[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Jul 10 20:14:54 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
0b097e60 by security tracker role at 2026-07-10T19:14:48+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,21 +1,21 @@
CVE-2026-9857 (The Invoice123 plugin for WordPress is vulnerable to authorization byp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-9838 (The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-8609 (An unauthenticated attacker can repeatedly call Grafana's OAuth login ...)
- TODO: check
+ NOT-FOR-US: Grafana Labs
CVE-2026-8595 (A user with Editor permissions can craft a dashboard whose table (Tabl ...)
- TODO: check
+ NOT-FOR-US: Grafana Labs
CVE-2026-6872
REJECTED
CVE-2026-6802 (The Easy Upload Files During Checkout plugin for WordPress is vulnerab ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-6440 (The GoodMeet \u2013 Google Meet Integration for Webinar, Meeting & Vid ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-6212 (Authorization bypass through User-Controlled key vulnerability in Tera ...)
TODO: check
CVE-2026-61492 (In JetBrains YouTrack before 2026.2.17394 stored XSS via article title ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-61461 (Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the M ...)
TODO: check
CVE-2026-61460 (Krayin CRM through 2.2.3 contains an insecure direct object reference ...)
@@ -49,17 +49,17 @@ CVE-2026-60086 (PraisonAI before 4.6.78 contains a prompt injection defense bypa
CVE-2026-5801 (Improper neutralization of special elements used in an SQL command ('S ...)
TODO: check
CVE-2026-59796 (In JetBrains TeamCity before 2026.1.2 pipeline modification was possib ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-59795 (In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated a ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-59794 (In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-59793 (In JetBrains TeamCity before 2026.1.2 arbitrary file access was possib ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-59792 (In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via ...)
TODO: check
CVE-2026-59791 (In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid di ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-59193 (Grav is a file-based Web platform. Prior to 2.0.0, an authenticated ad ...)
TODO: check
CVE-2026-59190 (grav-plugin-admin is an HTML user interface that provides a way to con ...)
@@ -75,7 +75,7 @@ CVE-2026-59154 (Wekan is open source kanban built with Meteor. Prior to 9.64, We
CVE-2026-59151 (Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML ...)
TODO: check
CVE-2026-58661 (n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a d ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-58493 (grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2 ...)
TODO: check
CVE-2026-58492 (grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2 ...)
@@ -101,11 +101,11 @@ CVE-2026-56813 (Improper Neutralization of Parameter/Argument Delimiters vulnera
CVE-2026-56765 (Vikunja before 2.2.1 contains an authorization flaw where the LinkShar ...)
TODO: check
CVE-2026-56690 (Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improp ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-56689 (Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improp ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-56688 (Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improp ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-56676 (9Router is an AI router & token saver. Prior to 0.5.2, 9router validat ...)
TODO: check
CVE-2026-56675 (9Router is an AI router & token saver. Prior to 0.5.2, 9router treats ...)
@@ -125,7 +125,7 @@ CVE-2026-56373 (ImageMagick before 7.1.2-15 contains a use-after-free vulnerabil
CVE-2026-56366 (ImageMagick before 7.1.2-18 contains a memory leak vulnerability in th ...)
TODO: check
CVE-2026-56354 (n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branch ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-56335 (Capgo before 12.128.2 contains an authorization bypass vulnerability w ...)
TODO: check
CVE-2026-56329 (Capgo before 12.128.2 contains a cross-tenant preview namespace collis ...)
@@ -191,11 +191,11 @@ CVE-2026-55460 (Snipe-IT is an IT asset/license management system. Prior to 8.6.
CVE-2026-54919 (cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTT ...)
TODO: check
CVE-2026-54470 (Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-54469 (Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-54468 (Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-54329 (Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the ...)
TODO: check
CVE-2026-54149 (MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-l ...)
@@ -235,19 +235,19 @@ CVE-2026-41876 (R-SOFT DMS is vulnerable toOS Command Injection in konwertujActi
CVE-2026-40454 (Out-of-bounds Read, Improper Input Validation vulnerability in Apache ...)
