[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Jul 24 22:06:42 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
6f748bec by Salvatore Bonaccorso at 2026-07-24T23:05:55+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,13 +1,13 @@
CVE-2026-9765 (Note: The CVE and blog post don't exist because we determined this is ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-8789 (The Easy Appointments plugin for WordPress is vulnerable to unauthoriz ...)
NOT-FOR-US: WordPress plugin
CVE-2026-8308 (Improper neutralization of input during web page generation ('cross-si ...)
- TODO: check
+ NOT-FOR-US: Website Template
CVE-2026-7484 (External control of Assumed-Immutable web parameter vulnerability in A ...)
- TODO: check
+ NOT-FOR-US: AVESIS
CVE-2026-7483 (Local privilege escalationpotentially allowed an attacker to write an ...)
- TODO: check
+ NOT-FOR-US: ESET
CVE-2026-7007 (The Zephyr ext2 file system validates the on-disk superblock in ext2_v ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-66144 (Although remote policy references are not retrieved during policy norm ...)
@@ -25,7 +25,7 @@ CVE-2026-66033 (libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-
CVE-2026-66032 (libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-fre ...)
TODO: check
CVE-2026-66027 (Suna before 0.9.102 contains a broken access control vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Suna
CVE-2026-66010 (DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook fo ...)
TODO: check
CVE-2026-66009 (Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 befo ...)
@@ -33,27 +33,27 @@ CVE-2026-66009 (Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.
CVE-2026-66008 (Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 befo ...)
NOT-FOR-US: Parse Server
CVE-2026-66007 (Datasets through 5.0.0, fixed in commit f989ef9, contains a path trave ...)
- TODO: check
+ NOT-FOR-US: HuggingFace Datasets
CVE-2026-66006 (lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentica ...)
- TODO: check
+ NOT-FOR-US: lakeFS
CVE-2026-66005 (Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfigu ...)
- TODO: check
+ NOT-FOR-US: Jan
CVE-2026-66004 (BlenderMCP before commit 30a3308 contains a path traversal vulnerabili ...)
- TODO: check
+ NOT-FOR-US: BlenderMCP
CVE-2026-65711 (sysPass through version 3.2.11 contains an OS command injection vulner ...)
- TODO: check
+ NOT-FOR-US: sysPass
CVE-2026-65710 (sysPass through version 3.2.11 contains a missing authorization vulner ...)
- TODO: check
+ NOT-FOR-US: sysPass
CVE-2026-65709 (sysPass through version 3.2.11 contains a missing object-level authori ...)
- TODO: check
+ NOT-FOR-US: sysPass
CVE-2026-65708 (sysPass through version 3.2.11 contains an insecure direct object refe ...)
- TODO: check
+ NOT-FOR-US: sysPass
CVE-2026-65707 (Likeshop through 3.0.5 contains an authenticated SQL injection vulnera ...)
- TODO: check
+ NOT-FOR-US: Likeshop
CVE-2026-65693 (Microweber CMS through 2.0.20 contains a server-side template injectio ...)
- TODO: check
+ NOT-FOR-US: Microweber CMS
CVE-2026-65623 (Inefficient Algorithmic Complexity vulnerability in mtrudel bandit all ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-64255 (In the Linux kernel, the following vulnerability has been resolved: w ...)
- linux 7.1.3-1
NOTE: https://git.kernel.org/linus/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2 (7.2-rc1)
@@ -323,7 +323,7 @@ CVE-2026-63317 (Arbitrary Class Instantiation via XML Feature Generator Descript
CVE-2026-58630 (Improper access control in Azure App Service allows an unauthorized at ...)
NOT-FOR-US: Microsoft
CVE-2026-58586 (Image::WebP versions through 0.2 for Perl bundle a vulnerable version ...)
- TODO: check
+ NOT-FOR-US: Image::WebP Perl module
CVE-2026-57106 (Server-side request forgery (ssrf) in Data Quality allows an unauthori ...)
NOT-FOR-US: Microsoft
CVE-2026-56392 (GNU coreutils unexpand is vulnerable to a heap-based buffer overflow d ...)
