE-2026-81093 (The get-html-skeleton tool fetched a URL the caller supplied after che ...)
-	TODO: check
+	NOT-FOR-US: get-html-skeleton tool
 CVE-2026-81092 (mcp-go accepted requests on its HTTP transports without checking the H ...)
-	TODO: check
+	NOT-FOR-US: mcp-go
 CVE-2026-81091 (The proxy middleware in mcp-use's inspector forwards requests to a des ...)
-	TODO: check
+	NOT-FOR-US: mcp-use
 CVE-2026-80433 (Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2. ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-80213 (An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resol ...)
-	TODO: check
+	NOT-FOR-US: resolv Ruby gem
 CVE-2026-80212 (An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resol ...)
-	TODO: check
+	NOT-FOR-US: resolv Ruby gem
 CVE-2026-80211 (FrontAccounting through 2.4.20 stores and verifies user passwords as u ...)
 	TODO: check
 CVE-2026-80210 (FrontAccounting through 2.4.20 generates a CSRF token in end_form() in ...)
 	TODO: check
 CVE-2026-80209 (The updateWorkspace handler in mods/identity/src/workspaces/createUpda ...)
-	TODO: check
+	NOT-FOR-US: Fonoster
 CVE-2026-80208 (APITable through 1.13.0-beta.1 annotates both getUserHistories and clo ...)
-	TODO: check
+	NOT-FOR-US: APITable
 CVE-2026-80207 (APITable through 1.13.0-beta.1 annotates the create handler of Interna ...)
-	TODO: check
+	NOT-FOR-US: APITable
 CVE-2026-79988 (The Twig sandbox mechanism in Craft CMS is configured to allow dangero ...)
 	NOT-FOR-US: Craft CMS or plugin for Craft CMS
 CVE-2026-79720 (Reflected XSS in Netron versions <=9.1.2 on desktop application throug ...)
-	TODO: check
+	NOT-FOR-US: Netron
 CVE-2026-79719 (Reflected XSS in Netron versions <=9.1.2 on desktop application throug ...)
-	TODO: check
+	NOT-FOR-US: Netron
 CVE-2026-79718 (Reflected XSS in Netron versions <=9.1.2 on desktop application throug ...)
-	TODO: check
+	NOT-FOR-US: Netron
 CVE-2026-79653 (In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if t ...)
-	TODO: check
+	NOT-FOR-US: Eclipse SW360
 CVE-2026-78293 (Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6  ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-78292 (Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.)
@@ -263,7 +263,7 @@ CVE-2026-75871 (GitLab has remediated a vulnerability in the GitLab AI Gateway c
 CVE-2026-75573 (In MongoDB Connector for BI, mongodrdl may write a TLS private-key pas ...)
 	TODO: check
 CVE-2026-75357 (An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to exec ...)
-	TODO: check
+	NOT-FOR-US: Bilibili Desktop
 CVE-2026-75159 (An unauthenticated client that can reach a MongoDB Connector for BI de ...)
 	TODO: check
 CVE-2026-75020 (Improper Neutralization of Special Elements used in an LDAP Query ('LD ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ca4abf726e73e7ff1a8945ba423207c8af3d77c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ca4abf726e73e7ff1a8945ba423207c8af3d77c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260827/5bd087c8/attachment-0001.htm>