[Git][security-tracker-team/security-tracker][master] Process some more NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sun Jul 12 21:57:08 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3de08701 by Salvatore Bonaccorso at 2026-07-12T22:56:43+02:00
Process some more NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -29,35 +29,35 @@ CVE-2026-56241 (Capgo before 12.128.2 contains a privilege escalation vulnerabil
CVE-2026-56238 (Capgo before 12.128.2 contains an information disclosure vulnerability ...)
NOT-FOR-US: Cap-go
CVE-2026-15502 (A vulnerability was detected in AojiaoZero Antaris 1.0. This affects t ...)
- TODO: check
+ NOT-FOR-US: AojiaoZero Antaris
CVE-2026-15501 (A security vulnerability has been detected in AstrBotDevs AstrBot up t ...)
- TODO: check
+ NOT-FOR-US: AstrBotDevs AstrBot
CVE-2026-15500 (A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Af ...)
- TODO: check
+ NOT-FOR-US: AstrBotDevs AstrBot
CVE-2026-15499 (A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25. ...)
- TODO: check
+ NOT-FOR-US: AstrBotDevs AstrBot
CVE-2026-15498 (A vulnerability was identified in sergomanov SmartHomeAdatum up to cf4 ...)
- TODO: check
+ NOT-FOR-US: sergomanov SmartHomeAdatum
CVE-2026-15497 (A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7. ...)
- TODO: check
+ NOT-FOR-US: SonicCloudOrg
CVE-2026-15496 (A vulnerability was found in SonicCloudOrg sonic-agent up to 2.7.2. Th ...)
- TODO: check
+ NOT-FOR-US: SonicCloudOrg
CVE-2026-15495 (A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7. ...)
- TODO: check
+ NOT-FOR-US: SonicCloudOrg
CVE-2026-15494 (A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Im ...)
- TODO: check
+ NOT-FOR-US: AMTT Hotel Broadband Operation System
CVE-2026-15493 (A vulnerability was detected in Akpali9 Attendance-Management-System u ...)
- TODO: check
+ NOT-FOR-US: Akpali9 Attendance-Management-System
CVE-2026-15492 (A security vulnerability has been detected in igweze wizgrade up to b1 ...)
- TODO: check
+ NOT-FOR-US: igweze wizgrade
CVE-2026-15491 (A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1 ...)
- TODO: check
+ NOT-FOR-US: RafyMrX TOKO-ONLINE-ROTI
CVE-2026-15490 (A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ...)
- TODO: check
+ NOT-FOR-US: RafyMrX TOKO-ONLINE-ROTI
CVE-2026-15489 (A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1 ...)
- TODO: check
+ NOT-FOR-US: RafyMrX TOKO-ONLINE-ROTI
CVE-2026-15488 (A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Af ...)
- TODO: check
+ NOT-FOR-US: hcr707305003 shiroiAdmin
CVE-2026-15487 (A vulnerability was found in TRENDnet TEW-821DAP 1.11B03. This impacts ...)
NOT-FOR-US: TRENDnet
CVE-2026-15486 (A vulnerability has been found in TRENDnet TEW-821DAP 1.11B03. This af ...)
@@ -83,31 +83,31 @@ CVE-2026-15484 (A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The
CVE-2026-15483 (A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12 ...)
NOT-FOR-US: TRENDnet
CVE-2026-15482 (A weakness has been identified in Aster Telecom Azcall 10/11. This iss ...)
- TODO: check
+ NOT-FOR-US: Aster Telecom Azcall
CVE-2026-15481 (A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00. ...)
NOT-FOR-US: TRENDnet
CVE-2026-15480 (A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. T ...)
NOT-FOR-US: TRENDnet
CVE-2026-15479 (A vulnerability was found in H3C NX15 V100R017. Affected by this vulne ...)
- TODO: check
+ NOT-FOR-US: H3C
CVE-2026-15478 (A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown ...)
