[Git][security-tracker-team/security-tracker][master] Reassociate some NFUs to itp'ed entry for wekan

Sun Feb 8 08:25:20 GMT 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
eca6478c by Salvatore Bonaccorso at 2026-02-08T09:24:55+01:00
Reassociate some NFUs to itp'ed entry for wekan

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -642,11 +642,11 @@ CVE-2026-1971 (A vulnerability has been found in Edimax BR-6288ACL up to 1.12. I
 CVE-2026-1970 (A flaw has been found in Edimax BR-6258n up to 1.18. This issue affect ...)
 	NOT-FOR-US: Edimax
 CVE-2026-1964 (A vulnerability was determined in WeKan up to 8.20. This impacts an un ...)
-	NOT-FOR-US: WeKan
+	- wekan <itp> (bug #819238)
 CVE-2026-1963 (A vulnerability was found in WeKan up to 8.20. This affects an unknown ...)
-	NOT-FOR-US: WeKan
+	- wekan <itp> (bug #819238)
 CVE-2026-1962 (A vulnerability has been found in WeKan up to 8.20. The impacted eleme ...)
-	NOT-FOR-US: WeKan
+	- wekan <itp> (bug #819238)
 CVE-2026-1909 (The WaveSurfer-WP plugin for WordPress is vulnerable to Stored Cross-S ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-1888 (The Docus \u2013 YouTube Video Playlist plugin for WordPress is vulner ...)
@@ -943,17 +943,17 @@ CVE-2026-22038 (AutoGPT is a platform that allows users to create, deploy, and m
 CVE-2026-1953 (Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vu ...)
 	NOT-FOR-US: Nukegraphic CMS
 CVE-2026-1898 (A vulnerability was determined in WeKan up to 8.20. This affects an un ...)
-	NOT-FOR-US: WeKan
+	- wekan <itp> (bug #819238)
 CVE-2026-1897 (A vulnerability was found in WeKan up to 8.20. Affected by this issue  ...)
-	NOT-FOR-US: WeKan
+	- wekan <itp> (bug #819238)
 CVE-2026-1896 (A vulnerability has been found in WeKan up to 8.20. Affected by this v ...)
-	NOT-FOR-US: WeKan
+	- wekan <itp> (bug #819238)
 CVE-2026-1895 (A flaw has been found in WeKan up to 8.20. Affected is the function ap ...)
-	NOT-FOR-US: WeKan
+	- wekan <itp> (bug #819238)
 CVE-2026-1894 (A vulnerability was detected in WeKan up to 8.20. This impacts an unkn ...)
-	NOT-FOR-US: WeKan
+	- wekan <itp> (bug #819238)
 CVE-2026-1892 (A security vulnerability has been detected in WeKan up to 8.20. This a ...)
-	NOT-FOR-US: WeKan
+	- wekan <itp> (bug #819238)
 CVE-2026-1884 (A weakness has been identified in ZenTao up to 21.7.6-85642. The impac ...)
 	NOT-FOR-US: ZenTao
 CVE-2026-1554 (XML Injection (aka Blind XPath Injection) vulnerability in Drupal Cent ...)
@@ -23008,15 +23008,15 @@ CVE-2025-66434 (An SSTI (Server-Side Template Injection) vulnerability exists in
 CVE-2025-65835 (The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-Phone ...)
 	NOT-FOR-US: Cordova plugin cordova-plugin-x-socialsharing
 CVE-2025-65782 (An issue was discovered in Wekan The Open Source kanban board system u ...)
-	NOT-FOR-US: Wekan
+	- wekan <itp> (bug #819238)
 CVE-2025-65781 (An issue was discovered in Wekan The Open Source kanban board system u ...)
-	NOT-FOR-US: Wekan
+	- wekan <itp> (bug #819238)
 CVE-2025-65780 (An issue was discovered in Wekan The Open Source kanban board system u ...)
-	NOT-FOR-US: Wekan
+	- wekan <itp> (bug #819238)
 CVE-2025-65779 (An issue was discovered in Wekan The Open Source kanban board system u ...)
