[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Thu Jul 2 08:33:20 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
f08519dd by Moritz Muehlenhoff at 2026-07-02T09:32:59+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3,13 +3,13 @@ CVE-2026-5821 (The Image Optimizer plugin for WordPress is vulnerable to arbitra
CVE-2026-5348 (The Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Sol ...)
NOT-FOR-US: WordPress plugin
CVE-2026-58593 (NodeBB does not bind the claimed author of an inbound ActivityPub obje ...)
- TODO: check
+ NOT-FOR-US: NodeBB
CVE-2026-58592 (Ladybird contains a dangling-reference memory-safety flaw in its WebAs ...)
- TODO: check
+ - ladybird <itp> (bug #1088305)
CVE-2026-58457 (Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an ...)
- TODO: check
+ NOT-FOR-US: Shenzhen Aitemi
CVE-2026-58263 (Jodit Editor is a WYSIWYG editor with written in pure TypeScript file ...)
- TODO: check
+ NOT-FOR-US: Jodit Editor
CVE-2026-57278 (GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and ...)
NOT-FOR-US: GeoVision
CVE-2026-57277 (GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and ...)
@@ -41,7 +41,7 @@ CVE-2026-57265 (GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentati
CVE-2026-57264 (GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and ...)
NOT-FOR-US: GeoVision
CVE-2026-55886 (Jodit Editor is a WYSIWYG editor with written in pure TypeScript file ...)
- TODO: check
+ NOT-FOR-US: Jodit Editor
CVE-2026-55794 (Craft CMS is a content management system (CMS). In versions 5.9.0 and ...)
TODO: check
CVE-2026-55793 (Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 ...)
@@ -65,7 +65,7 @@ CVE-2026-54908 (Pion DTLS is a Go implementation of Datagram Transport Layer Sec
CVE-2026-54786 (Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; ...)
TODO: check
CVE-2026-54756 (Jodit Editor is a WYSIWYG editor with written in pure TypeScript file ...)
- TODO: check
+ NOT-FOR-US: Jodit Editor
CVE-2026-54720 (Silverstripe Framework is a PHP framework which powers the Silverstrip ...)
TODO: check
CVE-2026-54712 (OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrum ...)
@@ -73,15 +73,15 @@ CVE-2026-54712 (OpenTelemetry Java Instrumentation provides OpenTelemetry auto-i
CVE-2026-54704 (OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrum ...)
TODO: check
CVE-2026-54263 (Wagtail is an open source content management system built on Django. I ...)
- TODO: check
+ NOT-FOR-US: Wagtail
CVE-2026-54262 (Wagtail is an open source content management system built on Django. I ...)
- TODO: check
+ NOT-FOR-US: Wagtail
CVE-2026-54261 (Wagtail is an open source content management system built on Django. I ...)
- TODO: check
+ NOT-FOR-US: Wagtail
CVE-2026-54260 (Wagtail is an open source content management system built on Django. I ...)
- TODO: check
+ NOT-FOR-US: Wagtail
CVE-2026-54259 (Wagtail is an open source content management system built on Django. I ...)
- TODO: check
+ NOT-FOR-US: Wagtail
CVE-2026-54164 (API Platform Core is a system to create hypermedia-driven REST and Gra ...)
TODO: check
CVE-2026-54074 (Tina is a headless content management system. @tinacms/cli versions pr ...)
@@ -413,29 +413,29 @@ CVE-2026-54428 (Allocation of resources without limits or throttling in the HTTP
CVE-2026-54399 (Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 messag ...)
TODO: check
CVE-2026-53909 (MCO does not correctly validate types of uploaded files. File upload v ...)
- TODO: check
+ NOT-FOR-US: MyComplianceOffice MCO
CVE-2026-53908 (MCO is vulnerable to User Enumeration through authentication-related f ...)
- TODO: check
+ NOT-FOR-US: MyComplianceOffice MCO
CVE-2026-53907 (MCO is vulnerable to Stored Cross\u2011Site Scripting (XSS) via the ap ...)
- TODO: check
+ NOT-FOR-US: MyComplianceOffice MCO
CVE-2026-53906 (MCO is vulnerable to Path Disclosure and Path Traversal in file handli ...)
- TODO: check
+ NOT-FOR-US: MyComplianceOffice MCO
CVE-2026-53905 (MCO does not properly enforce authorization checks in the /customer/se ...)