- TODO: check
+ NOT-FOR-US: IceHRM
CVE-2026-15477 (A vulnerability was detected in Bahmni bahmnicore up to 0.93. This aff ...)
- TODO: check
+ NOT-FOR-US: Bahmni bahmnicore
CVE-2026-15476 (A security vulnerability has been detected in QILING Disk Master 6.0.0 ...)
- TODO: check
+ NOT-FOR-US: QILING Disk Master
CVE-2026-15475 (A weakness has been identified in MiniTool Partition Wizard up to 13.6 ...)
- TODO: check
+ NOT-FOR-US: MiniTool Partition Wizard
CVE-2026-15474 (A security flaw has been discovered in Eleveo Call Recording Software ...)
- TODO: check
+ NOT-FOR-US: Eleveo Call Recording Software
CVE-2026-15473 (A vulnerability was identified in Eleveo Call Recording Software 9.7.0 ...)
- TODO: check
+ NOT-FOR-US: Eleveo Call Recording Software
CVE-2026-15472 (A vulnerability was determined in Eleveo Call Recording Software 9.7.0 ...)
- TODO: check
+ NOT-FOR-US: Eleveo Call Recording Software
CVE-2026-15471 (A vulnerability was found in Eleveo Call Recording Software 9.7.0. Thi ...)
- TODO: check
+ NOT-FOR-US: Eleveo Call Recording Software
CVE-2026-15470 (A vulnerability has been found in Eleveo Call Recording Software 9.7.0 ...)
- TODO: check
+ NOT-FOR-US: Eleveo Call Recording Software
CVE-2026-61870 (ImageMagick before 7.1.2-26 contains a memory leak vulnerability in th ...)
- imagemagick 8:7.1.2.26+dfsg1-1
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m596-67p7-69wh
@@ -365,9 +365,9 @@ CVE-2026-45196 (Kernel software installed and running inside a Host VM may post
CVE-2026-44795 (Spinnaker is an open source, multi-cloud continuous delivery platform. ...)
NOT-FOR-US: Spinnaker
CVE-2026-44383 (Multiple connections to the backend using the same charging station ID ...)
- TODO: check
+ NOT-FOR-US: Hydro-Quebec
CVE-2026-42952 (Previously, there was no throttling on repeated authentication attempt ...)
- TODO: check
+ NOT-FOR-US: Hydro-Quebec
CVE-2026-42219 (Frappe is a full-stack web application framework. Prior to 16.19.0 and ...)
NOT-FOR-US: Frappe
CVE-2026-41482 (Frappe is a full-stack web application framework. Prior to 16.18.3, po ...)
@@ -776,15 +776,15 @@ CVE-2026-51119 (An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to e
CVE-2026-46388 (osquery is a SQL powered operating system instrumentation, monitoring, ...)
TODO: check
CVE-2026-41880 (R-SOFT DMS is vulnerable toOS Command Injection in the Optical Charact ...)
- TODO: check
+ NOT-FOR-US: R-SOFT DMS
CVE-2026-41879 (R-SOFT DMSstores superadmin credentials using a non-salted nested MD5 ...)
- TODO: check
+ NOT-FOR-US: R-SOFT DMS
CVE-2026-41878 (R-SOFT DMS is vulnerable toInsecure Direct Object Reference (IDOR) att ...)
- TODO: check
+ NOT-FOR-US: R-SOFT DMS
CVE-2026-41877 (R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. A ...)
- TODO: check
+ NOT-FOR-US: R-SOFT DMS
CVE-2026-41876 (R-SOFT DMS is vulnerable toOS Command Injection in konwertujAction() f ...)
- TODO: check
+ NOT-FOR-US: R-SOFT DMS
CVE-2026-40454 (Out-of-bounds Read, Improper Input Validation vulnerability in Apache ...)
TODO: check
CVE-2026-40452 (Incorrect Authorization, Improper Access Control vulnerability in Apac ...)
