[Git][security-tracker-team/security-tracker][master] NFUs

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b5030938 by Moritz Muehlenhoff at 2026-06-26T17:46:05+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -75,7 +75,7 @@ CVE-2026-57521 (Bitwarden Server before 2026.5.0 contains a broken access contro
 CVE-2026-57520 (Bitwarden Server before 2026.5.0 contains a privilege escalation vulne ...)
 	- bitwarden <itp> (bug #956836)
 CVE-2026-56445 (The qrscp application's C-STORE handler uses a specific instance from  ...)
-	TODO: check
+	NOT-FOR-US: pynetdicom (different from src:pydicom)
 CVE-2026-55964 (Chain intermediate CA:TRUE without keyCertSign accepted as a signing C ...)
 	- wolfssl <unfixed>
 	NOTE: https://github.com/wolfSSL/wolfssl/pull/10702 (v5.9.2-stable)
@@ -89,21 +89,21 @@ CVE-2026-55958 (Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffe
 	- wolfssl <unfixed>
 	NOTE: https://github.com/wolfSSL/wolfssl/pull/10705 (v5.9.2-stable)
 CVE-2026-54479 (The WebSocket backend uses charging station identifiers to uniquely as ...)
-	TODO: check
+	NOT-FOR-US: Evoke
 CVE-2026-50745 (A missing sanitisation vulnerability exists with user input in the sta ...)
-	TODO: check
+	NOT-FOR-US: Revive Adserver
 CVE-2026-50744 (A bypass to the admin\u2011only restriction of the XML\u2011RPC API in ...)
-	TODO: check
+	NOT-FOR-US: Revive Adserver
 CVE-2026-50742 (A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` ...)
-	TODO: check
+	NOT-FOR-US: Revive Adserver
 CVE-2026-50741 (Bypass to the fix for CVE-2026-34916. Variants of such vectors have be ...)
-	TODO: check
+	NOT-FOR-US: Revive Adserver
 CVE-2026-50740 (A missing sanitisation vulnerability of user input in the zone-include ...)
-	TODO: check
+	NOT-FOR-US: Revive Adserver
 CVE-2026-50739 (A bypass for CVE\u20112026\u201134913 exists with proper ownership val ...)
-	TODO: check
+	NOT-FOR-US: Revive Adserver
 CVE-2026-50176 (The WebSocket Application Programming Interface lacks restrictions on  ...)
-	TODO: check
+	NOT-FOR-US: Evoke
 CVE-2026-46602 (The TIFF decoder does not set a limit on the size of tiles in tiled im ...)
 	TODO: check
 CVE-2026-46601 (The webp decoder can panic when processing a VP8 chunk with dimensions ...)
@@ -111,7 +111,7 @@ CVE-2026-46601 (The webp decoder can panic when processing a VP8 chunk with dime
 CVE-2026-44622 (Charging station authentication identifiers are publicly accessible vi ...)
 	TODO: check
 CVE-2026-43920 (FOSSBilling is a free, open-source billing and client management syste ...)
-	TODO: check
+	NOT-FOR-US: FOSSBilling
 CVE-2026-40941 (Cacti is an open source performance and fault management framework. Ve ...)
 	- cacti <unfixed>
 	NOTE: https://github.com/Cacti/cacti/security/advisories/GHSA-274c-97hj-pv2v



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b50309389f9d527cf77e93acb5597fb2625bd77b

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b50309389f9d527cf77e93acb5597fb2625bd77b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260626/3c2de97d/attachment-0001.htm>