[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Jul 1 20:14:55 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
9a4ac720 by security tracker role at 2026-07-01T19:14:49+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -31,15 +31,15 @@ CVE-2026-5136 (A flaw was found in Foreman. The Usergroup model in Foreman does
CVE-2026-5135 (A flaw was found in Foreman. This broken access control vulnerability ...)
TODO: check
CVE-2026-5120 (A Race Condition vulnerability affecting BIOVIA Workbook from Release ...)
- TODO: check
+ NOT-FOR-US: Dassault Systemes
CVE-2026-5051 (HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device valid ...)
TODO: check
CVE-2026-58521 (Improper neutralization of special elements used in an SQL command ('S ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-58520 (URL redirection to untrusted site ('open redirect') vulnerability in T ...)
TODO: check
CVE-2026-58517 (Improper neutralization of input terminators vulnerability in The Wiki ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-58454 (JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 c ...)
TODO: check
CVE-2026-58453 (JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 c ...)
@@ -59,23 +59,23 @@ CVE-2026-58038 (Improper Neutralization of Input During Web Page Generation (XSS
CVE-2026-58035 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
TODO: check
CVE-2026-58034 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-58031 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
TODO: check
CVE-2026-57737 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57736 (Insertion of Sensitive Information Into Sent Data vulnerability in Hub ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57723 (Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57722 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57721 (Missing Authorization vulnerability in WP Reloaded ApplyOnline allows ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57720 (Missing Authorization vulnerability in Codexpert Inc ThumbPress allows ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57692 (Incorrect Privilege Assignment vulnerability in LCweb PrivateContent a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57517 (Control Web Panel before 0.9.8.1225 contains a blind SQL injection vul ...)
TODO: check
CVE-2026-57516 (Ray prior to 2.56.0 contains an unsafe deserialization vulnerability i ...)
@@ -145,9 +145,9 @@ CVE-2026-49087 (Allocation of Resources Without Limits or Throttling (CWE-770) i
CVE-2026-46680 (containerd is an open-source container runtime. In versions prior to 1 ...)
TODO: check
CVE-2026-41121 (Dell Device Management Agent, versions prior to DDMA 26.05, contain an ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-38142 (An unauthenticated command injection vulnerability in the /goform/fast ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-34117 (Guardian language-system passes the id GET parameter directly into a P ...)
TODO: check
CVE-2026-34116 (Guardian language-system passes the id GET parameter directly into a P ...)
@@ -193,41 +193,41 @@ CVE-2026-34097 (Guardian language-system fails to sanitize the id GET parameter
CVE-2026-34096 (Guardian language-system fails to sanitize the name GET parameter befo ...)
TODO: check
CVE-2026-2891 (The following Poly Voice IP devices, CCX, Trio, and Edge E, might be i ...)
- TODO: check
+ NOT-FOR-US: HP
CVE-2026-27435 (Missing Authorization vulnerability in WofficeIO Woffice allows Exploi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27409 (Missing Authorization vulnerability in Webba Plugins Webba Booking all ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-24270 (NVIDIA AIStore framework contains a vulnerability where an attacker co ...)
TODO: check
CVE-2026-24266 (NVIDIA Triton Inference Server for Linux contains a vulnerability wher ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24264 (NVIDIA Triton Inference Server for Linux contains a vulnerability wher ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24260 (NVIDIA Container Toolkit for Linux contains a vulnerability where an a ...)
TODO: check
CVE-2026-24251 (NVIDIA Megatron Bridge for Linux contains a vulnerability where an att ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24250 (NVIDIA Megatron Bridge for Linux contains a vulnerability where an att ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24249 (NVIDIA Megatron Bridge for Linux contains a vulnerability where an att ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24248 (NVIDIA Megatron Bridge for Linux contains a vulnerability where an att ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24247 (NVIDIA Megatron Bridge for Linux contains a vulnerability where an att ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24246 (NVIDIA Megatron Bridge for Linux contains a vulnerability where an att ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24245 (NVIDIA Megatron Bridge for Linux contains a vulnerability where an att ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24244 (NVIDIA Megatron Bridge for Linux contains a vulnerability where an att ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24243 (NVIDIA Megatron Bridge for Linux contains a vulnerability where an att ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24242 (NVIDIA Megatron Bridge for Linux contains a vulnerability where an att ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-24240 (NVIDIA Megatron Bridge for Linux contains a vulnerability where an att ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-20244 (A vulnerability in the DMG file format parser of ClamAV could allow an ...)
