[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Mon Jul 20 20:14:44 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
f5224ac5 by security tracker role at 2026-07-20T19:14:37+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -19,67 +19,67 @@ CVE-2026-64194 (Net::DNS versions through 1.55 for Perl allow Denial of Service
CVE-2026-64193 (Net::DNS versions through 1.55 for Perl allow remote execution injecti ...)
TODO: check
CVE-2026-63763 (SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused dep ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63762 (SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial o ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63761 (SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63760 (SurrealDB before 3.1.0 fails to enforce the configured recursion depth ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63759 (SurrealDB before 3.1.0 fails to enforce recursion depth limits in the ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63758 (SurrealDB versions before 3.1.0 contain an authorization bypass vulner ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63757 (SurrealDB versions before 3.1.0 contain a session hijacking vulnerabil ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63756 (SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use ra ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63755 (SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63754 (SurrealDB versions before 3.1.0 contain a denial of service vulnerabil ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63753 (SurrealDB before 3.1.0 fails to refresh authentication state in LIVE S ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63752 (SurrealDB before 3.1.0 contains an authorization bypass vulnerability ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63751 (SurrealDB versions before 3.1.0 contain a field-level permission bypas ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63750 (SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MA ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63749 (SurrealDB versions before 3.1.0 contain an authentication bypass vulne ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63748 (SurrealDB versions before 3.1.0 contain an information disclosure vuln ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63747 (SurrealDB versions before 3.1.0 contain a denial of service vulnerabil ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63746 (SurrealDB versions before 3.1.0 fail to enforce table SELECT permissio ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63745 (SurrealDB versions before 3.1.0 contain an authorization bypass vulner ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63744 (SurrealDB before 3.1.5 contains a server-side request forgery vulnerab ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63743 (SurrealDB before 3.1.0 contains a capability bypass vulnerability in H ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63742 (SurrealDB versions before 3.1.0 contain a field-level SELECT permissio ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63741 (SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or D ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63740 (SurrealDB versions before 3.1.4 fail to properly enforce SELECT permis ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63739 (SurrealDB before 3.1.5 contains an arbitrary file read vulnerability i ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63738 (SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELE ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63737 (SurrealDB versions before 3.1.5 contain a denial of service vulnerabil ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63736 (SurrealDB before 3.2.0 contains a server-side request forgery vulnerab ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63735 (SurrealDB versions before 3.2.0 fail to validate namespace and databas ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63734 (SurrealDB versions before 3.2.0 contain a denial of service vulnerabil ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63733 (SurrealDB versions before 3.2.0 contain a permissions bypass vulnerabi ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-63429 (HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, ` ...)
TODO: check
CVE-2026-63428 (HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, ` ...)
@@ -91,29 +91,29 @@ CVE-2026-63107 (LimeSurvey through 6.17.10 and 7.0.4 contains a server-side requ
CVE-2026-63102 (rConfig Core before 8.2.8 contains a privilege escalation vulnerabilit ...)
TODO: check
CVE-2026-63071 (Improper Isolation or Compartmentalization vulnerability in Apache Syn ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-62418 (Low-privileged authenticated Server-Side Request Forgery (SSRF) vulne ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-62183 (Improper Privilege Management vulnerability in Apache Syncope. When: ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-60034 (The Joomla extension JMedia is vulnerable to a stored XSS vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-60033 (The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Re ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-60032 (The Joomla extension JMedia is vulnerable to an authenticated arbitrar ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-60031 (The Joomla extension Quix Page Builder Pro is vulnerable to an informa ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-60030 (The Joomla extension Quix Page Builder Pro is vulnerable to an imprope ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-60029 (The Joomla extension Quix Page Builder Pro is vulnerable to an authent ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-60028 (The Joomla extension Quix Page Builder Pro is vulnerable to an authent ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-60027 (The Joomla extension Quix Page Builder Pro is vulnerable to a unauthen ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-60026 (The Joomla extension Quix Page Builder Pro is vulnerable to an authent ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-59238 (Stored Cross-site Scripting (CWE-79) in the client-side report renderi ...)
