[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Sat Jul 18 15:16:09 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ec7ed34f by Salvatore Bonaccorso at 2026-07-18T16:15:31+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -98,7 +98,7 @@ CVE-2026-53727 (css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssPars
 CVE-2026-52584 (Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a l ...)
 	TODO: check
 CVE-2026-52348 (cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() ...)
-	TODO: check
+	NOT-FOR-US: cool-admin-java
 CVE-2026-52203 (An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive  ...)
 	NOT-FOR-US: MCMS
 CVE-2026-52199 (An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remot ...)
@@ -114,7 +114,7 @@ CVE-2026-50272 (dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0
 CVE-2026-50271 (Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2,  ...)
 	NOT-FOR-US: Datadog dd-trace-py
 CVE-2026-50197 (Skipper is an HTTP router and reverse proxy for service composition. P ...)
-	TODO: check
+	NOT-FOR-US: Zalando Skipper
 CVE-2026-50163 (oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, en ...)
 	TODO: check
 CVE-2026-50162 (oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, re ...)
@@ -126,39 +126,39 @@ CVE-2026-4942 (IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to sen
 CVE-2026-4938 (IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify ...)
 	NOT-FOR-US: IBM
 CVE-2026-49977 (tarteaucitron.js is a compliant and accessible cookie banner. Prior to ...)
-	TODO: check
+	NOT-FOR-US: tarteaucitron.js
 CVE-2026-49852 (joserfc is a Python library that provides an implementation of several ...)
 	TODO: check
 CVE-2026-49834 (sigstore-go is a Go library for Sigstore signing and verification. Pri ...)
 	TODO: check
 CVE-2026-49485 (HAPI FHIR is a complete implementation of the HL7 FHIR standard for he ...)
-	TODO: check
+	NOT-FOR-US: HAPI FHIR
 CVE-2026-49284 (SimpleSAMLphp versions before 1.18.6 contain an information disclosure ...)
 	TODO: check
 CVE-2026-48978 (oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, au ...)
 	TODO: check
 CVE-2026-48819 (Hey API is an ecosystem for turning API specifications into production ...)
-	TODO: check
+	NOT-FOR-US: Hey API
 CVE-2026-48504 (OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 ...)
-	TODO: check
+	NOT-FOR-US: OpenTelemetry Rust
 CVE-2026-48373 (Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerabili ...)
 	NOT-FOR-US: Adobe
 CVE-2026-48062 (CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext ...)
 	TODO: check
 CVE-2026-48049 (@hapi/inert provides static file and directory handlers for hapi.js. F ...)
-	TODO: check
+	NOT-FOR-US: hapi/inert
 CVE-2026-48022 (@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips c ...)
-	TODO: check
+	NOT-FOR-US: hapi/wreck
 CVE-2026-46420 (setup-php is a GitHub action to set up PHP with extensions, php.ini co ...)
-	TODO: check
+	NOT-FOR-US: setup-php
 CVE-2026-45799 (Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, an ...)
 	TODO: check
 CVE-2026-45785 (OpenMcdf is a fully .NET / C# library to manipulate Compound File Bina ...)
-	TODO: check
+	NOT-FOR-US: OpenMcdf
 CVE-2026-45784 (rust-openssl provides OpenSSL bindings for the Rust programming langua ...)
 	TODO: check
 CVE-2026-45704 (Pimcore is an Open Source Data & Experience Management Platform. Prior ...)
-	TODO: check
+	NOT-FOR-US: Pimcore
 CVE-2026-45260 (Pimcore is an Open Source Data & Experience Management Platform. Prior ...)
 	TODO: check
 CVE-2026-44979 (@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wre ...)
@@ -378,7 +378,7 @@ CVE-2026-47180 (Zeroconf is a pure Python implementation of multicast DNS servic
 	NOTE: https://github.com/python-zeroconf/python-zeroconf/pull/1719
 	NOTE: Fixed by: https://github.com/python-zeroconf/python-zeroconf/commit/f9e23592137f30fdf7ef710dba065da31c79b1cf (0.149.5)
 CVE-2026-45703 (Pimcore is an Open Source Data & Experience Management Platform. Prior ...)
-	TODO: check
+	NOT-FOR-US: Pimcore
 CVE-2026-45162 (Pimcore is an Open Source Data & Experience Management Platform. Prior ...)
 	TODO: check
 CVE-2026-44722 (pyzipper is a replacement for Python's zipfile that can read and write ...)
@@ -794,37 +794,37 @@ CVE-2026-46687 (Emlog is an open source website building system. In 2.6.13 and e
 CVE-2026-46686 (Emlog is an open source website building system. In 2.6.13 and earlier ...)
 	NOT-FOR-US: Emlog
 CVE-2026-46621 (Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs scrip ...)
-	TODO: check
+	NOT-FOR-US: Yamcs
 CVE-2026-46562 (Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn Scr ...)
-	TODO: check
+	NOT-FOR-US: Yamcs
 CVE-2026-46515 (Frogman provides headless PBX control through MCP and HTTP API. Prior  ...)
-	TODO: check
+	NOT-FOR-US: Frogman
 CVE-2026-46514 (Frogman provides headless PBX control through MCP and HTTP API. Prior  ...)
-	TODO: check
+	NOT-FOR-US: Frogman
 CVE-2026-46513 (Frogman provides headless PBX control through MCP and HTTP API. Prior  ...)