TODO: check
CVE-2026-20243 (A vulnerability in the ALZ file format parser of ClamAV could allow an ...)
@@ -257,53 +257,53 @@ CVE-2026-14198 (@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded
CVE-2026-14181 (@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL nor ...)
TODO: check
CVE-2026-13769 (Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-13760 (OS command injection in the NodejsFunction Docker bundling pipeline (O ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-13733 (The Download Manager plugin for WordPress is vulnerable to Stored Cros ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13707 (Session fixation vulnerability in Wikimedia Foundation OAuth. This v ...)
TODO: check
CVE-2026-13706 (Improper input validation vulnerability in Wikimedia Foundation UrlSho ...)
TODO: check
CVE-2026-13603 (The payment integration pretix-oppwa provides support for the payment ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-13602 (We found a chain of combining multiple weaknesses in the product that ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-13454 (The MotoPress Appointment Booking plugin for WordPress is vulnerable t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13323 (In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves ...)
TODO: check
CVE-2026-13228 (The LatePoint \u2013 Calendar Booking Plugin for Appointments and Even ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13211 (The genucenter web interface before version 8.0p11 unnecessarily expos ...)
TODO: check
CVE-2026-12754 (The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vuln ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12732 (The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12577 (DVP80ES3 with Improperly Implemented Security Check for Standard vulne ...)
- TODO: check
+ NOT-FOR-US: Delta Electronics
CVE-2026-12576 (DVP80ES3 with Improper Enforcement of Message Integrity During Transmi ...)
- TODO: check
+ NOT-FOR-US: Delta Electronics
CVE-2026-12575 (DVP80ES3 with Improper Resource Shutdown or Release vulnerability.)
- TODO: check
+ NOT-FOR-US: Delta Electronics
CVE-2026-12480 (Keras versions up to and including 3.13.2 are vulnerable to an arbitra ...)
TODO: check
CVE-2026-12435 (The Motors \u2013 Car Dealership & Classified Listings Plugin plugin f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12408 (The Slim SEO \u2013 A Fast & Automated SEO Plugin For WordPress plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12374 (Improper certificate validation and a time-of-check time-of-use (TOCTO ...)
- TODO: check
+ NOT-FOR-US: Cato
CVE-2026-12224 (The Dokan Pro plugin for WordPress is vulnerable to privilege escalati ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12158 (The RegistrationMagic \u2013 User Registration Forms Plugin plugin for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12142 (The NEX-Forms \u2013 Ultimate Forms Plugin for WordPress plugin for Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11387 (The SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-10540 (The Control-M/Enterprise Manager uses weak protections for stored hash ...)
TODO: check
CVE-2026-10539 (A Control-M/Server communication command does not sufficiently filter ...)
@@ -311,9 +311,9 @@ CVE-2026-10539 (A Control-M/Server communication command does not sufficiently f
CVE-2026-10538 (Messaging consumer functionality allows deserialization of user-contro ...)
TODO: check
CVE-2026-10096 (The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Ob ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-10095 (The WP Photo Album Plus plugin for WordPress is vulnerable to Stored C ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-23351 (NVIDIA ConnectX and BlueField contain a vulnerability in the command i ...)
TODO: check
CVE-2025-23350 (NVIDIA ConnectX and BlueField contain a vulnerability in the command i ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9a4ac720af75a3a2ebd3a06fb7cbb81e1ce33c80
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9a4ac720af75a3a2ebd3a06fb7cbb81e1ce33c80
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260701/62e4c5c0/attachment.htm>
More information about the debian-security-tracker-commits
mailing list