[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Jul 14 06:13:47 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
d0f06141 by Salvatore Bonaccorso at 2026-07-14T07:13:21+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -423,51 +423,51 @@ CVE-2026-40467 (Use After Free vulnerability has been found in "io.c" program fi
- gawk <unfixed>
NOTE: Fixed by: https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8
CVE-2026-26396 (OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in th ...)
- TODO: check
+ NOT-FOR-US: OpenBMB XAgent
CVE-2026-22103 (The NPC start endpoint on the web server at port 8090 is vulnerable to ...)
- TODO: check
+ NOT-FOR-US: DC-80
CVE-2026-22102 (A POST request sent to a specific webserver endpoint can be used to wr ...)
- TODO: check
+ NOT-FOR-US: DC-80
CVE-2026-22100 (The OCPP DataTransfer message `ReserveLogin` is vulnerable to command ...)
- TODO: check
+ NOT-FOR-US: DC-80
CVE-2026-22099 (The charging station does not require authentication for Bluetooth com ...)
- TODO: check
+ NOT-FOR-US: DC-80
CVE-2026-22098 (Various sensitive information such as passwords and charging card UIDs ...)
- TODO: check
+ NOT-FOR-US: DC-80
CVE-2026-22097 (The firmware update mechanism does not include cryptographic signature ...)
- TODO: check
+ NOT-FOR-US: DC-80
CVE-2026-22096 (The webserver running on port 8090 does not require authentication. Th ...)
- TODO: check
+ NOT-FOR-US: DC-80
CVE-2026-22095 (The network diagnosis endpoint on the web server at port 8090 is vulne ...)
- TODO: check
+ NOT-FOR-US: DC-80
CVE-2026-22093 (The EVbee Service Android app uses TLS encrypted communication (HTTPS) ...)
- TODO: check
+ NOT-FOR-US: DC-80
CVE-2026-15584 (A privilege escalation vulnerability was found in the incluster-checks ...)
- TODO: check
+ NOT-FOR-US: Red Hat OpenShift
CVE-2026-15574 (A flaw was found in the vllm-orchestrator-gateway component. The syste ...)
- TODO: check
+ NOT-FOR-US: Red Hat OpenShift
CVE-2026-15559 (A vulnerability was detected in CodeAstro Simple Online Leave Manageme ...)
NOT-FOR-US: CodeAstro
CVE-2026-15558 (A security vulnerability has been detected in CodeAstro Simple Online ...)
NOT-FOR-US: CodeAstro
CVE-2026-15557 (A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affecte ...)
- TODO: check
+ NOT-FOR-US: waooAI waoowaoo
CVE-2026-15548 (A security vulnerability has been detected in Shibby Tomato up to 1.28 ...)
- TODO: check
+ NOT-FOR-US: Shibby Tomato
CVE-2026-15547 (A weakness has been identified in Shibby Tomato up to 1.28.0000. This ...)
- TODO: check
+ NOT-FOR-US: Shibby Tomato
CVE-2026-15546 (A security flaw has been discovered in Shibby Tomato up to 1.28.0000. ...)
- TODO: check
+ NOT-FOR-US: Shibby Tomato
CVE-2026-15545 (A vulnerability was identified in Shibby Tomato up to 1.28.0000. Affec ...)
- TODO: check
+ NOT-FOR-US: Shibby Tomato
CVE-2026-15544 (A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affec ...)
- TODO: check
+ NOT-FOR-US: Shibby Tomato
CVE-2026-15543 (A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the func ...)
NOT-FOR-US: Tenda
CVE-2026-15542 (A vulnerability has been found in will-moss Isaiah up to 1.36.9. This ...)
- TODO: check
+ NOT-FOR-US: will-moss Isaiah
CVE-2026-15541 (A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted e ...)
- TODO: check
+ NOT-FOR-US: will-moss Isaiah
CVE-2026-15540 (A vulnerability was detected in SourceCodester Online Book Store Syste ...)
NOT-FOR-US: SourceCodester
CVE-2026-14934 (A Missing Authorization vulnerability in the repository creation funct ...)
