[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Jul 31 21:07:56 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
6650770c by Salvatore Bonaccorso at 2026-07-31T22:07:24+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -11,31 +11,31 @@ CVE-2026-68574
CVE-2026-67822 (Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnera ...)
NOT-FOR-US: Tenda
CVE-2026-67607 (LightFTP 2.3.1 contains a race condition vulnerability that allows rem ...)
- TODO: check
+ NOT-FOR-US: LightFTP
CVE-2026-67350 (Serendipity before 2.6.1 contains an open redirect vulnerability in ex ...)
TODO: check
CVE-2026-65636 (Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ...)
- TODO: check
+ NOT-FOR-US: ymlr
CVE-2026-65313 (A provisioning script used when installing HIPASE-250 (formerly 250 SC ...)
- TODO: check
+ NOT-FOR-US: ANDRITZ
CVE-2026-65311 (The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) i ...)
- TODO: check
+ NOT-FOR-US: ANDRITZ
CVE-2026-65310 (ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration ...)
- TODO: check
+ NOT-FOR-US: ANDRITZ
CVE-2026-65309 (ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores an ...)
- TODO: check
+ NOT-FOR-US: ANDRITZ
CVE-2026-64607 (HttpClient based on the classic i/o model fails to correctly release t ...)
TODO: check
CVE-2026-59232 (Cross-site Scripting in the lead index view in Roskus Prospero Flow CR ...)
- TODO: check
+ NOT-FOR-US: Roskus Prospero Flow CRM
CVE-2026-59231 (Server-Side Request Forgery in the PDF export component in maalfer Pen ...)
- TODO: check
+ NOT-FOR-US: maalfer Pentestify
CVE-2026-58048 (Improper preservation of SQL mode when renaming databases in cPanel a ...)
- TODO: check
+ NOT-FOR-US: cPanel
CVE-2026-58047 (HTTP Smuggling in cPanel allows potential leak of credentials.)
- TODO: check
+ NOT-FOR-US: cPanel
CVE-2026-57232 (Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7. ...)
- TODO: check
+ NOT-FOR-US: Contao CMS
CVE-2026-56571 (HCL iControl was affected by Improper Error Handling vulnerabilities. ...)
NOT-FOR-US: HCL
CVE-2026-56570 (HCL iControl was affected by Auto complete Enabled vulnerabilities. It ...)
@@ -47,15 +47,15 @@ CVE-2026-56568 (HCL iControl was affected by Information Exposure Through Verbos
CVE-2026-56567 (HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerab ...)
NOT-FOR-US: HCL
CVE-2026-55824 (Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5 ...)
- TODO: check
+ NOT-FOR-US: Contao CMS
CVE-2026-55100 (hashi-vault-js is a Node.js module for interacting with the HashiCorp ...)
- TODO: check
+ NOT-FOR-US: hashi-vault-js
CVE-2026-54737 (@phun-ky/defaults-deep is a library like lodash defaultsDeep with arra ...)
- TODO: check
+ NOT-FOR-US: phun-ky/defaults-deep
CVE-2026-54729 (DSSRF is a Node.js library that provides a wide range of utilities and ...)
- TODO: check
+ NOT-FOR-US: DSSRF
CVE-2026-54725 (vault-secrets-webhook is a Kubernetes mutating webhook that makes dire ...)
- TODO: check
+ NOT-FOR-US: vault-secrets-webhook
CVE-2026-53505 (Thumbor is an open-source photo thumbnail service by globo.com. Prior ...)
TODO: check
CVE-2026-53504 (Thumbor is an open-source photo thumbnail service by globo.com. Prior ...)
@@ -69,11 +69,11 @@ CVE-2026-53501 (Thumbor is an open-source photo thumbnail service by globo.com.
CVE-2026-53500 (Thumbor is an open-source photo thumbnail service by globo.com. Prior ...)
TODO: check
CVE-2026-52857 (Wings is the server control plane for Pterodactyl, a free, open-source ...)
- TODO: check
+ NOT-FOR-US: Wings
CVE-2026-52856 (Wings is the server control plane for Pterodactyl, a free, open-source ...)
- TODO: check
+ NOT-FOR-US: Wings
CVE-2026-52855 (Wings is the server control plane for Pterodactyl, a free, open-source ...)