-	TODO: check
+	NOT-FOR-US: Frogman
 CVE-2026-46512 (Frogman provides headless PBX control through MCP and HTTP API. Prior  ...)
-	TODO: check
+	NOT-FOR-US: Frogman
 CVE-2026-46404 (BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, th ...)
-	TODO: check
+	NOT-FOR-US: BigBlueButton
 CVE-2026-46378 (Dasel is a command-line tool and library for querying, modifying, and  ...)
 	TODO: check
 CVE-2026-46377 (Dasel is a command-line tool and library for querying, modifying, and  ...)
 	TODO: check
 CVE-2026-46353 (BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bb ...)
-	TODO: check
+	NOT-FOR-US: BigBlueButton
 CVE-2026-46351 (BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bb ...)
-	TODO: check
+	NOT-FOR-US: BigBlueButton
 CVE-2026-46341 (The Apify MCP server enables AI agents to extract data from websites u ...)
-	TODO: check
+	NOT-FOR-US: Apify MCP server
 CVE-2026-46338 (PyMdown Extensions is a set of extensions for the Python-Markdown mark ...)
 	TODO: check
 CVE-2026-46336 (Manyfold is an open source, self-hosted web application for managing a ...)
-	TODO: check
+	NOT-FOR-US: Manyfold
 CVE-2026-45795 (The Janssen Project is an open-source identity and access management ( ...)
-	TODO: check
+	NOT-FOR-US: Janssen Project
 CVE-2026-45695 (Kopia is a cross-platform backup tool for Windows, macOS, and Linux wi ...)
-	TODO: check
+	NOT-FOR-US: Kopia
 CVE-2026-45612 (rz-libdemangle is a Rizin library for demangling symbols. Prior to 6bf ...)
 	TODO: check
 CVE-2026-45576 (zrok is software for sharing web services, files, and network resource ...)
@@ -1228,9 +1228,9 @@ CVE-2026-48795 (AdonisJS is a TypeScript-first web framework. From 10.1.3 until
 CVE-2026-46684 (DataEase is an open source data visualization and analysis tool. Prior ...)
 	NOT-FOR-US: DataEase
 CVE-2026-46421 (The SAP Cloud Application Programming Model is a tool for building ent ...)
-	TODO: check
+	NOT-FOR-US: SAP Cloud Application Programming Model
 CVE-2026-46339 (9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Rout ...)
-	TODO: check
+	NOT-FOR-US: 9Router
 CVE-2026-45738 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
 	NOT-FOR-US: Argo CD
 CVE-2026-45737 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
@@ -1719,19 +1719,19 @@ CVE-2026-47159 (Vaultwarden is a Bitwarden-compatible server written in Rust. Pr
 CVE-2026-47158 (Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to ...)
 	- vaultwarden <itp> (bug #1067023)
 CVE-2026-46709 (Tabby (formerly Terminus) is a highly configurable terminal emulator.  ...)
-	TODO: check
+	NOT-FOR-US: Tabby (formerly Terminus, but not the same as src:terminus)
 CVE-2026-46485 (Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy dep ...)
-	TODO: check
+	NOT-FOR-US: Dashy
 CVE-2026-46459 (ICU Scandinavia Boomerang is vulnerable to a missing authentication fl ...)
-	TODO: check
+	NOT-FOR-US: ICU Scandinavia Boomerang
 CVE-2026-46458 (ICU Scandinavia Boomerang is vulnerable to an information disclosure f ...)
-	TODO: check
+	NOT-FOR-US: ICU Scandinavia Boomerang
 CVE-2026-45806 (Penpot is an open-source design tool for design and code collaboration ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-45805 (Penpot is an open-source design tool for design and code collaboration ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-45804 (Diffusers is the a library for pretrained diffusion models. Prior to 0 ...)
-	TODO: check
+	NOT-FOR-US: Diffusers
 CVE-2026-45337 (Better Auth is an authentication and authorization library for TypeScr ...)
 	TODO: check
 CVE-2026-45150 (Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not ...)
@@ -3208,7 +3208,7 @@ CVE-2026-48816 (sigstore-js provides JavaScript libraries for interacting with S
 CVE-2026-48815 (sigstore-js provides JavaScript libraries for interacting with Sigstor ...)
 	NOT-FOR-US: sigstore-js
 CVE-2026-48801 (linkify-it is a links recognition library with full Unicode support. P ...)
-	TODO: check
+	NOT-FOR-US: linkify-it Node.js module
 CVE-2026-48758 (sigstore-js provides JavaScript libraries for interacting with Sigstor ...)
 	NOT-FOR-US: sigstore-js
 CVE-2026-48581 (Insufficient granularity of access control in Microsoft Surface allows ...)
@@ -6899,7 +6899,7 @@ CVE-2026-59890 (setuptools is a package that allows users to download, build, in
 	- setuptools <not-affected> (Only affects setuptools on macOS APFS/HFS+)
 	NOTE: https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c
 CVE-2026-59887 (linkify-it is a links recognition library with full Unicode support. P ...)
-	TODO: check
+	NOT-FOR-US: linkify-it Node.js module
 CVE-2026-59883 (Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar di ...)
 	- guzzle 7.12.3-1
 	[trixie] - guzzle <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ec7ed34f1346dfaeb1a3dd386e4c833101103fd4

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ec7ed34f1346dfaeb1a3dd386e4c833101103fd4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260718/ba8860c4/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list