[Git][security-tracker-team/security-tracker][master] Process some NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6f9f2b66 by Salvatore Bonaccorso at 2026-07-09T10:12:50+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -17,7 +17,7 @@ CVE-2026-6896 (GitLab has remediated an issue in GitLab EE affecting all version
 CVE-2026-6352 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
 	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
 CVE-2026-60105 (Monsta FTP before 2.14.5 contains a server-side request forgery vulner ...)
-	TODO: check
+	NOT-FOR-US: Monsta FTP
 CVE-2026-60104 (Bitwarden Server before 2026.6.0 does not verify that the email in a P ...)
 	TODO: check
 CVE-2026-5923 (Malicious use of a stolen cookie might allow modifications to the cont ...)
@@ -41,23 +41,23 @@ CVE-2026-59936 (pypdf is a free and open-source pure-python PDF library. Prior t
 CVE-2026-59935 (pypdf is a free and open-source pure-python PDF library. Prior to 6.14 ...)
 	TODO: check
 CVE-2026-59822 (LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or  ...)
-	TODO: check
+	NOT-FOR-US: LiteLLM
 CVE-2026-59821 (LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or  ...)
-	TODO: check
+	NOT-FOR-US: LiteLLM
 CVE-2026-59820 (LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or  ...)
-	TODO: check
+	NOT-FOR-US: LiteLLM
 CVE-2026-59819 (LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or  ...)
-	TODO: check
+	NOT-FOR-US: LiteLLM
 CVE-2026-59818 (etcd is a distributed key-value store for the data of a distributed sy ...)
 	TODO: check
 CVE-2026-59807 (Composio SDK before 0.2.32-beta.283 contains a path validation bypass  ...)
-	TODO: check
+	NOT-FOR-US: Composio SDK
 CVE-2026-59806 (Gradio before 6.20.0 contains an open redirect and server-side request ...)
-	TODO: check
+	NOT-FOR-US: Gradio
 CVE-2026-59805 (Gumroad before 2026.07.06.2 contains a broken access control vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: Gumroad
 CVE-2026-59804 (Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contai ...)
-	TODO: check
+	NOT-FOR-US: Midscene Bridge Server
 CVE-2026-59803 (rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-serv ...)
 	TODO: check
 CVE-2026-59802 (PasswordPusher before 2.8.1 accepts data URI schemes in URL push paylo ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6f9f2b66a7d02b23fb3db69f811b30826bde21f2

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6f9f2b66a7d02b23fb3db69f811b30826bde21f2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260709/5b4df66f/attachment-0001.htm>