[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Wed Jul 29 08:47:56 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8811f681 by Salvatore Bonaccorso at 2026-07-29T09:47:31+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,45 +1,45 @@
 CVE-2026-6881 (A SQL Injection in the Giving Reports functionality in Ellucian Advanc ...)
-	TODO: check
+	NOT-FOR-US: Ellucian
 CVE-2026-66064 (goshs is a feature-rich single-binary file server for red teamers and  ...)
-	TODO: check
+	NOT-FOR-US: goshs
 CVE-2026-66063 (goshs is a feature-rich single-binary file server for red teamers and  ...)
-	TODO: check
+	NOT-FOR-US: goshs
 CVE-2026-64863 (goshs is a feature-rich single-binary file server for red teamers and  ...)
-	TODO: check
+	NOT-FOR-US: goshs
 CVE-2026-63242 (A business logic vulnerability in Koollab LMS allowed an authenticated ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63241 (An insecure direct object reference vulnerability in Koollab LMS allow ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63240 (An information disclosure vulnerability in Koollab LMS allowed an auth ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63239 (A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed  ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63238 (An authentication bypass vulnerability in Koollab LMS allowed an unaut ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63237 (A TOTP two-factor authentication bypass vulnerability in Koollab LMS a ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63236 (An improper access control vulnerability in Koollab LMS allowed an una ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63235 (An improper access control vulnerability in Koollab LMS allowed an una ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63234 (A SQL injection and unsafe deserialisation vulnerability in Koollab LM ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63233 (A SQL injection and unsafe deserialisation vulnerability in Koollab LM ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63232 (A SQL injection and unsafe deserialisation vulnerability in Koollab LM ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63231 (A post-authentication SQL injection vulnerability in Koollab LMS allow ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63230 (A pre-authentication error-based SQL injection vulnerability in Koolla ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63229 (A pre-authentication blind SQL injection vulnerability in Koollab LMS  ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63228 (An unrestricted image upload vulnerability in Koollab LMS allowed an a ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-63227 (An unrestricted SCORM file upload vulnerability in Koollab LMS allowed ...)
-	TODO: check
+	NOT-FOR-US: Koollab LMS
 CVE-2026-62325 (goshs is a feature-rich single-binary file server for red teamers and  ...)
-	TODO: check
+	NOT-FOR-US: goshs
 CVE-2026-5626 (The Survey Form Block plugin for WordPress is vulnerable to unauthoriz ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-59943 (Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior ...)
@@ -58,9 +58,9 @@ CVE-2026-59941 (Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and pr
 CVE-2026-59921 (Netty is an asynchronous, event-driven network application framework.  ...)
 	TODO: check
 CVE-2026-57511 (SuperPlane before 0.30.0 contains an SMTP header injection vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: SuperPlane
 CVE-2026-57510 (SuperPlane before 0.27.0 contains a broken object-level authorization  ...)
-	TODO: check
+	NOT-FOR-US: SuperPlane
 CVE-2026-56822 (Netty is an asynchronous, event-driven network application framework.  ...)
 	TODO: check
 CVE-2026-56821 (Netty is an asynchronous, event-driven network application framework.  ...)
@@ -78,39 +78,39 @@ CVE-2026-55554 (Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and
 	- php-dompdf <unfixed>
 	NOTE: https://github.com/dompdf/dompdf/security/advisories/GHSA-wvh6-f5jh-8gw4
 CVE-2026-55415 (datamodel-code-generator generates Pydantic v2 models, dataclasses, Ty ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-55403 (datamodel-code-generator generates Python data models from schema defi ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-55391 (datamodel-code-generator generates Pydantic v2 models, dataclasses, Ty ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-55390 (datamodel-code-generator generates Python data models from schema defi ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-55389 (datamodel-code-generator generates Pydantic v2 models, dataclasses, Ty ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-54719 (goshs is a feature-rich single-binary file server for red teamers and  ...)
-	TODO: check
+	NOT-FOR-US: goshs
 CVE-2026-54691 (datamodel-code-generator generates Python data models from schema defi ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-54690 (datamodel-code-generator generates Pydantic v2 models, dataclasses, Ty ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-54659 (Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, P ...)
 	TODO: check
 CVE-2026-54658 (Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0. ...)
 	TODO: check
 CVE-2026-54656 (datamodel-code-generator generates Pydantic v2 models, dataclasses, Ty ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-54655 (datamodel-code-generator generates Python data models from schema defi ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-54654 (datamodel-code-generator generates Python data models from schema defi ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-54653 (datamodel-code-generator generates Pydantic v2 models, dataclasses, Ty ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-54650 (openhole exposes localhost to the internet in one command. In 0.1.1 an ...)
 	TODO: check
 CVE-2026-54638 (gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, pr ...)
 	TODO: check
 CVE-2026-54621 (datamodel-code-generator generates Python data models from schema defi ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-49447 (Cosmos provides users the ability self-host a home server by acting as ...)
 	TODO: check
 CVE-2026-48060 (Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8811f681f2f464bc643e5c7ebfb9858b1d78fb57

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8811f681f2f464bc643e5c7ebfb9858b1d78fb57
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260729/be5fdcc6/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list