[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Tue Jul 21 08:49:18 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e09d1a92 by Salvatore Bonaccorso at 2026-07-21T09:48:34+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3,37 +3,37 @@ CVE-2026-8082 (The bpost-shipping-platform WordPress plugin before 3.2.3 does no
 CVE-2026-6952 (A post-authentication command injection vulnerability in the "LogServe ...)
 	NOT-FOR-US: Zyxel
 CVE-2026-64651 (The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode  ...)
-	TODO: check
+	NOT-FOR-US: ai-sdk/harness-opencode
 CVE-2026-64650 (The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by  ...)
-	TODO: check
+	NOT-FOR-US: ai-sdk/harness-opencode
 CVE-2026-64626 (AVideo versions from commit 0dbadbca through latest master contain a s ...)
-	TODO: check
+	NOT-FOR-US: WWBN AVideo
 CVE-2026-64625 (AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where ...)
-	TODO: check
+	NOT-FOR-US: WWBN AVideo
 CVE-2026-64624 (FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP ...)
 	TODO: check
 CVE-2026-64619 (FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in t ...)
-	TODO: check
+	NOT-FOR-US: FileCodeBox
 CVE-2026-63771 (Adminer before 5.4.3 contains a cookie injection vulnerability that al ...)
 	TODO: check
 CVE-2026-63770 (Glance through 0.8.5 contains an IP address spoofing vulnerability in  ...)
-	TODO: check
+	NOT-FOR-US: Glance (not same as src:glance)
 CVE-2026-63769 (Huginn through 2022.08.18 contains a server-side request forgery vulne ...)
-	TODO: check
+	NOT-FOR-US: Huginn
 CVE-2026-63768 (cal.diy through 6.2.0 contains an open redirect vulnerability in the c ...)
-	TODO: check
+	NOT-FOR-US: cal.diy
 CVE-2026-63767 (ktransformers through 0.6.3, fixed in commit def0f93, contains an unau ...)
-	TODO: check
+	NOT-FOR-US: ktransformers
 CVE-2026-63766 (GPT-SoVITS through 20250606v2pro contains an OS command injection vuln ...)
-	TODO: check
+	NOT-FOR-US: GPT-SoVITS
 CVE-2026-63731 (HyperDX before 2.31.0 contains a server-side request forgery vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: HyperDX
 CVE-2026-63730 (HyperDX before 2.31.0 contains a server-side request forgery vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: HyperDX
 CVE-2026-63729 (The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedd ...)
 	TODO: check
 CVE-2026-63728 (Gitleaks prior to 8.30.1 contains a template injection vulnerability t ...)
-	TODO: check
+	NOT-FOR-US: Gitleaks
 CVE-2026-62414 (The Joomla extension Page Builder CK does not properly apply access co ...)
 	NOT-FOR-US: Joomla
 CVE-2026-61901 (The Joomla extension Hikashop is vulnerable to an open redirect.)
@@ -45,65 +45,65 @@ CVE-2026-61425 (The Joomla extension Gridbox is vulnerable an authenticated bypa
 CVE-2026-61424 (The Joomla extension DJ-Classifieds is vulnerable to an unauthenticate ...)
 	NOT-FOR-US: Joomla
 CVE-2026-59776 (Missing Cryptographic Step (CWE-325) vulnerability exists in certain F ...)
-	TODO: check
+	NOT-FOR-US: FeliCa IC chips issues
 CVE-2026-57852 (Grav CMS scheduler-webhook plugin contains an authentication bypass vu ...)
-	TODO: check
+	NOT-FOR-US: Grav CMS
 CVE-2026-57495 (AgenticMail gives AI agents real email addresses and phone numbers. In ...)
-	TODO: check
+	NOT-FOR-US: AgenticMail
 CVE-2026-57494 (AgenticMail gives AI agents real email addresses and phone numbers. In ...)
-	TODO: check
+	NOT-FOR-US: AgenticMail
 CVE-2026-55833 (Netty is a network application framework for development of protocol s ...)
 	TODO: check
 CVE-2026-55831 (Netty is a network application framework for development of protocol s ...)
 	TODO: check
 CVE-2026-55550 (NextCRM is open-source customer relationship management (CRM) software ...)
-	TODO: check
+	NOT-FOR-US: NextCRM
 CVE-2026-55544 (NextCRM is open-source customer relationship management (CRM) software ...)
-	TODO: check
+	NOT-FOR-US: NextCRM
 CVE-2026-55219 (Paymenter is a free and open-source webshop solution for management of ...)
-	TODO: check
+	NOT-FOR-US: Paymenter
 CVE-2026-53596 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
-	TODO: check
+	NOT-FOR-US: FreeScout
 CVE-2026-53595 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
-	TODO: check
+	NOT-FOR-US: FreeScout
 CVE-2026-53594 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
-	TODO: check
+	NOT-FOR-US: FreeScout
 CVE-2026-53593 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
-	TODO: check
+	NOT-FOR-US: FreeScout
 CVE-2026-53592 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
-	TODO: check
+	NOT-FOR-US: FreeScout
 CVE-2026-53591 (FreeScout is a free help desk and shared inbox built with PHP's Larave ...)
