[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff (@jmm) jmm at debian.org
Tue Jul 7 11:32:29 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
313a2b40 by Moritz Muehlenhoff at 2026-07-07T12:32:12+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -345,13 +345,13 @@ CVE-2026-58203 (pydantic-settings provides settings management using Pydantic. F
 CVE-2026-56810 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
 	NOT-FOR-US: elixir-mint Mint
 CVE-2026-56140 (Improper Input Validation vulnerability in Apache Camel AWS SNS compon ...)
-	TODO: check
+	NOT-FOR-US: Camel addon
 CVE-2026-56139 (Generation of Error Message Containing Sensitive Information vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: Camel addon
 CVE-2026-55994 (Improper Input Validation, Exposure of Sensitive Information to an Una ...)
-	TODO: check
+	NOT-FOR-US: Camel addon
 CVE-2026-55993 (Improper Input Validation, Exposure of Sensitive Information to an Una ...)
-	TODO: check
+	NOT-FOR-US: Camel addon
 CVE-2026-55798 (Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get ...)
 	- pillow <not-affected> (Only affects Windows specific WindowsViewer)
 	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6
@@ -382,19 +382,19 @@ CVE-2026-54059 (Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFont
 	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x
 	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d (12.3.0)
 CVE-2026-53913 (Improper Authentication, Missing Authentication for Critical Function, ...)
-	TODO: check
+	NOT-FOR-US: Camel addon
 CVE-2026-4249 (The throttling event handling mechanism in multiple WSO2 products acce ...)
 	NOT-FOR-US: WSO2
 CVE-2026-49365 (Generation of Error Message Containing Sensitive Information vulnerabi ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-49099 (Improper Neutralization of Special Elements in Output Used by a Downst ...)
-	TODO: check
+	NOT-FOR-US: Camel addon
 CVE-2026-49098 (Improper Input Validation, Improper Neutralization of Special Elements ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-49097 (Improper Input Validation, Improper Neutralization of Special Elements ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-49086 (Improper Input Validation, Unintended Proxy or Intermediary ('Confused ...)
-	TODO: check
+	NOT-FOR-US: Camel addon
 CVE-2026-49042 (Improper Input Validation vulnerability in Apache Camel.  This issue a ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-48614 (An improper authorization vulnerability in the Plesk XML API allows an ...)
@@ -402,15 +402,15 @@ CVE-2026-48614 (An improper authorization vulnerability in the Plesk XML API all
 CVE-2026-48316 (ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Imp ...)
 	NOT-FOR-US: Adobe
 CVE-2026-48206 (Improper Input Validation, Authorization Bypass Through User-Controlle ...)
-	TODO: check
+	NOT-FOR-US: Camel addon
 CVE-2026-48205 (Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerab ...)
-	TODO: check
+	NOT-FOR-US: Camel addon
 CVE-2026-48204 (Improper Input Validation, Improper Access Control vulnerability in Ap ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-48203 (Improper Neutralization of Special Elements in Output Used by a Downst ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-46726 (Improper Input Validation, Exposure of Sensitive Information to an Una ...)
-	TODO: check
+	NOT-FOR-US: Camel addon
 CVE-2026-46592 (Improper Input Validation, Unintended Proxy or Intermediary ('Confused ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-46591 (Improper Neutralization of Special Elements in Data Query Logic vulner ...)
@@ -422,9 +422,9 @@ CVE-2026-46588 (Improper Input Validation vulnerability in Apache Camel.  This i
 CVE-2026-46587 (Improper Input Validation vulnerability in Apache Camel.  This issue a ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-46585 (Improper Input Validation, Authorization Bypass Through User-Controlle ...)
-	TODO: check
+	NOT-FOR-US: Camel addon
 CVE-2026-46584 (Improper Input Validation, Exposure of Sensitive Information to an Una ...)
-	TODO: check
+	NOT-FOR-US: Camel addon
 CVE-2026-46457 (Improper Input Validation vulnerability in Apache Camel NATS component ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-46456 (Improper Input Validation vulnerability in Apache Camel AWS2-SQS Compo ...)
@@ -444,7 +444,7 @@ CVE-2026-44934 (A information disclosure when DEBUG loglevel is set in SUSE Ranc
 CVE-2026-43867 (Deserialization of Untrusted Data vulnerability in Apache Camel PQC Co ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-43866 (Deserialization of Untrusted Data vulnerability in Apache Camel, Apach ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-43865 (Deserialization of Untrusted Data vulnerability in Apache Camel Hazelc ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-43825 (Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel  Versi ...)