- TODO: check
+ NOT-FOR-US: Wings
CVE-2026-51301
REJECTED
CVE-2026-51299
@@ -163,9 +163,9 @@ CVE-2026-51230
CVE-2026-51229
REJECTED
CVE-2026-46594 (A reflected cross-site scripting (XSS) vulnerability has been identifi ...)
- TODO: check
+ NOT-FOR-US: PHPJabbers
CVE-2026-46593 (A SQL injection vulnerability has been identified in the PHP Jabbers - ...)
- TODO: check
+ NOT-FOR-US: PHPJabbers
CVE-2026-34497 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
NOT-FOR-US: Johnson Controls
CVE-2026-34495 (Improper neutralization of input during web page generation ('cross-si ...)
@@ -177,7 +177,7 @@ CVE-2026-28145 (Insufficient Verification of Data Authenticity vulnerability in
CVE-2026-28144 (Insertion of Sensitive Information Into Sent Data vulnerability in Fli ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-25552 (Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that all ...)
- TODO: check
+ NOT-FOR-US: Ghost CLI
CVE-2026-21662 (Unrestricted upload of file with dangerous type vulnerability in Johns ...)
NOT-FOR-US: Johnson Controls
CVE-2026-18481 (Stored cross-site scripting in the participant URL handling in AWS Ops ...)
@@ -211,7 +211,7 @@ CVE-2026-18206 (A flaw was found in the keycloak-services component of Keycloak,
CVE-2026-18203 (A flaw was found in the group policy evaluation logic of Keycloak, an ...)
TODO: check
CVE-2026-18141 (A flaw was found in aap-gateway, a component of Ansible Automation Pla ...)
- TODO: check
+ NOT-FOR-US: Red Hat Ansible Automation Platform
CVE-2026-17592
REJECTED
CVE-2026-17567 (The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Co ...)
@@ -219,7 +219,7 @@ CVE-2026-17567 (The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz
CVE-2026-17566 (pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command ...)
TODO: check
CVE-2026-17561 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Logsign SIEM
CVE-2026-17351 (The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied ...)
TODO: check
CVE-2026-17350 (The per-tool permission system (custom roles / role-based tool permiss ...)
@@ -235,9 +235,9 @@ CVE-2026-17346 (The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral
CVE-2026-16843 (Some Hikvision Wireless Access Points are vulnerable to authenticated ...)
NOT-FOR-US: Hikvision
CVE-2026-16504 (Deployment of the VPS.org one-click Zulip template deploys a hardcoded ...)
- TODO: check
+ NOT-FOR-US: VPS.org one-click Zulip template
CVE-2026-16503 (Deployment of the VPS.org one-click Supabase template deploys a Postgr ...)
- TODO: check
+ NOT-FOR-US: VPS.org one-click Supabase template
CVE-2026-16105 (A flaw was found in the RoleContainerResource component of Keycloak. T ...)
TODO: check
CVE-2026-15722 (A stack buffer overflow flaw was found in 389 Directory Server (389-ds ...)
@@ -251,13 +251,13 @@ CVE-2026-10686 (Zephyr's IPv6 forwarding path re-sent routed unicast packets wit
CVE-2026-10685 (The Zephyr Bluetooth GATT client CCC-write response handler gatt_write ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-10079 (A flaw was found in Red Hat Advanced Cluster Security for Kubernetes ( ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Security for Kubernetes (RHACS)
CVE-2025-67651 (A Cross-Site Request Forgery (CSRF) vulnerability has been identified ...)
- TODO: check
+ NOT-FOR-US: PHPJabbers
CVE-2025-67650 (An authenticated SQL injection vulnerability has been identified in mu ...)
- TODO: check
+ NOT-FOR-US: PHPJabbers
CVE-2025-67649 (A SQL injection vulnerability has been identified in PHP Jabbers -Car ...)
- TODO: check
+ NOT-FOR-US: PHPJabbers
CVE-2025-62347 (HCL iControl was affected by Improper Input Validation vulnerability. ...)
NOT-FOR-US: HCL
CVE-2026-XXXX [GHSA-6v6x-387m-rj4w: Project restriction bypass on network address sets]
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6650770c8b8a2b02c4645bd5722df4d7b85b24e9
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6650770c8b8a2b02c4645bd5722df4d7b85b24e9
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260731/4b472a96/attachment.htm>
More information about the debian-security-tracker-commits
mailing list