- TODO: check
+ NOT-FOR-US: MyComplianceOffice MCO
CVE-2026-53904 (MCO is vulnerable to Account Denial of Service due to improper impleme ...)
- TODO: check
+ NOT-FOR-US: MyComplianceOffice MCO
CVE-2026-53903 (MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulner ...)
- TODO: check
+ NOT-FOR-US: MyComplianceOffice MCO
CVE-2026-53902 (MCO does not properly enforce authorization checks in the /customer/se ...)
- TODO: check
+ NOT-FOR-US: MyComplianceOffice MCO
CVE-2026-53467 (ImageMagick is free and open-source software used for editing and mani ...)
TODO: check
CVE-2026-53466 (ImageMagick is free and open-source software used for editing and mani ...)
TODO: check
CVE-2026-51947 (An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe ...)
- TODO: check
+ NOT-FOR-US: Pivotal CRM
CVE-2026-51946 (SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2 ...)
- TODO: check
+ NOT-FOR-US: GoAdminGroup GoAdmin
CVE-2026-50043 (Improper neutralization of special elements used in an OS command ('OS ...)
TODO: check
CVE-2026-49119 (Gradio before 6.16.0 contain a path traversal vulnerability in the Fil ...)
@@ -455,49 +455,49 @@ CVE-2026-41121 (Dell Device Management Agent, versions prior to DDMA 26.05, cont
CVE-2026-38142 (An unauthenticated command injection vulnerability in the /goform/fast ...)
NOT-FOR-US: Tenda
CVE-2026-34117 (Guardian language-system passes the id GET parameter directly into a P ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34116 (Guardian language-system passes the id GET parameter directly into a P ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34115 (Guardian language-system passes the id GET parameter directly into a P ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34114 (Guardian language-system passes the id GET parameter directly into a P ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34113 (Guardian language-system passes the id GET parameter directly into a P ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34112 (Guardian language-system passes the id GET parameter directly into a P ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34111 (Guardian language-system passes the id GET parameter directly into a P ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34110 (Guardian language-system passes the id GET parameter directly into a P ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34109 (Guardian language-system passes the id GET parameter directly into a P ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34108 (Guardian language-system passes the id GET parameter directly into a P ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34107 (Guardian language-system passes the id GET parameter directly into a P ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34106 (Guardian language-system passes the id GET parameter directly into a P ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34105 (Guardian language-system passes the id GET parameter directly into an ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34104 (Guardian language-system passes the name GET parameter directly into a ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34103 (Guardian language-system passes the id GET parameter directly into an ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34102 (Guardian language-system passes the id GET parameter directly into an ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34101 (Guardian language-system passes the id GET parameter directly into an ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34100 (Guardian language-system passes the id GET parameter directly into an ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34099 (Guardian language-system passes the id GET parameter directly into an ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34098 (Guardian language-system fails to sanitize the id GET parameter before ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34097 (Guardian language-system fails to sanitize the id GET parameter before ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-34096 (Guardian language-system fails to sanitize the name GET parameter befo ...)
- TODO: check
+ NOT-FOR-US: Guardian language-system
CVE-2026-2891 (The following Poly Voice IP devices, CCX, Trio, and Edge E, might be i ...)
NOT-FOR-US: HP
CVE-2026-27435 (Missing Authorization vulnerability in WofficeIO Woffice allows Exploi ...)
@@ -595,7 +595,8 @@ CVE-2026-12576 (DVP80ES3 with Improper Enforcement of Message Integrity During T
CVE-2026-12575 (DVP80ES3 with Improper Resource Shutdown or Release vulnerability.)
NOT-FOR-US: Delta Electronics
CVE-2026-12480 (Keras versions up to and including 3.13.2 are vulnerable to an arbitra ...)
- TODO: check
+ - keras <removed>
+ [bullseye] - keras <end-of-life> (EOL in bullseye LTS)
CVE-2026-12435 (The Motors \u2013 Car Dealership & Classified Listings Plugin plugin f ...)
NOT-FOR-US: WordPress plugin
CVE-2026-12408 (The Slim SEO \u2013 A Fast & Automated SEO Plugin For WordPress plugin ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f08519dde6f071a7e6a1939c4190aebe3c93b448
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f08519dde6f071a7e6a1939c4190aebe3c93b448
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260702/784b2222/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list