@@ -482,21 +482,21 @@ CVE-2026-24012 (Uncontrolled Resource Consumption vulnerability in Apache IoTDB.
 CVE-2026-1433 (uniFLOW Universal Login Manager (ULM) Standalone contains an informati ...)
 	NOT-FOR-US: Canon
 CVE-2026-14809 (Prog Management System developed by PROG MIS has a SQL Injection vulne ...)
-	TODO: check
+	NOT-FOR-US: PROG MIS
 CVE-2026-14808 (Prog   Management System developed by PROG MIS has a Exposure of Sensi ...)
-	TODO: check
+	NOT-FOR-US: PROG MIS
 CVE-2026-14807 (ERP App developed by PROG MIS has a Use of Hard-coded Credentials vuln ...)
-	TODO: check
+	NOT-FOR-US: PROG MIS
 CVE-2026-14802 (A vulnerability was detected in react create-react-app up to 5.0.1 on  ...)
-	TODO: check
+	NOT-FOR-US: create-react-app
 CVE-2026-14801 (A security vulnerability has been detected in GPAC 26.03-DEV-rev342-g8 ...)
 	TODO: check
 CVE-2026-14800 (A weakness has been identified in imhamzaazam ecommerceFlask up to cb7 ...)
-	TODO: check
+	NOT-FOR-US: ecommerceFlask
 CVE-2026-13753 (A missing authorization vulnerability exists in the embedded webserver ...)
-	TODO: check
+	NOT-FOR-US: HP
 CVE-2026-12686 (An authenticated user could manipulate a company ID parameter in a POS ...)
-	TODO: check
+	NOT-FOR-US: Adiss Biloop
 CVE-2026-12154 (The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPres ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-12083 (The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, a ...)
@@ -512,15 +512,15 @@ CVE-2026-10830 (The AllCoach  WordPress plugin before 1.0.2 does not verify that
 CVE-2025-8591 (The software accepts user-supplied input via a URL parameter without a ...)
 	NOT-FOR-US: WSO2
 CVE-2025-53831 (DrawIO for ownCloud is an application for using DrawIO with the file s ...)
-	TODO: check
+	NOT-FOR-US: ownCloud addon
 CVE-2025-53830 (Anti-Virus for ownCloud is an anti-virus application for file storage, ...)
-	TODO: check
+	NOT-FOR-US: ownCloud addon
 CVE-2025-53829 (ownCloud is a file storage, synchronization, and sharing application.  ...)
-	TODO: check
+	- owncloud <removed>
 CVE-2025-53828 (SharePoint for ownCloud is an application for using SharePoint with th ...)
-	TODO: check
+	NOT-FOR-US: ownCloud addon
 CVE-2025-53827 (ownCloud Core is the server-side component of the file storage, synchr ...)
-	TODO: check
+	- owncloud <removed>
 CVE-2025-15668 (A vulnerability was identified in GPAC up to b40ce70f5. This issue aff ...)
 	TODO: check
 CVE-2025-15667 (A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerabili ...)
@@ -641,11 +641,11 @@ CVE-2026-14771 (A flaw has been found in SourceCodester Class and Exam Timetabli
 CVE-2026-14770 (A vulnerability was detected in SourceCodester Class and Exam Timetabl ...)
 	NOT-FOR-US: SourceCodester
 CVE-2026-14769 (A security vulnerability has been detected in code-projects Real State ...)
-	TODO: check
+	NOT-FOR-US: code-projects
 CVE-2026-14768 (A weakness has been identified in code-projects Real State Services 1. ...)
-	TODO: check
+	NOT-FOR-US: code-projects
 CVE-2026-14767 (A security flaw has been discovered in CodeAstro Ecommerce Website 1.0 ...)
-	TODO: check
+	NOT-FOR-US: CodeAstro
 CVE-2026-10657 (Zephyr's DNS resolver detects mDNS (.local) queries in dns_resolve_nam ...)
 	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-10656 (The MAX32xxx USB device controller driver (drivers/usb/udc/udc_max32.c ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/313a2b40c215f8c8ddeff27f7cf25e0c7b1419f2

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/313a2b40c215f8c8ddeff27f7cf25e0c7b1419f2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260707/c1b742f4/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list