@@ -333,17 +333,17 @@ CVE-2026-56391 (GNU coreutils uniq is vulnerable to an out\u2011of\u2011bounds r
CVE-2026-56163 (Missing authentication for critical function in Microsoft Azure Kubern ...)
NOT-FOR-US: Microsoft
CVE-2026-55732 (Out-of-bounds Read (CWE-125)in BACnet packet parsing (`bacdt_datetime_ ...)
- TODO: check
+ NOT-FOR-US: Loytec
CVE-2026-55731 (Unchecked input for loop condition (CWE-606)in the SNMP agent in Loyte ...)
- TODO: check
+ NOT-FOR-US: Loytec
CVE-2026-55730 (Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 ...)
- TODO: check
+ NOT-FOR-US: Loytec
CVE-2026-55729 (Exposure of Sensitive Information (CWE-200)in LWEB802 browser `localSt ...)
- TODO: check
+ NOT-FOR-US: Loytec
CVE-2026-55728 (Stack-based Buffer Overflow (CWE-121)in `/usr/bin/ltsudo` `cmd_ipaddr_ ...)
- TODO: check
+ NOT-FOR-US: Loytec
CVE-2026-54342 (In epa4all, prior to version 2026-05-20, an attacker on the network pa ...)
- TODO: check
+ NOT-FOR-US: epa4all
CVE-2026-49745 (Kernel software installed and running inside a Guest VM may post impro ...)
NOT-FOR-US: Imagination Technologies
CVE-2026-49744 (Kernel software installed and running inside a Guest VM may post impro ...)
@@ -353,19 +353,19 @@ CVE-2026-49743 (Software installed and run as a non-privileged user may conduct
CVE-2026-49326 (Missing Authorization vulnerability in Apache HBase thrift and rest de ...)
TODO: check
CVE-2026-48037 (Hulumi is an open-source toolkit that ships secure-by-default cloud an ...)
- TODO: check
+ NOT-FOR-US: Hulumi
CVE-2026-48036 (Hulumi is an open-source toolkit that ships secure-by-default cloud an ...)
- TODO: check
+ NOT-FOR-US: Hulumi
CVE-2026-48035 (Hulumi is an open-source toolkit that ships secure-by-default cloud an ...)
- TODO: check
+ NOT-FOR-US: Hulumi
CVE-2026-48034 (Hulumi is an open-source toolkit that ships secure-by-default cloud an ...)
- TODO: check
+ NOT-FOR-US: Hulumi
CVE-2026-48033 (Hulumi is an open-source toolkit that ships secure-by-default cloud an ...)
- TODO: check
+ NOT-FOR-US: Hulumi
CVE-2026-48032 (Hulumi is an open-source toolkit that ships secure-by-default cloud an ...)
- TODO: check
+ NOT-FOR-US: Hulumi
CVE-2026-48021 (In epa4all, prior to version 2026-05-20, an attacker who can intercept ...)
- TODO: check
+ NOT-FOR-US: epa4all
CVE-2026-46452 (Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-45816 (NULL Pointer Dereference vulnerability in Apache NimBLE inLE Long Term ...)
@@ -379,9 +379,9 @@ CVE-2026-45812 (Incorrect Calculation of Buffer Size vulnerability in Apache Nim
CVE-2026-45811 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-24727 (An unrestricted upload of file with dangerous type vulnerability in th ...)
- TODO: check
+ NOT-FOR-US: SUNNET Corporate Training Management System
CVE-2026-17107 (A flaw was found in the cluster-proxy service-proxy component used in ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes (RHACM)
CVE-2026-17059 (A flaw was found in the role-users endpoint of the keycloak-services l ...)
TODO: check
CVE-2026-17048 (A flaw was found in the Keycloak Admin REST API, which is used to mana ...)
@@ -389,7 +389,7 @@ CVE-2026-17048 (A flaw was found in the Keycloak Admin REST API, which is used t
CVE-2026-17039 (A flaw was found in pki-core. The certificate authority (CA) renewal r ...)