@@ -802,29 +802,29 @@ CVE-2026-40005 (Improper Limitation of a Pathname to a Restricted Directory ('Pa
CVE-2026-3907 (The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scr ...)
NOT-FOR-US: WordPress plugin
CVE-2026-3251 (Improper neutralization of input during web page generation ('cross-si ...)
- TODO: check
+ NOT-FOR-US: Webremium Istanbul Web Design Mezunum Satiyorum
CVE-2026-39903 (Simple Machines Forum 2.1 prior to 2.1.8 and 3.0 prior to 3.0 Alpha 5 ...)
- TODO: check
+ NOT-FOR-US: Simple Machines Forum
CVE-2026-39244 (adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ...)
TODO: check
CVE-2026-38059 (The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoin ...)
- TODO: check
+ NOT-FOR-US: iDirect iQ200
CVE-2026-38057 (The iDirect iQ200 does not validate CSRF tokens on state-changing API ...)
- TODO: check
+ NOT-FOR-US: iDirect iQ200
CVE-2026-33382 (Several Grafana API endpoints, some of them unauthenticated, do not li ...)
NOT-FOR-US: Grafana Labs
CVE-2026-2398 (Authorization bypass through User-Controlled key vulnerability in Adam ...)
- TODO: check
+ NOT-FOR-US: Adam Retail Automation
CVE-2026-2397 (Improper neutralization of special elements used in an SQL command ('S ...)
- TODO: check
+ NOT-FOR-US: Adam Retail Automation
CVE-2026-29519 (Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x r ...)
- TODO: check
+ NOT-FOR-US: Lucee CFML Server
CVE-2026-28564 (Insufficient Session Expiration, Authentication Bypass by Capture-repl ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-22660 (FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw ...)
- TODO: check
+ NOT-FOR-US: FlaskBBFlaskBB
CVE-2026-22659 (FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorizat ...)
- TODO: check
+ NOT-FOR-US: FlaskBBFlaskBB
CVE-2026-1946 (The GW AI Website Builder plugin for WordPress is vulnerable to unauth ...)
NOT-FOR-US: WordPress plugin
CVE-2026-1667 (The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to A ...)
@@ -832,15 +832,15 @@ CVE-2026-1667 (The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable
CVE-2026-15378 (A flaw was found in the `guardrails-detectors` component. This vulnera ...)
TODO: check
CVE-2026-15377 (A vulnerability was determined in Eleveo Call Recording Software 9.7.0 ...)
- TODO: check
+ NOT-FOR-US: Eleveo Call Recording Software
CVE-2026-15376 (A vulnerability was found in Eleveo Call Recording Software 9.7.0. Aff ...)
- TODO: check
+ NOT-FOR-US: Eleveo Call Recording Software
CVE-2026-15375 (A vulnerability has been found in Eleveo Call Recording Software 9.7.0 ...)
- TODO: check
+ NOT-FOR-US: Eleveo Call Recording Software
CVE-2026-15374 (A flaw has been found in Eleveo Call Recording Software 9.7.0. This af ...)
- TODO: check
+ NOT-FOR-US: Eleveo Call Recording Software
CVE-2026-15373 (A vulnerability was detected in Eleveo Call Recording Software 9.7.0. ...)
- TODO: check
+ NOT-FOR-US: Eleveo Call Recording Software
CVE-2026-15146 (GNU Wget does not validate the IP address provided by an FTP PASV resp ...)
TODO: check
CVE-2026-15143 (A flaw was found in the file_type content detector of guardrails-detec ...)
@@ -1024,7 +1024,7 @@ CVE-2026-45780 (Discourse is an open-source discussion platform. Prior to 2026.6
CVE-2026-44787 (Discourse is an open-source discussion platform. Prior to 2026.6.0, 20 ...)
NOT-FOR-US: Discourse
CVE-2026-44342 (New API is a large language mode (LLM) gateway and artificial intellig ...)