TODO: check
CVE-2026-58484 (Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to ...)
@@ -133,7 +133,7 @@ CVE-2026-57310 (Windu CMS uses hashing algorithm based on MD5 and SHA1 with stat
CVE-2026-57309 (A Blind SQL injection vulnerability has been identified in Windu CMS. ...)
TODO: check
CVE-2026-57308 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-54910 (FileBrowser Quantum is a free, self-hosted, web-based file manager. Pr ...)
TODO: check
CVE-2026-54685 (FileBrowser Quantum is a free, self-hosted, web-based file manager. Pr ...)
@@ -141,9 +141,9 @@ CVE-2026-54685 (FileBrowser Quantum is a free, self-hosted, web-based file manag
CVE-2026-54051 (Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to ...)
TODO: check
CVE-2026-53421 (Improper Isolation or Compartmentalization vulnerability in Apache Syn ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-53405 (Improper Isolation or Compartmentalization vulnerability in Apache Syn ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-52349 (Directory Traversal vulnerability in Menyoo 2.0 Versions before commit ...)
TODO: check
CVE-2026-51386
@@ -159,7 +159,7 @@ CVE-2026-48824 (Mailpit is an email testing tool and API for developers. Prior t
CVE-2026-48812 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
TODO: check
CVE-2026-48389 (DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-47276 (In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in ...)
TODO: check
CVE-2026-47275 (In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in ...)
@@ -207,7 +207,7 @@ CVE-2026-40187 (In egroupware version 26.0 and earlier, an authenticated adminis
CVE-2026-39879 (Due to a missing sanitization call in [`afsql_dd_run_query`](https://g ...)
TODO: check
CVE-2026-39878 (Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site s ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-39385 (Frappe LMS is an open source learning management system. In version 2. ...)
TODO: check
CVE-2026-35591 (libvips is a fast image processing library with low memory needs. The ...)
@@ -245,7 +245,7 @@ CVE-2026-32807 (dataCycle is a data management system for centrally storing, man
CVE-2026-32806 (dataCycle is a data management system for centrally storing, managing, ...)
TODO: check
CVE-2026-2445 (The affected product accepts user-supplied input within a URL paramete ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-28220 (Wazuh is a free and open source platform used for threat prevention, d ...)
TODO: check
CVE-2026-27823 (A vulnerability has been identified in EGroupware that may lead to Rem ...)
@@ -259,7 +259,7 @@ CVE-2026-26197 (HDF5 is a high-performance library and a file format specificati
CVE-2026-25039 (Parsec is a cloud-based application for simple and cryptographically s ...)
TODO: check
CVE-2026-21824 (HCL Commerce contains an privilege escalation vulnerability that could ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-16312
REJECTED
CVE-2026-16277 (A stack-based buffer overflow was found in rpcbind's rpcinfo utility. ...)
@@ -269,13 +269,13 @@ CVE-2026-16254 (A flaw was found in claircore's apk package scanner. Malformed p
CVE-2026-16252 (A security flaw has been discovered in Beijing Shenzhou Shihan Technol ...)
TODO: check
CVE-2026-16248 (A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-16247 (In _connect.BRAIN versions prior to 5.06, the application LogPathConfi ...)
- TODO: check
+ NOT-FOR-US: Bizerba
CVE-2026-16246 (In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is ...)
- TODO: check
+ NOT-FOR-US: Bizerba
CVE-2026-16244 (A security vulnerability has been detected in itsourcecode Hospital Ma ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-16242 (A flaw was found in the Konnectivity proxy-server configuration for ho ...)
TODO: check
CVE-2026-15813 (A vulnerability was found in the network packet de-fragmentation engin ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f5224ac5a59252d4a5e7b4d77b0b1be5713590e0
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f5224ac5a59252d4a5e7b4d77b0b1be5713590e0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260720/2ad8e787/attachment.htm>
More information about the debian-security-tracker-commits
mailing list