-	NOT-FOR-US: Wekan
+	- wekan <itp> (bug #819238)
 CVE-2025-65778 (An issue was discovered in Wekan The Open Source kanban board system u ...)
-	NOT-FOR-US: Wekan
+	- wekan <itp> (bug #819238)
 CVE-2025-65742 (An unauthenticated Broken Function Level Authorization (BFLA) vulnerab ...)
 	NOT-FOR-US: Newgen OmniDocs
 CVE-2025-65431 (An issue was discovered in allauth-django before 65.13.0. Both Okta an ...)
@@ -274478,7 +274478,7 @@ CVE-2023-32346 (Teltonika\u2019s Remote Management System versions prior to 4.10
 CVE-2023-31923 (Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A v ...)
 	NOT-FOR-US: Suprema BioStar
 CVE-2023-31779 (Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). A ...)
-	NOT-FOR-US: Wekan
+	- wekan <itp> (bug #819238)
 CVE-2023-31742 (There is a command injection vulnerability in the Linksys WRT54GL rout ...)
 	NOT-FOR-US: Linksys
 CVE-2023-31689 (In Wcms 0.3.2, an attacker can send a crafted request from a vulnerabl ...)
@@ -285015,7 +285015,7 @@ CVE-2023-28486 (Sudo before 1.9.13 does not escape control characters in log mes
 	NOTE: https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca
 	NOTE: https://github.com/sudo-project/sudo/commit/12648b4e0a8cf486480442efd52f0e0b6cab6e8b (fix a regression)
 CVE-2023-28485 (A stored cross-site scripting (Stored XSS) vulnerability in file previ ...)
-	NOT-FOR-US: WeKan
+	- wekan <itp> (bug #819238)
 CVE-2023-28484 (In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can l ...)
 	{DSA-5391-1 DLA-3405-1}
 	- libxml2 2.9.14+dfsg-1.2 (bug #1034436)
@@ -442037,7 +442037,7 @@ CVE-2021-3311 (An issue was discovered in October through build 471. It reactiva
 CVE-2021-3310 (Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbol ...)
 	NOT-FOR-US: Western Digital
 CVE-2021-3309 (packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process co ...)
-	NOT-FOR-US: Wekan
+	- wekan <itp> (bug #819238)
 CVE-2021-26272 (It was possible to execute a ReDoS-type attack inside CKEditor 4 befor ...)
 	- ckeditor 4.16.0+dfsg-1 (bug #982587)
 	[buster] - ckeditor <no-dsa> (Minor issue)
@@ -457194,7 +457194,7 @@ CVE-2021-20656 (Exposure of information through directory listing in SolarView C
 CVE-2021-20655 (FileZen (V3.0.0 to V4.2.7 and V5.0.0 to V5.0.2) allows a remote attack ...)
 	NOT-FOR-US: FileZen
 CVE-2021-20654 (Wekan, open source kanban board system, between version 3.12 and 4.11, ...)
-	NOT-FOR-US: Wekan
+	- wekan <itp> (bug #819238)
 CVE-2021-20653 (Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, ...)
 	NOT-FOR-US: Calsos CSDJ
 CVE-2021-20652 (Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17 ...)
@@ -615498,7 +615498,7 @@ CVE-2018-1000550 (The Sympa Community Sympa version prior to version 6.2.32 cont
 	- sympa 6.2.32~dfsg-1
 	NOTE: https://sympa-community.github.io/security/2018-001.html
 CVE-2018-1000549 (Wekan version 1.04.0 contains a Email / Username Enumeration vulnerabi ...)
-	NOT-FOR-US: Wekan
+	- wekan <itp> (bug #819238)
 CVE-2018-1000548 (Umlet version < 14.3 contains a XML External Entity (XXE) vulnerabilit ...)
 	NOT-FOR-US: Umlet
 CVE-2018-1000547 (coreBOS version 7.0 and earlier contains a Incorrect Access Control vu ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/eca6478ca7182769876e2aad7da589d2e299797a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/eca6478ca7182769876e2aad7da589d2e299797a
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260208/64caa109/attachment.htm>