@@ -475,7 +475,7 @@ CVE-2026-14934 (A Missing Authorization vulnerability in the repository creation
CVE-2026-14906 (Pages with malicious titles could potentially allow saved PDF content ...)
TODO: check
CVE-2026-14846 (In version 8.2.1 of PrestaShop, there is a vulnerability relating to t ...)
- TODO: check
+ NOT-FOR-US: PrestaShop
CVE-2026-14453 (This vulnerability is a critical Server-Side Template Injection (SSTI) ...)
NOT-FOR-US: Centreon
CVE-2026-14165 (An Authorization Bypass Through User-Controlled Key vulnerability affe ...)
@@ -503,79 +503,79 @@ CVE-2026-9492 (The MBStorage DRAM lighting control module within Gigabyte Contro
CVE-2026-7162 (Successful exploitation of the integer overflow vulnerability could al ...)
NOT-FOR-US: WinFsp
CVE-2026-15553 (Enterprise Cloud Database developed by Ragic has a Arbitrary File Uplo ...)
- TODO: check
+ NOT-FOR-US: Ragic
CVE-2026-15552 (Enterprise Cloud Database developed by Ragic has a Stored Cross-Site S ...)
- TODO: check
+ NOT-FOR-US: Ragic
CVE-2026-15551 (Integer overflow or wraparound vulnerability in Samsung Open Source rl ...)
TODO: check
CVE-2026-15539 (A security vulnerability has been detected in SourceCodester Online Bo ...)
NOT-FOR-US: SourceCodester
CVE-2026-15538 (A weakness has been identified in primefaces primereact up to 10.9.8. ...)
- TODO: check
+ NOT-FOR-US: primefaces primereact
CVE-2026-15537 (A security flaw has been discovered in SourceCodester Online Book Stor ...)
NOT-FOR-US: SourceCodester
CVE-2026-15536 (A vulnerability was identified in itsourcecode Hospital Management Sys ...)
NOT-FOR-US: itsourcecode System
CVE-2026-15535 (A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48 ...)
- TODO: check
+ NOT-FOR-US: AkariAsai self-rag
CVE-2026-15533 (A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an ...)
NOT-FOR-US: DedeCMS
CVE-2026-15532 (A vulnerability was identified in SourceCodester Online Book Store Sys ...)
NOT-FOR-US: SourceCodester
CVE-2026-15531 (A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 8 ...)
- TODO: check
+ NOT-FOR-US: yashbhalgat HashNeRF-pytorch
CVE-2026-15530 (A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulner ...)
- TODO: check
+ NOT-FOR-US: WuzhiCMS
CVE-2026-15529 (A vulnerability was detected in yzhao062 pyod 3.5.0/3.5.1/3.5.2. Affec ...)
- TODO: check
+ NOT-FOR-US: yzhao062 pyod
CVE-2026-15528 (A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This i ...)
- TODO: check
+ NOT-FOR-US: lamaalrajih kicad-mcp
CVE-2026-15527 (A vulnerability has been found in better-auth better-icons up to 1.0.5 ...)
- TODO: check
+ NOT-FOR-US: better-auth better-icons
CVE-2026-15526 (A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue ...)
- TODO: check
+ NOT-FOR-US: augmnt augments-mcp-server
CVE-2026-15525 (A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnera ...)
- TODO: check
+ NOT-FOR-US: kLOsk adloop
CVE-2026-15524 (A security vulnerability has been detected in alioshr memory-bank-mcp ...)
- TODO: check
+ NOT-FOR-US: alioshr memory-bank-mcp
CVE-2026-15523 (A weakness has been identified in CodeAstro Simple Online Leave Manage ...)
NOT-FOR-US: CodeAstro
CVE-2026-15522 (A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0 ...)
- TODO: check
+ NOT-FOR-US: tugcantopaloglu godot-mcp
CVE-2026-15521 (A vulnerability was identified in makafeli n8n-workflow-builder up to ...)
NOT-FOR-US: n8n
CVE-2026-15520 (A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. T ...)
TODO: check
CVE-2026-15519 (A vulnerability was found in usestrix strix up to 1.0.2. This affects ...)