- TODO: check
+ NOT-FOR-US: New API
CVE-2026-39246 (decompress before 4.2.2 allows arbitrary symlink creation during archi ...)
TODO: check
CVE-2026-39245 (decompress before 4.2.2 contains an improper path containment check th ...)
@@ -1046,9 +1046,9 @@ CVE-2026-33799 (An Out-of-bounds Write vulnerability in the SNMP daemon (snmpd)
CVE-2026-33794 (An Improper Check for Unusual or Exceptional Conditions vulnerability ...)
NOT-FOR-US: Juniper
CVE-2026-33655 (New API is a large language mode (LLM) gateway and artificial intellig ...)
- TODO: check
+ NOT-FOR-US: New API
CVE-2026-31267 (Mercusys MW302R MW302R(EU)_V1_1.4.10 Build 231023 is vulnerable to Buf ...)
- TODO: check
+ NOT-FOR-US: Mercusys
CVE-2026-21901 (A NULL Pointer Dereference vulnerability in the management daemon (mgd ...)
NOT-FOR-US: Juniper
CVE-2026-21057 (Improper input validation in Samsung Pass prior to version 5.2.10.3 al ...)
@@ -1088,17 +1088,17 @@ CVE-2026-21040 (Improper access control in IAFDService prior to SMR Jul-2026 Rel
CVE-2026-21039 (Improper access control in Settings prior to SMR Jul-2026 Release 1 al ...)
NOT-FOR-US: Samsung Mobile
CVE-2026-15332 (A security flaw has been discovered in zhayujie CowAgent up to 2.1.0. ...)
- TODO: check
+ NOT-FOR-US: zhayujie CowAgent
CVE-2026-15331 (A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The a ...)
- TODO: check
+ NOT-FOR-US: zhayujie CowAgent
CVE-2026-15330 (A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impac ...)
- TODO: check
+ NOT-FOR-US: zhayujie CowAgent
CVE-2026-15329 (A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue ...)
- TODO: check
+ NOT-FOR-US: zhayujie CowAgent
CVE-2026-15326 (A vulnerability was identified in halo-dev halo up to 2.24.2. This aff ...)
TODO: check
CVE-2026-15321 (A vulnerability was found in MyEMS up to 6.4.0. The affected element i ...)
- TODO: check
+ NOT-FOR-US: MyEMS
CVE-2026-15320 (A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vuln ...)
TODO: check
CVE-2026-15319 (A security vulnerability has been detected in Sipeed PicoClaw up to 0. ...)
@@ -1767,21 +1767,21 @@ CVE-2026-52200 (An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a
CVE-2026-51535 (In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Ser ...)
NOT-FOR-US: OpENer
CVE-2026-49866 (libp2p is a JavaScript Implementation of libp2p networking stack. Prio ...)
- TODO: check
+ NOT-FOR-US: js-libp2p
CVE-2026-48492 (Snipe-IT is an IT asset/license management system. Prior to version 8. ...)
- snipe-it <itp> (bug #1005172)
CVE-2026-47840 (A network attacker positioned between UAA and its LDAP directory can i ...)
- TODO: check
+ NOT-FOR-US: Cloud Foundry UAA
CVE-2026-47831 (Use of a cryptographically weak random number generator in the Generat ...)
- TODO: check
+ NOT-FOR-US: bosh-windows-stemcell-builder
CVE-2026-47830 (Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem b ...)
- TODO: check
+ NOT-FOR-US: bosh-windows-stemcell-builder
CVE-2026-47829 (Argument Injection in bosh-cli allows a compromised BOSH Director to i ...)
- TODO: check
+ NOT-FOR-US: bosh-cli
CVE-2026-47828 (During bosh create-env and bosh delete-env, the CLI uploads compiled C ...)
- TODO: check
+ NOT-FOR-US: bosh-cli
CVE-2026-47826 (The blobs.yml path key traversal vulnerability in the BOSH CLI tool al ...)