TODO: check
CVE-2026-16910 (A flaw was found in Red Hat Quay's notification webhook feature. The S ...)
- TODO: check
+ NOT-FOR-US: Quay
CVE-2026-16802 (Cleartext storage of sensitive information in the variables feature in ...)
NOT-FOR-US: Devolutions
CVE-2026-16801 (Improper control of generation of code ('Code Injection') in the varia ...)
@@ -401,15 +401,18 @@ CVE-2026-16799 (Improper access control in the automation tests and workflows fe
CVE-2026-16798 (Insertion of sensitive information into sent data in the automation jo ...)
NOT-FOR-US: Devolutions
CVE-2026-16743 (A flaw was found in accountsservice. The systemd-homed code path for S ...)
- TODO: check
+ - accountsservice <unfixed>
+ NOTE: https://gitlab.freedesktop.org/accountsservice/accountsservice/-/work_items/138
+ NOTE: https://gitlab.freedesktop.org/accountsservice/accountsservice/-/merge_requests/182 (26.26.9)
CVE-2026-16730 (A flaw was found in dbus-broker. When the process file-descriptor limi ...)
- TODO: check
+ - dbus-broker <unfixed>
+ NOTE: https://github.com/bus1/dbus-broker/issues/435
CVE-2026-16519 (A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Uti ...)
NOT-FOR-US: GeoVision
CVE-2026-15821 (The SureDash \u2013 Community, Courses & Member Dashboard plugin for W ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15810 (A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker vers ...)
- TODO: check
+ NOT-FOR-US: Google Cloud Looker
CVE-2026-15755 (The Open User Map \u2013 Interactive Leaflet Maps plugin for WordPress ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15739 (The Rich Showcase for Google Reviews plugin for WordPress is vulnerabl ...)
@@ -435,7 +438,7 @@ CVE-2026-15334 (The Cozy Blocks \u2013 Page Builder for Gutenberg Editor & FSE w
CVE-2026-15333 (The Cozy Blocks \u2013 Page Builder for Gutenberg Editor & FSE with 60 ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15243 (Apereo CAS Clientaccepts any CA-trusted certificate for any hostname, ...)
- TODO: check
+ NOT-FOR-US: Apereo CAS Client
CVE-2026-12702 (In affected versions of Octopus Deploy Insufficient checks on the proj ...)
NOT-FOR-US: Octopus Deploy
CVE-2026-12654 (The Payment Plugins for Stripe WooCommerce plugin for WordPress is vul ...)
@@ -515,17 +518,17 @@ CVE-2026-52439 (An issue in xiandafu beetl 3.20.2 allows a remote attacker to ex
CVE-2026-50517 (Deserialization of untrusted data in M365 Copilot allows an authorized ...)
NOT-FOR-US: Microsoft
CVE-2026-50103 (A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, ...)
- TODO: check
+ NOT-FOR-US: MZ Automation
CVE-2026-50044 (Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encr ...)
NOT-FOR-US: Pronetiqs IntraVUE
CVE-2026-50039 (The affected product is vulnerable to a stack-based buffer overflow, w ...)
- TODO: check
+ NOT-FOR-US: MZ Automation
CVE-2026-50032 (A NULL pointer dereference in the MMS Write Named Variable List handle ...)
- TODO: check
+ NOT-FOR-US: MZ Automation
CVE-2026-49159 (Exposure of sensitive information to an unauthorized actor in Microsof ...)
NOT-FOR-US: Microsoft
CVE-2026-49035 (The affected product is vulnerable to a heap-based buffer overflow via ...)
- TODO: check
+ NOT-FOR-US: MZ Automation
CVE-2026-48013 (Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1 ...)
NOT-FOR-US: Shopware
CVE-2026-48012 (Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10 ...)
@@ -541,11 +544,11 @@ CVE-2026-47670 (DbGate is cross-platform database manager. Versions 7.1.8 and pr
CVE-2026-47669 (DbGate is cross-platform database manager. In versions 7.1.8 and prior ...)
NOT-FOR-US: DbGate
CVE-2026-44955 (Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sen ...)