-	TODO: check
+	NOT-FOR-US: FreeScout
 CVE-2026-52656 (An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before  ...)
-	TODO: check
+	NOT-FOR-US: SJCAM
 CVE-2026-51385 (An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 al ...)
-	TODO: check
+	NOT-FOR-US: safishamsi Open-Source GRAPHIFY
 CVE-2026-51031 (FlareSolverr before version 3.4.7 contains a server-side request forge ...)
-	TODO: check
+	NOT-FOR-US: FlareSolverr
 CVE-2026-51025 (Cross Site Scripting vulnerability in fuint Member Marketing System <= ...)
-	TODO: check
+	NOT-FOR-US: fuint Member Marketing System
 CVE-2026-47255 (AgenticMail gives AI agents real email addresses and phone numbers. @a ...)
-	TODO: check
+	NOT-FOR-US: AgenticMail
 CVE-2026-47198 (Paymenter is a free and open-source webshop solution for management of ...)
-	TODO: check
+	NOT-FOR-US: Paymenter
 CVE-2026-47144 (Shamefile is a linter for undocumented linter warnings. Prior to versi ...)
-	TODO: check
+	NOT-FOR-US: Shamefile
 CVE-2026-47134 (ClearanceKit intercepts file-system access events on macOS and enforce ...)
-	TODO: check
+	NOT-FOR-US: ClearanceKit
 CVE-2026-47133 (ClearanceKit intercepts file-system access events on macOS and enforce ...)
-	TODO: check
+	NOT-FOR-US: ClearanceKit
 CVE-2026-47130 (NextCRM is open-source customer relationship management (CRM) software ...)
-	TODO: check
+	NOT-FOR-US: NextCRM
 CVE-2026-47129 (NextCRM is open-source customer relationship management (CRM) software ...)
 	NOT-FOR-US: Next.js
 CVE-2026-47128 (nono is software that allows users to run AI agents in a zero-latency  ...)
-	TODO: check
+	NOT-FOR-US: nono
 CVE-2026-44585 (Paymenter is a free and open-source webshop solution for management of ...)
-	TODO: check
+	NOT-FOR-US: Paymenter
 CVE-2026-44584 (Paymenter is a free and open-source webshop solution for management of ...)
-	TODO: check
+	NOT-FOR-US: Paymenter
 CVE-2026-44583 (Paymenter is a free and open-source webshop solution for management of ...)
-	TODO: check
+	NOT-FOR-US: Paymenter
 CVE-2026-44510 (Rsync is a file-copying tool that uses a delta-transfer algorithm to s ...)
 	TODO: check
 CVE-2026-44509 (Rsync is a file-copying tool that uses a delta-transfer algorithm to s ...)
@@ -115,9 +115,9 @@ CVE-2026-44507 (Rsync is a file-copying tool that uses a delta-transfer algorith
 CVE-2026-3182 (Zohocorp ManageEngine Endpoint Central versions before11.4.2528.34 are ...)
 	NOT-FOR-US: Zoho
 CVE-2026-16337 (Improper authorization in the ToolGroupResource and RoleAjax REST/DWR  ...)
-	TODO: check
+	NOT-FOR-US: dotCMS
 CVE-2026-16336 (A vulnerability was found in trinodb trino 481. Affected is an unknown ...)
-	TODO: check
+	NOT-FOR-US: trinodb
 CVE-2026-16334 (A vulnerability was identified in itsourcecode Hospital Management Sys ...)
 	NOT-FOR-US: itsourcecode System
 CVE-2026-16332 (A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an  ...)
@@ -131,11 +131,11 @@ CVE-2026-16329 (A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted
 CVE-2026-16327 (A vulnerability was determined in D-Link DNS-320 1.0.2. This issue aff ...)
 	NOT-FOR-US: D-Link
 CVE-2026-16324 (A vulnerability was identified in Metasoft \u7f8e\u7279\u8f6f\u4ef6 Me ...)
-	TODO: check
+	NOT-FOR-US: Metasoft
 CVE-2026-16266 (Versions of the package mongo-object before 3.0.3 are vulnerable to Pr ...)
-	TODO: check
+	NOT-FOR-US: mongo-object
 CVE-2026-15927 (A flaw was found in Red Hat Quay's repository-level mirror configurati ...)
-	TODO: check
+	NOT-FOR-US: Quay
 CVE-2026-15812 (A vulnerability was found in the internal Access Control List (ACL) su ...)
 	TODO: check
 CVE-2026-15811 (A vulnerability was found in kronosnet's (version <=1.34) cryptographi ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e09d1a920136432efe9200cbfc4f7ebfa4c05b96

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e09d1a920136432efe9200cbfc4f7ebfa4c05b96
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260721/586d20d4/attachment.htm>

More information about the debian-security-tracker-commits mailing list