- TODO: check
+ NOT-FOR-US: bosh-cli
CVE-2026-47646 (Improper neutralization of input during web page generation ('cross-si ...)
NOT-FOR-US: Microsoft
CVE-2026-45045 (Fiber is an Express inspired web framework written in Go. Prior to 3.3 ...)
@@ -1815,7 +1815,7 @@ CVE-2026-35211 (OpenCTI is an open source platform for managing cyber threat int
CVE-2026-35210 (OpenCTI is an open source platform for managing cyber threat intellige ...)
NOT-FOR-US: OpenCTI
CVE-2026-31309 (Improper authorization in the /tequilapi/config/user endpoint of Myste ...)
- TODO: check
+ NOT-FOR-US: Mysterium Node
CVE-2026-15174 (Catapult DCT2000 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15173 (pcapng file parser crash in Wireshark 4.6.0 to 4.6.6 allows denial of ...)
@@ -2344,7 +2344,7 @@ CVE-2026-49145 (App::Ack versions through 3.10.0 for Perl read arbitrary files v
NOTE: Fixed by: https://github.com/beyondgrep/ack3/commit/45ff5fe77dbd96f7332f31943102291f878f30b8 (v3.10.0)
NOTE: v3.10.0 only released with a partial fix for the --follow-option.
CVE-2026-44840 (Dgraph is an open source distributed GraphQL database. Prior to versio ...)
- TODO: check
+ NOT-FOR-US: Dgraph
CVE-2026-41122 (Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 r ...)
NOT-FOR-US: Dell / EMC
CVE-2026-41042 (Unauthenticated callers can supply a malicious H2 JDBC URL through the ...)
@@ -2368,7 +2368,7 @@ CVE-2026-24698 (An OS command injection vulnerability exists in the save_syslog_
CVE-2026-24697 (An OS command injection vulnerability exists in the start_bonjour() fu ...)
TODO: check
CVE-2026-22927 (Omnissa Workspace ONE\xae Tunnel for Windows addresses a Local Privi ...)
- TODO: check
+ NOT-FOR-US: Omnissa
CVE-2026-15067 (Snowflake Terraform Provider versions prior to 2.18.0 contain several ...)
TODO: check
CVE-2026-15063 (A flaw was found in the gorch service template, which is part of the t ...)
@@ -2674,7 +2674,7 @@ CVE-2026-49471 (Serena is a powerful MCP toolkit for coding that provides semant
CVE-2026-49229 (Actual is a local-first personal finance app. Prior to 26.6.0, in Open ...)
NOT-FOR-US: Actual
CVE-2026-49033 (The application contains a stack-based buffer overflow vulnerability t ...)
- TODO: check
+ NOT-FOR-US: Labcenter
CVE-2026-48958 (An improper access check allows unauthorized users to create custom fi ...)
NOT-FOR-US: Joomla
CVE-2026-48957 (An improper access check allows unauthorized users to access com_priva ...)
@@ -2722,9 +2722,9 @@ CVE-2026-37271 (Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vuln
CVE-2026-37270 (Trueview Security camera T18161- AF v4.9.60.0 contains an authenticati ...)
NOT-FOR-US: ActualSecurity camera
CVE-2026-36163 (An HTML injection vulnerability in the file view endpoint of LiquidFil ...)
- TODO: check
+ NOT-FOR-US: LiquidFiles
CVE-2026-36162 (An authenticated stored cross-site scripting (XSS) vulnerability in th ...)
- TODO: check
+ NOT-FOR-US: LiquidFiles
CVE-2026-28378 (The public dashboard deletion endpoint does not enforce organization i ...)
TODO: check
CVE-2026-23698 (Vtiger CRM through 8.4.0 contains an authenticated remote code executi ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3de08701c8a8639eaaf302d13b1e036e02c18af1
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3de08701c8a8639eaaf302d13b1e036e02c18af1
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260712/94fa739f/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list