- TODO: check
+ NOT-FOR-US: Pronetiqs IntraVUE
CVE-2026-42933 (Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended prox ...)
NOT-FOR-US: Pronetiqs IntraVUE
CVE-2026-40430 (Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storag ...)
- TODO: check
+ NOT-FOR-US: Pronetiqs IntraVUE
CVE-2026-39155 (Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability ...)
TODO: check
CVE-2026-38764 (An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a l ...)
@@ -555,7 +558,7 @@ CVE-2026-35425 (Improper access control in Azure API Management (APIM) allows an
CVE-2026-34496 (Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows ...)
NOT-FOR-US: Johnson Controls
CVE-2026-28698 (Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sen ...)
- TODO: check
+ NOT-FOR-US: Pronetiqs IntraVUE
CVE-2026-25800 (Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC ...)
TODO: check
CVE-2026-21655 (Deserialization of untrusted data vulnerability in Johnson Control vic ...)
@@ -563,7 +566,7 @@ CVE-2026-21655 (Deserialization of untrusted data vulnerability in Johnson Contr
CVE-2026-21653 (Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor ap ...)
NOT-FOR-US: Johnson Controls
CVE-2026-16870 (Multiple security vulnerabilities in Snowflake libsnowflakeclient vers ...)
- TODO: check
+ NOT-FOR-US: Snowflake libsnowflakeclient
CVE-2026-16807 (Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 ...)
- chromium <unfixed>
[bullseye] - chromium <end-of-life> (see #1061268)
@@ -579,15 +582,15 @@ CVE-2026-16804 (Use after free in Input in Google Chrome prior to 150.0.7871.186
CVE-2026-16796 (Improper neutralization of argument delimiters in the install_packages ...)
NOT-FOR-US: Amazon
CVE-2026-16767 (A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affe ...)
- TODO: check
+ NOT-FOR-US: Ne-Lexa php-zip
CVE-2026-16765 (A vulnerability was determined in CodeAstro Online Classroom 1.0. Affe ...)
- TODO: check
+ NOT-FOR-US: CodeAstro Online Classroom
CVE-2026-16764 (A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue ...)
- TODO: check
+ NOT-FOR-US: OWASP DefectDojo
CVE-2026-16763 (A vulnerability was identified in localstack serverless-localstack up ...)
- TODO: check
+ NOT-FOR-US: localstack serverless-localstack
CVE-2026-16002 (The affected product is vulnerable to an Out-of-bounds read, which may ...)
- TODO: check
+ NOT-FOR-US: MZ Automation
CVE-2026-15981 (The SAML Single Sign On \u2013 SSO Login plugin for WordPress is vulne ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15968 (Improper neutralization of input during web page generation ('cross-si ...)
@@ -597,7 +600,7 @@ CVE-2026-15967 (Insufficient session expiration vulnerability in Progress MOVEit
CVE-2026-15966 (Permissive cross-domain security policy with untrusted domains vulnera ...)
NOT-FOR-US: Progress Software
CVE-2026-15630 (A non-global organization admin in one tenant can bypass tenant bounda ...)
- TODO: check
+ NOT-FOR-US: Casdoor
CVE-2026-15420 (The Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website B ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15212 (The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Re ...)
@@ -607,7 +610,7 @@ CVE-2026-15100 (The Post Grid Gutenberg Blocks \u2013 PostX plugin for WordPress
CVE-2026-14603 (The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 doe ...)
NOT-FOR-US: WordPress plugin
CVE-2026-14172 (Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered ex ...)
- TODO: check
+ NOT-FOR-US: Rapid7
CVE-2026-13464 (The Kirki \u2013 Freeform Page Builder, Website Builder & Customizer p ...)
NOT-FOR-US: WordPress plugin
CVE-2026-12981 (The CAFEHAUS API WordPress plugin through 1.0.0 does not have any auth ...)
@@ -1240,17 +1243,17 @@ CVE-2026-16768 (A flaw was found in gdk-pixbuf. When parsing a specially crafted
CVE-2026-16756 (Missing connection and header-read timeouts and the absence of a concu ...)