- TODO: check
+ NOT-FOR-US: usestrix strix
CVE-2026-15518 (A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The i ...)
- TODO: check
+ NOT-FOR-US: AREA 17 Twill CMS
CVE-2026-15517 (A flaw has been found in Jinher OA 1.0. The affected element is an unk ...)
- TODO: check
+ NOT-FOR-US: Jinher OA
CVE-2026-15516 (A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impac ...)
- TODO: check
+ NOT-FOR-US: MacCMS Pro
CVE-2026-15515 (A security vulnerability has been detected in Tencent PC Manager 18.1. ...)
- TODO: check
+ NOT-FOR-US: Tencent PC Manager
CVE-2026-15514 (A weakness has been identified in Metasoft \u7f8e\u7279\u8f6f\u4ef6 Me ...)
- TODO: check
+ NOT-FOR-US: Metasoft
CVE-2026-15513 (A security flaw has been discovered in Wavlink WL-NU516U1 260515. This ...)
NOT-FOR-US: Wavlink
CVE-2026-15512 (A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected b ...)
- TODO: check
+ NOT-FOR-US: pig-mesh Pig
CVE-2026-15511 (A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. ...)
- TODO: check
+ NOT-FOR-US: Comfast
CVE-2026-15510 (A vulnerability was found in Leantime up to 3.8.0. Affected is the fun ...)
- TODO: check
+ NOT-FOR-US: Leantime
CVE-2026-15509 (A vulnerability has been found in Leantime up to 3.8.0. This impacts t ...)
- TODO: check
+ NOT-FOR-US: Leantime
CVE-2026-15508 (A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This ...)
- TODO: check
+ NOT-FOR-US: Helicone ai-gateway
CVE-2026-15507 (A vulnerability was detected in coollabsio Coolify up to 4.1.1. The im ...)
- TODO: check
+ NOT-FOR-US: coollabsio Coolify
CVE-2026-15506 (A security vulnerability has been detected in SecureAge CatchPulse up ...)
- TODO: check
+ NOT-FOR-US: SecureAge CatchPulse
CVE-2026-15505 (A weakness has been identified in vnotex vnote up to 3.20.1. Impacted ...)
- TODO: check
+ NOT-FOR-US: vnotex vnote
CVE-2026-12582 (The Library Management System WordPress plugin before 3.5.8 does not s ...)
NOT-FOR-US: WordPress plugin
CVE-2026-12397 (The WP Job Portal WordPress plugin before 2.5.5 does not verify owner ...)
@@ -985,7 +985,7 @@ CVE-2026-34196 (Software installed and run as a non-privileged user may conduct
CVE-2026-2354 (The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitra ...)
NOT-FOR-US: WordPress plugin
CVE-2026-20744 (The charging station websocket endpoint accepts connections without p ...)
- TODO: check
+ NOT-FOR-US: Hydro-Quebec
CVE-2026-1832 (The ThriveDesk \u2013 Live Chat, AI Chatbot, Helpdesk & Knowledge Base ...)
NOT-FOR-US: WordPress plugin
CVE-2026-1382 (The fresh Podcaster plugin for WordPress is vulnerable to Stored Cross ...)
@@ -1029,7 +1029,7 @@ CVE-2026-15072 (The KiviCare \u2013 Clinic & Patient Management System (EHR) plu
CVE-2026-15010 (The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross- ...)
NOT-FOR-US: WordPress plugin
CVE-2026-14480 (OpenPLC Runtime v3 contains an authenticated arbitrary file write vul ...)
- TODO: check
+ NOT-FOR-US: OpenPLC
CVE-2026-14286
REJECTED
CVE-2026-14262 (The Simple JWT Login \u2013 Allows you to use JWT on REST endpoints. p ...)
@@ -1432,7 +1432,7 @@ CVE-2026-1946 (The GW AI Website Builder plugin for WordPress is vulnerable to u
CVE-2026-1667 (The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to A ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15378 (A flaw was found in the `guardrails-detectors` component. This vulnera ...)
