[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Jul 9 08:14:21 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
503079ce by security tracker role at 2026-07-09T07:14:15+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,31 +1,31 @@
CVE-2026-8801 (Path equivalence: vulnerability in Progress MOVEit Transfer (File Uplo ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-8800 (Incorrect Authorization vulnerability in Progress MOVEit Transfer (Aud ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-8651 (Limited authentication bypass by spoofing vulnerability in Progress MO ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-8650 (Relative path traversal vulnerability in Progress MOVEit Transfer (Adm ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-8649 (Improper Neutralization of Special Elements in Data Query Logic vulner ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-8472 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-7492 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-6896 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-6352 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-60105 (Monsta FTP before 2.14.5 contains a server-side request forgery vulner ...)
TODO: check
CVE-2026-60104 (Bitwarden Server before 2026.6.0 does not verify that the email in a P ...)
TODO: check
CVE-2026-5923 (Malicious use of a stolen cookie might allow modifications to the cont ...)
- TODO: check
+ NOT-FOR-US: HP
CVE-2026-5922 (The IP phone might use malicious input stored in configuration paramet ...)
- TODO: check
+ NOT-FOR-US: HP
CVE-2026-5523 (The Divi Form Builder plugin for WordPress is vulnerable to Missing Au ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-59948 (Composer is a dependency Manager for the PHP language. Prior to 2.2.29 ...)
TODO: check
CVE-2026-59947 (Composer is a dependency Manager for the PHP language. Prior to 2.2.29 ...)
@@ -63,7 +63,7 @@ CVE-2026-59802 (PasswordPusher before 2.8.1 accepts data URI schemes in URL push
CVE-2026-59723 (Cline is an autonomous coding agent as an SDK, IDE extension, or CLI a ...)
TODO: check
CVE-2026-58525 (Improper access control in Microsoft Edge (Chromium-based) allows an u ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-58501 (Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbid ...)
TODO: check
CVE-2026-58494 (Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0 ...)
@@ -73,9 +73,9 @@ CVE-2026-58192 (Appium is a cross-platform automation framework for all kinds of
CVE-2026-58191 (Appium is a cross-platform automation framework for all kinds of apps, ...)
TODO: check
CVE-2026-57481 (Parse Server is an open source backend that can be deployed to any inf ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-57480 (Parse Server is an open source backend that can be deployed to any inf ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-56669 (Elysia is a Typescript framework for request validation, type inferenc ...)
TODO: check
CVE-2026-55878 (Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2 ...)
@@ -85,7 +85,7 @@ CVE-2026-55877 (Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 be
CVE-2026-55849 (@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials ...)
TODO: check
CVE-2026-55778 (Parse Server is an open source backend that can be deployed to any inf ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-55760 (Handlebars.java provides logic-less and semantic Mustache templates wi ...)
TODO: check
CVE-2026-55596 (Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 5 ...)
@@ -163,7 +163,7 @@ CVE-2026-47828 (During bosh create-env and bosh delete-env, the CLI uploads comp
CVE-2026-47826 (The blobs.yml path key traversal vulnerability in the BOSH CLI tool al ...)
TODO: check
CVE-2026-47646 (Improper neutralization of input during web page generation ('cross-si ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-45045 (Fiber is an Express inspired web framework written in Go. Prior to 3.3 ...)
TODO: check
CVE-2026-44512 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
@@ -197,39 +197,39 @@ CVE-2026-35210 (OpenCTI is an open source platform for managing cyber threat int
CVE-2026-31309 (Improper authorization in the /tequilapi/config/user endpoint of Myste ...)
TODO: check
CVE-2026-15174 (Catapult DCT2000 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15173 (pcapng file parser crash in Wireshark 4.6.0 to 4.6.6 allows denial of ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15172 (FMP/NOTIFY protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4. ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15171 (SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15170 (Z39.50 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15169 (UMTS FP protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15168 (BLF file parser in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15167 (DBS Etherwatch file parser crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15166 (IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4 ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15165 (TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of s ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15164 (Crash in ciscodump 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15163 (Multiple protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.6 ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15154 (A flaw was found in `guardrails-detectors`, a component of Red Hat Ope ...)
TODO: check
CVE-2026-15138 (A security vulnerability has been detected in tumf mcp-text-editor up ...)
TODO: check
CVE-2026-15137 (A weakness has been identified in code-projects Interview Management S ...)
- TODO: check
+ NOT-FOR-US: code-projects
CVE-2026-15135 (A security flaw has been discovered in code-projects Online Food Order ...)
- TODO: check
+ NOT-FOR-US: code-projects
CVE-2026-15134 (A vulnerability was determined in CodeAstro Simple Online Leave Manage ...)
- TODO: check
+ NOT-FOR-US: CodeAstro
CVE-2026-15105 (A flaw has been found in davenardella snap7 up to 1.4.3. This affects ...)
TODO: check
CVE-2026-14896 (HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespa ...)
@@ -241,29 +241,29 @@ CVE-2026-14373 (HashiCorp Nomad and Nomad Enterprise did not enforce the allow_p
CVE-2026-14361 (The consul-template library before version 0.42.1 is vulnerable to a p ...)
TODO: check
CVE-2026-13320 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-13151 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-12517 (The Fediverse Embeds WordPress plugin before 1.5.8 does not validate t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12516 (The Fediverse Embeds WordPress plugin before 1.5.8 does not validate t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12270 (The Everest Forms WordPress plugin before 3.5.0 does not correctly re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11875 (The WP Support Plus Responsive Ticket System WordPress plugin through ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11869 (The WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 does not perf ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11827 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-11571 (The Everest Forms WordPress plugin before 3.5.0 does not reliably del ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-10037 (A sandbox escape vulnerability exists in the OpenJDK packages provided ...)
TODO: check
CVE-2026-0288 (Multiple buffer overflow vulnerabilities in the User-ID Terminal Serve ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2025-12506 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15112 (Use after free in Ozone in Google Chrome prior to 150.0.7871.115 allow ...)
- chromium <unfixed>
[bullseye] - chromium <end-of-life> (see #1061268)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/503079ce79a8ca055d5bf31993a82cc93cd2d873
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/503079ce79a8ca055d5bf31993a82cc93cd2d873
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260709/79986b37/attachment.htm>
More information about the debian-security-tracker-commits
mailing list