NOT-FOR-US: Amazon
CVE-2026-16745 (A flaw was found in odh-dashboard, the web console component of Red Ha ...)
- TODO: check
+ NOT-FOR-US: odh-dashboard
CVE-2026-16735 (A security vulnerability has been detected in release-it conventional- ...)
- TODO: check
+ NOT-FOR-US: release-it conventional-changelog
CVE-2026-16733 (A weakness has been identified in bahmutov find-cypress-specs up to 1. ...)
- TODO: check
+ NOT-FOR-US: bahmutov find-cypress-specs
CVE-2026-16723 (A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 ...)
- TODO: check
+ NOT-FOR-US: FastjsonEngine
CVE-2026-16584 (Improper handling of an initialization failure in AWS API MCP Server f ...)
NOT-FOR-US: Amazon
CVE-2026-16287 (Improper neutralization of special elements used in an OS command ('OS ...)
- TODO: check
+ NOT-FOR-US: pardus-update
CVE-2026-16078 (The WCPOS \u2013 Point of Sale (POS) plugin for WooCommerce plugin for ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15906 (The Premium Packages \u2013 Sell Digital Products Securely plugin for ...)
@@ -1270,17 +1273,17 @@ CVE-2026-15647 (The Brands for WooCommerce plugin for WordPress is vulnerable to
CVE-2026-15646 (The Brands for WooCommerce plugin for WordPress is vulnerable to Store ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15617 (Logto performs principal lookup without normalizing email and identifi ...)
- TODO: check
+ NOT-FOR-US: Logto
CVE-2026-15616 (Logto does not enforce locally configured MFA during SSO authenticatio ...)
- TODO: check
+ NOT-FOR-US: Logto
CVE-2026-15615 (Logto omits validation of the SAML <Conditions> element, enabling atta ...)
- TODO: check
+ NOT-FOR-US: Logto
CVE-2026-15614 (Logto silently fails to delete IdP-initiated SAML sessions, enabling s ...)
- TODO: check
+ NOT-FOR-US: Logto
CVE-2026-15612 (Logto bypasses OIDC nonce validation when the nonce claim is absent fr ...)
- TODO: check
+ NOT-FOR-US: Logto
CVE-2026-15611 (Logto allows unverified email-based SSO account linking, enabling an a ...)
- TODO: check
+ NOT-FOR-US: Logto
CVE-2026-15448 (The Tickera \u2013 Sell Tickets & Manage Events plugin for WordPress i ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15404 (The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Sc ...)
@@ -1411,7 +1414,7 @@ CVE-2026-16629 (A vulnerability was identified in danger danger-js up to 13.0.7.
CVE-2026-16628 (A vulnerability was detected in oclif up to 4.23.16. Affected by this ...)
NOT-FOR-US: oclif
CVE-2026-15074 (@fastify/static up to and including version 10.1.0 fails to reject dot ...)
- TODO: check
+ NOT-FOR-US: fastify/static
CVE-2026-14899 (The code to parse MIME headers for display when forwarding a message ( ...)
TODO: check
CVE-2026-14881 (When importing connections in Compass it is possible to override some ...)
@@ -1660,7 +1663,7 @@ CVE-2026-16157 (Duplicati v2.3.0.1 backup software gives Authenticated Users MOD
CVE-2026-15787 (The Ultimate Addons for Elementor plugin for WordPress is vulnerable t ...)
NOT-FOR-US: WordPress plugin
CVE-2026-14985 (The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains ...)
- TODO: check
+ NOT-FOR-US: Analog Way Picturall Quad Compact Mark II
CVE-2026-14932 (In Progress\xae Telerik\xae UI for AJAX prior to v2026.2.708, the obso ...)
NOT-FOR-US: Progress Software
CVE-2026-14865 (In Progress\xae Telerik\xae UI for AJAX prior to v2026.2.708, the inte ...)