- TODO: check
+ NOT-FOR-US: guardrails-detectors
CVE-2026-15377 (A vulnerability was determined in Eleveo Call Recording Software 9.7.0 ...)
NOT-FOR-US: Eleveo Call Recording Software
CVE-2026-15376 (A vulnerability was found in Eleveo Call Recording Software 9.7.0. Aff ...)
@@ -1446,7 +1446,7 @@ CVE-2026-15373 (A vulnerability was detected in Eleveo Call Recording Software 9
CVE-2026-15146 (GNU Wget does not validate the IP address provided by an FTP PASV resp ...)
TODO: check
CVE-2026-15143 (A flaw was found in the file_type content detector of guardrails-detec ...)
- TODO: check
+ NOT-FOR-US: guardrails-detectors
CVE-2026-15104 (The BetterDocs \u2013 AI Documentation, Knowledge Base, Docs, Wikis, F ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15028 (A flaw was found in libarchive. This vulnerability allows a remote att ...)
@@ -1698,19 +1698,19 @@ CVE-2026-15330 (A vulnerability was determined in zhayujie CowAgent up to 2.1.1.
CVE-2026-15329 (A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue ...)
NOT-FOR-US: zhayujie CowAgent
CVE-2026-15326 (A vulnerability was identified in halo-dev halo up to 2.24.2. This aff ...)
- TODO: check
+ NOT-FOR-US: Halo
CVE-2026-15321 (A vulnerability was found in MyEMS up to 6.4.0. The affected element i ...)
NOT-FOR-US: MyEMS
CVE-2026-15320 (A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vuln ...)
- TODO: check
+ NOT-FOR-US: Sipeed PicoClaw
CVE-2026-15319 (A security vulnerability has been detected in Sipeed PicoClaw up to 0. ...)
- TODO: check
+ NOT-FOR-US: Sipeed PicoClaw
CVE-2026-15318 (A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affecte ...)
- TODO: check
+ NOT-FOR-US: Sipeed PicoClaw
CVE-2026-15317 (A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Af ...)
- TODO: check
+ NOT-FOR-US: Sipeed PicoClaw
CVE-2026-15311 (A vulnerability was identified in NousResearch hermes-agent up to 2026 ...)
- TODO: check
+ NOT-FOR-US: NousResearch hermes-agent
CVE-2026-15302 (The ARMember plugin for WordPress is vulnerable to Directory Traversal ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15301 (The BuddyHolis TableSearch plugin for WordPress is vulnerable to Store ...)
@@ -1750,9 +1750,9 @@ CVE-2026-15283 (The WPvivid Backup for MainWP plugin for WordPress is vulnerable
CVE-2026-15282 (The Instant Appointment plugin for WordPress is vulnerable to arbitrar ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15276 (A flaw has been found in pdeljanov Symphonia up to 0.6.0. This vulnera ...)
- TODO: check
+ NOT-FOR-US: pdeljanov Symphonia
CVE-2026-15274 (A vulnerability was detected in lo48576 fbxcel up to 0.9.0. This affec ...)
- TODO: check
+ NOT-FOR-US: lo48576 fbxcel
CVE-2026-15271 (A security vulnerability has been detected in TOTOLINK A3000RU, A3100R ...)
NOT-FOR-US: TOTOLINK
CVE-2026-15270 (A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. A ...)
@@ -2984,35 +2984,35 @@ CVE-2026-29008 (U-Boot through 2026.04-rc3 contains an integer underflow vulnera
CVE-2026-29007 (U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerabilit ...)
TODO: check
CVE-2026-24700 (An OS command injection vulnerability exists in the start_lltd() funct ...)
- TODO: check
+ NOT-FOR-US: Cisco RV130/RV130W
CVE-2026-24699 (An OS command injection vulnerability exists in the sub_34984() functi ...)
- TODO: check
+ NOT-FOR-US: Cisco RV130/RV130W
CVE-2026-24698 (An OS command injection vulnerability exists in the save_syslog_to_fil ...)
- TODO: check
+ NOT-FOR-US: Cisco RV130/RV130W
CVE-2026-24697 (An OS command injection vulnerability exists in the start_bonjour() fu ...)