TODO: check
CVE-2026-40452 (Incorrect Authorization, Improper Access Control vulnerability in Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-40009 (Improper Privilege Management, Improper Access Control vulnerability i ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-40008 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-40007 (Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-40006 (Memory Allocation with Excessive Size Value, Allocation of Resources W ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-40005 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-3907 (The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-3251 (Improper neutralization of input during web page generation ('cross-si ...)
TODO: check
CVE-2026-39903 (Simple Machines Forum 2.1 prior to 2.1.8 and 3.0 prior to 3.0 Alpha 5 ...)
@@ -259,7 +259,7 @@ CVE-2026-38059 (The iDirect iQ200 exposes the /api/identity and /api/ REST API e
CVE-2026-38057 (The iDirect iQ200 does not validate CSRF tokens on state-changing API ...)
TODO: check
CVE-2026-33382 (Several Grafana API endpoints, some of them unauthenticated, do not li ...)
- TODO: check
+ NOT-FOR-US: Grafana Labs
CVE-2026-2398 (Authorization bypass through User-Controlled key vulnerability in Adam ...)
TODO: check
CVE-2026-2397 (Improper neutralization of special elements used in an SQL command ('S ...)
@@ -267,15 +267,15 @@ CVE-2026-2397 (Improper neutralization of special elements used in an SQL comman
CVE-2026-29519 (Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x r ...)
TODO: check
CVE-2026-28564 (Insufficient Session Expiration, Authentication Bypass by Capture-repl ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-22660 (FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw ...)
TODO: check
CVE-2026-22659 (FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorizat ...)
TODO: check
CVE-2026-1946 (The GW AI Website Builder plugin for WordPress is vulnerable to unauth ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-1667 (The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to A ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15378 (A flaw was found in the `guardrails-detectors` component. This vulnera ...)
TODO: check
CVE-2026-15377 (A vulnerability was determined in Eleveo Call Recording Software 9.7.0 ...)
@@ -293,37 +293,37 @@ CVE-2026-15146 (GNU Wget does not validate the IP address provided by an FTP PAS
CVE-2026-15143 (A flaw was found in the file_type content detector of guardrails-detec ...)
TODO: check
CVE-2026-15104 (The BetterDocs \u2013 AI Documentation, Knowledge Base, Docs, Wikis, F ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15028 (A flaw was found in libarchive. This vulnerability allows a remote att ...)
TODO: check
CVE-2026-15026 (The Import and export users and customers plugin for WordPress is vuln ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14475 (The Cookie Banner for GDPR / CCPA \u2013 WPLP Cookie Consent plugin fo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14461 (mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup( ...)
TODO: check
CVE-2026-13710 (The Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widget ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13347 (The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary Fi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13247 (The Logo Slider \u2013 Logo Carousel, Client Logo Slider & Brand Showc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13010 (The JoomSport \u2013 for Sports: Team & League, Football, Hockey & mor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12955 (The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12924 (The Eventin \u2013 Event Calendar, Event Registration, Tickets & Booki ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12918 (The Mail Mint \u2013 Email Marketing, Newsletter, Email Automation & W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12400 (The FlowForms \u2013 Conversational Form Builder plugin for WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12108 (The Highlighting Code Block plugin for WordPress is vulnerable to Stor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11992 (The Easy Appointments plugin for WordPress is vulnerable to authorizat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11990 (The KiviCare \u2013 Clinic & Patient Management System (EHR) plugin fo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-70796 (An unauthenticated path traversal vulnerability exists in the web mana ...)
TODO: check
CVE-2025-30008 (HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerabi ...)
@@ -333,7 +333,7 @@ CVE-2025-30007 (HestiaCP before 1.9.5 contains an authenticated OS command injec
CVE-2025-12127
REJECTED
CVE-2025-11977 (The Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-53363 (In the Linux kernel, the following vulnerability has been resolved: x ...)
- linux 7.0.13-1
[trixie] - linux <not-affected> (Vulnerable code not present)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0b097e604470361d71a1c684c11c1a587a037b18
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0b097e604470361d71a1c684c11c1a587a037b18
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260710/5e2f324b/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list