@@ -4674,7 +4677,7 @@ CVE-2026-16461 (A stack-based buffer overflow was found in rpcbind's rpcinfo uti
- rpcbind <unfixed> (bug #1142716)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2502719
CVE-2026-16454 (InEclipse hawkBitversions 1.0.3 and prior, a privilege escalation vuln ...)
- TODO: check
+ NOT-FOR-US: Eclipse hawkBit
CVE-2026-16451 (A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e ...)
NOT-FOR-US: zsadmin2025 ZS-Admin
CVE-2026-16450 (A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536 ...)
@@ -4695,7 +4698,7 @@ CVE-2026-16439 (In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace me
CVE-2026-16243 (In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation f ...)
NOT-FOR-US: Eclipse
CVE-2026-15829 (A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulner ...)
- TODO: check
+ NOT-FOR-US: googleapis/mcp-toolbox
CVE-2026-15793 (BuildKit custom frontends or clients using the raw low-level API can s ...)
TODO: check
CVE-2026-15792 (A malicious BuildKit client or frontend could craft a request that cou ...)
@@ -5266,9 +5269,9 @@ CVE-2026-13693 (The Bit Form WordPress plugin before 3.1.0 does not restrict a
CVE-2026-13439 (The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerabl ...)
NOT-FOR-US: WordPress plugin
CVE-2026-13381 (VSee Clinic 7.1.26 and API1.3.0contain an Insecure Direct Object Refer ...)
- TODO: check
+ NOT-FOR-US: VSee Clinic
CVE-2026-13380 (VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP cr ...)
- TODO: check
+ NOT-FOR-US: VSee Clinic
CVE-2026-12900 (The Spectra Gutenberg Blocks \u2013 Website Builder for the Block Edit ...)
NOT-FOR-US: WordPress plugin
CVE-2026-11767 (The Free Builder for Elementor WordPress plugin before 1.6.7 does no ...)
@@ -5645,9 +5648,9 @@ CVE-2026-15588 (A denial-of-service and resource exhaustion vulnerability exists
CVE-2026-14448 (An high privileged remote attacker can exploit an authenticated OS com ...)
TODO: check
CVE-2026-13724 (Client-Side Enforcement of Server-Side Security vulnerability in Gobit ...)
- TODO: check
+ NOT-FOR-US: Corporate Training Management System
CVE-2026-12701 (A path traversal vulnerability was found in pulpcore. The relative_pat ...)
- TODO: check
+ NOT-FOR-US: pulpcore
CVE-2026-12341 (This vulnerability impacts all versions of IdentityIQ and allows an un ...)
TODO: check
CVE-2026-12080 (A flaw was found in the QEMU Guest Agent (qga). A local unprivileged u ...)
@@ -8886,17 +8889,17 @@ CVE-2026-13082 (GD::SecurityImage versions through 1.75 for Perl use rand to gen
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41903267/
NOTE: https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch
CVE-2026-12715 (Missing Authorization in Google Cloud Firebase Studio versions prior t ...)
- TODO: check
+ NOT-FOR-US: Google Cloud Firebase Studio
CVE-2026-12705 (Missing support for integrity check vulnerability in ABB KNX Update To ...)
NOT-FOR-US: ABB group
CVE-2026-12694 (Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video ...)
- TODO: check
+ NOT-FOR-US: Enterprise Video Platform
CVE-2026-12693 (Authorization bypass through User-Controlled key vulnerability in Vime ...)
- TODO: check
+ NOT-FOR-US: Enterprise Video Platform
CVE-2026-12692 (Unverified password change vulnerability in Vimesoft Inc. Enterprise V ...)
- TODO: check
+ NOT-FOR-US: Enterprise Video Platform
CVE-2026-12691 (Missing authentication for critical function vulnerability in Vimesoft ...)
- TODO: check
+ NOT-FOR-US: Enterprise Video Platform
CVE-2026-11763 (Authorization bypass through User-Controlled key vulnerability in Gis ...)
TODO: check
CVE-2025-60357 (AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQ ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6f748beca201c4fbabde44857bc199e1bb4462d3
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6f748beca201c4fbabde44857bc199e1bb4462d3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260724/3071904b/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list