[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Jun 26 20:14:44 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
6f96cc5c by security tracker role at 2026-06-26T19:14:38+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -11,17 +11,17 @@ CVE-2026-5757 (Unauthenticated remote information disclosure vulnerability in Ol
CVE-2026-57940 (HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerabilit ...)
TODO: check
CVE-2026-57926 (In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vu ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-57925 (In JetBrains YouTrack before 2026.2.16593 improper access control allo ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-57924 (In JetBrains YouTrack before 2026.2.16593 default role configuration e ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-57923 (In JetBrains YouTrack before 2026.2.16593 improper authorisation in th ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-57922 (In JetBrains YouTrack before 2026.2.16593 project settings disclosure ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-57921 (In JetBrains YouTrack before 2026.2.16593 improper access control allo ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-57920 (Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a s ...)
TODO: check
CVE-2026-57918 (libnfs through 6.0.2 before 935b8db has an xid integer underflow in RE ...)
@@ -55,91 +55,91 @@ CVE-2026-57873 (An unauthenticated NULL pointer dereference vulnerability exists
CVE-2026-57872 (An unauthenticated directory traversal vulnerability exists in get_fco ...)
TODO: check
CVE-2026-57667 (Sales Representative SQL Injection in Groundhogg <= 4.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57665 (Unauthenticated Insecure Direct Object References (IDOR) in GravityVie ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57664 (Unauthenticated Sensitive Data Exposure in Bopo \u2013 WooCommerce Pro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57663 (Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57662 (Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57661 (Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57660 (Unauthenticated Broken Access Control in Booking and Rental Manager <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57659 (Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57658 (Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57657 (Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57656 (Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57655 (Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizar ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57654 (Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57653 (Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57652 (Unauthenticated Insecure Direct Object References (IDOR) in JS Help De ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57651 (Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57650 (Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57649 (Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57648 (Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57647 (Contributor Local File Inclusion in Panorama Viewer \u2013 360 Degree ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57646 (Subscriber Insecure Direct Object References (IDOR) in Majestic Suppor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57645 (newsletters_subscribers Broken Access Control in Newsletters <= 4.13 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57644 (Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57643 (Contributor SQL Injection in WP Post Author <= 3.9.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57642 (Contributor SQL Injection in Gallery <= 4.7.8 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57641 (Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57640 (Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57638 (Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57637 (Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Li ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57636 (Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57635 (Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57634 (Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57633 (Unauthenticated Sensitive Data Exposure in WCBoost – Products Co ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57632 (Subscriber Broken Access Control in Email Marketing for WooCommerce by ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57631 (Administrator SQL Injection in Popup box <= 6.0.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57630 (Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Co ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57629 (Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57628 (Administrator SQL Injection in WP All Import <= 4.0.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57627 (Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57622 (Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57620 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57618 (Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57617 (Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57527 (Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an i ...)
TODO: check
CVE-2026-57518 (Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that ...)
@@ -147,35 +147,35 @@ CVE-2026-57518 (Pagekit CMS 1.0.18 contains a privilege escalation vulnerability
CVE-2026-57473 (A vulnerability exists in the netclient and factory services of Reolin ...)
TODO: check
CVE-2026-57431 (Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57430 (Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57325 (Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57324 (Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57323 (Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57322 (Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57321 (Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57319 (Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57318 (Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57317 (Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointm ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57316 (Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57315 (Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57314 (Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57313 (Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57312 (Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57231 (Podman is a tool for managing OCI containers and pods. From 1.8.1 unti ...)
TODO: check
CVE-2026-56876 (extract-zip does not validate symlink targets when extracting zip arch ...)
@@ -187,85 +187,85 @@ CVE-2026-56773 (Teable's v2 REST API controller lacks @Permissions metadata on O
CVE-2026-56663 (AutoGPT is a workflow automation platform for creating, deploying, and ...)
TODO: check
CVE-2026-56072 (Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56070 (Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56069 (Unauthenticated Insecure Direct Object References (IDOR) in Toolset Fo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56068 (Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56067 (Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56066 (Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56064 (Subscriber SQL Injection in Tourfic <= 2.22.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56063 (Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56062 (Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56061 (Unauthenticated Broken Access Control in Subscriptions for WooCommerce ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56060 (Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery No ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56059 (Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56058 (Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56057 (Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56055 (Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56048 (Unauthenticated Insecure Direct Object References (IDOR) in Payment Ga ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56047 (Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56046 (Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56045 (Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56044 (Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56043 (Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for Woo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56041 (Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56040 (Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56039 (Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56038 (Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56036 (Unauthenticated SQL Injection in \uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56035 (Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56034 (Unauthenticated SQL Injection in Library Management System <= 3.5.7 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56033 (Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56032 (Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56031 (Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56030 (Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56029 (Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56028 (Unauthenticated Privilege Escalation in Easy Elements for Elementor &# ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56027 (Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56026 (Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56025 (Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56011 (Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56010 (Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56008 (Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-55686 (Podman is a tool for managing OCI containers and pods. From 3.0.0 unti ...)