- TODO: check
+ NOT-FOR-US: Cisco RV130/RV130W
CVE-2026-22927 (Omnissa Workspace ONE\xae Tunnel for Windows addresses a Local Privi ...)
NOT-FOR-US: Omnissa
CVE-2026-15067 (Snowflake Terraform Provider versions prior to 2.18.0 contain several ...)
- TODO: check
+ NOT-FOR-US: Snowflake Terraform Provider
CVE-2026-15063 (A flaw was found in the gorch service template, which is part of the t ...)
TODO: check
CVE-2026-15062 (SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (sn ...)
- TODO: check
+ NOT-FOR-US: Snowflake Snowpark Python SDK
CVE-2026-15053 (Tanium addressed a denial of service vulnerability in Tanium Server.)
NOT-FOR-US: Tanium
CVE-2026-15044 (A flaw was found in the TrustyAI Service Operator. When deploying serv ...)
- TODO: check
+ NOT-FOR-US: TrustyAI Service Operator
CVE-2026-15041 (A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password v ...)
TODO: check
CVE-2026-15036 (A vulnerability was determined in Harness up to 2.28.2. This vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Harness
CVE-2026-15035 (A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the ...)
- TODO: check
+ NOT-FOR-US: bentoml OpenLLM
CVE-2026-15034 (A vulnerability has been found in flask-dashboard Flask-MonitoringDash ...)
TODO: check
CVE-2026-15033 (A flaw has been found in christopherthielen check-peer-dependencies up ...)
- TODO: check
+ NOT-FOR-US: christopherthielen check-peer-dependencies
CVE-2026-14967 (BBOT's `github_workflows` module could be induced to write a downloade ...)
TODO: check
CVE-2026-14966 (BBOT's unarchive module rejects archives containing symlink entries be ...)
@@ -3377,7 +3377,7 @@ CVE-2026-36163 (An HTML injection vulnerability in the file view endpoint of Liq
CVE-2026-36162 (An authenticated stored cross-site scripting (XSS) vulnerability in th ...)
NOT-FOR-US: LiquidFiles
CVE-2026-28378 (The public dashboard deletion endpoint does not enforce organization i ...)
- TODO: check
+ NOT-FOR-US: Grafana Labs
CVE-2026-23698 (Vtiger CRM through 8.4.0 contains an authenticated remote code executi ...)
NOT-FOR-US: Vtiger CRM
CVE-2026-23697 (Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerab ...)
@@ -3398,9 +3398,9 @@ CVE-2026-14935 (A logic vulnerability was found in GStreamer's webrtcbin compone
CVE-2026-14904 (AWS Research and Engineering Studio (RES) is an open-source solution t ...)
NOT-FOR-US: Amazon
CVE-2026-14868 (The encryption algorithm used to protect the configuration of user acc ...)
- TODO: check
+ NOT-FOR-US: PcVue
CVE-2026-14867 (Credentials of built-in users are insecurely stored in the User direct ...)
- TODO: check
+ NOT-FOR-US: PcVue
CVE-2026-14500 (The Bulk Order Update for WooCommerce plugin for WordPress is vulnerab ...)
NOT-FOR-US: WordPress plugin
CVE-2026-14495 (The DoLogin Security plugin for WordPress is vulnerable to Authenticat ...)
@@ -3935,7 +3935,7 @@ CVE-2026-14536 (Improper enforcement of a mandatory multi-factor authentication
CVE-2026-14471 (Improper Neutralization of Special Elements in the metrics-service ret ...)
NOT-FOR-US: Amazon
CVE-2026-14468 (HashiCorp Terraform Enterprise contained an issue in its version contr ...)
- TODO: check
+ NOT-FOR-US: HashiCorp Terraform Enterprise
CVE-2026-14345 (The WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & On ...)
NOT-FOR-US: WordPress plugin
CVE-2026-13356 (A malicious webpage could interrupt a pending navigation by enqueuing ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d0f06141a98557d9a6008a7f010dc5ac0683eb90
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d0f06141a98557d9a6008a7f010dc5ac0683eb90
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260714/6aea54b8/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list