TODO: check
CVE-2026-55677 (Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router a ...)
@@ -275,35 +275,35 @@ CVE-2026-55448 (mise manages dev tools like node, python, cmake, and terraform.
CVE-2026-55441 (mise manages dev tools like node, python, cmake, and terraform. Prior ...)
TODO: check
CVE-2026-54847 (Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54846 (Unauthenticated Broken Access Control in Syncee Premium Dropshipping & ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54840 (Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54839 (Unauthenticated Sensitive Data Exposure in Trinity Backup – Back ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54837 (Unauthenticated Broken Access Control in Intranet & Private Site & ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54835 (Unauthenticated Broken Access Control in Five Star Restaurant Menu <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54834 (Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54833 (Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54832 (Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54831 (Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54827 (Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54826 (Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54825 (Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54824 (Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54820 (Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54753 (Nx is a monorepo solution for TypeScript and polyglot codebases. From ...)
TODO: check
CVE-2026-54636 (Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utili ...)
@@ -313,9 +313,9 @@ CVE-2026-54557 (mise manages dev tools like node, python, cmake, and terraform.
CVE-2026-54341 (Dragonfly is an in-memory data store built for modern application work ...)
TODO: check
CVE-2026-53914 (In JetBrains Kotlin before 2.4.20 code execution was possible via unsa ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-52701 (Unauthenticated Broken Access Control in User Registration <= 5.2.2 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-4339 (Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 1 ...)
TODO: check
CVE-2026-49486 (The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ft ...)
@@ -367,11 +367,11 @@ CVE-2026-45257 (The KTLS receive path decrypted each record in place, assuming t
CVE-2026-45256 (When used to deliver a signal to a specific thread, thr_kill2(2) calle ...)
TODO: check
CVE-2026-45195 (Kernel software installed and running inside a Host VM may post improp ...)
- TODO: check
+ NOT-FOR-US: Imagination Technologies
CVE-2026-44018 (Docling simplifies document processing by parsing diverse formats and ...)
TODO: check
CVE-2026-40711 (Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0 ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-3472 (Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 1 ...)
TODO: check
CVE-2026-33646 (mise manages dev tools like node, python, cmake, and terraform. Prior ...)
@@ -381,21 +381,21 @@ CVE-2026-30041 (An integer overflow in the PSD parser compnent of FastStone Imag
CVE-2026-30040 (A heap overflow in the FSViewer.exe process of FastStone Image Viewer ...)
TODO: check
CVE-2026-2053 (The WSO2 API Manager's message flow component, when processing WS-Addr ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-28385 (In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forg ...)
TODO: check
CVE-2026-24547 (Unauthenticated Broken Access Control in SiteGround Email Marketing <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-21734 (A web page that contains unusual GPU shader code is loaded into the GP ...)
- TODO: check
+ NOT-FOR-US: Imagination Technologies
CVE-2026-1869 (The User Registration & Membership \u2013 Free & Paid Memberships, Sub ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13434 (A flaw was found in KubeVirt's network annotation generator. When a te ...)
TODO: check
CVE-2026-13426 (The Mattermost Go module github.com/mattermost/mattermost/server/publi ...)
TODO: check
CVE-2026-13372 (Incorrect link resolution by display name in the custom PowerShell VPN ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-13325 (A flaw was found in KubeVirt's migration proxy. When spec.configuratio ...)
TODO: check
CVE-2026-12411 (Broken Access Control in the devLXDInstancePatchHandler component of C ...)
@@ -409,31 +409,31 @@ CVE-2026-0685 (Server side template inject (SSTI) in the expression evaluation c
CVE-2025-7958 (A Code Injection vulnerability existed in Trellix Network Security CM ...)
TODO: check
CVE-2025-68075 (Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2025-68074 (Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2025-68064 (Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2025-68063 (Contributor Local File Inclusion in Splash - Sport Club WordPress Them ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2025-68052 (Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2025-66123 (Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2025-64637 (Unauthenticated Content Injection in Auros Core <= 5.3.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2025-64636 (Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2025-64152 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2025-63079 (Contributor Broken Access Control in Live Copy Paste for Elementor <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2025-63078 (Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2025-63041 (Contributor Broken Access Control in Forget About Shortcode Buttons <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2025-55017 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2025-32423 (AutoGPT is a workflow automation platform for creating, deploying, and ...)
TODO: check
CVE-2025-32394 (AutoGPT is a workflow automation platform for creating, deploying, and ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6f96cc5cf707c5c4d95e3476356dbd27ff42a24b
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6f96cc5cf707c5c4d95e3476356dbd27ff42a24b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260626/87fcf998/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list